What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Monetary Authority of Singapore urges stronger AI governance and cyber defenses as financial sector adoption scales
The Monetary Authority of Singapore urged financial institutions to strengthen AI governance and cyber defenses as adoption expands beyond pilots. Pathfin.ai now has more than 300 participants, while cross-bank AI testing for scam detection is expected to produce findings by the end of 2026. MAS also warned of a sixfold rise in high-severity vulnerabilities and called for stronger multilayered defenses supported by AI.
New York State Department of Financial Services clarifies cybersecurity risk assessment expectations
The New York State Department of Financial Services clarified existing cybersecurity risk assessment requirements for regulated entities without imposing new obligations. Assessments must be updated at least annually and after material business or technology changes, and should address third-party concentrations, emerging technologies and whether existing controls remain adequate.
Central Bank of Latvia implements offline card payments up to EUR 200 for essential goods during communications outages
The Central Bank of Latvia has implemented offline card payments for essential goods during internet or mobile communications outages. Customers of four designated banks can spend up to EUR 200 per card at participating grocery, fuel and pharmacy chains by inserting a physical card and entering the PIN. The service does not support smart device payments and requires electricity at the merchant.
European Securities and Markets Authority identifies rising correction and cyber risks despite resilient markets
The European Securities and Markets Authority warned that elevated technology valuations and strong investor optimism are increasingly detached from weaker economic conditions and geopolitical risks, raising the prospect of an abrupt market correction. Operational risks are also rising as frontier artificial intelligence intensifies cyber threats, while growing U.S. equity concentration leaves EU investors more exposed to a repricing.
Bank for International Settlements assesses frontier AI cyber threats and finds authorities reinforcing existing resilience frameworks
A Bank for International Settlements paper finds that frontier AI is accelerating cyber attacks by automating vulnerability discovery, exploitation and complex operations. Financial authorities are mainly reinforcing existing operational resilience frameworks, with greater emphasis on faster patching, stronger governance, recovery capabilities and oversight of critical third-party dependencies.
Committee on Payments and Market Infrastructures and International Organization of Securities Commissions launch cyber resilience toolkit consultation and assess third party risks at financial market infrastructures
The Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions are consulting on a voluntary cyber resilience toolkit for financial market infrastructures and a discussion paper on third-party service risks. The toolkit covers governance, scenario design, recovery and testing, while the discussion paper highlights provider concentration, supply chain opacity, exit constraints and other operational resilience challenges.
Central Bank of Bahrain chairs GCC preparatory meeting on payments, supervision and cybersecurity cooperation
The Central Bank of Bahrain chaired a GCC preparatory committee meeting covering payment systems, banking supervision and financial technology. Members also discussed cybersecurity information sharing and regional efforts to combat money laundering and terrorist financing.
Central Bank of Peru survey finds 83% of nonfinancial companies preparing for El Niño, rising to 94% in northern Peru
A Central Bank of Peru survey found that 83% of 345 nonfinancial companies have taken or plan preventive measures against El Niño, rising to 94% in northern Peru. Most expect logistics disruption or higher costs, while nearly half forecast lower sales and production. Companies in the north report substantially greater exposure.
South Korea Financial Services Commission expands AI security testing eligibility to 75 firms
The South Korea Financial Services Commission expanded eligibility for its second frontier AI security test from 49 to 75 firms and will select up to 15 participants for one-year relief from network-separation rules. Selected firms must adopt alternative security controls and report their findings, while an interim review of the first round found that AI could scan large codebases rapidly and consistently for vulnerabilities.
Australia’s Council of Financial Regulators finds system resilient, backs unchanged macroprudential settings amid elevated risks
The Council of Financial Regulators maintained that Australia’s financial system remains resilient despite elevated geopolitical, market and cyber risks, and backed unchanged macroprudential settings. Borrower stress remains limited, but authorities emphasized sound lending standards and stronger operational resilience. A payments cyber crisis coordination framework will be published shortly, alongside ongoing work on critical third-party and AI-enabled cyber risks.
U.S. Securities and Exchange Commission proposes transfer agent rule overhaul, including one-day processing and new compliance safeguards
The U.S. Securities and Exchange Commission proposed a comprehensive modernization of registered transfer agent rules, including one-day processing and posting standards, six-year record retention and expanded reporting. The package would add compliance, safeguarding, cybersecurity and business continuity requirements while removing several existing exemptions. It would also regulate restrictive legend removal and require notifications to securityholders after 18 months of inactivity.
Australian Prudential Regulation Authority and Australian Securities and Investments Commission release superannuation CEO roundtable notes on AI and resilience
The Australian Prudential Regulation Authority and Australian Securities and Investments Commission have released notes from superannuation CEO roundtables on frontier AI, cyber and operational resilience, and crisis preparedness. Participants emphasized tested governance, individual accountability and stronger oversight of concentrated service-provider dependencies, reinforcing the regulators’ recent focus on converting cyber-risk awareness into operational readiness.
Bank of Mozambique sets data localization and cloud outsourcing requirements for financial institutions
The Bank of Mozambique requires credit institutions and financial companies to keep primary data centers and core systems in Mozambique and obtain approval for specified offshore and cloud arrangements. Banks, microbanks and electronic money institutions may use only private clouds, while outsourcing contracts must provide security, audit, regulatory access and exit protections. Existing institutions have 12 months after the rules take effect to comply fully.
Central Bank of Bahrain holds financial sector cybersecurity event focused on AI-era data risks
The Central Bank of Bahrain and the National Cyber Security Center held a cybersecurity awareness event for financial services professionals focused on data protection in the AI era. Sessions covered human risk, secure practices, artificial intelligence and emerging cyber threats.
Financial Stability Board chair warns of cyber risks from frontier AI models
Financial Stability Board Chair Andrew Bailey warned that frontier AI models could intensify cyber risk and called for safe model deployment, robust financial-sector recovery capabilities and resilient critical technology providers. He also cautioned that rising leverage, stretched valuations, market concentration and AI-related optimism could amplify a market correction.
Reserve Bank of Australia sets 2026/27 priorities for monetary policy, payments resilience and digital money
The Reserve Bank of Australia’s 2026/27 corporate plan prioritizes modernizing monetary policy implementation, strengthening payment infrastructure and advancing work on digital money. The RBA plans to complete its payments regulation review, test new crisis management powers and assess the case for a retail central bank digital currency. It will also progress cyber upgrades and maintain demanding availability targets for critical settlement services.
National Bank of the Kyrgyz Republic holds cybersecurity and financial literacy seminar for regional media
The National Bank of the Kyrgyz Republic trained regional journalists on financial literacy, cybersecurity, money mule activity and protection against financial fraud. Participants also developed crisis communication protocols and approaches to countering false information.
European Banking Authority launches consultation on proportionate operational risk framework, with lighter requirements below EUR 750 million
The European Banking Authority has consulted on harmonized standards for institutions’ governance, assessment and management of operational risk. The proposals cover management accountability, independent oversight, data, reporting, validation and audit, with lighter requirements for institutions whose business indicator is below EUR 750 million. The final standards will be submitted to the European Commission for adoption.
Australian Securities and Investments Commission sets 2026–27 priorities on consumer harm, AI oversight and regulatory burden
The Australian Securities and Investments Commission has set its 2026–27 priorities, combining stronger action on consumer harm and artificial intelligence risks with measures to reduce unnecessary regulatory burden. Its work will cover scams, debt collection, insurance intermediaries, buy now pay later, superannuation fee deductions and AI-related threats to consumers and markets.
INTERPOL operation against West African organized crime leads to 58 arrests and identification of 263 suspects
INTERPOL reported 58 arrests and the identification of 263 suspects following a 22-country operation against West African organized crime groups. Authorities disrupted major romance, investment and money laundering schemes, including by blocking 257 South African bank accounts and identifying a 196-person Crime-as-a-Service network in Argentina. The operation also found increased sextortion targeting minors and greater outsourcing of criminal activities through the dark web.
Securities and Exchange Board of India launches centralized cyber information portal for securities markets
The Securities and Exchange Board of India has launched a centralized portal for securities market participants to access cybersecurity circulars, vulnerability warnings and incident insights.
Securities and Exchange Board of India signs partnership to strengthen cybersecurity, market intelligence and technical innovation
The Securities and Exchange Board of India signed a long-term partnership with Rashtriya Raksha University and the National Institute of Securities Markets. The collaboration covers cybersecurity and emerging-technology training, research and open-source intelligence, and includes a planned Technical Innovation Unit for joint operations and innovation in the securities market.
Securities and Exchange Board of India mandates IT resilience index for market infrastructure institutions by February 2027
The Securities and Exchange Board of India will require market infrastructure institutions to calculate a system-driven IT Resilience Index every six months. Institutions must implement the index, early warnings and real-time service monitoring by February 28, 2027. The first submission will cover the half-year ending March 31, 2027.
Securities and Exchange Board of India aligns cyber incident reporting portal with FSB FIRE format
The Securities and Exchange Board of India has aligned its Cyber Incident Reporting Portal with the Financial Stability Board’s FIRE framework. Regulated entities must provide standardized, staged reports from initial notification through updates and final closure, alongside existing six-hour email and 24-hour portal reporting requirements.
Danish Financial Supervisory Authority urges financial firms to strengthen defenses against AI-enabled cyberattacks
The Danish Financial Supervisory Authority has urged all financial firms to assess AI-enabled cyber threats and strengthen their cybersecurity and operational resilience proportionately. Firms should establish clear management accountability, improve vulnerability monitoring and patching, and test response and recovery plans against AI-driven attacks. The authority will analyze the sector’s AI use and related risks in the second half of 2026.