What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Bank of Greece reports improved bank fundamentals and prioritizes geopolitical, climate and digital resilience
The Bank of Greece reported stronger profitability, capital and asset quality across Greek banks in 2025, while the insurance market remained resilient. Its supervisory priorities focus on capital adequacy, geopolitical and climate risks, corporate governance, digitalization and AI-related cyberthreats.
Financial Conduct Authority and Prudential Regulation Authority outline expectations as critical third-party oversight regime goes live
The Financial Conduct Authority and Prudential Regulation Authority outlined expectations under the UK’s now-live critical third-party oversight regime. Designated providers must manage and test the resilience of critical services and support coordination during incidents, while regulated firms remain responsible for their own operational resilience and third-party risks.
European Central Bank Banking Supervision requires cyber action plans by October, reinforces AI accountability
European Central Bank Banking Supervision expects bank boards and senior management to remain accountable for AI use and associated risks. Banks must submit cyber action plans by October 2026 addressing resilience, incident response and critical third-party oversight. The ECB also plans to publish the outcome of its 2026 geopolitical reverse stress test.
Hong Kong Securities and Futures Commission reprimands and fines Luk Fook Securities HKD 2.1 million over cybersecurity failures
The Hong Kong Securities and Futures Commission reprimanded Luk Fook Securities and fined it HKD 2.1 million for cybersecurity failures linked to its vulnerability and delayed recovery from a ransomware attack. The deficiencies covered network security, software maintenance, access controls, staff training, backups and business continuity.
Bank of the Lao PDR calls for joint China ASEAN governance of AI related financial risks
The Bank of the Lao PDR called for joint China-ASEAN governance mechanisms to manage cybersecurity and systemic risks from AI in finance. Its deputy governor also joined the launch of an AI and finance cooperation project and discussions on AI-enabled local-currency cooperation.
Central Bank of the Philippines urges banks and other supervised entities to strengthen cybersecurity against AI-driven threats
The Central Bank of the Philippines has urged banks and other supervised entities to strengthen cybersecurity in response to AI-related cyber risks. Its memorandum calls for tighter security controls, better asset and vulnerability management, greater use of AI-based defensive tools, and stronger incident response and business continuity planning.
Bank of Thailand and Monetary Authority of Singapore sign MoU on cybersecurity cooperation and digital fraud protection
The Bank of Thailand and the Monetary Authority of Singapore signed a memorandum of understanding on cybersecurity cooperation and digital fraud protection, expanding existing collaboration across their financial sectors. It covers threat and incident information sharing, staff training and policy exchanges, and joint cross-border cybersecurity and crisis management exercises.
Canadian Public Accountability Board publishes audit committee insights on AI, cybersecurity, IFRS 18 implementation and public inspection reports
The Canadian Public Accountability Board published insights from its 2026 audit committee outreach, with AI, cybersecurity, IFRS 18 implementation and firm-specific public inspection reports identified as the main oversight issues. Discussions pointed to uneven IFRS 18 readiness, closer scrutiny of AI governance and auditors’ use of technology, and demand for timely inspection reports that can inform auditor assessments. IFRS 18 takes effect for annual periods beginning on or after January 1, 2027, with related Canadian Securities Administrators changes expected in fall 2026.
Polish Financial Supervision Commission issues recommendations on Frontier AI cyber risks for financial market entities
The Polish Financial Supervision Commission has issued recommendations telling financial market entities to reassess ICT risk management and operational resilience for cyber threats linked to Frontier AI. Firms should incorporate AI threat scenarios into DORA processes, prioritize vulnerability management, third-party risk and protection of internet-facing assets, and ensure senior management allocates sufficient resources. UKNF said the adequacy and effectiveness of firms' measures will be tested through ongoing supervision and inspections.
Vietnam State Securities Commission holds cybersecurity warning and guidance conference for securities sector with police cyber unit
The Vietnam State Securities Commission held a conference with the Ministry of Public Security's cyber unit to warn and guide securities-sector entities on cybersecurity risks and incident coordination. Discussions covered the legal framework, attack methods, monitoring and operational controls, alongside firms' practical challenges. The commission asked market participants to upgrade systems, review processes and strengthen response preparedness and staff training.
National Bank of the Kyrgyz Republic holds CYBERFINANCE-2026 forum, creates cyber cooperation platform
The National Bank of the Kyrgyz Republic held the CYBERFINANCE-2026 forum and created a cooperation platform for the central bank, banks, the IT sector and universities to address cyber risks. More than 130 participants discussed social engineering, phishing and consumer protection, alongside cyber exercises designed to identify talent for the banking sector.
Bank for International Settlements bulletin examines frontier AI cyber risks and urges swift defensive adoption
The Bank for International Settlements published a bulletin warning that frontier AI can strengthen both cyber offence and defence, but that cost asymmetries may leave attackers with an advantage. It says the impact on systemic cyber risk will depend on access to advanced models, compute and incentives, and it calls for rapid defensive adoption of these tools. The bulletin also highlights the need for stronger domestic and cross-border coordination, especially around vulnerability remediation, third-party risk and resilience planning.
Superintendency of the Securities Market of the Dominican Republic signs cooperation agreement with INDOTEL on digital governance and cyber risk
The Superintendency of the Securities Market of the Dominican Republic signed a cooperation agreement with the Dominican Institute of Telecommunications to deepen technical and regulatory coordination. The agreement focuses on digital governance, interoperability, regulatory innovation and electronic trust services, and also covers cooperation on cybersecurity, data protection and technology incident management.
Bank of Italy tells directly supervised intermediaries to strengthen digital resilience and submit action plans by 31 December 2026
The Bank of Italy has told directly supervised intermediaries to strengthen digital operational resilience and cyber controls, warning that advanced AI models are accelerating the exploitation of software vulnerabilities. It expects boards to review governance, cyber hygiene, asset inventories, patching, monitoring, testing and outsourcing controls, and to submit a report and remediation plan to supervisors by 31 December 2026.
Canadian Securities Administrators publish cybersecurity guidance after review of 73 registered firms, identify gaps in controls and incident planning
The Canadian Securities Administrators issued updated cybersecurity guidance after a compliance review of 73 registered firms. The review found that many firms had solid frameworks, especially larger firms, but also highlighted gaps in areas including controls, third-party oversight and incident response. Firms are expected to assess the guidance against their own operations and address weaknesses.
China's National Financial Regulatory Administration launches consultation on cybersecurity management rules for banks insurers and financial holding companies
China's National Financial Regulatory Administration is consulting on draft cybersecurity management measures for banking institutions, insurance institutions and financial holding companies. The 72-article draft sets requirements on governance, operations, risk monitoring, incident response and critical information infrastructure, with stricter standards for higher-risk infrastructure. The authority plans to revise the text after consultation and publish final rules later.
HM Treasury designates four cloud providers as Critical Third Parties from 13 July 2026
HM Treasury has designated Microsoft, Google Cloud, Amazon Web Services and Oracle entities as Critical Third Parties from 13 July 2026. Their systemic services to the UK financial sector will come under joint oversight by the Bank of England, Prudential Regulation Authority and Financial Conduct Authority. The regime is risk-based and may be extended to other providers over time.
Dutch Central Bank and Dutch regulators urge joint IT contracting and procurement changes to strengthen digital autonomy
The Dutch Central Bank and four other Dutch regulators have issued a joint report urging governments, businesses and IT providers to strengthen digital autonomy in IT services. They call for digital autonomy to be built into procurement decisions, more use of open standards and interoperability, and greater scope for companies to collaborate when contracting with suppliers. The aim is to reduce dependence on a small number of non-European providers and improve resilience and switching options.
Bank of Italy publishes 2025 ICT incident analysis showing higher volumes and significant third party provider involvement
The Bank of Italy has published its 2025 analysis of major ICT incidents reported under DORA. It found more incidents than in the previous year, mostly operational rather than cyber-related, with around one quarter involving cybersecurity. The report also highlights significant involvement of external ICT service providers and stresses the need for strong ICT and third party risk controls.
Hong Kong Securities and Futures Commission requires internet brokers and virtual asset trading platform operators to replace OTP logins with phishing resistant authentication within 12 months
The Hong Kong Securities and Futures Commission has ordered internet brokers and virtual asset trading platform operators to replace OTP-based client login and device binding with phishing-resistant authentication. Firms must implement the change as soon as practicable and within 12 months, while large internet brokers are expected to act immediately. The circular also requires stronger monitoring, incident response and client alert measures, with senior management accountable for control lapses.
Guernsey Financial Services Commission tells firms to review technology risk controls as AI speeds vulnerability discovery
The Guernsey Financial Services Commission has told regulated firms to review technology risk management after advances in AI increased the speed and scale of software vulnerability discovery. Its Dear CEO letter focuses on vulnerability management, patching and outsourced provider oversight. Boards and senior management are expected to ensure technology risk is monitored continuously and that remediation can be accelerated without weakening controls.
European Securities and Markets Authority launches supervisory review of crypto custody providers digital operational resilience
The European Securities and Markets Authority has launched a Common Supervisory Action on the digital operational resilience of crypto-asset service providers, centred on custody services. National Competent Authorities will review a risk-based sample of authorised firms from the second half of 2026 to the first half of 2027, focusing on distributed ledger technology risks such as key management, transaction controls, incident response, smart contracts and third-party dependencies. ESMA will compile the findings into a final report for its Board of Supervisors in the second half of 2027.
European Central Bank Banking Supervision directs significant institutions to submit AI cyber-risk action plans by October 31
European Central Bank Banking Supervision has directed significant institutions to assess AI-enabled cyber threats and submit action plans by October 31, 2026. Plans must address accelerated patching, exposed assets, monitoring, third-party risk and longer-term operational resilience. The ECB has extended the annual IT Risk Questionnaire deadline to February 2027 to support this work.
Dutch Authority for the Financial Markets publishes Financial Stability Committee warning on AI driven cyber risk and private credit transparency
The Dutch Authority for the Financial Markets published a Financial Stability Committee update warning that advanced AI models are increasing the urgency of stronger cyber resilience in finance. The committee called for faster vulnerability management and better coordination and information sharing across sectors. It also said private credit's rapid growth requires better data on exposures, credit quality and links to the wider financial system.
De Nederlandsche Bank reports Financial Stability Committee urges stronger cyber coordination and better private credit data
De Nederlandsche Bank said the Dutch Financial Stability Committee has warned that advanced AI models are changing cyber risk and that financial institutions need to adapt their risk management and resilience. The committee also said financial stability risks remain high and called for stronger cross-sector cyber coordination and information sharing. It separately flagged rapid private credit growth and said better data are needed on exposures, credit quality and interconnectedness.