What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Dutch Authority for the Financial Markets publishes Financial Stability Committee warning that advanced AI models raise cyber resilience urgency
The Dutch Authority for the Financial Markets published a Financial Stability Committee update warning that advanced AI models are intensifying cyber risks and require financial institutions to strengthen cyber resilience and adapt risk management. The committee also said broader financial stability risks remain elevated and called for better data on the fast-growing private credit market. Improved coordination and information sharing across authorities, firms and critical sectors were identified as a priority.
European Systemic Risk Board warns frontier AI models could intensify systemic cyber risks in EU finance
The European Systemic Risk Board has warned that frontier AI models could raise systemic cyber risks for the EU financial system by helping threat actors find vulnerabilities and conduct attacks faster and at greater scale. It also flagged strategic dependency risks from the concentration of leading AI providers outside the EU. The ESRB will review the issue in its quarterly risk assessments and may take further action if needed.
European Banking Authority backs ESRB warning on frontier AI cyber risks and urges stronger financial sector defences
The European Banking Authority, alongside the other European Supervisory Authorities, backed the ESRB warning that frontier AI models are increasing systemic cyber risks for the financial sector. It urged financial entities to strengthen cybersecurity capabilities and called on supervisors to reflect the risks in their oversight. The authorities will continue monitoring the issue and clarify supervisory expectations under DORA.
Central Bank of the Philippines issues frontier AI cyber risk recommendations including hardware-backed MFA for privileged access
The Central Bank of the Philippines issued guidance for supervised institutions on managing cybersecurity risks from frontier AI systems that could automate vulnerability discovery and multi-stage attacks. It recommends stronger attack-surface visibility, zero trust and patching controls, hardware-backed MFA for privileged access with passwords and SMS or push methods discontinued for that purpose, AI-enabled defensive tools, business continuity reviews and institution-specific AI governance frameworks.
National Bank of Belgium flags rising payment fraud and broader operational risks in 2026 oversight report
The National Bank of Belgium’s 2026 oversight report identifies rising payment fraud, cyber threats, third-party technology dependence and physical security risks as key resilience concerns for financial market infrastructures and payment service providers. It calls for stronger controls, real-time fraud monitoring and regular crisis testing. New Belgian legislation also expands the bank’s oversight powers over financial messaging providers such as Swift.
South Africa Financial Sector Conduct Authority publishes 2026-2029 regulation plan focused on COFI Bill transition and JIBAR to ZARONIA reform
The South Africa Financial Sector Conduct Authority has issued its 2026-2029 regulation plan, with the Conduct of Financial Institutions Bill as the central driver of future market conduct reform. Priorities include themed consultations for the new framework, benchmark reform and the JIBAR to ZARONIA transition by 31 December 2026, plus joint standards on governance, outsourcing, operational resilience and beneficial ownership transparency. The authority also says it will limit new projects where possible and phase reforms to manage industry impact.
Bank of France, French National Agency for the Security of Information Systems and Prudential Supervision and Resolution Authority sign cyber cooperation agreement under DORA and NIS 2
The Bank of France, the French National Agency for the Security of Information Systems and the Prudential Supervision and Resolution Authority signed an agreement to deepen cyber cooperation in the financial sector. It supports their roles under DORA and NIS 2 and covers incident and threat information sharing, supervisory coordination, cyber crisis management and threat-led penetration testing.
Ukraine National Commission on Securities and Stock Market launches DORA-based overhaul of IT system controls for capital markets firms
The Ukraine National Commission on Securities and Stock Market has proposed new DORA-based rules to tighten oversight of the IT systems used by professional capital markets participants. Firms would face broader reporting on software, cloud and server arrangements, security measures and automated bots, plus immediate notification duties for cyberattacks, software failures and prohibited sanctioned software. Comments are open until July 27, 2026, after which the measure will be sent for registration with the Ministry of Justice.
National Bank of Denmark and Danish Financial Supervisory Authority launch three sector preparedness initiatives after joint cyber resilience stress test
The National Bank of Denmark reported that a joint stress test with the Danish Financial Supervisory Authority and key market participants has led to three new sector-wide preparedness initiatives. The exercise tested an extreme but plausible securities data manipulation scenario and highlighted the need for coordinated recovery, communication and contingency planning across the financial sector.
Spanish Securities Commission updates internal regulations for MiCA DLT Pilot DORA and employee cryptoasset trading
The Spanish Securities Commission has revised its internal regulations to reflect new EU rules including MiCA, the DLT Pilot Regime and DORA. The changes also rename and expand two departments, add data governance responsibilities and extend staff trading rules to cover cryptoassets.
Dominican Republic Superintendency of Banks holds strategic dialogue on digital resilience and highlights new technology supervision directorate
The Dominican Republic Superintendency of Banks held five sessions with supervised financial institutions and industry groups on cybersecurity, technology supervision and operational continuity. It said its internal strengthening in cybersecurity and risk management has supported the creation of a new Directorate of Technology and Information Security Supervision. The discussions also included a consumer protection perspective on complaints and the applicable regulatory framework.
Bank of Albania approves digital operational resilience rules for licensed entities and joins IMF regional capacity center
The Bank of Albania approved a new regulation on digital operational resilience and amended its existing ICT rulebook for entities it licenses. The changes are aimed at strengthening management of technology and cyber risks as banking and financial services become more digital, while also supporting alignment with European Union requirements. It also approved participation in the IMF's Regional Capacity Development Center for Southeast Europe.
World Federation of Exchanges publishes Mythos AI paper and urges stronger existing cyber resilience frameworks
The World Federation of Exchanges has issued a position paper on the Mythos AI model, saying it reinforces existing cybersecurity trends rather than creating a wholly new threat. For exchanges and clearinghouses, the paper points to stronger vulnerability management, patching, access controls and incident response, alongside continued industry coordination and information-sharing.
International Monetary Fund identifies systemic AI cyber risks and sets out seven resilience actions
The International Monetary Fund warns that AI could turn vulnerabilities in shared financial technologies and critical service providers into rapid, correlated disruptions. It recommends seven resilience actions covering surveillance, third-party oversight, cross-sector exercises, incident reporting, international coordination and frontier AI monitoring. Financial institutions should prioritize containment, recovery and machine-speed defenses.
Germany's Federal Financial Supervisory Authority launches consultation on amendments to investment audit reporting rules
Germany's Federal Financial Supervisory Authority is consulting on amendments to investment audit reporting rules for capital management companies and managed funds. The draft reflects new fund lending requirements and adds or updates audit obligations tied to DORA, SFTR, the Benchmark Regulation, SFDR and anti-money laundering reporting. Comments are due by 31 July 2026.
French Financial Markets Authority publishes 2026 market and risk mapping highlighting geopolitical cyber and frontier AI risks
The French Financial Markets Authority has issued its 2026 market and risk mapping, highlighting geopolitical instability, cyber risk, market resilience and the rise of advanced frontier AI models. It also points to changes in household financial savings amid innovation and increasing risks.
U.S. Senate Committee on Banking, Housing and Urban Affairs leaders introduce bill to codify Commerce Department ICTS authority and restrict covered foreign adversary technology transactions
Senate Banking Committee leaders introduced a bill to codify and strengthen the Commerce Department’s ICTS supply chain security powers. The measure would let Commerce prohibit or mitigate covered transactions tied to technology from specified foreign adversary countries, while adding enforcement tools, congressional oversight and protections for free speech and open-source software. It would also formalize the ICTS office within the Bureau of Industry and Security and create a Senate-confirmed assistant secretary role.
Swedish Financial Supervisory Authority becomes part of new operational crisis management function from July 1 2026
The Swedish Financial Supervisory Authority said it will be part of a new operational crisis management function that takes effect on July 1, 2026 to help prevent and manage serious operational disruptions in Sweden’s financial system. Led by the Riksbank, the function will bring together public authorities and selected private firms to improve coordination, responsibility allocation and information-sharing.
Portuguese Insurance Regulator updates RiskOutlook reporting form for cyber risk and DORA implementation
The Portuguese Insurance Regulator has revised the RiskOutlook reporting form to reflect cyber risk and DORA-related digital operational resilience requirements. The changes add a dedicated cyber and digitalization risk class, include new resilience questions, remove certain ad hoc components, and apply to reporting due from July 1, 2026.
Central Bank of Uruguay advances cybersecurity supervision rollout for the payment system with periodic reporting by e-money issuers
The Central Bank of Uruguay is implementing a new cybersecurity supervision framework for the National Payment System based on the Uruguay Cybersecurity Framework. From July 1, Electronic Money Issuers must periodically report their cybersecurity capabilities to support more consistent and proactive supervision. The framework is set to be extended gradually to other financial system participants.
European Central Bank Banking Supervision flags AI-driven cyber and concentration risks as a 2026-28 supervisory priority
In a letter to an MEP, European Central Bank Banking Supervision said AI-related cyber and operational risks are a supervisory priority for 2026-28 and warned that advanced AI could increase the likelihood of systemic cyber incidents. It is reviewing banks' AI use and controls, following up on weaknesses through supervision, and urging banks to test AI-driven cyber scenarios. The ECB also said it is monitoring wider financial stability risks from concentrated reliance on common AI tools and technology providers.
Norwegian Financial Supervisory Authority sets new mandate for financial infrastructure contingency committee on severe ICT incidents and crises
The Norwegian Financial Supervisory Authority has adopted a new mandate for the Preparedness Committee for Financial Infrastructure, clarifying its role in severe ICT incidents and crises. The mandate strengthens sector coordination and assigns the committee responsibilities including crisis coordination, information sharing, planning and annual exercises.
Danish Financial Supervisory Authority publishes half-yearly risk outlook and sets H2 2026 focus on housing cyber and AI risks
The Danish Financial Supervisory Authority's half-yearly risk outlook highlights geopolitical shocks, stretched housing prices, cyber threats and growing AI use as the main risks for the financial sector. Its H2 2026 supervisory focus will center on lending and housing developments, prioritetslån, cyber resilience and AI-related risk management. The authority will also step up work on pensions, alternative funds, crypto-asset firms and trade-based money laundering.
Central Bank of the Philippines requires stronger authentication for high risk digital transactions by banks and large e wallet operators by 25 June 2026
The Central Bank of the Philippines said banks and e-wallet operators with more than P75 million in monthly online transactions must replace SMS- and email-based OTPs with stronger authentication for high-risk digital transactions by 25 June 2026. Covered firms must also strengthen fraud monitoring to detect suspicious activity, while lower-risk transactions may still use less stringent methods.
Bank of Italy hosts G7 Cyber Expert Group meeting on cyberattack coordination and emerging technology risks
The Bank of Italy hosted a G7 Cyber Expert Group meeting in Palermo focused on cybersecurity and operational resilience in finance. Discussions covered lessons from a recent cross-border cyberattack coordination exercise and the risks associated with artificial intelligence and quantum computing. The meeting underscored the need for international coordination to manage operational interdependencies and emerging vulnerabilities.