What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Dutch Central Bank identifies cyber and operational risks from AI and geopolitics as major threats while banks remain resilient in war stress test
De Nederlandsche Bank’s semiannual Financial Stability Overview flags cyber and operational risks, driven by rapid advances in artificial intelligence and heightened geopolitical tensions, as a major threat to financial stability, with geo-economic fragmentation and prolonged higher energy prices remaining key risk drivers. Stress tests indicate Dutch banks can absorb losses from a Middle East conflict escalation within existing capital buffers, while the bank also highlights rising private credit exposures of large insurers and rapid global stablecoin market growth as emerging vulnerabilities.
Bank for International Settlements research finds ECB cyber stress test scrutiny raised cybersecurity investment by about 45% and by about 80% at laggard banks
The Bank for International Settlements published research showing that supervisory scrutiny alone can significantly increase banks’ cybersecurity spending, based on the European Central Bank’s 2024 cyber resilience stress test for 109 large euro area banks. The announcement of the qualitative test, which had no capital consequences and did not disclose bank-level results, was associated with a 45% rise in sector-wide cybersecurity investment, with prior underinvestors increasing spending by about 80% and adjusting outsourcing, staffing and cyber insurance in response to more intensive supervisory follow-up.
South Korea Financial Services Commission launches phased easing of network separation rules for AI cybersecurity at 49 large financial companies
South Korea’s Financial Services Commission announced measures to address cyber risks from advanced AI in finance, centred on phased easing of network separation rules so eligible firms can use AI and SaaS cybersecurity tools. It will grant one-year relief via no action letters to large institutions that pass expert screening, require vulnerability test reporting, and may fully lift network separation through the regulatory sandbox. The commission will also issue AI cybersecurity guidelines in June 2026.
State Bank of Vietnam governor urges banks to strengthen digital infrastructure data security and digital skills
The State Bank of Vietnam published remarks by Governor Pham Duc An outlining digitalisation priorities for the banking sector, including a stronger legal framework, expanded digital infrastructure and databases, enhanced cyber security and personal data protection, and improved workforce digital skills. He urged banks to centre citizens and businesses, treat data as foundational and technology as a driver, and advance digital payments, electronic authentication, biometric verification, data cleansing and anti-fraud measures linked to Project 06. The State Bank said contest proposals on process redesign, technology deployment, customer experience and system security will be further studied and implemented.
Australian Prudential Regulation Authority intensifies oversight as geopolitical shocks AI and private credit risks evolve
The Australian Prudential Regulation Authority’s latest System Risk Outlook finds Australia’s financial system remains resilient, with banks and insurers well capitalised and liquid, but notes intensified oversight and higher expectations for risk management amid geopolitical tensions, rapid artificial intelligence adoption and more complex global market linkages. APRA highlights AI governance and cyber resilience as central supervisory priorities, citing an April 2026 industry letter that set minimum expectations for board literacy, AI strategy, lifecycle accountability, supplier visibility, security testing and continuous monitoring. The report also notes that domestic private credit exposures remain contained at about AUD 200 billion, or 3 per cent of the banking system, but warns of growing offshore risks through international private market holdings and banks’ funds finance activities.
New York State Department of Financial Services issues cybersecurity guidance for heightened threat environments including frontier AI and geopolitical risks
The New York State Department of Financial Services issued non-binding guidance on cybersecurity measures DFS-regulated entities should consider when threats intensify, including during geopolitical events and following technological developments such as frontier AI models. Framed as actionable best practices rather than new legal requirements, the guidance groups measures into reducing the attack surface, improving threat detection and readiness, and strengthening resilience and response.
Financial Stability Board Regional Consultative Group for the Americas discusses 2026 priorities on operational resilience cross border payments and sovereign bond market risks
The Financial Stability Board’s Regional Consultative Group for the Americas met in Grand Cayman to review global and regional financial vulnerabilities and the FSB’s 2026 work priorities. Members discussed operational resilience, including cyber risks, cross-border payments action plans, regulatory and supervisory modernisation, and nonbank activity in sovereign bond markets and related data challenges.
Basel Committee on Banking Supervision agrees to publish ICT risk management report and advances cryptoasset and liquidity work
The Basel Committee on Banking Supervision will publish a report on observed ICT risk management practices for non-malicious incidents and advanced its review of the prudential standard for banks’ cryptoasset exposures. It will also assess whether to update its Principles for Sound Liquidity Risk Management and Supervision, finalise machine-readable Pillar 3 disclosures, consult on the treatment of cross-border exposures within the European banking union in the global systemically important bank framework, and deepen analytical work on banks’ management of physical risks from extreme weather events and the role of insurance.
INTERPOL reports first MENA cybercrime operation led to 201 arrests and 53 servers seized
INTERPOL reported the results of Operation Ramz, a coordinated cybercrime enforcement action across 13 Middle East and North Africa countries from October 2025 to 28 February 2026, targeting phishing, malware and cyber scams. The operation led to 201 arrests, 382 additional suspects identified, 3,867 victims identified, 53 servers seized and the exchange of nearly 8,000 pieces of data and intelligence, and was described as the first cyber operation of this scale that INTERPOL has coordinated in the region.
United Kingdom's Financial Conduct Authority, Bank of England and HM Treasury reinforce cyber resilience steps for firms facing frontier AI threats
The Financial Conduct Authority, Bank of England and HM Treasury issued a joint statement warning that frontier artificial intelligence models materially increase cyber risk for regulated firms and financial market infrastructures, reiterating that firms must address these risks under existing operational resilience requirements. The authorities highlight expectations around governance, vulnerability management, third-party risk, protection, and response and recovery, and direct firms to cyber resilience practices and guidance from the Cross Market Operational Resilience Group and the National Cyber Security Centre.
Japan Financial Services Agency convenes working group on AI related cyber threats in the financial sector
The Japan Financial Services Agency has established a working group under its public private partnership conference to strengthen financial sector cybersecurity against artificial intelligence-related threats. The group brings together financial institutions, technology providers, industry associations and government bodies, including the Bank of Japan, to build a shared understanding of AI-driven cyber risks and consider countermeasures, with discussions confidential due to their cybersecurity sensitivity.
Germany's Federal Financial Supervisory Authority sets supervisory focus on cyber threats private debt and risky mortgages
At its annual press conference, Germany's Federal Financial Supervisory Authority said consumer protection and financial stability are equal priorities and flagged cyber risk, private debt and risky residential mortgage lending as key supervisory concerns. BaFin is adding resources to cyber inspections, warned about liquidity and transparency risks in retail private-markets products such as ELTIFs, and said supervisory action on higher-risk new mortgages remains possible. It also pointed to tougher enforcement against unauthorized business, including more than 800 fraud warnings in 2025.
Albania's Ministry of Finance highlights near complete digitalisation of public finance processes and renewed anti-money laundering focus at cyber security summit
Albania’s Finance Minister Petrit Malaj told the Albania-Israel Cyber Security Summit that protecting public financial systems is a strategic national priority and reaffirmed the government’s commitment to strengthening the legal and institutional framework against money laundering and terrorist financing. He cited progress in modernising public finance administration through digitalisation, interoperability and efficiency, and stressed international cooperation, including using Israel’s cyber security and data protection experience, to build more secure and transparent financial systems.
Bank of Albania says first full banking system cybersecurity assessment under 93 controls is complete and DORA alignment is under way
The Bank of Albania has completed its first full cybersecurity assessment cycle for the entire banking system using a U.S. Treasury-assisted methodology based on 93 controls and is conducting a horizontal reassessment. Governor Gent Sejko said cyber risk regulation and supervision have been a strategic priority, with efforts focused on supervisory capacity, cooperation with domestic authorities, adoption of international standards, and alignment with EU rules. Work is under way to harmonise the framework with the Digital Operational Resilience Act, with assessments to be repeated until consistent cybersecurity maturity is achieved across all banks.
Middle East and North Africa Financial Action Task Force sets plenary priorities on faster financial crime response and five ongoing mutual evaluations
The Middle East and North Africa Financial Action Task Force set strategic priorities under its current presidency to enhance faster, more flexible responses to organised crime, fraud and cyber threats, with a work programme focused on strengthening the presidency framework, advancing institutional development and overseeing the third round of mutual evaluations. Launched last year, this round now covers five countries at different stages, and MENAFATF has also created its first forum for research and training centres to integrate academia into regional efforts against financial crime.
Sweden's Financial Supervisory Authority opens registration for FTPOS 2026 financial sector crisis exercise
Sweden’s Financial Supervisory Authority has invited public and private actors in the financial services preparedness sector to participate in FTPOS Sector Exercise 2026, a tabletop and functional exercise aimed at strengthening sector-wide coordination and crisis management through realistic scenarios. The exercise targets authorities, banks, insurance companies, securities firms, central infrastructure organisations and cash-handling actors, and is structured around situational awareness and reporting, sector focus areas, and communication and common messaging.
Australian Securities & Investments Commission warns licensees and market participants to urgently strengthen cyber resilience as frontier AI raises cyber risk
The Australian Securities & Investments Commission has issued an open letter urging all licensees and market participants to strengthen cyber resilience as frontier AI increases the speed, scale and sophistication of cyber threats. ASIC reiterates that cyber resilience is a core licensing obligation requiring board and executive leadership, references its recent court outcome against FIIG Securities Limited, and sets expectations for effective, proportionate cyber risk controls and governance. The letter must be tabled at boards and risk governance committees and directs firms to Australian Government guidance as ASIC coordinates with other regulators to promote consistent expectations.
The Financial Supervisory Authority of Norway updates DORA incident reporting guidance and clarifies 72 hour status reporting and one month final report deadlines
The Financial Supervisory Authority of Norway has updated its guidance on incident reporting under the Digital Operational Resilience Act, clarifying when firms must submit status and final reports following serious ICT-related incidents. It specifies timelines and triggers for initial and subsequent status reports, confirms that remedial actions need not be completed before the final report, and updates the Altinn incident reporting form to allow firms to enter future dates for handling root causes and expected resolution.
International Monetary Fund analysis warns AI-enabled cyberattacks could trigger systemic financial stress
The International Monetary Fund warns that advances in artificial intelligence are increasing the scale and speed of cyberattacks on the financial system and could turn extreme cyber incidents into macro-financial shocks. It urges supervisors to treat cybersecurity as a core financial stability issue by strengthening resilience standards, oversight of systemic transmission channels, and public-private coordination, while noting that AI can also enhance cyber defenses if supported by appropriate investment, governance, oversight and cooperation.
Securities & Exchange Board of India issues advisory on AI led vulnerability detection risks and creates cyber-suraksha.ai task force
The Securities & Exchange Board of India has warned securities market intermediaries about cyber risks from advanced AI tools and created a cyber-suraksha.ai task force for a coordinated response. The task force will assess AI-driven cybersecurity risks, develop a uniform mitigation strategy, facilitate threat intelligence sharing, and review third-party providers. SEBI’s advisory sets expectations for immediate and virtual patching, enhanced vulnerability assessments and SOC monitoring, stronger vendor and API controls, and longer-term plans for AI-based detection and mitigation.
European Central Bank working paper finds cyber stress test scrutiny drove about 80 percent higher cybersecurity investment at laggard banks
The European Central Bank has published a working paper on its 2024 Cyber Resilience Stress Test, finding that supervisory scrutiny was associated with materially higher cybersecurity investment by euro area banks that had previously underinvested relative to their cyber risk profiles. Using confidential data for 109 Significant Institutions from 2019 to 2024, the authors estimate that the March 2023 announcement of the exercise was followed by an average 45 percent increase in cybersecurity investment across the sector and about 80 percent among laggard banks. The paper is presented as research and states that the views are those of the authors and do not necessarily reflect those of the European Central Bank.
Norwegian Financial Supervisory Authority finds financial sector preparedness sound but flags high cyber threats and third party vulnerabilities
The Norwegian Financial Supervisory Authority’s 2026 risk and vulnerability analysis finds Norway’s financial infrastructure remains robust, with satisfactory operational stability and payment service availability. However, it assesses the digital threat level as high, driven by organised criminal groups, state actors, wider use of artificial intelligence and heightened geopolitical tensions, and highlights supplier and value chain risk as a critical vulnerability. The authority notes new rules requiring firms to manage third-party risk, identify critical suppliers and maintain exit options.
European Insurance and Occupational Pensions Authority says European insurance sector risks remain stable at medium level in April 2026 dashboard
The European Insurance and Occupational Pensions Authority has published its April 2026 Insurance Risk Dashboard, assessing overall risks in the European insurance sector as stable at a medium level. Market risk has increased amid higher bond and equity volatility, while other key risks remain at medium levels, supported by strong capital positions, premium growth and stable underwriting, though geopolitical, inflation, marine/aviation/trade-related and cyber risks continue to weigh on the outlook. The assessment is based on fourth quarter 2025 and end-2024 Solvency II data from 94 insurance groups and 2,092 solo undertakings.
Australian Prudential Regulation Authority finalises CPS 230 amendments granting limited contractual exemptions for certain non-traditional service providers
The Australian Prudential Regulation Authority has finalised targeted amendments to Prudential Standard CPS 230 Operational Risk Management, Prudential Practice Guide CPG 230 and the Material Service Provider Register template. The changes introduce limited exemptions from certain contractual requirements for material arrangements with specified non-traditional service providers, including central banks and clearing and settlement facilities, and clarify expectations for managing these arrangements and reporting on exempt providers.
Central Bank of Brazil convenes cyber resilience forum for critical providers and says cybersecurity rulemaking will continue
The Central Bank of Brazil convened the BC Cyber Resilience Forum 2026 Critical Providers to discuss cybersecurity and operational resilience in the National Financial System, stating that cyber risk has become a structural risk for financial stability and that its cybersecurity regulatory agenda will continue. Officials emphasized coordinated action across critical technology providers, robust third-party risk management and secure arrangements for services such as Pix and the Reserve Transfer System. The central bank reported a sharp increase in critical incident reports and incidents involving diversion of financial institutions’ funds between 2020 and 2025 and signalled it will continue to assess potential regulatory enhancements.