The Basel Committee on Banking Supervision is turning its attention to the technology failures that can disrupt banks without a cyberattack ever taking place, highlighting weaknesses in change management, system testing and third-party dependencies as persistent sources of operational risk.
At two CEO roundtables in June, the Australian Prudential Regulation Authority and Australian Securities and Investments Commission asked industry leaders to consider cyberattacks complicated by artificial intelligence, failures at critical service providers and crises that spill across organizational boundaries. The regulators published notes from the discussions Tuesday.
Not long ago, a CFO at one of the world's largest pharmaceutical companies said something that has stayed with me. We were discussing a major acquisition his company had just completed, and I asked what kept him up at night during the integration. His answer was not about valuation, synergies, or headcount. It was about business processes.
The Australian Securities and Investments Commission and Australian Prudential Regulation Authority have urged financial market entities to move beyond awareness of frontier AI risks and begin preparing for their consequences. The regulators said increasingly capable AI models are accelerating cyber threats while adding pressure to the technology and operational risks financial institutions already face.
The EBA opened a public consultation on draft Regulatory Technical Standards under CRR3 that would set common requirements for how institutions govern, identify, assess, monitor and manage operational risk. The consultation runs through Dec. 31.
The more time I've spent working in Governance, Risk and Compliance (GRC), the more I've realized that a good risk assessment is rarely about preventing something from happening. It's about understanding what could happen, deciding whether the organization is comfortable with that level of risk, and making sure the right controls are in place before moving forward. That is a very different conversation.
APRA’s 2026-27 Corporate Plan puts cyberattacks, artificial intelligence, geopolitical tensions and dependence on common technology providers among the risks demanding closer attention from banks, insurers and superannuation trustees. The plan sets the regulator’s strategic direction for the next four years and, more immediately, its policy and supervisory agenda for the coming 12 to 18 months.