New Zealand Regulators Press Financial Institutions on AI-Driven Cyber Risks

Key Takeaways

• Regulators Outline AI Cyber Risk Expectations: The Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) have outlined supervisory expectations for financial institutions managing cybersecurity threats associated with frontier AI.
• Three Principal Risks Identified: The regulators highlighted increasing cyber threats, evolving governance and oversight challenges, and growing third-party and concentration risks.
• Board Accountability Emphasized: Boards and senior management are expected to understand where AI is used within their organizations, assess the associated risks and establish clear accountability for managing them.
• Cybersecurity Fundamentals Remain Essential: Financial institutions are expected to maintain strong foundational security controls and address emerging AI threats within existing prudential, conduct and operational resilience obligations.
• Continued Supervisory Engagement: The RBNZ and FMA will continue engaging with regulated institutions on operational resilience and AI-related risks. The announcement did not introduce new binding requirements or compliance deadlines.

Deep Dive

New Zealand's financial regulators have told banks and other regulated institutions to examine whether their cybersecurity arrangements are keeping pace with advances in artificial intelligence, warning that the technology is creating new problems for corporate oversight and increasing dependence on outside technology providers.

The Reserve Bank of New Zealand (RBNZ) and the Financial Markets Authority (FMA) outlined their supervisory expectations at an industry roundtable jointly hosted with the Department of the Prime Minister and Cabinet and the National Cyber Security Centre. Senior financial services executives joined regulators for a discussion of the cyber threats associated with frontier AI and the responsibilities institutions have for managing them.

Three concerns dominated the regulators' assessment. Advances in AI are increasing cyber risk, complicating governance and oversight, and adding to the dangers associated with third-party technology providers and the concentration of critical services.

Angus McGregor, the RBNZ's assistant governor for financial stability, said institutions are expected to maintain cybersecurity strategies and frameworks capable of addressing the threats they face. Existing obligations concerning prudential supervision, market conduct, cybersecurity and operational resilience remain the foundation of that responsibility.

"Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI," McGregor said. "These build upon existing prudential, conduct, cyber and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system."

The regulators' immediate prescription was comparatively straightforward. Institutions should concentrate on maintaining strong foundational cybersecurity controls and an effective security posture. McGregor described the priority as "getting the basics right."

That advice carries particular weight as financial institutions assess technologies whose capabilities are developing faster than many established risk management practices. The regulators are concerned with whether existing safeguards remain effective against the threats institutions now face, regardless of how sophisticated those threats become.

Boards Face Questions About AI Oversight

The discussion also exposed a governance problem that reaches beyond cybersecurity teams. Financial institutions cannot exercise meaningful oversight of AI-related risks without knowing where the technology is being used, what exposure it creates and who is responsible for managing it.

Louise Unger, the FMA's executive director of response and enforcement, made clear that these questions belong with boards and senior management.

"Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them," Unger said.

Her remarks put responsibility for AI risk management within the established machinery of corporate governance. Institutions must be able to account for the technology deployed across their operations and establish clear lines of responsibility for the risks that accompany it.

The regulators also singled out third-party and concentration risk, reflecting concerns about the dependencies that arise when financial institutions rely on external providers for important technology services.

Those dependencies present difficult questions for operational resilience. A financial institution may maintain effective controls over its own systems while remaining exposed to failures or security weaknesses elsewhere in its technology arrangements. The growing role of AI adds another consideration to how institutions assess those relationships.

The joint announcement did not prescribe particular technical measures for managing third-party AI providers or establish new concentration limits. It identified the issue as an area that regulated entities are expected to address within their existing risk management responsibilities.

Unger said the roundtable had offered regulators an opportunity to hear how financial institutions were approaching these challenges.

"We appreciated the strong engagement from industry participants and the willingness to share practical insights and experiences," she said. "These perspectives help inform our understanding of the challenges and opportunities arising from AI and support our ongoing regulatory work."

Participants recognized that AI developments were changing the cyber threat environment, according to Unger, and discussed the importance of effective oversight, operational resilience and managing third-party dependencies.

She acknowledged that AI could benefit financial institutions and their customers. Its adoption nevertheless changes the risks institutions must understand and control.

Existing Obligations, New Supervisory Attention

The joint statement draws on the different responsibilities of New Zealand's two financial regulators. The RBNZ considers cybersecurity through its financial stability mandate, while the FMA approaches the subject through its conduct mandate. Both have long regarded cyber threats as a significant operational risk for regulated institutions.

Frontier AI has now become a specific focus within that supervisory work. The announcement did not introduce new binding rules, reporting obligations or implementation deadlines. Instead, the regulators explained how they expect institutions to respond to AI-related cyber threats under the prudential, conduct and operational resilience requirements already applicable to them.

That approach leaves individual institutions responsible for assessing the adequacy of their existing arrangements. Their cybersecurity strategies must account for changing threats, their governance structures must provide effective oversight, and their operational resilience arrangements must address risks associated with external technology dependencies.

McGregor said operational resilience would remain a supervisory priority for both agencies, which intend to continue engaging with regulated entities over their management of these risks.

"Advances in AI are changing the operating environment for financial institutions," he said. "Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI."

For institutions already subject to cybersecurity and operational resilience requirements, the regulators' expectations leave little room to treat AI as a matter confined to technology development or experimentation. Its risks fall within the responsibilities of the people charged with running and overseeing the business.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey