New Zealand’s two principal financial regulators, the Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) and the Financial Markets Authority – Te Mana Tātai Hokohoko (FMA), have set out how they expect supervised firms to handle the cyber threats emerging from frontier artificial intelligence.

The expectations were presented at an industry roundtable co-hosted by the RBNZ and the FMA alongside the Department of the Prime Minister and Cabinet and the National Cyber Security Centre.

Angus McGregor, assistant governor for financial stability at the RBNZ, and Louise Unger, executive director of response and enforcement at the FMA, addressed senior figures from the financial services sector.

The guidance targets three areas where advances in frontier AI are creating pressure: a heightened level of cyber risk, more complex demands on governance and oversight, and rising exposure to third-party providers and concentration risk.

Regulators stressed that the new expectations do not replace existing rules. Instead, they extend obligations firms already carry across prudential, conduct, cyber and operational resilience regimes.

McGregor said supervised entities must keep cyber strategies and frameworks proportionate to the threats confronting them, and that robust foundational controls remain essential, describing the priority as “getting the basics right”.

Both bodies have treated cyber risk as a material operational concern for some time. The RBNZ approaches it through its mandate to safeguard financial stability, while the FMA examines it through its responsibility for market conduct.

Operational resilience will stay central to their supervisory work, and both regulators intend to keep engaging with regulated firms to confirm the risks are being controlled.

Source link