The Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) have jointly outlined supervisory expectations for how regulated financial institutions should manage cyber and operational risks arising from frontier AI, with a particular focus on governance, third-party dependencies, and incident preparedness.
The regulators said advances in frontier AI are increasing the speed and scale at which cyber vulnerabilities can be identified and exploited, particularly in legacy or unsupported technology environments. Institutions are expected to maintain strong foundational cyber controls, including identity and access management, asset lifecycle management, and timely patching, while considering whether manual monitoring and triage remain adequate against “machine-speed” threats. “The core message today is simple: advances in AI are changing the operating environment for financial institutions,” said Angus McGregor, RBNZ Assistant Governor for Financial Stability. “Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI.”
The expectations also put significant responsibility on boards and senior management. Regulated entities should align their approach to AI-related risk with business strategy, risk appetite, tolerance levels, and operational resilience objectives. Boards should have sufficient visibility into where AI is being used, understand material risks and dependencies, assign clear accountability, and maintain the expertise needed to provide effective challenge.
Third-party and concentration risk is another focus. The regulators warned that growing reliance on a relatively small number of AI and cloud providers could allow outages, model failures, or other disruptions to affect multiple institutions simultaneously. Firms are expected to understand how third parties use AI, assess the resilience of key suppliers, and ensure that contractual arrangements support timely notification of vulnerabilities and incidents. Accountability for operational risk remains with the regulated entity.
Institutions should assume incidents will occur and prepare accordingly, the regulators stressed, including through response and recovery plans and severe but plausible scenarios involving AI-enabled attacks, model failures, and third-party outages. Operational resilience will remain an ongoing supervisory priority for both regulators, which said they would continue engaging with firms as AI-related risks evolve.
Join The Discussion
Sign in and be the first to comment.