Expectations touch on how regulated entities should respond to cyber threats
At a recent roundtable, the Reserve Bank of New Zealand | Te Pūtea Matua (RBNZ) and the Financial Markets Authority | Te Mana Tātai Hokohoko (FMA) set out their supervisory expectations regarding the cyber risks arising from frontier artificial intelligence (AI).
The RBNZ, the FMA, the Department of the Prime Minister and Cabinet, and the National Cyber Security Centre jointly hosted the event. The discussion touched upon how AI developments have altered the operating environment for entities within the financial services industry.
Angus McGregor, RBNZ’s assistant governor for financial stability, and Louise Unger, the FMA’s executive director for response and enforcement, expressed their expectations that regulated organisations maintain the foundational cybersecurity controls, strategies, and frameworks.
According to McGregor, these expectations “build upon existing prudential, conduct, cyber and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system.”
The RBNZ’s and the FMA’s expectations centred on the response of regulated entities to the following emerging risks associated with advances in frontier AI:
“Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them,” Unger said.
During the roundtable, Unger welcomed the opportunity to hear from senior leaders within the financial services sector.
"We appreciated the strong engagement from industry participants and the willingness to share practical insights and experiences,” she said. “These perspectives help inform our understanding of the challenges and opportunities arising from AI and support our ongoing regulatory work.”
The conversation covered the need for governance, oversight, operational resilience, and third-party dependency management.
Unger confirmed that the RBNZ and the FMA would continue to prioritise operational resilience as they carried out their supervisory functions.
The National Cyber Security Centre recently published its Cyber Threat Report 2026, examining the cybersecurity risks encountered by New Zealand businesses and organisations amid the frontier AI developments swiftly altering the cyber environment.
In a speech at the National Cyber Security Summit 2026 last March, Privacy Commissioner Michael Webster attributed 61 percent of serious privacy breaches in the latest quarter to intentional or malicious activity, and 36 percent to human error.
Enjoy this story? Read the latest banking and finance news on the main page!
