RBNZ And FMA Outline Supervisory Expectations On Cyber And AI Risks
by The Reserve Bank of New Zealand · SCOOPThe Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) and the Financial Markets Authority – Te Mana Tātai Hokohoko (FMA) have today outlined their supervisory expectations on cyber risks associated with frontier Artificial Intelligence (AI).
RBNZ Assistant Governor Financial Stability, Angus McGregor and FMA Executive Director Response and Enforcement, Louise Unger, delivered the remarks at an industry roundtable jointly hosted by the RBNZ, FMA, Department of the Prime Minister and Cabinet and the National Cyber Security Centre.
Cyber risk has long been recognised as a significant operational risk for regulated entities and a focus for both the RBNZ through its financial stability mandate and the FMA through its conduct mandate.
Mr McGregor explained that regulators expect entities to maintain cyber security strategies and frameworks that adequately address the cyber threats they face.
“Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI. These build upon existing prudential, conduct, cyber and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system” Mr McGregor said.
The supervisory expectations focus on how entities should be responding to three key risks arising from frontier AI developments:
- increased cyber risk,
- evolving governance and oversight challenges, and
- growing third-party and concentration risk.
Advertisement - scroll to continue reading
In the face of this dynamic risk landscape, the RBNZ and FMA expect regulated entities to maintain strong foundational cyber controls and security posture, this means focussing on “getting the basics right” Mr McGregor said.
FMA Executive Director, Response and Enforcement, Louise Unger said engaging with senior leaders from the financial services sector provided a valuable opportunity to gather industry’s insights.
"We appreciated the strong engagement from industry participants and the willingness to share practical insights and experiences. These perspectives help inform our understanding of the challenges and opportunities arising from AI and support our ongoing regulatory work.”
“Today's discussion highlighted a shared recognition that advances in AI are changing the cyber threat environment. There was a constructive conversation about the importance of strong governance, effective oversight, operational resilience and the management of third-party dependencies as entities adapt to emerging risks.”
Ms Unger also noted AI can bring benefits for entities and their customers, but it also changes the risks they face.
“Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them."
Mr McGregor explained that operational resilience remains a key supervisory focus for the Reserve Bank and the FMA, who will continue engaging with regulated entities to ensure these risks are managed appropriately.
“The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI”, Mr McGregor concluded.
Advertisement - scroll to continue reading