New Zealand’s two principal financial regulators, the Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) and the Financial Markets Authority – Te Mana Tātai Hokohoko (FMA), have set out how they expect supervised firms to handle the cyber threats emerging from frontier artificial intelligence.
The expectations were presented at an industry roundtable co-hosted by the RBNZ and the FMA alongside the Department of the Prime Minister and Cabinet and the National Cyber Security Centre.
Angus McGregor, assistant governor for financial stability at the RBNZ, and Louise Unger, executive director of response and enforcement at the FMA, addressed senior figures from the financial services sector.
The guidance targets three areas where advances in frontier AI are creating pressure: a heightened level of cyber risk, more complex demands on governance and oversight, and rising exposure to third-party providers and concentration risk.
Regulators stressed that the new expectations do not replace existing rules. Instead, they extend obligations firms already carry across prudential, conduct, cyber and operational resilience regimes.
McGregor said supervised entities must keep cyber strategies and frameworks proportionate to the threats confronting them, and that robust foundational controls remain essential, describing the priority as “getting the basics right”.
Both bodies have treated cyber risk as a material operational concern for some time. The RBNZ approaches it through its mandate to safeguard financial stability, while the FMA examines it through its responsibility for market conduct.
Operational resilience will stay central to their supervisory work, and both regulators intend to keep engaging with regulated firms to confirm the risks are being controlled.
Unger acknowledged that AI can deliver advantages to firms and their customers, while cautioning that it also alters the risk profile they must manage.
RBNZ assistant governor financial stability Angus McGregor said, “Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI. These build upon existing prudential, conduct, cyber and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system”
FMA executive director response and enforcement Louise Unger said, “We appreciated the strong engagement from industry participants and the willingness to share practical insights and experiences. These perspectives help inform our understanding of the challenges and opportunities arising from AI and support our ongoing regulatory work.”
Unger added, “Today’s discussion highlighted a shared recognition that advances in AI are changing the cyber threat environment. There was a constructive conversation about the importance of strong governance, effective oversight, operational resilience and the management of third-party dependencies as entities adapt to emerging risks.”
She also said, “Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them.”
McGregor concluded, “The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI”
Copyright © 2026 FinTech Global
Investors
The following investor(s) were tagged in this article.
Leave a Reply