New Zealand’s two main financial regulators have told the firms they supervise how they expect them to handle the cyber risks that come with advances in frontier artificial intelligence. The Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) and the Financial Markets Authority – Te Mana Tātai Hokohoko (FMA) are not introducing a new rule. They say the expectations “build upon existing prudential, conduct, cyber and operational resilience obligations.”
The regulators set out their position on Thursday, 15 October 2026, and published a document titled Supervisory expectations on cyber risk associated with frontier AI.
Where the message was delivered
RBNZ Assistant Governor for Financial Stability Angus McGregor and FMA Executive Director for Response and Enforcement Louise Unger gave the remarks at an industry roundtable. It was jointly hosted by the RBNZ, the FMA, the Department of the Prime Minister and Cabinet, and the National Cyber Security Centre.
The two regulators have different jobs. The RBNZ looks at cyber risk through its financial stability mandate, while the FMA does so through its conduct mandate. Both have long treated cyber risk as a significant operational risk for regulated entities.
The three risks
The expectations focus on how entities should respond to three risks that the regulators say arise from frontier AI:
- “increased cyber risk”;
- “evolving governance and oversight challenges”; and
- “growing third-party and concentration risk.”
The third point reflects a concern that many firms may come to depend on a small number of outside AI and technology providers, so that a problem at one provider could affect many institutions at once.
‘Getting the basics right’
McGregor said regulators expect entities to keep cyber security strategies and frameworks that adequately address the threats they face. In what he called “this dynamic risk landscape”, the RBNZ and FMA expect firms to maintain strong foundational cyber controls and security posture, which he summed up as “getting the basics right.”
“Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI,” McGregor said.
He concluded: “The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI.”
Accountability at the top
Unger said AI can bring benefits for firms and their customers, but also changes the risks they face. “Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them,” she said.
She said the roundtable showed “a shared recognition that advances in AI are changing the cyber threat environment,” with discussion of “strong governance, effective oversight, operational resilience and the management of third-party dependencies.”
What happens next
McGregor said operational resilience remains a key supervisory focus for both regulators, which will keep engaging with regulated entities to make sure these risks are managed. TSN has not yet reviewed the detailed expectations document, so we are not reporting its specific contents here.
What this means
- No new rule. The expectations sit on top of obligations firms already have.
- Basics first. Regulators want strong core cyber controls as AI changes the threat picture.
- Boards are on the hook. Leaders must know where AI is used and who owns the risk.
Sources
- Reserve Bank of New Zealand, “RBNZ and FMA outline supervisory expectations on cyber and AI risks”, 15 October 2026. https://www.rbnz.govt.nz/news-and-events/news/2026/10/rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risks
- Financial Markets Authority, media release, 15 October 2026. https://www.fma.govt.nz/news/all-releases/media-releases/rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risk/
