The Reserve Bank and the Financial Markets Authority (FMA) have told financial firms that advanced AI has changed the cyber threat, and that dealing with it is their job.
Angus McGregor, the Reserve Bank's Assistant Governor for Financial Stability, and Louise Unger, the FMA's Executive Director for Response and Enforcement, delivered joint remarks to financial services leaders in Auckland on 15 October. The FMA published them the same day.
It isn't a new law. The speech says the expectations "reflect existing prudential, conduct, cyber and operational resilience obligations".
It names three risks: "increased cyber risk, evolving governance and oversight challenges, and growing third-party and concentration risk".
Frontier AI, meaning the most advanced models, "has fundamentally changed the capability, speed and accessibility of the tools that can be used to identify and potentially exploit weaknesses" in technology systems, the speech says.
It also says that cyber risk "raises the risk for consumers of financial services, including through disruption to essential services, loss of access to accounts, scams and fraud, as well as data breaches".
On what firms should do, the speech has five key messages. First, get the basics right: strong identity and access management, asset lifecycle management and "timely patching", especially for "legacy or unsupported" technology.
Second, boards and senior management should know where AI is used, set risk appetite and assign accountability.
Third, check suppliers, particularly where many firms depend on a small number of AI and cloud providers. The speech says "accountability for managing operational risks remains with regulated entities".
Fourth, firms "should assume incidents will occur", prepare accordingly and test recovery against "severe but plausible" scenarios.
Fifth, watch for "deepfake impersonation, synthetic identities and increasingly sophisticated social engineering attacks", and check whether "customer and employee verification processes" still work.
Unger said the FMA expects AI use to extend "into areas such as investment research, portfolio management, client communications and financial advice". She pointed to the FMA's separate review of AI in financial advice, which is looking at how firms use AI-enabled tools and the governance around them.
The speech names no insurer and no insurance product. Its audience is "regulated entities" in the financial sector generally. By our reading that includes insurers and advisers, but the speech doesn't list them.
It sets no deadlines and gives no penalties, and it doesn't say whether either regulator will turn the expectations into a formal standard.
