Financial markets under increasing pressure

For compliance and risk leaders, the key message is that cyber resilience is no longer only an IT control issue: a successful attack could impair markets, customers and confidence, while government capacity to absorb shocks is narrowing. Firms should expect heightened supervisory attention on board accountability, ICT and third-party concentration, incident response and reporting, and the governance of emerging technologies such as AI and tokenisation. There is no new rule or deadline in this announcement, but the direction of travel is clear.

Actionable priorities: refresh cyber and operational resilience assessments; test severe but plausible attack scenarios; validate escalation and regulatory notification playbooks; strengthen oversight of cloud, outsourcing and supply-chain dependencies; and ensure board reporting includes clear risk appetite, metrics and remediation tracking. Compliance teams should also map cyber risk into financial crime, data protection and conduct risks, and monitor AFM and EU supervisory expectations. Firms with mature resilience can turn this into a trust and competitive advantage, but implementation requires sustained investment and senior management ownership.