New Zealand’s two principal financial regulators, the Reserve Bank of New Zealand (Te Pūtea Matua) and the Financial Markets Authority (Te Mana Tātai Hokohoko), have set out how they expect regulated entities to handle the cyber threats emerging from frontier artificial intelligence.
The guidance was presented at an industry roundtable co-hosted by the RBNZ, the FMA, the Department of the Prime Minister and Cabinet and the National Cyber Security Centre.
RBNZ assistant governor financial stability Angus McGregor and FMA executive director response and enforcement Louise Unger addressed senior figures from across the financial services sector.
The expectations target three areas where frontier AI is shifting the risk profile of financial institutions. These are a rise in cyber risk, mounting difficulties in governance and oversight, and expanding exposure to third-party and concentration risk. Rather than replacing existing rules, the expectations extend current prudential, conduct, cyber and operational resilience obligations.
Both regulators have long treated cyber risk as a material operational threat. The RBNZ approaches it through its financial stability mandate, while the FMA addresses it through its conduct mandate.
McGregor stressed that firms must already keep cyber security strategies and frameworks proportionate to the threats confronting them, and that strong foundational controls remain the priority. In his words, firms should concentrate on “getting the basics right”.
Unger observed that AI can deliver gains for firms and their clients, yet it simultaneously alters the threats they must manage. McGregor added that operational resilience will stay central to supervision, with both bodies continuing to work with regulated entities to confirm these risks are properly controlled.
RBNZ assistant governor financial stability Angus McGregor said, “Today, we take the opportunity to outline our supervisory expectations specifically on the cyber risk associated with the advances in frontier AI. These build upon existing prudential, conduct, cyber and operational resilience obligations and aim to support resilience for regulated entities and the broader financial system”
FMA executive director response and enforcement Louise Unger said, “We appreciated the strong engagement from industry participants and the willingness to share practical insights and experiences. These perspectives help inform our understanding of the challenges and opportunities arising from AI and support our ongoing regulatory work.”
Unger added, “Today’s discussion highlighted a shared recognition that advances in AI are changing the cyber threat environment. There was a constructive conversation about the importance of strong governance, effective oversight, operational resilience and the management of third-party dependencies as entities adapt to emerging risks.”
She continued, “Boards and senior management need to know where AI is being used in their business, understand the risks it brings, and be clear about who is accountable for managing them.”
McGregor concluded, “The core message today is simple: advances in AI are changing the operating environment for financial institutions. Entities are responsible for ensuring that they have the systems and controls in place to manage the risks arising from AI”
Copyright © 2026 RegTech Analyst
