Operational Resilience / Outsourcing in International
Operational Resilience / Outsourcing regulatory updates from International.
We track 28 Operational Resilience / Outsourcing updates from International regulators, published by FSB and BIS. The archive covers 9 news items, 8 speeches and 4 reports. Most recent update: October 2026. Coverage runs from 2025 to 2026.
In this speech, Dominique Laboureix, Chair of the FSB Resolution Steering Group, discusses the importance of cross-border, cross-sectoral crisis preparedness.
Why this matters
The document is a speech by a named official delivered at a conference in Berlin. Its substance covers crisis preparedness, deposit insurance and resolution, stablecoins as a perimeter question, and operational incidents such as cloud and IT outages affecting banks.
In this speech at RiskLive Asia 2026, John Schindler, FSB Secretary General, addresses the importance of international organisations in a shifting geopolitical landscape.
Why this matters
The document is a keynote speech by the FSB Secretary General, so content_type is speech. It covers AI adoption risks, including third-party provider dependencies, cyber risk, and model governance, which supports Technology & Cyber and Operational Resilience / Outsourcing.
This document summarises the responses to the June 2026 public consultation on the Sound Practices for financial institutions’ responsible AI adoption.
AI Analysis
The FSB published its 15 October 2026 overview of approximately 160 consultation responses and finalised 12 sound practices for responsible AI adoption by financial institutions. The practices are non-binding, technology-neutral recommendations, but the final text materially sharpens expectations for agentic AI, risk-based human approval, documentation, safe interruption, and third-party AI dependency management.
Key dates
2026-06-10
The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.
2026-07-22
The FSB consultation closed; approximately 160 responses were received.
2026-10-15
The FSB published the overview of consultation responses and the final report containing the 12 sound practices.
Suggested considerations
Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.
What changed
The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.
Compliance impact
The publication does not itself impose binding obligations, penalties, or a compliance deadline, so its immediate legal impact is limited. Its supervisory significance is nevertheless material: the detailed expectations on governance, documentation, human oversight, AI lifecycle controls, cyber risk, and third-party dependencies provide a likely benchmark for supervisory reviews and for future domestic implementation, particularly in higher-risk or autonomous AI use cases.
FSB publishes sound practices for financial institutions to adopt, use, and innovate with AI in a responsible manner.
AI Analysis
The FSB published its final 12 sound practices for responsible AI adoption on 15 October 2026, following its June 2026 consultation. The practices are non-binding, technology-neutral guidance, but they establish a clear supervisory benchmark for board accountability, AI risk integration, lifecycle controls, human oversight, cyber resilience and third-party dependency management; independent reporting highlights strengthened expectations for autonomous or agentic AI.
Key dates
2026-06-10
The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.
2026-10-15
The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.
Suggested considerations
Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.
What changed
The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies.
Compliance impact
The publication does not itself create directly enforceable obligations or a compliance deadline, so immediate legal-change severity is moderate. Its practical significance is nevertheless material: supervisors may use the practices as a reference point when assessing governance, operational resilience, outsourcing, model risk and senior-management oversight, particularly where autonomous AI causes customer, prudential, conduct, cyber or systemic-risk concerns.
FSB sets out 12 sound practices to facilitate responsible AI adoption by financial institutions.
AI Analysis
On 15 October 2026, the Financial Stability Board published final guidance containing 12 sound practices for responsible AI adoption across financial institutions, covering board oversight, risk assessment, the AI lifecycle, human oversight, cyber and ICT risk, and third-party dependencies. The guidance is non-binding and technology-neutral, but it provides a significant supervisory benchmark that firms may be expected to evidence through existing governance, model risk, operational resilience, outsourcing and cybersecurity frameworks, particularly for generative and agentic AI.
Key dates
2026-10-15
FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.
Suggested considerations
Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.
What changed
The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...
Compliance impact
The immediate legal impact is limited because the FSB document is guidance rather than a binding rule and contains no specified implementation deadline, quantitative threshold or direct enforcement mechanism. Its practical supervisory impact is nevertheless material: regulators may use the practices as a reference when assessing governance, operational resilience, model risk, cybersecurity, outsourcing, conduct and senior-management accountability, with heightened scrutiny likely for high-impact, autonomous or poorly explainable AI.
Almost 300 central bankers and banking supervisors attended the International Conference of Banking Supervisors (ICBS) to discuss the future of supervision and the digitalisation of finance...
Why this matters
This is a media release summarizing the 24th ICBS conference. It documents supervisory consensus on key regulatory themes: enhanced supervisory effectiveness through judgment-led approaches, simplification of regulation, digitalisation risks (AI, crypto, cyber), and bank-NBFI interlinkages.
BIS Americas Office hosts the FSB Americas group in Mexico City.
Why this matters
The content documents a regional meeting of the FSB's Americas consultative group discussing financial stability topics including geopolitical vulnerabilities, extreme weather impacts, stablecoins, AI/quantum computing resilience, and cyber crisis preparedness.
Roundtable to explore how collaboration efforts between the public and private sectors can be structured and applied to prepare for and manage significant operational disruptions.
Why this matters
This is a news item reporting on an FSB roundtable discussion focused on strengthening operational resilience through public-private collaboration. The content discusses practical steps, relationship-building, lessons learned, and interoperability across sectors and jurisdictions.
CPMI-IOSCO are seeking input from stakeholders on a cyber resilience toolkit for financial market infrastructures (FMIs) and on risks to FMIs from third-party service providers. The Cyber resilience toolkit: practical considerations for FMIs supports FMIs in strengthening their cyber resilience frameworks. The…
Why this matters
This is a formal consultation by CPMI-IOSCO seeking stakeholder input on two interconnected deliverables: a cyber resilience toolkit for FMIs and a discussion paper on third-party service provider risks. The toolkit complements existing PFMI principles and provides practical guidance on operational resilience.
The potential impact of frontier AI on cyber risk is the most immediate concern to the financial system, says FSB Chair, Andrew Bailey.
Why this matters
This is a policy statement from the FSB Chair to G20 authorities identifying frontier AI and cyber risk as priority concerns requiring jurisdictional and institutional response. The letter calls for concrete steps on safe AI deployment and third-party resilience, indicating regulatory intent to develop standards.
In his letter to G20 Finance Ministers and Central Bank Governors, Andrew Bailey, warns that markets remain vulnerable to a potential disorderly correction and cautions on the risks posed by frontier AI models.
Why this matters
This is a speech/letter from the FSB Chair to G20 policymakers flagging frontier AI as an emerging systemic risk to financial stability, particularly through cyber vulnerabilities and market confidence impacts.
In this speech, John Schindler, FSB Secretary General, addresses the importance of international organisations in a shifting geopolitical landscape.
Why this matters
This is a speech by the FSB Secretary General addressing the state of multilateralism in financial regulation. While not a binding rule or consultation, it provides noteworthy regulatory signals about FSB priorities and approach.
In this speech, FSB Secretary General, John Schindler highlights the importance of resolve in resolution planning, emphasising collaboration, preparedness, in maintaining financial system resilience.
Why this matters
This is an informational speech (urgency: null) but carries noteworthy regulatory signals. The FSB Secretary General explicitly announces a strategic review of crisis preparedness and emphasizes a deliberate policy shift from sector-by-sector resolution frameworks to integrated cross-sectoral planning.
At the virtual event, hosted by OMFIF, FSB Deputy Secretary General calls for a debate on the next steps for cross-border payments beyond 2027.
Why this matters
This is an opening remarks speech at a virtual event, not a binding obligation or final rule. However, it carries concrete regulatory signals about the FSB's thinking on cross-border payments policy beyond 2027, including questions about standardization (ISO 20022), stablecoins, regional coordination, and...
In this speech, Dominique Laboureix, Chair of the FSB Resolution Steering Group, discusses the importance of cross-border, cross-sectoral crisis preparedness.
Why this matters
This is a speech by the Chair of the FSB Resolution Steering Group at the ReSolve event, focused on cross-sectoral interconnections in financial stability and crisis management.
Roundtable hosted by the Bank of Spain discusses external audit.
Why this matters
This is a news item reporting on an FSB convened roundtable discussion (not a binding rule, consultation, or enforcement action). The content addresses structural changes in the audit profession driven by technology (AI) and ownership shifts, with implications for audit quality and financial stability.
The Basel Committee on Banking Supervision today published a range of practices report on information and communication technology (ICT) risk management. ICT is a key component of operational risk management, playing a vital role in supporting the broader goal of achieving operational resilience.
Why this matters
This is a Basel Committee publication of a range of practices report (not binding rules, but authoritative guidance) addressing ICT risk management as a component of operational resilience. The content is informational/guidance-focused rather than a consultation or final rule, and targets banks specifically.
Basel Committee publishes report on information and communication technology risk management.
Why this matters
This is a published report from the Basel Committee on Banking Supervision (BCBS) analyzing ICT risk management practices across jurisdictions. The content explicitly addresses operational resilience and ICT/cyber risk in banking.
The Basel Committee has published a report describing a range of observed information and communication technology (ICT) risk management practices across jurisdictions to address non-malicious ICT incidents.
Why this matters
This is a media release announcing publication of a Basel Committee range of practices report on ICT risk management. The report documents observed practices across jurisdictions and is intended as a reference for banks and supervisory authorities.
The Project Agorá prototype demonstrates how tokenisation and programmable technologies can address long-standing inefficiencies in wholesale cross-border payments at scale, while preserving the safety and integrity of settlement in central bank reserves.
Why this matters
This is a press release and research report from the BIS announcing Project Agorá findings on tokenisation for wholesale payments. It is informational and exploratory in nature (explicitly noted as experimental), not a binding obligation or final rule.
The Project Agorá prototype demonstrates how tokenisation and programmable technologies can address long-standing inefficiencies in wholesale cross-border payments at scale, while preserving the safety and integrity of settlement in central bank reserves.
Why this matters
The content is a media release and research report from the BIS Innovation Hub detailing Project Agorá's exploratory findings on tokenised wholesale cross-border payments.
Agrees to publish range of practices report on information and communication technology risk management. Progresses its targeted review of the prudential standard for banks' cryptoasset exposures. Considers targeted updates of its principles on liquidity risk.
Why this matters
This is a Basel Committee press release documenting meeting outcomes and regulatory work in progress. The Committee approved publication of an ICT risk management practices report (addressing operational resilience), is progressing a targeted review of cryptoasset prudential standards, and is considering updates to...
Agrees to publish range of practices report on information and communication technology risk management. Progresses its targeted review of the prudential standard for banks' cryptoasset exposures. Considers targeted updates of its principles on liquidity risk.
Why this matters
This is a media release documenting Basel Committee meeting outcomes. The content supports three primary regulatory initiatives: (1) publication of ICT risk management practices report addressing operational resilience, (2) ongoing targeted review of cryptoasset prudential standards with updates promised later in...
CPMI-IOSCO is seeking input from interested stakeholders on amendments to CCP-related resilience guidance and public quantitative disclosures requirements.
Why this matters
This is a formal consultation by CPMI-IOSCO on proposed amendments to existing CCP resilience guidance (2017) and public quantitative disclosure standards (2015), incorporating proposals from the January 2025 BCBS-CPMI-IOSCO report on initial margin transparency.
Discusses vulnerabilities in government bond-backed repo markets. Discusses progress of a targeted review of the prudential standard for banks' cryptoasset exposures. Announces date and location of the International Conference of Banking Supervisors.
Why this matters
This is a press release announcing Basel Committee meeting outcomes. The text explicitly discusses an expedited review of cryptoasset exposure standards (with update promised later in 2026), approved technical amendments to operational risk standardised approach (publishing March 2026), and vulnerabilities in repo...
As part of its 2025-2026 work programme, the Basel Committee is advancing various supervisory initiatives related to the digitalisation of finance.
AI Analysis
The Basel Committee has published its Principles for the sound management of third-party risk, setting a common baseline for banks and supervisors as firms become more dependent on third-party service providers. The publication matters because it broadens the supervisory lens beyond traditional outsourcing to a wider range of third-party arrangements, with implications for governance, due diligence, contracts, monitoring, and exit planning.
Key dates
2025-12-10
Basel Committee publication date for the Principles for the sound management of third-party risk
Suggested considerations
Compliance teams may wish to map all third-party arrangements against the new lifecycle expectations, including non-traditional outsourcing and intra-group or technology-enabled arrangements.
Firms should consider whether board-approved third-party risk appetite, tolerance for disruption, and reporting lines are documented clearly and align with current governance arrangements.
Banks may wish to review due diligence, contracting, onboarding, monitoring, continuity, and exit procedures to confirm they address the principle-based expectations across the full relationship lifecycle.
Supervisory liaison teams may wish to assess whether concentration risk, critical provider dependencies, and cross-border coordination issues are adequately captured in existing risk registers and escalation frameworks.
What changed
The document sets out 12 principles covering the full third-party service provider lifecycle, divided between bank-facing expectations and supervisor-facing expectations. For banks, the principles cover governance and strategy, board and senior management oversight, risk assessment, due diligence, legally binding contracts, onboarding, ongoing monitoring, business continuity, and termination/exit management.
Compliance impact
The publication is a material supervisory signal rather than a binding rule, but it raises the expected standard for how banks identify, manage, and oversee third-party dependencies. Institutions that rely heavily on external providers may face closer supervisory scrutiny of governance, resilience, and concentration risk, especially where critical services are involved.
The Basel Committee has published principles for the sound management of third-party risk in the banking sector. The principles establish a common baseline for banks and supervisors for the sound management of third-party risk. The Committee will continue to monitor developments related to the digitalisation of…
AI Analysis
The Basel Committee published final principles for the sound management of third-party risk in the banking sector on 2025-12-10. The publication matters because it creates a common prudential baseline for banks and supervisors and explicitly supersedes the Basel/Joint Forum 2005 outsourcing paper for banking-sector purposes.
Key dates
2025-12-10
Basel Committee published the principles for the sound management of third-party risk
2024-10-09 Deadline
Comment deadline for the consultative version of the principles
Suggested considerations
Compliance teams may wish to compare existing outsourcing and third-party risk frameworks against the new 12-principle baseline to identify gaps in governance, lifecycle controls, and supervisor-facing documentation.
Firms may wish to review board and senior management oversight arrangements for third-party risk to ensure responsibilities, risk appetite, escalation, and reporting are clearly assigned.
Banks should consider whether their third-party inventories, risk assessments, due diligence files, contracts, monitoring processes, and exit planning are aligned to a full lifecycle model rather than a narrow outsourcing model.
Supervisory relations teams may wish to map the principles against home and host jurisdiction requirements to identify where local rules are already aligned or where additional supervisory engagement may be needed.
Operational resilience teams may wish to test whether critical third-party dependencies, including cloud and technology providers, are sufficiently captured in business continuity and termination planning.
What changed
The Basel Committee replaced the older 2005 Joint Forum outsourcing guidance with a new 12-principle framework focused on third-party service provider arrangements in banking. The framework is broader than traditional outsourcing and is designed to cover the larger, more diverse third-party ecosystem created by digitalisation and financial technology.
Compliance impact
The practical impact is broad for banking-sector third-party risk management because the publication updates the prudential benchmark supervisors may use when assessing governance, controls, and resilience. The Committee does not describe legal sanctions, but firms that lag the baseline may face supervisory challenge, remediation expectations, or pressure to strengthen third-party oversight and lifecycle controls.
The Basel Committee on Banking Supervision horizon scanning report on banks' interconnections with non-bank financial intermediaries (NBFIs).
Why this matters
This is a published horizon scanning report from the Basel Committee analyzing interconnections between banks and non-bank financial intermediaries. The report describes direct and indirect linkages, discusses risks and vulnerabilities, includes case studies and stylised failure scenarios, and emphasizes data...