Technology & Cyber regulatory updates from International.
We track 29 Technology & Cyber updates from International regulators, published by FSB and BIS. The archive covers 9 speeches, 8 news items and 5 reports. Most recent update: October 2026. Coverage runs from 2025 to 2026.
In this speech, Dominique Laboureix, Chair of the FSB Resolution Steering Group, discusses the importance of cross-border, cross-sectoral crisis preparedness.
Why this matters
The document is a speech by a named official delivered at a conference in Berlin. Its substance covers crisis preparedness, deposit insurance and resolution, stablecoins as a perimeter question, and operational incidents such as cloud and IT outages affecting banks.
In this speech at RiskLive Asia 2026, John Schindler, FSB Secretary General, addresses the importance of international organisations in a shifting geopolitical landscape.
Why this matters
The document is a keynote speech by the FSB Secretary General, so content_type is speech. It covers AI adoption risks, including third-party provider dependencies, cyber risk, and model governance, which supports Technology & Cyber and Operational Resilience / Outsourcing.
This document summarises the responses to the June 2026 public consultation on the Sound Practices for financial institutions’ responsible AI adoption.
AI Analysis
The FSB published its 15 October 2026 overview of approximately 160 consultation responses and finalised 12 sound practices for responsible AI adoption by financial institutions. The practices are non-binding, technology-neutral recommendations, but the final text materially sharpens expectations for agentic AI, risk-based human approval, documentation, safe interruption, and third-party AI dependency management.
Key dates
2026-06-10
The FSB published the consultation report proposing 12 sound practices for responsible AI adoption.
2026-07-22
The FSB consultation closed; approximately 160 responses were received.
2026-10-15
The FSB published the overview of consultation responses and the final report containing the 12 sound practices.
Suggested considerations
Firms should consider mapping existing AI inventories, model-risk controls, operational-resilience arrangements, cyber controls, outsourcing registers, and board reporting against all 12 FSB practices.
Compliance teams may wish to introduce or validate a documented, risk-based materiality assessment for each AI use case at inception and throughout its lifecycle, including uses embedded in products or obtained from vendors.
Boards and senior management should consider whether AI adoption is aligned with business strategy, risk appetite, accountability structures, and existing risk-management frameworks.
Firms using generative or agentic AI should consider defining permitted actions, autonomy limits, escalation paths, human-approval triggers, monitoring thresholds, and tested stop or safe-interruption procedures.
Firms should consider retaining records sufficient to identify the AI system, data, model or vendor, intended purpose, materiality assessment, testing, approvals, monitoring results, changes, incidents, and reconstructed decisions or actions.
Procurement and third-party-risk teams may wish to assess AI providers for performance, transparency, data quality, supply-chain exposure, concentration risk, exit options, resilience, and business-continuity arrangements.
Technology and operational-resilience teams should consider adding AI-specific cyber and ICT scenarios to testing and exercises, including model manipulation, data poisoning, prompt or agent compromise, erroneous autonomous actions, provider outage, and loss of vendor access.
Firms should consider reviewing the interaction between the FSB practices and binding local requirements, including the EU Digital Operational Resilience Act, EU AI Act, sectoral outsourcing rules, model-risk requirements, data-protection law, and senior-management accountability regimes.
What changed
The final framework retains 12 practices covering board and senior-management oversight, governance and accountability, AI risk integration and documentation, organisational adaptability, materiality assessment, model selection, data governance, explainability and transparency, performance management, human oversight, cyber and ICT risk, and third-party AI risk.
Compliance impact
The publication does not itself impose binding obligations, penalties, or a compliance deadline, so its immediate legal impact is limited. Its supervisory significance is nevertheless material: the detailed expectations on governance, documentation, human oversight, AI lifecycle controls, cyber risk, and third-party dependencies provide a likely benchmark for supervisory reviews and for future domestic implementation, particularly in higher-risk or autonomous AI use cases.
FSB publishes sound practices for financial institutions to adopt, use, and innovate with AI in a responsible manner.
AI Analysis
The FSB published its final 12 sound practices for responsible AI adoption on 15 October 2026, following its June 2026 consultation. The practices are non-binding, technology-neutral guidance, but they establish a clear supervisory benchmark for board accountability, AI risk integration, lifecycle controls, human oversight, cyber resilience and third-party dependency management; independent reporting highlights strengthened expectations for autonomous or agentic AI.
Key dates
2026-06-10
The FSB published its consultation report proposing 12 sound practices for responsible AI adoption by financial institutions.
2026-10-15
The FSB published the final report and consultation-response overview. The sound practices take effect as non-binding supervisory guidance with no stated implementation deadline.
Suggested considerations
Firms should inventory AI use cases, including embedded or shadow AI and autonomous or agentic functionality, and assign accountable owners for each use case.
Boards and senior management may wish to evidence how AI adoption aligns with the business model, strategy, risk appetite and existing governance framework.
Compliance and risk teams should consider adding AI-specific materiality, risk and approval assessments at inception and at defined review points after deployment or material model changes.
Firms should consider documenting model purpose, data sources, versions, limitations, testing, performance results, explainability assessments, human controls, incidents and changes sufficiently to reconstruct AI-supported decisions and actions.
For higher-risk or autonomous use cases, firms should consider setting risk-based human-approval triggers, access and action limits, real-time or periodic monitoring, escalation paths and tested intervention or shutdown mechanisms.
Existing cyber, ICT, operational resilience and third-party risk assessments may need to be extended to cover AI-specific threats, model manipulation, data leakage, outages, unsafe updates and concentration among common providers or models.
Procurement and legal teams should consider whether third-party AI contracts provide adequate monitoring, transparency, data-quality information, audit and access rights, change notification, incident cooperation, business continuity and exit arrangements.
Firms should map the FSB practices against applicable requirements under DORA, the EU AI Act, outsourcing rules, model-risk frameworks, conduct obligations and data-protection law, recording any gaps and the basis for proportionate controls.
What changed
The final report consolidates 12 proportionate practices into two areas: organisation-wide AI governance and risk management across the AI lifecycle. It strongly encourages boards and senior management to align AI adoption with business strategy and risk appetite, define responsibilities, incorporate AI risks into existing risk frameworks, document AI use cases, assess materiality at inception and thereafter, govern data, address explainability, evaluate performance, provide risk-based human oversight, manage AI-related cyber and ICT risks, and control third-party AI dependencies.
Compliance impact
The publication does not itself create directly enforceable obligations or a compliance deadline, so immediate legal-change severity is moderate. Its practical significance is nevertheless material: supervisors may use the practices as a reference point when assessing governance, operational resilience, outsourcing, model risk and senior-management oversight, particularly where autonomous AI causes customer, prudential, conduct, cyber or systemic-risk concerns.
FSB sets out 12 sound practices to facilitate responsible AI adoption by financial institutions.
AI Analysis
On 15 October 2026, the Financial Stability Board published final guidance containing 12 sound practices for responsible AI adoption across financial institutions, covering board oversight, risk assessment, the AI lifecycle, human oversight, cyber and ICT risk, and third-party dependencies. The guidance is non-binding and technology-neutral, but it provides a significant supervisory benchmark that firms may be expected to evidence through existing governance, model risk, operational resilience, outsourcing and cybersecurity frameworks, particularly for generative and agentic AI.
Key dates
2026-10-15
FSB published the final report on Sound Practices for Responsible Adoption of Artificial Intelligence.
Suggested considerations
Firms should consider inventorying all material AI use cases, including internally developed tools, vendor-provided models, embedded productivity tools, generative AI and agentic or multi-agent systems, with ownership, purpose, data sources, model dependencies and deployment status recorded.
Compliance teams may wish to map each use case to a documented materiality and risk classification performed at inception and refreshed after material model, data, vendor, scope or operating-environment changes.
Boards and senior management should consider whether AI governance, risk appetite statements, delegated authorities and management information clearly cover autonomous actions, prohibited uses, escalation thresholds and accountability for AI-supported decisions.
Firms should consider integrating AI-specific controls into existing model risk management, operational-risk, ICT-risk, cybersecurity, outsourcing and business-continuity frameworks rather than creating disconnected governance.
Model and technology teams may wish to maintain evidence of data provenance, data quality, testing, validation, performance metrics, drift monitoring, incident handling, explainability assessments and compensating controls where explainability is limited.
For higher-risk or autonomous use cases, firms should consider mandatory human approval triggers, bounded permissions, segregation of duties, real-time or near-real-time monitoring, complete audit trails, emergency stop or rollback capability and periodic reassessment of whether human oversight remains effective.
Procurement and third-party-risk functions should consider enhancing due diligence and contracts for AI providers to address model performance, transparency, training and input data, subcontracting, security, audit access, incident notification, portability, exit planning, concentration risk and service continuity.
Cybersecurity teams should consider adding AI-enabled attacks, prompt injection, data poisoning, model manipulation, deepfakes, automated exploitation and misuse of AI-assisted coding or defensive tools to threat assessments, testing and exercises.
What changed
The FSB replaced its June 2026 consultation with a final framework of 12 proportionate sound practices. The practices require firms to align AI adoption with business strategy and risk appetite; define accountability; incorporate AI risks into enterprise risk management; document AI use and materiality assessments; select models according to business, technical and risk requirements; govern data quality and security; address explainability and stakeholder transparency; test and monitor performance; apply human oversight proportionate to autonomy, complexity, risk and explainability; manage...
Compliance impact
The immediate legal impact is limited because the FSB document is guidance rather than a binding rule and contains no specified implementation deadline, quantitative threshold or direct enforcement mechanism. Its practical supervisory impact is nevertheless material: regulators may use the practices as a reference when assessing governance, operational resilience, model risk, cybersecurity, outsourcing, conduct and senior-management accountability, with heightened scrutiny likely for high-impact, autonomous or poorly explainable AI.
FSB seeks feedback on eight high-level principles to assist financial authorities in their modernisation efforts.
AI Analysis
The FSB published a consultation on eight high-level principles intended to help authorities modernise regulatory and supervisory frameworks while preserving or enhancing financial-system resilience. The consultation does not create binding obligations for firms, but it signals a more risk-focused, proportionate and forward-looking approach to future rulemaking; independent reporting also highlights the FSB's intention to prioritise genuinely cross-border, cross-sectoral and systemic vulnerabilities and to use high-level principles where risks are still emerging.
Key dates
2026-10-14
FSB published the consultation report on Regulatory and Supervisory Modernisation Principles and the 2026 G20 Implementation Monitoring Review.
2027-01-08 Deadline
Deadline for submitting comments on the consultation report and its questions through the FSB secure online form.
Suggested considerations
Compliance teams may wish to determine whether their firm, trade association or parent group intends to submit feedback through the FSB's secure online form by 8 January 2027.
Firms should consider reviewing the consultation questions against their existing regulatory-change, horizon-scanning and risk-assessment processes, particularly for emerging technology, new financial offerings and changing market vulnerabilities.
Groups operating across jurisdictions may wish to map where differing legal frameworks, market structures or supervisory expectations could produce uneven implementation of future FSB-aligned measures.
Regulatory-policy teams should consider monitoring the final FSB report, expected in the first half of 2027, together with consultations and rulemaking by relevant national and regional authorities.
Firms may wish to retain evidence of material operational, prudential, technology and business-model risks that could inform proportionate, risk-based future regulation, without treating the consultation as a current change to applicable obligations.
What changed
The FSB proposed eight high-level principles for financial authorities in FSB member jurisdictions to apply when reviewing or modernising regulatory and supervisory frameworks. The principles are intended to improve effectiveness, efficiency, risk focus, coherence and responsiveness to new vulnerabilities, technologies, financial offerings and economic conditions.
Compliance impact
Immediate compliance impact is low because the publication is a consultation and introduces no directly binding requirements, thresholds or firm-level reporting duties. Its strategic impact is broader: the FSB describes slowing implementation as a potential threat to the financial system's ability to withstand future shocks, while the review signals that future international standards may be more targeted, proportionate, nationally adaptable and focused on cross-border systemic risks.
Andrew Bailey delivers note on vulnerabilities and monitoring of global stablecoins and finalised sound practices on AI adoption.
Why this matters
The document is a letter from a named official (FSB Chair Andrew Bailey), which fits the speech category as an official statement. It covers AI adoption, stablecoin cross-border vulnerabilities, public sector backstop funding for banks in resolution, and regulatory modernisation.
FSB Chair, Andrew Bailey’s letter to the G20 Finance Ministers and Central Bank Governors ahead of their October meeting in Bangkok.
Why this matters
The document is a letter from a named official (the FSB Chair, Andrew Bailey) to G20 ministers, which fits the speech category. It is cross-cutting, covering systemic risks and several workstreams, so the sector is General.
Exchanges experiences and views on developments in artificial intelligence for the global banking system and supervisors, modernisation efforts and implications for the Committee’s future work programme...
Why this matters
This is a Basel Committee policy statement announcing multiple final standards and consultations with concrete implementation timelines. The approval of final machine-readable Pillar 3 disclosure standards, G-SIB assessment framework revisions, and upcoming consultations on IRRBB Pillar 2 guidance and cryptoasset...
Almost 300 central bankers and banking supervisors attended the International Conference of Banking Supervisors (ICBS) to discuss the future of supervision and the digitalisation of finance...
Why this matters
This is a media release summarizing the 24th ICBS conference. It documents supervisory consensus on key regulatory themes: enhanced supervisory effectiveness through judgment-led approaches, simplification of regulation, digitalisation risks (AI, crypto, cyber), and bank-NBFI interlinkages.
BIS Americas Office hosts the FSB Americas group in Mexico City.
Why this matters
The content documents a regional meeting of the FSB's Americas consultative group discussing financial stability topics including geopolitical vulnerabilities, extreme weather impacts, stablecoins, AI/quantum computing resilience, and cyber crisis preparedness.
CPMI-IOSCO are seeking input from stakeholders on a cyber resilience toolkit for financial market infrastructures (FMIs) and on risks to FMIs from third-party service providers. The Cyber resilience toolkit: practical considerations for FMIs supports FMIs in strengthening their cyber resilience frameworks. The…
Why this matters
This is a formal consultation by CPMI-IOSCO seeking stakeholder input on two interconnected deliverables: a cyber resilience toolkit for FMIs and a discussion paper on third-party service provider risks. The toolkit complements existing PFMI principles and provides practical guidance on operational resilience.
The potential impact of frontier AI on cyber risk is the most immediate concern to the financial system, says FSB Chair, Andrew Bailey.
Why this matters
This is a policy statement from the FSB Chair to G20 authorities identifying frontier AI and cyber risk as priority concerns requiring jurisdictional and institutional response. The letter calls for concrete steps on safe AI deployment and third-party resilience, indicating regulatory intent to develop standards.
In his letter to G20 Finance Ministers and Central Bank Governors, Andrew Bailey, warns that markets remain vulnerable to a potential disorderly correction and cautions on the risks posed by frontier AI models.
Why this matters
This is a speech/letter from the FSB Chair to G20 policymakers flagging frontier AI as an emerging systemic risk to financial stability, particularly through cyber vulnerabilities and market confidence impacts.
Consultation responses to ‘Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report‘.
AI Analysis
The FSB has published public responses to its consultation on sound practices for responsible AI adoption, following the 10 June 2026 consultation report and the 22 July 2026 comment deadline. This is a consultation-stage update, so it does not create binding obligations, but it signals the direction of emerging global expectations for AI governance in financial institutions.
Key dates
2026-06-10
FSB published the consultation report on Sound Practices for Responsible Adoption of Artificial Intelligence (AI)
2026-07-22 Deadline
Deadline for written comments on the consultation report
2026-08-06
FSB published the public responses to the consultation
Suggested considerations
Compliance teams may wish to review the consultation responses to identify supervisory themes and likely refinements to the final FSB report.
Firms considering or already using AI may wish to map their current governance, risk, and lifecycle controls against the FSB’s 12 proposed sound practices.
Risk and model governance teams may wish to assess whether their controls address generative AI, agentic AI, and third-party or technology dependencies in a way that aligns with the consultation’s focus.
Public policy and regulatory affairs functions may wish to track the final report once published, as it may influence national supervisory expectations even if it remains non-binding soft law.
What changed
The publication makes available the written public comments received on the FSB’s consultation report on Sound Practices for Responsible Adoption of Artificial Intelligence (AI). The underlying consultation proposed a menu of 12 sound practices for financial institutions to apply across organisation-wide AI governance and the full AI lifecycle, including emerging forms such as generative AI and agentic AI.
Compliance impact
The immediate compliance impact is limited because this is a consultation-response publication and the underlying document is non-binding guidance. The practical consequence is that firms may see the direction of future international supervisory expectations on AI governance, lifecycle controls, and related technology and third-party risks.
In this speech, John Schindler, FSB Secretary General, addresses the importance of international organisations in a shifting geopolitical landscape.
Why this matters
This is a speech by the FSB Secretary General addressing the state of multilateralism in financial regulation. While not a binding rule or consultation, it provides noteworthy regulatory signals about FSB priorities and approach.
At the virtual event, hosted by OMFIF, FSB Deputy Secretary General calls for a debate on the next steps for cross-border payments beyond 2027.
Why this matters
This is an opening remarks speech at a virtual event, not a binding obligation or final rule. However, it carries concrete regulatory signals about the FSB's thinking on cross-border payments policy beyond 2027, including questions about standardization (ISO 20022), stablecoins, regional coordination, and...
In her remarks, Michelle W. Bowman, Chair of the FSB Standing Committee on Supervisory and Regulatory Cooperation (SRC), discusses the FSB’s Consultation Report on the Sound Practices for Responsible Adoption of Artificial Intelligence.
AI Analysis
The FSB used this speech to signal that its consultation report on sound practices for responsible AI adoption is meant to guide, not hard-code, how financial institutions govern AI use. For compliance teams, the key message is that the draft framework is risk-based and proportional, with lighter-touch expectations for lower-risk uses and greater scrutiny where AI is material to business operations or legal and regulatory obligations.
Key dates
2026-06-10
FSB published the consultation report on Sound Practices for Responsible Adoption of Artificial Intelligence
2026-07-07
FSB virtual outreach event and Michelle W. Bowman opening remarks on the consultation
2026-07-22 Deadline
Deadline for public comments on the consultation report
Suggested considerations
Compliance teams may wish to map all AI use cases and classify which deployments are material to business operations, legal obligations, or regulatory obligations.
Firms should consider whether existing governance, model risk, and operational risk controls already cover AI lifecycle risks, including selection, data governance, monitoring, human oversight, and cyber/ICT exposures.
Institutions may wish to test whether AI governance is proportionate by business size and complexity, especially where lower-risk use cases could justify lighter controls.
Board and senior management teams should consider whether roles, responsibilities, and escalation paths for AI are clearly defined and documented.
Firms may wish to maintain a current inventory of AI systems and vendors so they can evidence oversight, dependency management, and remediation decisions if the final report adopts similar sound practices.
Compliance teams should monitor the final FSB report later in 2026 and compare any finalized practices against current internal policies, third-party controls, and incident response arrangements.
What changed
This publication does not impose new binding rules; it is an opening remark supporting the FSB’s June 2026 consultation report on Sound Practices for Responsible Adoption of Artificial Intelligence. The speaker says the report is intended to be finalized later in 2026 as a U.S. G20 deliverable, and that feedback from the public comment process will shape the final text.
Compliance impact
The current publication is consultative and non-binding, so immediate legal impact is limited. The practical consequence is preparatory pressure: firms that use AI should expect a future FSB final report to reinforce risk-based governance, proportionality, and stronger controls for materially important AI deployments.
The FSB hosted a virtual outreach event on 7 July 2026.
Why this matters
This is an announcement of a virtual outreach event supporting an FSB consultation on responsible AI adoption. The underlying consultation report (published 10 June 2026) is substantive policy guidance on AI governance and risk management for financial institutions.
Digital innovation is transforming finance, potentially enabling greater competition and efficiency in payment systems and financial intermediation. However, it also poses new macro-financial challenges and raises the broader question of how to preserve trust in money in the digital age.
Why this matters
This is a BIS media release accompanying a special chapter of the Annual Economic Report 2026. It articulates high-level policy direction on stablecoins and tokenisation, identifies structural weaknesses in current stablecoin designs, and calls for coordinated global regulatory efforts on two fronts: near-term...
The Basel Committee on Banking Supervision today published a range of practices report on information and communication technology (ICT) risk management. ICT is a key component of operational risk management, playing a vital role in supporting the broader goal of achieving operational resilience.
Why this matters
This is a Basel Committee publication of a range of practices report (not binding rules, but authoritative guidance) addressing ICT risk management as a component of operational resilience. The content is informational/guidance-focused rather than a consultation or final rule, and targets banks specifically.
Basel Committee publishes report on information and communication technology risk management.
Why this matters
This is a published report from the Basel Committee on Banking Supervision (BCBS) analyzing ICT risk management practices across jurisdictions. The content explicitly addresses operational resilience and ICT/cyber risk in banking.
The Basel Committee has published a report describing a range of observed information and communication technology (ICT) risk management practices across jurisdictions to address non-malicious ICT incidents.
Why this matters
This is a media release announcing publication of a Basel Committee range of practices report on ICT risk management. The report documents observed practices across jurisdictions and is intended as a reference for banks and supervisory authorities.
The Project Agorá prototype demonstrates how tokenisation and programmable technologies can address long-standing inefficiencies in wholesale cross-border payments at scale, while preserving the safety and integrity of settlement in central bank reserves.
Why this matters
This is a press release and research report from the BIS announcing Project Agorá findings on tokenisation for wholesale payments. It is informational and exploratory in nature (explicitly noted as experimental), not a binding obligation or final rule.
The Project Agorá prototype demonstrates how tokenisation and programmable technologies can address long-standing inefficiencies in wholesale cross-border payments at scale, while preserving the safety and integrity of settlement in central bank reserves.
Why this matters
The content is a media release and research report from the BIS Innovation Hub detailing Project Agorá's exploratory findings on tokenised wholesale cross-border payments.
Agrees to publish range of practices report on information and communication technology risk management. Progresses its targeted review of the prudential standard for banks' cryptoasset exposures. Considers targeted updates of its principles on liquidity risk.
Why this matters
This is a Basel Committee press release documenting meeting outcomes and regulatory work in progress. The Committee approved publication of an ICT risk management practices report (addressing operational resilience), is progressing a targeted review of cryptoasset prudential standards, and is considering updates to...
Agrees to publish range of practices report on information and communication technology risk management. Progresses its targeted review of the prudential standard for banks' cryptoasset exposures. Considers targeted updates of its principles on liquidity risk.
Why this matters
This is a media release documenting Basel Committee meeting outcomes. The content supports three primary regulatory initiatives: (1) publication of ICT risk management practices report addressing operational resilience, (2) ongoing targeted review of cryptoasset prudential standards with updates promised later in...
As part of its 2025-2026 work programme, the Basel Committee is advancing various supervisory initiatives related to the digitalisation of finance.
AI Analysis
The Basel Committee has published its Principles for the sound management of third-party risk, setting a common baseline for banks and supervisors as firms become more dependent on third-party service providers. The publication matters because it broadens the supervisory lens beyond traditional outsourcing to a wider range of third-party arrangements, with implications for governance, due diligence, contracts, monitoring, and exit planning.
Key dates
2025-12-10
Basel Committee publication date for the Principles for the sound management of third-party risk
Suggested considerations
Compliance teams may wish to map all third-party arrangements against the new lifecycle expectations, including non-traditional outsourcing and intra-group or technology-enabled arrangements.
Firms should consider whether board-approved third-party risk appetite, tolerance for disruption, and reporting lines are documented clearly and align with current governance arrangements.
Banks may wish to review due diligence, contracting, onboarding, monitoring, continuity, and exit procedures to confirm they address the principle-based expectations across the full relationship lifecycle.
Supervisory liaison teams may wish to assess whether concentration risk, critical provider dependencies, and cross-border coordination issues are adequately captured in existing risk registers and escalation frameworks.
What changed
The document sets out 12 principles covering the full third-party service provider lifecycle, divided between bank-facing expectations and supervisor-facing expectations. For banks, the principles cover governance and strategy, board and senior management oversight, risk assessment, due diligence, legally binding contracts, onboarding, ongoing monitoring, business continuity, and termination/exit management.
Compliance impact
The publication is a material supervisory signal rather than a binding rule, but it raises the expected standard for how banks identify, manage, and oversee third-party dependencies. Institutions that rely heavily on external providers may face closer supervisory scrutiny of governance, resilience, and concentration risk, especially where critical services are involved.
The Basel Committee on Banking Supervision has issued a consultation on Machine-readable Pillar 3 disclosure. The consultation proposes to make the data disclosed by banks (so-called Pillar 3 disclosures) available in a machine-readable format.
AI Analysis
The Basel Committee issued a consultation proposing a standard for machine-readable Pillar 3 disclosures, aimed at making banks’ quantitative prudential disclosures easier to aggregate, process, and compare across jurisdictions. The proposal matters because it adds technical format requirements without changing the underlying disclosure content, signaling a move toward standardized supervisory data infrastructure.
Key dates
2025-12-05
Basel Committee publishes the consultation on machine-readable Pillar 3 disclosure
2026-03-05 Deadline
Deadline for comments on the consultative document
Suggested considerations
Compliance teams may wish to review current Pillar 3 disclosure production processes and determine whether quantitative disclosures can be generated in a machine-readable format.
Banks may wish to map any existing PDF-based Pillar 3 outputs against likely technical data structure requirements, including whether disclosures could be published on a website or via a central repository.
Supervisors and policy teams may wish to assess how local disclosure arrangements align with the proposed global standard and whether current formats already satisfy the envisaged approach.
Firms subject to overlapping regional disclosure regimes may wish to compare current machine-readable standards with the Basel Committee proposal to identify expected implementation gaps.
What changed
The consultation proposes a new standard for machine-readable quantitative Pillar 3 disclosures across Basel Committee member jurisdictions. It would introduce both a requirement and technical specifications for producing disclosures in a machine-readable format, while leaving the substantive disclosure obligations unchanged. The consultation also contemplates that national supervisors would choose whether disclosures are posted on banks’ own websites or in a central repository.
Compliance impact
The Basel Committee describes the issue as a practical transparency and data-usability problem, because many banks currently publish Pillar 3 information only in PDF format, making cross-bank comparison difficult. The proposal is not a new prudential capital requirement, but it could materially affect disclosure production, data governance, and supervisory reporting processes for affected banks.