FCA, BoE and Treasury issue joint statement on cyber resilience

The Financial Conduct Authority (FCA), Bank of England (BoE) and Treasury have issued a joint statement on frontier artificial intelligence (AI) models and cyber resilience.

With AI continuing to evolve rapidly, the bodies noted that frontier AI models represented a ‘step-change’ in capability, with “significant implications” for cyber security and operational resilience.

Frontier AI models’ cyber capabilities were found to be already exceeding what a skilled practitioner could achieve, at a higher speed, greater scale, and lower cost.

If used maliciously, these capabilities amplified cyber threats to firms’ safety, alongside their customers, market integrity, and financial stability, the statement warned.

These risks were expected to increase as more advanced models became available, and firms that were underinvested in core cyber security fundamentals were told they were likely to become progressively more exposed.

The statement said it was essential for firms to have effective protective, detective, threat containment, and cyber response capabilities, including those that would tackle faster and more disruptive frontier AI-driven attacks.

“In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures need to take action to plan for and mitigate cybersecurity risks posed by frontier AI,” the FCA stated.

“The government and UK financial authorities judge that firms should be taking active steps across several domains.”

These domains included governance and strategy; the identification and risk management of vulnerabilities; managing risks from third parties; protection; and response and recovery.

“The government and UK financial authorities will continue to actively monitor frontier AI developments and engage with industry through the Cross Market Operational Resilience Group,” the statement concluded.

---