Risk Radar for October 2026

Banks Advised to Strengthen Defences Against AI-Driven Cyber Threats

A high-level meeting involving Union Finance Minister Nirmala Sitharaman, Electronics and Information Technology Minister Ashwini Vaishnaw and scheduled commercial banks highlighted the growing risks arising from the misuse of artificial intelligence (AI) in cyberattacks targeting the banking sector.

The discussion focused on the potential use of AI to exploit software vulnerabilities and create more sophisticated cyber threats. Banks were advised to strengthen cybersecurity frameworks by engaging specialised professionals and agencies to improve threat detection and response capabilities.

AI can increase the speed and complexity of cyberattacks by enabling attackers to analyse systems, identify weaknesses and automate malicious activities. For banks, this creates significant operational risk due to their dependence on interconnected digital platforms, payment systems and large volumes of sensitive customer information.

The developments underline the need for banks to adopt proactive cyber resilience strategies, including continuous monitoring, vulnerability assessment, incident response planning and stronger technology governance.

AI-Based Customs Risk Management Enhances Trade Compliance

Artificial intelligence is increasingly being adopted in customs and trade risk management to improve compliance monitoring, detect potential violations and strengthen efficiency in cross-border trade operations.

Customs authorities manage large volumes of import and export transactions, documentation and regulatory requirements. Traditional risk assessment approaches based largely on manual reviews and historical data may face limitations in identifying emerging risks.

AI-powered systems can analyse extensive datasets, including transaction records, shipping information and compliance histories, to identify unusual patterns and potential areas of concern. These tools can improve targeting capabilities by helping authorities focus on high-risk shipments while allowing legitimate trade activities to move more efficiently.

For businesses, AI-enabled compliance solutions can support accurate documentation, regulatory monitoring and reduction of compliance-related risks. However, effective implementation requires strong governance around data quality, algorithm transparency, cybersecurity and accountability.

Human oversight remains essential, particularly where AI-based assessments influence enforcement actions. Strong data protection measures and access controls are also necessary as customs systems handle sensitive commercial information.

Security Awareness Strengthens Cyber Resilience

Cybersecurity resilience increasingly depends not only on technology solutions but also on employee awareness and behaviour. Building a strong security culture can help organisations reduce cyber risks and improve their ability to respond effectively to threats.

As cyberattacks become more sophisticated, employees have become an important part of an organisation’s defence framework. Awareness programmes help individuals identify threats, follow secure practices and contribute to overall risk reduction.

Human behaviour remains a significant factor in cybersecurity incidents, with phishing attacks, social engineering and credential theft often exploiting employee actions rather than only technical weaknesses.

Regular security awareness training helps employees recognise suspicious emails, unsafe links, unusual requests and potential data security incidents. For insurance companies and financial institutions, such awareness is especially important due to the sensitive customer and financial information they handle.

Technology controls such as encryption, firewalls and monitoring systems remain essential, but they cannot completely eliminate risks arising from human error. Continuous learning, simulated exercises and leadership involvement are critical to developing a security-focused culture.

ISO 31000 Supports Structured Risk Management Practices

The adoption of ISO 31000 risk management principles is gaining importance as organisations focus on building structured and proactive approaches to managing uncertainty.

The framework provides guidance for identifying, assessing, treating and monitoring risks while integrating risk management into strategic and operational decision-making.

Modern organisations face interconnected risks including cybersecurity threats, regulatory changes, supply chain disruptions, climate-related challenges and technology uncertainties. ISO 31000 helps organisations develop a common approach to address these risks while improving resilience and long-term value creation.

A key principle of the framework is embedding risk management into organisational culture rather than treating it only as a compliance function. Effective implementation requires collaboration between business teams, risk professionals, compliance departments and senior leadership.

Financial institutions, including banks and insurance companies, can benefit from structured risk approaches by strengthening governance, improving internal controls and enhancing operational resilience.

DORA Strengthens ICT Vendor Risk Management Requirements

The European Union’s Digital Operational Resilience Act (DORA) is increasing regulatory expectations around third-party and information and communication technology (ICT) vendor risk management for financial institutions.

The regulation reflects a shift in how technology dependency risks are managed, making vendor oversight a formal governance and compliance responsibility rather than only an internal policy matter.

Financial institutions increasingly depend on cloud providers, software companies, data centres and cybersecurity service providers. Any disruption or security incident affecting critical technology providers can create significant operational risks across multiple organisations.

Under DORA, financial entities need structured processes to identify, assess and manage ICT third-party risks. This includes understanding technology dependencies, establishing contractual safeguards and maintaining continuous oversight throughout vendor relationships.

Contracts with technology providers need clear provisions covering security responsibilities, incident reporting, access controls and risk management expectations.

India’s Digital Growth Requires Stronger Risk Management Infrastructure

India’s digital transformation has created one of the world’s largest technology-driven financial ecosystems, but sustaining this growth requires stronger risk management frameworks to address cybersecurity, data protection, operational resilience and technology governance challenges.

The expansion of digital payments, online services, cloud platforms and data-driven solutions has improved access and efficiency while also increasing exposure to cyber threats, system failures and operational disruptions.

Cybersecurity has become a critical priority as financial institutions, government platforms and businesses manage growing volumes of sensitive information. Strong security frameworks, continuous monitoring and effective incident response mechanisms are essential to protect digital infrastructure.

Operational resilience is also gaining importance as organisations become increasingly dependent on technology. Business continuity plans, disaster recovery capabilities and disruption management processes are required to maintain critical services.

Data governance has emerged as another important area, particularly with the growing use of artificial intelligence and analytics. Organisations need controls around data quality, security, responsible usage and AI model management.

AI Model Risk Assessment Requires Evaluation Beyond Country of Origin

The country where an artificial intelligence (AI) model is developed provides limited understanding of its actual risk profile, highlighting the need for stronger AI governance, transparency and comprehensive model evaluation frameworks.

As AI systems become increasingly embedded across financial services, customer support, cybersecurity, risk assessment and decision-making processes, organisations need deeper assessment approaches beyond geographical origin or developer background.

AI model risks are influenced by multiple factors, including training data quality, model architecture, testing methodology, deployment environment and governance practices. These elements play a greater role in determining reliability, security and operational impact.

For financial institutions and enterprises, effective AI risk management requires evaluation of accuracy, explainability, security controls and compliance with internal policies. AI applications in areas such as credit decisions, fraud detection, underwriting and claims assessment can directly impact customers and business outcomes.

Poorly governed AI systems may create risks including inaccurate predictions, biased results, security vulnerabilities and lack of transparency. Organisations therefore need clear accountability structures, regular model validation, performance monitoring and human oversight for high-impact decisions.

UAE Develops Fraud Risk Management Capabilities

The Central Bank of the United Arab Emirates (CBUAE) and Mastercard have completed a capability-building programme focused on strengthening expertise in fraud risk management. The initiative highlights the growing importance of specialised skills as financial institutions face increasingly sophisticated fraud and financial crime risks.

While technology solutions such as artificial intelligence, analytics and digital monitoring tools are improving fraud detection, skilled professionals remain essential to interpret risk indicators, investigate suspicious activities and design effective controls.

The growth of digital payments, online banking and technology-enabled financial products has increased convenience while also creating new opportunities for fraudsters. Financial institutions need strong frameworks covering vulnerability identification, transaction monitoring, investigation processes and continuous improvement of controls.

Artificial intelligence can support fraud prevention by analysing large transaction volumes and identifying unusual patterns. However, effective governance remains necessary to manage challenges related to false positives, data quality and model risks.

Capability development and professional training will remain important as financial organisations strengthen their ability to respond to evolving fraud patterns.

FinReg Highlights Importance of Data Quality Before Expanding RegTech Investments

Financial institutions should strengthen data quality and governance frameworks before making significant investments in additional regulatory technology (RegTech) solutions, according to industry experts.

The recommendation highlights a key challenge in modern compliance management: advanced technology platforms can only deliver effective results when supported by accurate, consistent and well-governed data.

Banks are increasingly adopting RegTech solutions for regulatory reporting, compliance monitoring, risk assessment and fraud detection. However, fragmented systems, inconsistent data definitions and inaccurate customer information can limit the effectiveness of these technologies.

Strong data governance is therefore becoming a foundation for successful RegTech adoption. Financial institutions need clear ownership structures, standardised processes, quality controls and integrated data platforms to improve information reliability.

The importance of data quality has increased further with the adoption of artificial intelligence and analytics-based compliance tools. Poor-quality data can result in inaccurate risk identification and ineffective compliance decisions.

For banks, improving data architecture and governance should be treated as a strategic priority to maximise the benefits of regulatory technology investments.