pc
nid 92490
May 13, 2026
tojuri@vixio.com
Finland
Financial Supervisory Authority
horizon scanning
124% of draft length
draft in Generated
Generated
1910 charsFinland's Financial Supervisory Authority Addresses Advanced Artificial Intelligence Models and Cybersecurity Threats in Financial Institutions
On May 12, 2026, the Financial Supervisory Authority (FSA) of Finland issued guidance addressing the evolving cybersecurity landscape created by advanced artificial intelligence models in the financial sector.
The FSA highlighted significant developments in AI capabilities, particularly large language models' ability to identify and exploit software vulnerabilities in complex information systems. The authority referenced Anthropic's Claude Mythos model, released in early April 2026, which demonstrates exceptional capability in detecting and automatically generating code to exploit software vulnerabilities across operating systems, browsers, open-source libraries, and both proprietary and third-party software. The FSA noted that the convergence of vulnerability detection and exploitation within a single model represents a potentially broader shift in the cybersecurity threat environment, with the timeframe for detecting and exploiting cyber threats significantly shortening.
In response, the FSA emphasised the importance of robust information and communications technology (ICT) risk management under the Digital Operational Resilience Act (2022/2554, DORA). The authority identified five key focus areas for financial institutions: software quality and secure development practices; vulnerability identification and classification mechanisms; ICT change management and update processes; multi-layered defensive controls; and third-party risk management to ensure partners meet DORA requirements.
Financial institutions must report significant ICT-related incidents to the FSA without delay and notify the authority of other material information affecting the financial system or customers. The FSA will monitor developments in collaboration with the European Central Bank, European DORA supervision authorities, and domestic agencies, and stands ready to take supervisory action as necessary.
Agent draft
Not run yet.
Published
2377 charsFinland's Financial Supervisory Authority Addresses Advanced Artificial Intelligence Models and Cybersecurity Threats in Financial Institutions
On May 12, 2026, the Finnish Financial Supervisory Authority (FIN-FSA) issued a notice addressing the evolving cybersecurity landscape created by advanced artificial intelligence models in the financial sector.
The FIN-FSA highlighted significant developments in AI capabilities, particularly the ability of large language models to identify and exploit software vulnerabilities in complex information systems.
In response, the FSA emphasised the importance of robust ICT risk management under the Digital Operational Resilience Act ( Regulation (EU) 2022/2554 - DORA). The authority identified five key focus areas for financial institutions:
Software quality and secure development - financial institutions should emphasise vulnerability prevention throughout the software design and development process.
Vulnerability identification - financial institutions must have mechanisms to identify and classify vulnerabilities in information system environments, even after the design and development phases, during service production.
ICT change management and update processes - accelerating the discovery of vulnerabilities requires financial institutions to keep their change management and update processes up to the level required by the changing operating environment.
Security - financial institutions must ensure that key security and management measures are consistently in place. They must also strengthen their defences across multiple layers, including enhanced monitoring, network traffic monitoring, network segmentation and other advanced security solutions.
Third-party risk management - financial institutions must also take ICT risks into account when working with partners and outsourcing providers, and ensure that partners' procedures comply with DORA requirements, especially when the services they provide support critical functions of financial institutions.
The FIN-FSA expects supervised entities to integrate the implications of emerging AI-driven cyber threats into their risk profiles and preparedness strategies. Under regulatory requirements, financial institutions are mandated to report widespread ICT-related incidents to the FIN-FSA immediately upon occurrence. Furthermore, the FIN-FSA encourages institutions to report any additional information deemed significant for the stability of the financial system, service users or customers.