meta_id 3239381

On May 22, 2026, the Financial Services Agency (FSA) and Bank of Japan (BOJ) jointly issued a request to financial institutions regarding short-term measures in response to changes in the threat posed by frontier artificial intelligence (AI). The request addresses the evolving risks associated with frontier AI technologies and establishes guidance for financial institutions to implement protective measures. Frontier AI. The Financial Services Agency directed financial institutions to implement the following nine short-term measures, with the direct involvement of senior management including chief executive officers, chief information officers, and chief information security officers, within a general timeframe of approximately one month: Management prioritisation: Top executives must treat frontier artificial intelligence threats as a company-wide priority, ensuring close coordination across business, risk management, information technology, cybersecurity, and finance functions, with senior management directly involved in formulating response strategies and monitoring implementation. Identification of priority services and systems: Financial institutions must adopt a risk-based approach to identify priority services and information technology systems, allocating resources in a focused manner. Externally accessible systems supporting critical services such as internet banking must be prioritised, with roles and responsibilities between users and service providers clearly defined. Resolution of technical debt: Financial institutions must review software and network configurations for identified priority systems, reduce technical debt by closing unnecessary network ports, removing redundant privileged accounts, applying outstanding patches, and upgrading systems running on end-of-support products. Securing patching personnel: Financial institutions must review project plans and consider allocating additional personnel including from other information technology teams, and must confirm that vendors responsible for patching have secured sufficient capacity to handle an increasing volume of vulnerabilities, including for triage activities conducted jointly with vendors. Verification of vendor maintenance contracts: Financial institutions must confirm that patching activities are covered under existing maintenance contracts with clearly defined roles and responsibilities, that contracts permit timely patching including during nights and holidays, and that vendors can meet service level agreements and service level objectives even where vulnerabilities arise simultaneously across multiple institutions. Contingency processes for prioritisation and risk acceptance in the event of vendor resource constraints must be established. Risk-based approach to patching: Financial institutions must assess the potential impact of vulnerabilities on their own services and systems, including the likelihood of exploitation, and prioritise remediation accordingly. The Agency noted that even low-scoring vulnerabilities are increasingly being exploited and that exploit code may emerge immediately after vulnerability or patch disclosure. Strengthening defences beyond patching: Where patching is difficult or timelines cannot be shortened, financial institutions must strengthen multi-layered defences including virtual patching through cloud-based web application firewalls, bot mitigation measures, network segmentation, multi-factor authentication for privileged accounts, and endpoint detection and response capabilities. Preparation for service disruption: Top executives must plan for scenarios in which priority services and systems are disrupted by cyberattacks, assess the effectiveness of business continuity plans and emergency communication frameworks, and establish internal criteria and procedures for the proactive suspension of services in the event of heightened cyber risk, including for systems operated under joint arrangements or provided by cloud service providers. Maintaining external collaboration: Financial institutions must actively collect information from sources including Financials ISAC Japan, industry groups, and regulatory authorities, and share practices within mutual-assistance communities to contribute to the resilience of the financial sector as a whole.