https://itol.app/news Operational-resilience news for banking and financial services — regulators, standard setters, FMIs, and the recognized press, pressed into a fresh edition many times a day. Edition 2026–239–1640. en Thu, 27 Aug 2026 16:40:15 GMT 60 ITOL. press run (script/fetch-news.mjs) https://www.eba.europa.eu/publications-and-media/press-releases/eba-consults-draft-technical-standards-institutions-operational-risk-management eba-47b9a51a Wed, 26 Aug 2026 08:37:24 GMT European Banking Authority policy ​The European Banking Authority (EBA) today launched a public consultation on draft Regulatory Technical Standards (RTS) specifying the operational risk management framework that institutions must have in place as per Article 323 of the Capital Requirements… AI précis: The draft RTS cover three components — governance, the operational risk management process, and the assessment system — with proportionality relief for institutions with a business indicator below EUR 750 million; ICT risk stays under DORA. Comments are due 31 December 2026, with a virtual public hearing on 29 September 2026. https://gfmag.com/technology/cybersecurity-data-sharing-faces-liability-deadline/ gfmag-b5fafc63 Fri, 21 Aug 2026 10:34:00 GMT Global Finance cyber With CISA protections expiring Sept. 30, businesses face new liability risks. CFOs must weigh alternatives for cybersecurity data sharing. AI précis: CISA 2015's liability shield lapses September 30, 2026; the House has folded an extension into the 2027 NDAA, still awaiting the Senate. A DHS inspector-general report found AIS participation fell from 304 non-federal users to under 90, while the administration has launched an AI-powered alternative clearinghouse called "Gold Eagle." Lawyers warn shared data could reach regulators, litigants, and insurers. https://qa-financial.com/banks-reveal-key-dora-resilience-gaps/ qaf-52060f3f Fri, 21 Aug 2026 07:08:18 GMT QA Financial continuity AI précis: A Zanders study of 23 banks finds strong compliance with DORA's foundations but weak embedding: fewer than half had a board-approved ICT risk-appetite statement, only 12 addressed concentration and interconnectedness risks, advanced testing such as threat-led penetration testing remains limited, and only 16 said continuity plans cover all critical functions. https://www.nytimes.com/2026/08/18/magazine/national-blackout-power-electricity-outage.html pin-nyt-blackout-2026-08 Tue, 18 Aug 2026 13:20:38 GMT The New York Times continuity third-party The power grid relies on thousands of aging, hand-built transformers. If enough fail, the blackout could last years. https://www.consumerfinancemonitor.com/2026/08/17/fdic-considers-industry-standard-setting-organization-for-third-party-service-providers/ cfmon-de39fe84 Mon, 17 Aug 2026 19:24:05 GMT Consumer Finance Monitor third-party AI précis: Per a Bloomberg Law report, the FDIC is circulating a term sheet for a Banking Industry Standards Development Organization (BISDO) that would set standards and certify third-party service providers to banks, with scope extending well beyond fintech partnerships. Compliance would not be a regulatory safe harbor, and governance, funding, and participation questions remain open. https://www.bankofengland.co.uk/working-paper/2026/outsourcing-and-competition-in-the-banking-sector-the-rise-of-csps boe-7100d5be Fri, 14 Aug 2026 13:00:00 GMT Bank of England third-party Staff working papers set out research in progress by our staff, with the aim of encouraging comments and debate. AI précis: Using proprietary bank-provider contract data, BoE researchers find cloud spending is associated with lower operating costs and higher deposits, with demand-side benefits largest for small and medium banks. A counterfactual restricting cloud outsourcing implies higher market concentration and lower depositor welfare; lower capital requirements would cut cloud investment, offsetting about 32% of their welfare gain. https://www.govinfosecurity.com/critical-infrastructure-needs-unified-cyber-defense-a-32545 gvis-b389b824 Thu, 13 Aug 2026 17:00:00 GMT GovInfoSecurity cyber Critical infrastructure cyberattacks increasingly cross sector boundaries, exposing weaknesses created by siloed defenses. Alliance for Critical Infrastructure's ... https://telecomreseller.com/2026/08/13/ai-complicates-resilience/ pin-tcr-ai-resilience-2026-08 Thu, 13 Aug 2026 12:00:00 GMT Telecom Reseller / Technology Reseller News third-party continuity AI adds another layer of dependencies to an already complicated business environment. If an AI-dependent system behind critical customer service goes offline, the consequences turn serious. The piece's answer: map the dependency chain, hold multiple contingencies, and actually test them. https://www.moneycontrol.com/news/business/why-jamie-dimon-is-calling-ceos-across-corporate-america-about-ai-13995858.html moneycontr-3792f35b Wed, 05 Aug 2026 18:37:00 GMT Moneycontrol policy The JPMorgan CEO has approached banks, technology firms and critical-infrastructure operators as the ACI seeks to develop safeguards with the Trump administration. AI précis: Dimon's outreach began in July and spans more than 40 companies; he is expanding the Alliance for Critical Infrastructure, a group JPMorgan helped found, with calls planned for August to discuss collaboration, according to two sources cited by Reuters. https://www.reuters.com/world/jpmorgan-ceo-dimon-leads-new-cross-industry-effort-tackle-ai-risks-2026-08-05/ pin-aci-reuters-2026-08 Wed, 05 Aug 2026 10:03:00 GMT Reuters cyber third-party Reuters exclusive: Dimon is urging corporate leaders to join a US-focused group on AI risk — an expansion of the Alliance for Critical Infrastructure, which JPMorgan helped found, spanning more than 40 firms across critical-infrastructure industries. https://www.cmorg.org.uk/artefact/dynamic-scenario-library-volume-20 pin-cmorg-dsl2-2026-08 Tue, 04 Aug 2026 12:00:00 GMT Cross Market Operational Resilience Group continuity cyber The DSL is designed to be a shared resource which contains a catalogue of categorised and individually described scenarios, constructed using a common design methodology. This is version 2.0 of the DSL, published July 2026, reflecting a series of interim updates to the original document. https://www.eba.europa.eu/publications-and-media/press-releases/eba-eiopa-and-esma-call-enhanced-governance-and-consistent-supervision-mitigate-ict-risks-frontier eba-56493de3 Fri, 31 Jul 2026 12:30:00 GMT European Banking Authority policy The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today published a statement calling for a cross-sectoral, risk-based and consistent supervisory approach to mitigate the ICT risks stemming from frontier AI models. AI précis: The statement stresses prevention, detection and management of cyber risks tied to frontier AI, says financial entities need robust governance and risk-management frameworks, and updates on DORA oversight activities for critical ICT third-party providers. The ESAs encourage firms and supervisors to use it as a basis for supervisory dialogue. https://www.bankofengland.co.uk/letter/2026/letter-from-the-governor-to-the-daily-mail boe-d0a7e708 Thu, 23 Jul 2026 16:00:00 GMT Bank of England cyber Letter from Governor Andrew Bailey to the Daily Mail on the subject of AI and cyber-attacks AI précis: Bank of England Governor Andrew Bailey wrote to the Daily Mail rejecting a claim that the Bank's cyber defences are unsophisticated. He says the real concern is frontier AI making cyber-attacks, outages and scams worse, and points to stress tests, penetration testing and international coordination on testing frontier AI models. https://content.govdelivery.com/accounts/USFDIC/bulletins/420cf8d fdic-79517541 Thu, 16 Jul 2026 18:20:46 GMT Federal Deposit Insurance Corporation policy PRESS RELEASE | JULY 16, 2026 Agencies Issue Joint Statement on Handling of Highly Sensitive Information During Bank Examinations WASHINGTON — The federal bank regulatory agencies today issued a joint statement describing enhanced security procedures for… AI précis: Federal bank regulators issued a joint statement on enhanced security procedures for handling highly sensitive information during examinations, such as reviewing materials on-site rather than transferring them to agency systems. The agencies commit to notifying affected banks of any material breach of confidential supervisory information within 72 hours of discovery, absent legal restrictions. https://www.fsb.org/2026/07/exploring-cross-sectoral-interconnections-in-resolution-planning/ fsb-ca005049 Thu, 09 Jul 2026 08:04:47 GMT Financial Stability Board continuity In this speech, FSB Secretary General, John Schindler highlights the importance of resolve in resolution planning, emphasising collaboration, preparedness, in maintaining financial system resilience. AI précis: FSB Secretary General John Schindler, speaking at the FSB's ReSolve event, urged a cross-sectoral approach to resolution planning, bringing together working groups covering banks, financial market infrastructures, and insurers. He noted the FSB has launched a strategic review of its crisis preparedness activities, with cross-sectoral interconnections central to that review. https://www.reuters.com/business/media-telecom/telstra-outage-disrupts-australian-train-services-taxi-payments-2026-07-07/ reu-52f6cfa9 Wed, 08 Jul 2026 07:00:00 GMT Reuters continuity payments https://www.bankofengland.co.uk/financial-policy-committee-record/2026/july-2026 boe-81096b87 Tue, 07 Jul 2026 09:30:00 GMT Bank of England continuity policy Our Financial Policy Committee (FPC) meets to identify risks to financial stability and agree policy actions aimed at safeguarding the resilience of the UK financial system. AI précis: The Bank of England published the record of its Financial Policy Committee's 26 June 2026 meeting. The FPC judged that vulnerabilities in risky asset valuations, sovereign debt, and private credit remain and some have grown, noting increased equity-market leverage, market effects from the Middle East conflict, and rising cyber and operational-resilience risks from advances in frontier AI. https://www.ft.com/content/304cdbb9-c161-4e40-af4d-6df1d2ff5363?syn-25a6b1a6 ft-e702c18f Tue, 07 Jul 2026 07:00:00 GMT Financial Times cyber https://www.euronews.com/business/2026/07/07/ecb-tells-europes-biggest-banks-to-prepare-for-ai-powered-cyber-threats euronews-a8cabaec Tue, 07 Jul 2026 07:00:00 GMT Euronews cyber https://www.reuters.com/business/finance/ecbs-t2-payment-system-back-up-after-brief-incident-impacting-payments-2026-07-06/ reu-2f2209a5 Mon, 06 Jul 2026 07:00:00 GMT Reuters continuity payments https://www.crowdfundinsider.com/2026/07/289670-financial-entities-must-move-beyond-third-party-oversight-to-meet-eus-digital-operational-resilience-act-dora-requirements/ crowdfundi-f74fcdad Sun, 05 Jul 2026 04:12:00 GMT Crowdfund Insider third-party continuity UK Finance has shared a blog post authored by Craig Oliver, Third-Party Risk Management and Supplier Assurance Lead, PA Consulting and Karan Chao, Third Party Risk & Digital Trust Expert, PA ... AI précis: The authors argue DORA's direct ESA supervision of critical ICT providers makes resilience a shared responsibility, not an arm's-length contractual one, and firms stay fully accountable. They urge four steps: explain impact tolerances to key suppliers, align contracts and governance with the oversight regime, run joint multi-party resilience exercises, and help suppliers mature their own compliance. https://qa-financial.com/doras-first-incident-banking-data-gives-regulators-fresh-testing-playbook/ qaf-78e81d48 Thu, 02 Jul 2026 07:00:00 GMT QA Financial policy AI précis: The European Supervisory Authorities published the first annual overview of major DORA incident reports on June 3, calling ICT risks 'increasingly borderless and interconnected.' Consultants say 2025 was a transition year and 2026 marks DORA's first real enforcement test, with the ECB embedding its TIBER-EU framework as the model for mandatory threat-led penetration testing.