Good Practices in Cyber Risk Regulation and Supervision
Departmental Papers, January 5, 2026
Source details
- Canonical URL
- Good Practices in Cyber Risk Regulation and Supervision
Other formats
Bibliographic details
- Authors: Tamas Gaidosch, Emran Islam, Tanai Khiaonarong, Rangachary Ravikumar, Christopher Wilson
- Published: January 5, 2026
- Series: Departmental Papers
- DOI: https://doi.org/10.5089/9798229026185.087
Overview
- Synthesizes global experiences and key lessons in the regulation and supervision of cyber risk in the financial sector, drawing on the IMF’s financial stability surveillance and technical assistance work.
- Underscores the increasing frequency and complexity of cyber threats and the systemic risk posed as financial institutions and market infrastructures become more reliant on digital technologies.
- Seeks to support authorities worldwide in enhancing cyber resilience, promoting financial stability, and preserving the integrity of the digital financial ecosystem.
Key findings
- Cyber threats are increasing in frequency and complexity and present systemic risk to the financial sector.
- Effective frameworks should be:
- Proportionate and outcome-oriented.
- Adaptable to the maturity of individual institutions.
- Ongoing supervisory visibility and capacity development are essential.
Established good practices (policy and supervisory priorities)
- Ensure frameworks address information and communication technology and comprehensive cyber risk management.
- Establish clear governance arrangements and rigorous risk management protocols.
- Conduct systematic testing and ensure robust oversight of third-party service providers.
- Apply good supervisory practices in supervision and oversight, including:
- Offsite and onsite supervision
- Thematic reviews
- Simulation exercises
- Develop strategies for sector-wide operational resilience.
- Adopt a calibrated approach blending principles-based and prescriptive regulation.
Recommendations for authorities
- Implement frameworks that explicitly cover ICT and holistic cyber risk management.
- Strengthen governance and internal risk-management arrangements within firms.
- Require and supervise systematic testing regimes and third-party oversight.
- Maintain ongoing supervisory visibility through a mix of supervisory tools and exercises.
- Invest in supervisory capacity development to sustain effective oversight.
Subjects and keywords
- Subjects: Cyber risk, Economic sectors, Financial sector, Financial sector policy and analysis, Financial sector stability, Technology
- Keywords: crisis exercise, cyber, cyber resilience, cyber risk, cyber risk oversight, cyber risk regulation, cyber risk supervision, cybersecurity testing, Financial sector, Financial sector stability, financial stability assessment program, financial system, fmi supervision, Global, good practices, oversight authorities, technical assistance