New Zealand regulators put AI supplier risk into financial firms’ cyber planning

New Zealand’s financial regulators have asked firms to account for AI-related risks inside their suppliers as well as their own operations. Supervisory expectations outlined on 15 October connect cyber controls, management accountability and provider concentration, with disruption at shared AI or cloud services capable of affecting several institutions together.[1]

The RBNZ and FMA urge faster vulnerability remediation while recognising that accelerated patching can itself cause incidents. They also question whether manual monitoring remains adequate against faster attacks. For supplier relationships, they emphasise timely notification of material changes, vulnerabilities and incidents, with responsibilities clearly allocated between the provider and regulated firm.[1]

Boards should understand where AI is used and who owns the resulting risks. Response exercises should test severe but plausible attacks, model failures and supplier outages. These expectations build on existing obligations and keep accountability with the financial institution.[1]

The relevance to brokers is supported by the FMA’s April 2026 report on derivatives issuers. Its voluntary survey, conducted in 2025, found that some respondents reviewed outsourcing only at contract renewal and some continuity plans omitted outsourced arrangements. Other respondents lacked continuous anomaly monitoring or collected information with a material delay. The findings were self-reported and not independently verified.[2]

The same survey reported widespread reliance on customised critical technology, with most respondents saying replacement would be moderately or very difficult. That matters when assessing a fallback: identifying an alternative supplier is only the beginning if the systems needed to use it cannot be substituted quickly.[2]

The FMA’s standing operational-resilience guidance explains that most market-services licensees have a licence condition requiring notification of material incidents affecting critical systems or customers. It recommends reviewing outsourced services according to their importance, testing continuity arrangements and documenting lessons after incidents. Derivatives issuers have been subject to the relevant technology and business-continuity licence condition since July 2024.[3]

For an online brokerage, the practical implication is to connect supplier oversight with the service customers need during a disruption. An outage exercise should establish who can restore account access, communicate with clients and operate agreed fallback processes. A supplier’s contractual assurance becomes useful when those dependencies have been tested.[3]

Report an error or submit an update