Financial Services Cyber Regulation Map: Banking, Payments and Insurance Rules by Region

A bank, insurer or payment firm operating in more than one country now meets a dense stack of cyber and operational resilience rules that overlap on substance but differ on scope, reporting clocks and evidence. DORA in the EU, the UK operational resilience and incident reporting rules, NYDFS Part 500 and SEC rules in the US, and supervisory standards from MAS, APRA, HKMA, RBI and SAMA all ask for governance, ICT risk management, incident reporting, testing and third-party oversight, each in its own vocabulary. This map summarises those instruments by region, shows where they align, and links to the NHI Mgmt Group guides that cover each one in depth instead of repeating them. It is written for CISOs, operational resilience leads, compliance teams and the technology suppliers that serve regulated firms. Status as of 25 October 2026: confirm dates against each regulator's own publication before acting on them.

Key takeaways

• Operational resilience is now the frame. DORA, the UK impact tolerance regime, APRA CPS 230 and HKMA's operational resilience work all ask whether critical services stay within tolerance, not only whether controls exist.
• Third-party oversight has gone direct. The EU designated its first critical ICT third-party providers on 18 November 2025, and the UK runs its own critical third parties regime, so cloud and technology suppliers are now supervised as well as their clients.
• Reporting clocks range from hours to days. MAS expects notification within an hour of discovery for relevant incidents, NYDFS within 72 hours, SEC registrants disclose material incidents within four business days, and the new UK rules start on 18 March 2027.
• Testing is prescribed, not optional. DORA threat-led penetration testing, RBI half-yearly DR drills and six-monthly vulnerability assessments, and HKMA iCAST all set testing cadences that auditors will check.
• Machine identities sit at the centre. API keys, service accounts, OAuth integrations and AI agents are the access paths regulators ask about in privileged access, third-party and incident evidence reviews.

Regulations and frameworks at a glance

For a cross-sector view, see the Global Cybersecurity Regulatory Map. Financial market infrastructures that are also designated as critical infrastructure should read this page with the Critical Infrastructure Regulation Map.

Scope: who and what is covered

European Union and United Kingdom

• DORA: Banks, investment firms, payment and e-money institutions, crypto-asset service providers, insurers, trading venues, central counterparties and others, with proportionality for smaller firms. DORA is the sector-specific act for these firms, so it takes precedence over NIS2 on ICT risk. See the DORA and NIS2 Overlap Mapping Guide.
• Critical ICT third-party providers: The European Supervisory Authorities published the first list of designated CTPPs on 18 November 2025 and have moved to direct oversight engagement, assessing their risk management and governance.
• UK operational resilience: SS1/21 applies to UK banks, building societies, PRA-designated investment firms, Solvency II firms and the Society of Lloyd's and its managing agents, with parallel FCA rules. Firms identify important business services, set impact tolerances, map dependencies and test severe but plausible scenarios.
• UK incident and third party reporting: FCA PS26/2, published 18 March 2026 with a PRA and Bank of England counterpart, introduces standard and enhanced operational incident reports and requires named firm types to notify new or changed material third party arrangements and submit a register of them every year. The rules take effect on 18 March 2027.

United States

• NYDFS Part 500: Applies to DFS-licensed entities, with limited exemptions for small firms and higher duties for Class A companies. DFS issued industry letters on 21 May 2026 about a heightened threat environment and frontier AI model risks, and on 10 September 2026 about risk assessments.
• SEC: Public companies disclose material cybersecurity incidents on Form 8-K Item 1.05 and describe risk management and governance annually. The Regulation S-P amendments adopted on 16 May 2024 require broker-dealers, investment companies, registered advisers and transfer agents to run an incident response programme and notify affected individuals within 30 days, with larger entities given 18 months and smaller ones 24 months from publication to comply.
• Banking agencies: The FFIEC handbooks, interagency third-party guidance and the computer-security incident notification rule set expectations for banks. The FFIEC published a sunset statement for its Cybersecurity Assessment Tool in August 2024, pointing institutions to frameworks such as NIST CSF 2.0.

Asia Pacific and Middle East

• MAS (Singapore): The TRM Guidelines set expectations; legally binding notices set minimum requirements. Notice FSM-N06 on cyber hygiene, effective 10 May 2024 for banks, covers securing administrative accounts, security patching, baseline security standards, network security devices, anti-malware and strengthened user authentication.
• APRA (Australia): CPS 234 covers information security capability, controls, testing and notification. CPS 230 covers operational risk, critical operations, tolerance levels and material service providers; APRA's April 2026 update says the amended standard and guide commence on 1 July 2026, and pre-existing service contracts must comply by the earlier of renewal or 1 July 2026.
• HKMA (Hong Kong): CFI 2.0 combines C-RAF 2.0 (inherent risk and maturity assessment with iCAST intelligence-led testing, now including blue team requirements and cloud controls), a professional development programme and the Cyber Intelligence Sharing Platform.
• RBI (India): The 2023 Master Direction applies to commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions, with comply-or-explain for foreign bank branches.
• SAMA (Saudi Arabia): The Cyber Security Framework has four domains and a maturity scale from 0 (non-existent) to 5 (adaptive); member organisations should operate at level 3 or higher.

Key obligations

Hong Kong and Saudi Arabia use maturity-based frameworks (C-RAF 2.0 and the SAMA CSF) rather than prescriptive clocks for most controls; read them as target maturity levels set by the supervisor. Payment card and SWIFT obligations add specific controls on top of these: see the PCI DSS Readiness Checklist and the SWIFT Customer Security Programme (CSP) Guide.

Framework mapping

Timeline and current status

Enforcement and penalties

• EU: DORA penalties are set by Member States and imposed by national competent authorities; lead overseers can impose periodic penalty payments on CTPPs.
• UK: The PRA and FCA use their general enforcement powers, including fines and public censure, for operational resilience and outsourcing failures.
• US: NYDFS enforces Part 500 through consent orders and penalties; recent actions include a $2.25 million settlement with Delta Dental (30 April 2026) and a consent order with Order Express (August 2026). Banking regulators use civil money penalties: the OCC fined Capital One $80 million in August 2020 over cloud risk management after the Capital One breach, where a firewall's over-privileged cloud role exposed data on about 106 million people.
• Asia Pacific: MAS can issue directions and penalties for notice breaches; APRA uses capital overlays, enforceable undertakings and directions; RBI and HKMA apply supervisory measures and monetary penalties under their banking statutes.

What it means for AI agents and non-human identities

• Privileged access includes machines: NYDFS privileged access requirements, MAS administrative account controls and DORA access policies apply to service accounts and API keys that can move money or change systems, not only to administrators. See the Financial Services Identity Security Guide.
• Third-party registers should list integrations: OAuth apps, open banking connections and SaaS integrations holding tokens are ICT third-party arrangements. They belong in the DORA register of information and the UK material third party register where material. See the Third-Party Access Guide.
• AI risk is now in supervisory letters: NYDFS's May 2026 letter on frontier AI model risks shows supervisors expect AI-specific threat analysis. Agents with access to customer data or payment systems need owners, scoped credentials and audit trails good enough for a one hour or 72 hour report. See the AI Agent Audit Trails for Regulators Guide.
• Payments-specific identity: Strong customer authentication and payment fraud controls interact with these rules; see the PSD2/PSD3 Strong Customer Authentication Guide.

Compliance steps

1. Build the obligation register. For each licensed entity, list applicable instruments, supervisors, reporting clocks and testing cadences. Assign owners and review dates. The Regulatory Change Management Guide covers the process.
2. Define critical services once. Align DORA critical or important functions, UK important business services and APRA critical operations into one service catalogue with tolerances, then map people, technology, data, suppliers and identities to each service.
3. Unify incident classification. Build one severity model and a jurisdiction matrix of clocks (one hour MAS, 24 hours NYDFS extortion payment, 72 hours NYDFS and APRA, four business days SEC materiality, DORA staged reports). Exercise it with a scenario affecting several entities.
4. Consolidate third-party data. One supplier inventory feeding the DORA register, the UK register and CPS 230 material service provider lists, including machine integrations and the credentials they hold. See the Third-Party Concentration Risk Guide.
5. Harden access first. MFA for everyone, privileged access management for administrators and service accounts, short-lived credentials for integrations, and quarterly reviews of machine access.
6. Plan testing. Combine TLPT, CBEST, iCAST and annual penetration tests into one programme where regulators accept mutual recognition; see the Threat-Led Penetration Testing Guide. Keep a rollback plan for any control change tested in production.
7. Evidence continuously. Automate collection of access reviews, patch status and incident logs so annual certifications (NYDFS) and attestations (SWIFT, PCI DSS) draw on the same evidence.

Measuring progress

• Tolerance tests passed: share of important business services tested within tolerance in the last year.
• Reporting speed: detection to first regulatory notification in exercises, against the shortest clock.
• Register completeness: percentage of ICT suppliers and integrations recorded with owner, criticality and credentials.
• Machine access hygiene: service accounts and API keys without an owner or past rotation date (target zero).
• Finding closure: median days to close high-severity test findings.

Common failure patterns

• Parallel programmes: separate DORA, UK and APRA projects that build three service catalogues and three supplier registers.
• Human-only access reviews: certifications that skip service accounts and API keys, the access paths behind incidents such as Capital One.
• Clock confusion: legal and security teams disagreeing on when the clock starts (discovery, determination, classification).
• Integrations missing from registers: OAuth and API connections treated as configuration rather than third-party arrangements.
• Stale maturity claims: self-assessments under C-RAF or the SAMA CSF not refreshed after major change.

Practitioner checklist

• Keep a dated obligation register per entity with each regulator, clock and testing cadence.
• Prepare for the UK reporting rules taking effect on 18 March 2027.
• Confirm CPS 230 material service provider contracts meet the 1 July 2026 requirement.
• Check whether any of your ICT suppliers are designated EU CTPPs and adjust exit and concentration plans.
• Extend access reviews and privileged access controls to service accounts, API keys and AI agents.
• Record OAuth and API integrations in third-party registers.
• Test the multi-jurisdiction incident clock matrix at least once a year.
• Read new supervisory letters (for example NYDFS on AI risk) into the risk assessment.

Standards and references

• ESMA: European Supervisory Authorities designate critical ICT third-party providers
• FCA: PS26/2 Operational incident and third party reporting
• Bank of England PRA: SS1/21 Operational resilience, impact tolerances for important business services
• New York DFS: Cybersecurity Resource Center
• SEC: Amendments to Regulation S-P
• APRA: Operational risk management (CPS 230)
• MAS: Notice FSM-N06 Cyber Hygiene
• RBI: Information Technology Governance, Risk, Controls and Assurance Practices Directions, 2023

This guide summarises financial services cyber regulation for security practitioners and is not legal advice; confirm obligations with your legal and compliance teams and the primary texts. Related NHI Mgmt Group resources: Global Cybersecurity Regulatory Map · Financial Services Identity Security Guide · Identity Security Regulatory Map · Third-Party Risk Management Guide