Financial regulators are telling banks they now operate in a sharply more dangerous geopolitical environment, and need to treat foreign interference and cyberattacks as core strategic threats. The prudential regulator has formally written to banks, insurers and super funds, setting out tougher expectations for how they protect the financial system from disinformation campaigns and insider attempts to steal sensitive data.
Institutions are being pushed to run more rigorous checks on senior staff and to treat geopolitics as a key risk in their governance and crisis planning. Directors are told to ensure their organisations can keep supporting the country through what is described as the most volatile global environment in decades.
Regulators emphasise that the responsibility extends beyond traditional cybersecurity into information integrity and internal controls across the sector. The letter highlights that insider threats and coordinated online disinformation can undermine trust in payments, markets and deposits just as severely as a technical outage.
Supervisory expectations now cover how boards assess geopolitical flashpoints, how management anticipates hostile state activity and how crisis playbooks handle large scale disruption. Banks are expected to harden vetting for senior roles where access to customer data, core systems or liquidity decisions creates outsized vulnerabilities.
Supervisors are also using public platforms to reinforce the message, rather than relying only on private correspondence. The prudential regulator’s chair and the central bank’s assistant governor delivered aligned speeches at an Australian Banking Association conference in Melbourne, underscoring the coordinated stance.
Leaders from major institutions, including the heads of ANZ and Westpac, were in the room as regulators described the new expectations.
