On 15 October 2026, the Reserve Bank of New Zealand and the Financial Markets Authority stood up at an industry roundtable. The Department of the Prime Minister and Cabinet and the National Cyber Security Centre joined them. Together they named three risks facing every regulated financial entity in the country: rising cyber risk, harder governance and oversight questions, and growing exposure to third parties and concentrated vendors. Then came the sentence that makes this worth a board's attention. The new expectations, the regulators said, "build upon existing prudential, conduct, cyber and operational resilience obligations." [1]
A regulator usually wants that sentence read as reassurance: nothing is changing. A board has to read it the other way. It already owes this, not starting Monday.
That is an uncomfortable thing for two regulators to say thirteen days before a general election, and it deserves more scrutiny than a press release usually gets. Part of what they are pointing to has bound entities for six years. Part of it has bound them for seven months. The piece that would turn the third named risk, exposure to third parties and concentrated vendors, into an actual enforceable standard is different. It does not bind anyone yet. It will not before 2027 at the earliest. Whether "nothing new" is true depends on which obligation a board is asked to point to.
The roundtable itself was a domestic event from start to finish. Two domestic regulators hosted it alongside two more government bodies, on home soil, discussing obligations created by New Zealand statute. The only international coverage was a syndicated republishing of New Zealand reporting. Nobody outside the country found it newsworthy. [1][2]
The Reserve Bank's own account of the roundtable said institutions should maintain cybersecurity strategies and frameworks that adequately address the threats they face. It said advances in artificial intelligence are changing the operating environment for financial institutions. Entities are responsible for having the systems and controls to manage the risk that follows. The Financial Markets Authority's account made the oversight point explicit. Boards and senior management need to know where artificial intelligence is used in their business. They must understand the risk it brings and be clear about who is accountable for managing it. [1]
Nothing in either statement names a new rule, a new form, or a new reporting line. That absence signals continuity. New Zealand's financial-sector cyber regulation has been under active construction for sixteen months, not sixteen days. The 15 October statement is one point inside a build already under way, not a new site breaking ground. A board that only reads the headline will miss that distinction, because the headline and the substance pull in different directions on purpose.
My Cyber Guide for New Zealand Boards gives directors a formula for exactly this kind of question, and I wrote it long before this specific statement existed. Fiduciary Risk Exposure multiplies the cost of remediation by the probability of a breach and adds the potential loss. It is built directly against section 137 of the Companies Act 1993 and its duty to enquire. The formula was never designed to answer whether a board has done enough work. It puts a number on the gap between asking and not asking, before a breach makes that gap visible in a much less forgiving way. A board that has never run the calculation cannot say where it sits on it. Reading the 15 October statement through that formula is my own extension of it, not a calculation either regulator performed. But the shape fits closely: a regulator naming a risk category is itself a form of enquiry a board can no longer say it never received.
So test the formula against what the statement actually invokes, obligation by obligation: they do not all carry the same weight.
Outsourcing control for the largest banks has been binding since April 2020. The Reserve Bank's Outsourcing Policy, known in the sector as BS11, requires registered banks with liabilities of ten billion dollars or more to keep the legal and practical ability to control and execute any function they outsource, cloud services included. That is so resolution and continuity of basic banking services survive a vendor failure. As at December 2023, the country's largest banks were reported compliant. [3] Six years of a real, enforceable outsourcing duty, not a principle, though it binds only the handful of banks that clear the ten-billion-dollar threshold, not the financial sector in general.
Cyber-specific guidance on third-party risk followed a year later, in April 2021. It says plainly that entities should be fully aware of the cyber risk a third party brings and act to manage it, reading the guidance alongside BS11 where BS11 applies. [4] But it is guidance, not a Banking Prudential Requirement, and that distinction matters more than it looks. A regulator can point to this document as proof the expectation existed, not as proof it was enforceable.
The clearest binding duty is also the newest. Material cyber incident reporting within 72 hours has applied to Reserve Bank regulated entities since 8 April 2024, alongside periodic reporting and an annual Cyber Capability Survey. It is enforced under existing statutory information gathering powers, with penalties of up to one million New Zealand dollars for non-compliance. [5] Eighteen months of a binding, financially consequential duty is about as far from "nothing new" as regulation gets.
On the conduct side, financial institution licences have carried a business continuity and technology systems standard condition since 31 March 2025. It directs licensees to review their outsource providers' criticality and consider whether the information those providers hold is confidential or sensitive. [6] That is seven months bound, running alongside the prudential side. It sits squarely on the conduct regulator's own patch rather than the prudential one's, so a licensee cannot treat it as someone else's compliance problem.
What does not exist yet is the piece that would turn the third named risk into a binding, cyber-specific standard, rather than a set of adjacent instruments. The Reserve Bank's Operational Resilience Standard for deposit takers, covering how they manage technology risk under the Deposit Takers Act 2023, is still an exposure draft. Consultation closed on 11 September 2026. The finalised standard is expected in 2027, and the licensing period it belongs to is not due to start before 1 June 2027. [7][8] As at the date of publication, nobody is bound by it.
One more piece sits underneath all of this and rarely gets named. Information Privacy Principle 5 of the Privacy Act 2020 already requires any agency holding personal information to do everything reasonably within its power to prevent unauthorised use or disclosure. That duty applies once the information reaches a service provider. [9] It is a real, economy-wide duty and has existed since the Act came into force. It covers every sector a financial entity might sit in, alongside the prudential and conduct rules above it. But it sets a general standard of reasonableness. It does not specify an assessment framework, a named evidentiary standard, or a live demonstration of compliance, the way a sector-specific code can. A board can satisfy it in good faith and still have nothing written down that a regulator would accept as evidence.
Put the five pieces beside each other and the honest version of "nothing new" is neither fully true nor fully false. Reporting and outsourcing control were genuinely already owed, and are enforced. A codified, specific cyber-risk-management duty with real evidentiary teeth is still being built, on a slower, separate, consultative track. It arrives from a different document than the one read out on 15 October. A board that treats every named obligation as equally settled will overstate its own position on the one piece that is not yet law. A board that treats the whole statement as empty will understate its exposure on the four pieces that already are.
New Zealand already has a worked example of what happens when the third named risk, not the first two, is actually enforced. It is not inside financial services. The Privacy Commissioner issued compliance notices against Manage My Health and Health New Zealand over a breach that exposed roughly a hundred thousand people, most of them in Northland. [10] The Manage My Health notice, issued under the Health Information Privacy Code, found seven security areas ineffective, three already remediated, four still open against staged deadlines running into 2027. The Health New Zealand notice is the sharper instrument for this article's purposes. It sits on the exact limb the 15 October statement is talking about: safeguards that must exist before information is given to a service provider, not during, not after. It names four areas a board has to show evidence on. The first is project governance, with privacy and security as standing agenda items. The second is privacy risk management, with independent assessments built into the project's own timeline rather than bolted on afterwards. The third is information security, including independent assessment of providers against the Health Information Safety Framework and a live demonstration of compliance. The fourth is contracting, so the obligations sit in the agreement itself rather than in a policy nobody attached to it. Complete by January 2027. [10]
Nothing about the health sector's enforcement instance proves anything about financial services, and this article is not claiming it does. It shows that the duty the Reserve Bank and the Financial Markets Authority say already applies has, in a different sector, already been tested. The organisation that failed the test was not asked whether it had a policy. It was asked whether it had asked the question before the contract was signed, and whether it could produce the paperwork proving it.
That is the practical test for a board reading the 15 October statement, stripped of the regulatory language. Three questions carry the whole thing. Did anyone in this organisation ask a critical vendor to demonstrate its security before data started moving, not after a problem was found? Is that assessment written down somewhere a regulator, an auditor or a new director could find it? And if the answer to either question is no, is that because nobody thought to ask? Or because the organisation decided it did not need to, and can it show which? None of those three questions needs a new regulation to be worth asking on Monday morning. Every one of them can be answered from paperwork that should already exist, if the duty really was already owed.
A board that reads 15 October as a signal of requirements still to come has read it backwards. A board that reads it as confirmation that nobody checks anything has read it almost right. The exception is incident reporting, outsourcing control at the largest banks, and business continuity planning: somebody already checks those, on paper, and has done for between one and six years.
What changes next is worth watching rather than waiting for. The Reserve Bank's Operational Resilience Standard, still in exposure draft, is the instrument that would finally turn today's patchwork into a single, binding standard for how a deposit taker manages technology risk. That mix is outsourcing control for the largest banks, incident reporting for everyone regulated, business continuity for licensed conduct, and non-binding guidance for the rest. It will not be finalised before 2027. The licensing regime it belongs to does not begin before June of that year, with the full regime reaching every deposit taker only from 2028. Every board with a financial-services exposure has a genuine window, measured in months rather than years, to get its own paperwork in order. That window closes once a regulator asks for it as a matter of course rather than good practice. The window is useful in itself. A standard still in consultation is one a board can still shape its own readiness against, instead of scrambling to meet it later.
A smaller but useful marker sits in the same week. Monday, 30 October 2026, is the first anniversary of the National Cyber Security Centre's ten Minimum Cyber Security Standards for the thirty-seven agencies mandated under the Protective Security Requirements framework. [11] A year of a live standard is now reportable history rather than a future deadline. The pattern it sets is specific, checkable requirements rather than a general exhortation to be careful. Every piece of this build is moving in that direction, one instrument at a time.
The same instinct, verify before you trust, already has a home outside financial regulation. It has been built there publicly and for free, on the other side of the industry that supplies the vendors a board is now being asked to check.
The same question sits underneath an open-source project that no board signs a contract for. Sigstore, built under the Open Source Security Foundation at the Linux Foundation, lets a developer sign a software artefact and record that signature in a public, append-only transparency log called Rekor. Anyone can check that log without asking the publisher to vouch for itself. It exists because a vendor's own word has never been a security control, only a convenience dressed as one. A duty to verify a provider's security before data moves, the obligation this week's statement describes, is the same instinct, applied to contracts instead of code. The open-source world built a free, checkable record for that instinct. Financial regulation is still building the paperwork trail one compliance notice at a time.
The same sequencing question is already settled, in binding form, for a larger financial system than New Zealand's. The European Union's Digital Operational Resilience Act became applicable to every bank, insurer and investment firm in the bloc on 17 January 2025. It enforces named contractual terms a financial entity must secure from a critical technology provider before signing, not after. New Zealand's own Critical Infrastructure Protection Act regime sits a step behind that model rather than ahead of it. Finance is treated as an essential sector. The obligations named on 15 October sit across several separate instruments. The one instrument built to bind them into a single, enforceable standard is still in consultation. Sovereign capacity also includes whether the rulebook arrives before or after the sector that depends on it.
When did your organisation last ask a critical vendor to prove its security before the contract was signed, rather than after something went wrong, and could you find the paperwork that proves you asked?
If your board wants an independent AI and cyber risk briefing, or a review of what your vendor's assurance actually verified, message me and I will send the scope and the fixed fee.
• • •
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
• • •
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Cyber Guide for New Zealand Boards is the third book in The Hamberger Report series, providing board members and senior leaders with practical cyber resilience governance guidance. Through Te Pono he provides independent AI and cyber risk briefings and vendor assurance reviews to boards; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] Reserve Bank of New Zealand and Financial Markets Authority. "RBNZ and FMA outline supervisory expectations on cyber and AI risks." 15 October 2026. https://www.rbnz.govt.nz/news-and-events/news/2026/10/rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risks
[2] LiveNews. "Economy: RBNZ and FMA outline supervisory expectations on cyber and AI risks." 15 October 2026. https://livenews.co.nz/2026/10/15/economy-rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risks/
[3] Reserve Bank of New Zealand. "Outsourcing Policy (BS11)." April 2020. https://www.rbnz.govt.nz/-/media/project/sites/rbnz/files/regulation-and-supervision/banks/policy/white-list-for-the-purposes-of-bs11.pdf
[4] Reserve Bank of New Zealand. "Guidance on Cyber Resilience." April 2021. https://www.rbnz.govt.nz/-/media/project/sites/rbnz/files/consultations/cyber-resilience/guidance-on-cyber-resilience.pdf
[5] Bell Gully. "Cybersecurity update: new reporting obligations for the financial sector." https://www.bellgully.com/insights/cybersecurity-update-new-reporting-obligations-for-financial-sector/
[6] Financial Markets Authority. "Operational resilience." https://www.fma.govt.nz/business/focus-areas/operational-resilience/
[7] Reserve Bank of New Zealand. "Deposit Takers Act: DTA Standards Implementation Roadmap." 2026. https://www.rbnz.govt.nz/regulation-and-supervision/deposit-takers-act/dta-standards-implementation-roadmap
[8] Reserve Bank of New Zealand. "DTA and DCS: DTA Standards Exposure Drafts, Tranche 3." 2026. https://consultations.rbnz.govt.nz/dta-and-dcs/dta-standards-exposure-drafts-tranche-3/
[9] Office of the Privacy Commissioner. "Privacy principle 5: Storage and security of personal information." https://www.privacy.org.nz/privacy-principles/5/
[10] Office of the Privacy Commissioner. Compliance notices to Manage My Health (28 August 2026) and Health New Zealand (22 September 2026), issued under section 123 of the Privacy Act 2020.
[11] National Cyber Security Centre. "Minimum Cyber Security Standards." https://www.ncsc.govt.nz/protect-your-organisation/minimum-standards/