The Bank of England is urging financial institutions to strengthen their cybersecurity and prepare for potentially disruptive attacks powered by advanced artificial intelligence, warning that increasingly capable AI systems could expose vulnerabilities faster than banks can respond. The central bank is also working with lenders on recovery strategies designed to restore essential services if their primary technology systems are compromised.
Sarah Breeden, the Bank of England’s deputy governor for financial stability, outlined the growing threat during the Institute of International Finance’s annual meeting in Bangkok on Thursday. She said financial institutions could no longer assume that their existing cybersecurity defences would prevent every attack, as the capabilities of advanced AI models continue to develop.
The warning reflects mounting concern among regulators that AI could change the speed, scale and sophistication of cyberattacks against financial institutions. A successful attack on a major bank or critical financial market infrastructure could disrupt payments, affect other connected institutions and weaken public confidence in the wider financial system.
Breeden said the Bank of England was working with banks to consider what are known as “bare-metal recovery” arrangements. These involve restoring essential systems from a clean, independent technology environment rather than relying on infrastructure that may already have been compromised.
The approach is intended to help banks recover essential operations even if attackers gain access to their normal IT systems. Depending on how an incident unfolds, recovery arrangements may be critical to restoring payment services and other functions that households, businesses and financial markets depend on every day.
Why advanced AI is raising cybersecurity concerns
Traditional cyberattacks can involve exploiting software weaknesses, stealing credentials, deploying malicious programs or manipulating employees through fraudulent messages. Advanced AI can potentially accelerate several stages of these operations, from identifying weaknesses and developing attack strategies to automating tasks that would otherwise require substantial technical expertise.
The concern is not limited to a single attacker breaking into one institution. Financial firms frequently depend on shared software, cloud providers, digital services and other technology suppliers. If an attacker identifies a weakness in a widely used system, AI-assisted techniques could potentially help discover and exploit the same vulnerability across multiple organisations in a shorter period.
Such a scenario could make otherwise separate cyber incidents more closely connected. Simultaneous disruptions affecting banks, payment providers or market infrastructure could create operational pressures that extend well beyond the institution initially targeted.
The Bank of England, the Financial Conduct Authority and the UK Treasury addressed these risks in a joint statement published in May 2026. They warned that the cybersecurity capabilities of leading AI models were advancing rapidly and could exceed what a skilled practitioner could achieve in certain tasks, while operating at greater speed and scale and at lower cost.
The authorities urged regulated firms to improve their ability to identify vulnerabilities, prioritise security fixes, restrict unauthorised access and respond rapidly to incidents. They also highlighted risks arising from third-party technology providers, open-source software and outdated systems that no longer receive adequate security support.
AI could also strengthen cybersecurity by helping defenders detect suspicious activity, identify weaknesses and automate protective measures. However, regulators are concerned that organisations may struggle to keep pace if malicious actors can use increasingly capable tools to discover and exploit vulnerabilities before security teams can patch them.
Recovery planning becomes a priority for banks
The Bank of England’s emphasis on independent recovery systems reflects a broader shift in cybersecurity planning: financial institutions must prepare not only to prevent attacks but also to continue operating and recover when their defences fail.
For a major bank, a severe cyber incident could affect more than its internal technology. Customers might be unable to make payments or access services, while businesses could face delays in transferring money or meeting financial obligations. Disruption to a critical payment, clearing or settlement service could also affect institutions that rely on it.
Recovery planning therefore needs to extend beyond individual banks. Institutions must understand how their systems depend on external technology providers and how disruptions could spread through interconnected financial services. Independent backups, tested recovery environments, clear incident-response responsibilities and coordinated contingency plans can help limit the consequences of an attack.
The Bank of England has previously highlighted these concerns in its July 2026 Financial Stability Report. According to the report, 82% of respondents to the central bank’s first-half systemic risk survey identified cyberattacks as one of their five leading risks to the UK financial system. A further 26% identified cyber risk as the single biggest threat, making it the second most frequently cited response. The survey was conducted before the announcement of the latest advanced AI models discussed in the report.
The findings underline why cybersecurity is increasingly treated as a financial stability issue rather than simply an information technology problem. A significant incident could affect confidence in institutions, interrupt essential services and expose weaknesses in systems shared across the industry.
Bank of England also examines quantum computing risks
Breeden also said the Bank of England was surveying financial firms to assess their preparedness for the potential impact of quantum computing on encryption. The central bank intends to use the findings, alongside guidance from the UK’s National Cyber Security Centre, to help develop a coordinated response for the financial sector.
Powerful future quantum computers could threaten some of the cryptographic methods currently used to protect financial transactions, communications and sensitive information. The timing of such a development remains uncertain, but regulators are concerned that waiting until the technology becomes capable of breaking widely used encryption could leave institutions with insufficient time to upgrade their systems.
Preparing for that possibility requires institutions to understand where encryption is used, identify systems that would be difficult to replace and develop migration plans for stronger, quantum-resistant cryptographic methods. Because financial infrastructure can remain in service for many years, the transition could require extensive coordination between banks, technology providers and regulators.
The quantum computing issue is distinct from the immediate concern surrounding AI-driven cyberattacks, but both highlight the need for financial institutions to plan for technological changes that could outpace existing security arrangements.
G7 considers coordinated response to AI cyber threats
The growing international focus on the issue was also evident at the Group of Seven finance ministers’ and central bank governors’ meeting in Bangkok. On October 15, Japanese Finance Minister Satsuki Katayama said G7 finance leaders had approved plans for tabletop exercises designed to test how authorities would respond to cyberattacks involving advanced AI.
The proposed exercises will simulate AI-driven cyber incidents and assess whether existing response procedures are effective. A Japanese finance ministry official said the findings would be used to improve operational guidance and revise response manuals. Participation by private financial institutions could depend on the nature of the simulations.
The initiative is intended to help authorities identify gaps in coordination before a major incident occurs. Cyberattacks affecting financial services can cross national borders, particularly when institutions rely on the same technology providers or interconnected payment systems. Coordinated planning could therefore improve the ability of governments, regulators and banks to contain disruptions.
The International Monetary Fund has also warned that cyber incidents involving critical financial services could undermine confidence. In its October 2026 Global Financial Stability Report, the IMF identified cyber threats as one of several risks facing the global financial system, alongside concerns about potential corrections in AI-related asset prices and pressures from sovereign borrowing costs.
These warnings do not mean that a major AI-driven attack on a bank has been confirmed. Rather, regulators are responding to the possibility that increasingly capable technology could make existing weaknesses easier to exploit and increase the potential consequences of a successful intrusion.
For banks, the immediate challenge is to strengthen basic cybersecurity, monitor technology supplied by third parties, identify and repair weaknesses quickly, and ensure that essential services can be restored if their main systems become unusable. Regulators, meanwhile, face the task of improving cooperation across institutions and national borders.
The Bank of England’s message is that stronger prevention remains essential, but it is no longer sufficient on its own. As AI capabilities evolve, banks will also need to demonstrate that they can withstand a serious cyber incident, contain its impact and recover their most important services without allowing disruption to spread across the financial system.