October roundup of regulatory and compliance news

A monthly roundup of the most important regulatory, legal and supervisory developments shaping QA, software testing, AI governance and digital resilience across banking and financial services.

October’s developments are bringing the practical demands of technology assurance into sharper focus. From Singapore’s new AI risk management guidelines to the Bank of England’s calls for testing before and after deployment, authorities are emphasising the evidence financial institutions need to show that increasingly capable systems remain under control.

The challenge extends beyond validating individual models. Banks must assess third-party AI, demonstrate that human oversight works and monitor how systems behave as technology, permissions and operational conditions change.

Meanwhile, proposals to update UK regulatory thresholds automatically and efforts to scale digital-asset markets raise wider questions for software quality teams: whether compliance systems apply changing requirements correctly, and whether new platforms can connect reliably with established financial infrastructure.

Against continuing concerns cyber threats and concentrated technology dependencies, testing is becoming central to how firms demonstrate both responsible innovation and operational resilience.

MAS zooms in on AI lifecycle testing

The Monetary Authority of Singapore has issued new AI risk management guidelines, setting out expectations for financial institutions to maintain oversight as increasingly capable systems move into everyday operations.

Published on October 7, the guidelines cover all forms of AI and call for proportionate controls across the technology’s lifecycle, including testing, human oversight, cybersecurity, monitoring and change management.

Institutions remain accountable for third-party AI used in their services and should obtain sufficient assurance that it is suitable for its intended purpose.

For QA teams, the practical implication is that model validation must connect with the controls surrounding deployment. Testing should help establish whether oversight remains effective, whether changes introduce new risks and whether supplier assurance leaves gaps requiring additional safeguards.

The guidelines take effect on October 7, 2027, with phased implementation extending to October 2028. MAS also intends to consult the sector in 2027 on additional guidance for agentic AI.

PRA’s regulatory ‘autopilot’ raises change-control questions

The UK’s Prudential Regulation Authority is consulting on proposals to increase 128 regulatory thresholds automatically in line with nominal GDP, replacing the predominantly ad hoc approach used today.

The October 7 proposals cover banking, insurance and credit unions. They seek to maintain proportionality as the economy grows, reducing the risk that firms become subject to additional requirements simply because fixed thresholds have lost their original calibration.

The framework would use an initial three-year indexation period followed by recurring five-year updates.

For financial institutions, the QA implication is a need to check how changing thresholds flow through compliance systems, reporting processes and calculations. If adopted, the framework would make effective dates, parameter updates and consistent interpretation across applications important areas for validation.

Boundary testing would be particularly useful: firms should be able to establish that systems apply the correct treatment immediately below and above a threshold, and retain evidence explaining why a requirement applied at a particular time.

Bailey calls for more AI testing

Bank of England governor Andrew Bailey has argued that rigorous testing should be a starting point for governing frontier AI, with assurance continuing after systems enter operational use.

In an article published last week, Bailey wrote: “A sensible starting point is rigorous model testing, conducted before and after deployment.”

His intervention carries into October’s regulatory debate because it connects AI assurance with financial stability, including the resilience of banks, payments networks and market infrastructure.

Bailey also emphasised learning from failures and near misses, recognising that testing cannot eliminate unexpected behaviour.

For banking QA teams, that supports an approach in which production incidents feed back into test scenarios and model changes trigger appropriate revalidation. Assurance also needs to examine whether an institution can intervene effectively when a system behaves outside its intended boundaries.

Bailey’s article sets out a governance argument rather than a new binding testing regime, but places practical evidence safeguards at the centre of the discussion.

EU supervisors flag tech dependencies

European financial supervisors have warned that reliance on non-EU technology providers and infrastructure could amplify geopolitical shocks and operational disruption.

The European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority identified external dependencies, emerging technologies and private credit as key vulnerabilities in their autumn risk update.

The warning remains relevant to October’s resilience planning. The authorities highlighted concentration among ICT providers outside the European Economic Area and the prospect of advanced AI enabling attackers to discover and exploit vulnerabilities more quickly.

For software testing and operational resilience teams, the practical implication is to examine how critical services behave when an external dependency becomes unavailable or unreliable.

Recovery exercises may need to consider simultaneous disruption across shared suppliers, alongside the ability to restore services without normal access to external infrastructure.

The update adds weight to the case for connecting supplier-risk assessments with tested recovery arrangements and evidence the dependencies supporting important financial services.

FSB puts frontier AI at top of cyber agenda

The Financial Stability Board has identified the effect of frontier AI on cyber risk as the most immediate AI-related concern facing the financial system.

In a letter to G20 finance ministers and central bank governors, FSB chair Andrew Bailey warned that advanced models are developing increasingly sophisticated autonomous, problem-solving and threat capabilities.

The global financial system’s interconnectedness means a cyber incident may not remain confined to one institution. Disruption could spread across borders through common technology providers, shared vulnerabilities and dependencies on a relatively small group of major suppliers.

The warning strengthens the case for tests that go beyond isolated system failures. Scenario design may need to cover simultaneous outages, disruption at a widely used supplier, attacks that move across connected systems and recovery when normal digital infrastructure is unavailable.

The FSB’s intervention also elevates AI testing from an internal technology concern to a potential financial-stability issue.

EBA proposes operational risk standards for banks

The European Banking Authority has launched a consultation on draft regulatory technical standards specifying the operational risk management framework banks must maintain under the revised Capital Requirements Regulation.

The proposed framework has three main elements: governance arrangements, the operational risk management process and an operational risk assessment system.

It would require institutions to identify, assess, monitor and report operational risks through documented and traceable processes. ICT risk management under the Digital Operational Resilience Act would form part of that wider framework, allowing institutions to rely on certain DORA arrangements where the two regimes overlap.

The consultation is significant for technology teams because software failures, cyber incidents, data problems and unsuccessful system changes can all result in operational losses.

Testing evidence may consequently need to serve several purposes. It must demonstrate the technical effectiveness of controls while also supporting operational risk assessments, incident classification, management reporting and audit. The EBA consultation runs until December 31 of this year.

Australian regulators demand tested response plans

Australia’s two principal financial regulators have told firms to move beyond awareness of frontier AI risks and take decisive action.

The Australian Securities and Investments Commission and Australian Prudential Regulation Authority issued the warning after nine industry roundtables attended by more than 600 people.

The regulators highlighted timely patching, strong identity and access controls, reduced attack surfaces, backup integrity, third-party risk management and tested response and recovery arrangements.

ASIC commissioner Simone Constant said boards and executives must ensure their organisations have “well-tested response plans” and understand where they remain vulnerable.

The roundtables also identified interest in using AI for threat intelligence, vulnerability detection, code review and incident response, although the maturity of those capabilities remains limited.

The Australian intervention is unusually direct: having a response plan is not enough. Firms must demonstrate that it has been exercised and that recovery priorities, escalation authority and communication arrangements have been decided before an incident compresses the time available for action.

ASIC puts customer-facing banking AI under scrutiny

ASIC has separately made AI a priority in its Corporate Plan for 2026–27 .

The regulator will examine how banks use AI in customer-facing services, how the technology affects consumers and investors, and how deepfakes, manipulation and AI-generated misinformation could affect market integrity.

The move brings customer experience testing into the regulatory picture.

Banks will need to demonstrate that AI-enabled services do not produce misleading information, conceal accountability or result in poorer treatment of particular customer groups. Monitoring must also identify emerging harm after deployment rather than relying solely on a model’s performance during development.

ASIC will build its own AI, data and cyber capabilities to detect misconduct earlier, suggesting that firms may increasingly face regulators equipped to interrogate the underlying technology and evidence rather than relying on policy descriptions.

Critical infrastructure warned over continuous remediation

A Banque de France speech published by the Bank for International Settlements has warned central counterparties that frontier AI will shorten the interval between discovering a vulnerability and exploiting it.

First Deputy Governor Denis Beau said organisations will need to move away from traditional periodic patching towards continuous, exploitability-driven remediation.

Central counterparties are particularly exposed because of their systemic role and reliance on a limited number of cloud providers, cybersecurity companies and specialist software suppliers. Disruption at one critical provider could spread across interconnected financial market infrastructures.

The shift to continuous remediation has substantial implications for quality engineering. Faster patching cannot come at the expense of validation, particularly in infrastructure supporting clearing, collateral and margin processes.

Testing pipelines must therefore become quicker and more automated while retaining controls over compatibility, performance, failover behaviour and unintended changes to critical services.

Beau also pointed to work by CPMI and IOSCO on response, resumption and recovery plans, including scenario design and testing. Together with DORA’s new oversight regime for critical third-party providers, the work signals growing supervisory attention to the infrastructure and suppliers supporting the financial system.

Taken together, October’s developments show regulators converging around a common principle: resilience and responsible AI adoption must be demonstrated through evidence.

Policies, inventories and governance committees remain necessary, but they will not establish that a bank can recover from disruption, detect an AI-enabled attack or prevent a customer-facing model from causing harm.

Testing, validation, monitoring and documented recovery exercises are rapidly becoming the practical language through which financial institutions prove that their technology remains under control.

FSB responses expose emerging AI governance debate

Finally, the FSB has published responses to its consultation on responsible AI adoption in financial services.

Its original report proposed 12 sound practices covering organisation-wide governance and different stages of the AI development and deployment lifecycle. The framework was designed to address conventional AI alongside generative and increasingly agentic systems.

Publication of the submissions gives regulators and financial institutions a body of industry evidence to consider before the framework is finalised.

For testing teams, the key question is how broad governance principles will translate into repeatable assurance requirements.

Firms need practical criteria for deciding when a model is ready for deployment, which behaviours require adversarial testing, how performance should be monitored and when a change is significant enough to trigger revalidation.

Responsibility for third-party models remains equally important. A bank may not have built an underlying model, but it will still need evidence that its use of the technology is controlled, monitored and suitable for the customer or operational context.

* Receive our weekly every Wednesday * Get priority invitations to our Forum events *

ANZ Bank weighs testing outsourcing as AI reshapes QA

October roundup of regulatory and compliance news

Bank of England’s ‘autopilot’ puts testing in focus

Banks face a new QA challenge in AI orchestration

CRA compliance drives continuous security testing

QA FINANCIAL PODCASTS

LISTEN TO OUR EXCLUSIVE CONVERSATIONS