EU Banks Face Increased Cybersecurity Regulations Amidst Rising Threats

• •The ECB is prioritizing cyber resilience for the 2026-2028 cycle.
• •Banks are concerned about regulatory duplication with new EU cybersecurity obligations.
• •AI tools are increasingly being leveraged by threat actors in cyberattacks.

The European banking sector is experiencing a shift in cybersecurity dynamics, moving from isolated incidents to sustained campaigns that threaten operational continuity. The European Central Bank (ECB) has prioritized cyber resilience for the 2026-2028 cycle, emphasizing the need for banks to demonstrate the ability to maintain critical services during severe disruptions. This comes in response to findings from the 2025 Verizon Data Breach Investigations Report, which highlighted the finance sector's vulnerability to cyber incidents. Concurrently, banks and EU governments are expressing concerns over potential duplication of cybersecurity regulations, particularly with the introduction of the EU's Cyber Resilience Act alongside existing frameworks like the Digital Operational Resilience Act (DORA). The ECB expects banks to fully implement DORA requirements, focusing on third-party risk management, incident response, and cloud oversight. The rise of AI tools in cyberattacks further complicates the landscape, necessitating robust governance and contingency planning. As a result, cybersecurity has become a board-level issue directly tied to financial stability.