Regulator lookup · Ready before the rule

Where does your regulator stand?

78 regulator documents across North America, Asia-Pacific, the Gulf and the EU, each scored on nine questions about staff security awareness. Pick a regulator to see its scores and the exact words behind them.

Read the analysis

Canada (federal)2 documents

OSFI

Guidance · Guidance

Guideline B-13, Technology and Cyber Risk Management

Final 2022-07-13; effective 2024-01-01 (per OSFI letter); guideline page shows 2022-07-31

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Specific requirement
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: 3.1.7 Cyber awareness is promoted and tested: FRFIs should enable and encourage its employees, customers and third parties to report suspicious cyber activity, recognizing the role that each can play in preventing cyber attacks. FRFIs should create awareness of cyber attack scenarios directly targeting employees, customers and relevant third parties. Also 1.1.2: ... appropriate subject-matter expertise and training; ... Promote a culture of risk awareness in relation to technology and cyber risks throughout the institution.
Testing staff: 3.1.7: In addition, the FRFI should regularly test its employees to assess their awareness of cyber threats and the effectiveness of their reporting processes and tools.
AI and social engineering: silent: the words phishing, social engineering, deepfake and artificial intelligence do not appear in the guideline text (keyword count zero)
Verification: silent
Sections: 1.1.2; 1.3.2; 3.1.2; 3.1.7; 3.1.8
Applies to: Federally regulated financial institutions (banks, foreign bank branches, trust and loan companies, insurers)

Read the source document

OSFI

Guidance · Guidance

Integrity and Security Guideline

Effective 2024-01-31

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: codes of conduct ... apply to all employees, and include regular training
Testing staff: silent
AI and social engineering: silent on phishing, social engineering, AI and deepfakes
Verification: silent
Sections: Integrity (codes of conduct); Security (gaps and deficiencies)
Applies to: Federally regulated financial institutions

Read the source document

US (federal)28 documents

OCC, FDIC, Federal Reserve (interagency)

Binding · Rule

Interagency Guidelines Establishing Information Security Standards (12 CFR 30 App. B; 12 CFR 364 App. B; 12 CFR 208 App. D-2)

Original 2001 (66 FR 8633 / 8616); OCC and FDIC versions show amendment at 91 FR 18293-18294, 2026-04-10 (content of that amendment not reviewed); eCFR current as of 2026-10-01

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: III.C.2: Train staff to implement the national bank's or Federal savings association's information security program. (FDIC/Fed text: Train staff to implement the institution's / the bank's information security program.)
Testing staff: silent on testing staff. III.C.3: Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the ... risk assessment. (systems and controls, not people)
AI and social engineering: silent on phishing, social engineering, AI and deepfakes
Verification: silent
Sections: III.C.2; III.C.3; III.F
Applies to: National banks, federal savings associations, FDIC-supervised institutions, state member banks

Read the source document

NCUA

Binding · Rule

12 CFR Part 748 Appendix A, Guidelines for Safeguarding Member Information

Appendix A 2001 (66 FR 8161) with later amendments to Part 748 through 89 FR 79393 (2024-09-30); eCFR current as of 2026-10-01

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: III.C.2: Train staff to implement the credit union's information security program.
Testing staff: III.C.3: Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the credit union's risk assessment. (systems, not staff)
AI and social engineering: silent on phishing, social engineering, AI and deepfakes
Verification: silent
Sections: App. A III.C.2; III.C.3; III.F
Applies to: Federally insured credit unions

Read the source document

SEC

Binding · Rule

Regulation S-P, 17 CFR 248.30 as amended (safeguards, incident response, customer notification)

Amended 89 FR 47786, 2024-06-03 (adopted 2024-05-16); compliance 18 months (larger entities) and 24 months (smaller entities) after FR publication, i.e. computed 2025-12-03 and 2026-06-03

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent on training or employee awareness
Testing staff: silent
AI and social engineering: silent on phishing, social engineering, AI and deepfakes
Verification: silent
Sections: 248.30(a)(3) incident response program; 248.30(a)(4) notice within 30 days; 248.30(a)(5) service providers
Applies to: Broker-dealers, investment companies, registered investment advisers, transfer agents

Read the source document

SEC

Binding · Rule

Regulation S-ID, 17 CFR 248.201 Identity Theft Red Flags (with Appendix A guidelines)

In force; FR citation not returned by the eCFR API extract (eCFR current as of 2026-10-01)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Specific requirement
Verification controls (customer or staff): General mention

What it says

Training: 248.201(e)(3): Train staff, as necessary, to effectively implement the Program;
Testing staff: silent
AI and social engineering: silent on phishing, social engineering, AI and deepfakes (red flags framework)
Verification: silent on out-of-band verification
Sections: 248.201(e); Appendix A section VI
Applies to: SEC-regulated financial institutions and creditors with covered accounts

Read the source document

SEC

Binding · Rule

Item 106 of Regulation S-K, 17 CFR 229.106 Cybersecurity (disclosure)

88 FR 51942, 2023-08-04

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent
Verification: silent
Sections: 229.106(c)
Applies to: SEC registrants (public companies)

Read the source document

FTC

Binding · Rule

Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314

86 FR 70304, 2021-12-09 (in effect for most provisions 2023-06-09 per FTC); amended 88 FR 77508, 2023-11-13 (breach notification, effective 2024-05); eCFR current as of 2026-10-01

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: 314.4(e): Implement policies and procedures to ensure that personnel are able to enact your information security program by: (1) Providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment; ... (3) Providing information security personnel with security updates and training sufficient to address relevant security risks;
Testing staff: silent on testing staff. 314.4(d)(2): For information systems, the monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. (penetration testing annually and vulnerability assessments at least every six months apply to systems, not people)
AI and social engineering: silent on phishing, social engineering, AI and deepfakes
Verification: silent
Sections: 314.4(e)(1); 314.4(d); 314.4(i)
Applies to: Non-bank financial institutions under FTC jurisdiction (lenders, mortgage brokers, dealers, fintechs, etc.)

Read the source document

FFIEC (OCC, FDIC, Federal Reserve, NCUA, CFPB, SLC)

Guidance · Guidance

IT Examination Handbook, Information Security booklet

Base booklet date not shown on the InfoBase page; page carries note: In February 2026, the Federal Financial Institutions Examination Council, on behalf of its members, released updates to the FFIEC IT Handbook to remove references to reputational risk

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Specific requirement
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: II.C.7(e): Training programs should include scenarios capturing areas of significant and growing concern, such as phishing and social engineering attempts, loss of data through e-mail or removable media, or unintentional posting of confidential or proprietary information on social media. As the risk environment changes, so should the training. The institution should collect signed acknowledgments of the employee acceptable use policy as part of the annual training program.
Testing staff: IV.A.2(b): There are many types of penetration tests (e.g., network, client-side, web application, and social engineering), and management should determine the level and types of tests employed to ensure effective and comprehensive coverage.
AI and social engineering: silent on AI, deepfakes, voice or SMS; phishing and social engineering named (II.C.7(e))
Verification: silent
Sections: II.C.7(e); IV.A.2(b); II.D.1; I.B
Applies to: All FFIEC-supervised depository institutions and their service providers

Read the source document

FFIEC

Guidance · Guidance

Authentication and Access to Financial Institution Services and Systems (guidance)

2021-08 (replaces 2005 and 2011 authentication guidance); still current

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: Section 10: For employees, board members, and other users accessing a financial institution's information systems, education can include training and testing programs on authentication-related scenarios such as phishing and social engineering. Appendix: Users periodically receive authentication security awareness training.
Testing staff: Appendix (Email Systems): Testing and Training Users. Social engineering campaigns are administered to test users' comprehension of and adherence to security policies. User training techniques are adjusted based on test results.
AI and social engineering: Section 8: Threat actors frequently have used social engineering and other techniques to deceive customer call center and IT help desk representatives into resetting passwords and other credentials ... (phone-based social engineering implied, not named as vishing); silent on AI and deepfakes
Verification: Appendix (Credential Reset): Enhanced Authentication for Credential Reset. Enhanced authentication controls are applied to customer and user credential resets, such as sending an OTP to a pre-established communication device; ... and call-backs to a pre-established phone number.
Sections: Section 7 (Email Systems); Section 8; Section 10; Appendix examples
Applies to: All FFIEC-supervised financial institutions

Read the source document

FFIEC (via OCC Bulletin 2024-25)

Guidance · Guidance

Cybersecurity Assessment Tool (CAT) Sunset Statement

2024-08-29; CAT removed 2025-08-31

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent
Verification: silent
Sections: OCC Bulletin 2024-25 (whole)
Applies to: All FFIEC-supervised institutions

Read the source document

NCUA

Guidance · Guidance

Letter to Credit Unions 24-CU-02, Board of Director Engagement in Cybersecurity Oversight

2024-10

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: Your board should ensure the credit union's employees receive regular cybersecurity education to maintain high awareness and preparedness across the organization.
Testing staff: silent on testing staff (tabletop exercises for incident scenarios and backup testing only)
AI and social engineering: silent on phishing, social engineering, AI and deepfakes (letter discusses malvertising and general threats)
Verification: silent
Sections: Board oversight and training paragraphs
Applies to: Federally insured credit unions

Read the source document

NCUA

Guidance · Guidance

Letter to Credit Unions 25-CU-01, NCUA's 2025 Supervisory Priorities

2025-01

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent (no mention of training, social engineering, phishing, AI or deepfakes in the cybersecurity section)
Verification: silent
Sections: Cybersecurity section
Applies to: Federally insured credit unions

Read the source document

NCUA

Guidance · Alert

Risk Alert 22-RISK-01, Heightened Risk of Social Engineering and Phishing Attacks

2022-03

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: the continued importance of educating your employees and members on how to avoid these threats
Testing staff: silent
AI and social engineering: Phishing is a technique that uses email or malicious websites to solicit personal information or to get victims to download malicious software by posing as a trustworthy entity. ... Another variant of phishing, known as smishing, uses SMS or other text messaging applications to get victims to click on malicious links to achieve similar goals to email phishing. (silent on AI and deepfakes)
Verification: If you are unsure whether an email request is legitimate, try to verify it by contacting the entity directly, by another means, such as the phone.
Sections: whole letter
Applies to: Federally insured credit unions

Read the source document

FinCEN (US Treasury)

Guidance · Alert

FIN-2024-Alert004, FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions

2024-11-13

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent on staff training
Testing staff: silent
AI and social engineering: Criminals may also target financial institution customers and employees through sophisticated, GenAI-enabled social engineering attempts in support of other scams and fraud typologies, such as business email compromise (BEC) schemes, spear phishing attacks, elder financial exploitation, romance scams, and virtual currency investment scams. ... Similarly, criminals have reportedly used GenAI tools to target companies by impersonating an executive or other trusted employee and then instructing victims to transfer large sums or make payments to accounts ultimately under the scammer's control.
Verification: multifactor authentication (MFA), including phishing-resistant MFA, and live verification checks in which a customer is prompted to confirm their identity through audio or video, are two such processes. (customer identity verification, not payment-instruction verification)
Sections: pp. 1, 4-5 (Use of Deepfake Media in Phishing Attacks and Scams; Red Flag Indicators)
Applies to: All BSA-defined financial institutions

Read the source document

SEC Division of Examinations

Guidance · Information paper

Examination Priorities, Fiscal Year 2026

2025-11-17

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: General mention
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: p.16: In addition, focus will be on training and security controls that firms are employing to identify and mitigate new risks associated with artificial intelligence (AI) and polymorphic malware attacks, including how they are operationalizing information from threat intelligence sources.
Testing staff: silent on testing staff
AI and social engineering: names AI-associated risks and polymorphic malware (p.16); silent on deepfakes, voice or SMS
Verification: p.16 (Regulation S-ID): Are reasonably designed to identify and detect red flags, particularly during customer account takeovers and fraudulent transfers; and ... Include firm training on identity theft prevention.
Sections: p.16 Information Security and Operational Resiliency; Regulation S-ID
Applies to: SEC registrants (advisers, broker-dealers, investment companies, transfer agents)

Read the source document

FINRA

Guidance · Guidance

Regulatory Notice 24-09, FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models

2024-06-27

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: General mention
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent on deepfakes, impersonation, social engineering and phishing (notice concerns firms' own use of Gen AI)
Verification: silent
Sections: whole notice
Applies to: FINRA member broker-dealers

Read the source document

FINRA

Guidance · Consultation

Regulatory Notice 25-07, Modernizing FINRA Rules, Guidance, and Processes for the Organization and Operation of Member Workplaces (request for comment)

2025-04-14 (comments to 2025-07-14)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: General mention
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: Criminal perpetrators employ increasingly sophisticated tactics using technology, including AI tools that may make it more difficult for members and investors to identify scams by removing errors or improving the viability of imposter schemes.
Verification: silent
Sections: Section G (fraud)
Applies to: FINRA member broker-dealers

Read the source document

FINRA

Guidance · Information paper

2025 FINRA Annual Regulatory Oversight Report, Cybersecurity and Cyber-Enabled Fraud section

2025-01-28

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: Effective practice: Periodically training staff to identify and thwart tactics, techniques and procedures (TTPs) associated with people-centric attack vectors (e.g., phishing attacks, social engineering)
Testing staff: silent on phishing simulation or testing staff
AI and social engineering: threat actors exploiting generative AI's ease of use and wide range of applications to enhance their cyber-enabled crimes ... generating fake content (e.g., imposter sites, false identification documents, deep fake audio and video). Also names quishing (QR-code phishing).
Verification: silent on call-back or out-of-band verification (page reviewed)
Sections: Cybersecurity and Cyber-Enabled Fraud section (Emerging Threats; Effective Practices)
Applies to: FINRA member broker-dealers

Read the source document

FINRA

Guidance · Information paper

2026 FINRA Annual Regulatory Oversight Report, Cybersecurity and Cyber-Enabled Fraud section

2025-12-09

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: Conduct Training and Security Awareness: Regularly train staff on cybersecurity measures, including how to identify and report phishing or social engineering attacks.
Testing staff: silent on phishing simulation or testing staff
AI and social engineering: Phishing, Smishing or Quishing: deceptive social engineering attacks using email, SMS text messages or QR codes to redirect customers to malicious domains. ... threat actors exploiting GenAI's ease of use and wide range of applications to enhance their cyber-enabled crimes, for example, by: generating fake content (e.g., imposter sites, false identification documents, deepfake audio and video)
Verification: Identity Verification: Review email addresses and verify signatures associated with third-party accounts if funds are requested to be sent to or from those outside accounts. Also: Review unusual or suspicious activity such as wire requests to third-party accounts
Sections: Cybersecurity and Cyber-Enabled Fraud section (Emerging Threats; Effective Practices)
Applies to: FINRA member broker-dealers

Read the source document

FINRA

Guidance · Alert

Cybersecurity Advisory: Social Engineering Attempts Impersonating FINRA

First quarter of 2024 (page states); advisory remains posted

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: training to increase employee awareness of this type of threat actor activity continues to be an important aspect of a comprehensive cybersecurity program
Testing staff: silent
AI and social engineering: Threat actors may impersonate FINRA staff to request documents or filings from member firms, including annual reports ... Many of the reported sites impersonating FINRA or FINRA staff leveraged end-to-end encrypted communication platforms (messaging apps named; silent on AI)
Verification: Verify the legitimacy of any suspicious email prior to responding to it, opening any attachments or clicking on any links
Sections: whole advisory
Applies to: FINRA member broker-dealers

Read the source document

FBI Internet Crime Complaint Center (IC3)

Guidance · Alert

Public Service Announcement I-120324-PSA, Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud

2024-12-03

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Specific requirement

What it says

Training: silent on staff training
Testing staff: silent
AI and social engineering: Criminals generate videos for real time video chats with alleged company executives, law enforcement, or other authority figures. ... Criminals obtain access to bank accounts using AI-generated audio clips of individuals and impersonating them.
Verification: Verify the identity of the person calling you by hanging up the phone, researching the contact of the bank or organization purporting to call you, and call the phone number directly. Also: establish a secret word or phrase with your family to verify their identity.
Sections: AI-Generated Audio; AI-Generated Videos; Tips to Protect Yourself
Applies to: General public and businesses (law-enforcement alert, not a financial regulator instrument)

Read the source document

FBI Internet Crime Complaint Center (IC3)

Guidance · Alert

Public Service Announcement I-051525-PSA, Senior US Officials Impersonated in Malicious Messaging Campaign

2025-05-15

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Specific requirement

What it says

Training: silent
Testing staff: silent
AI and social engineering: Malicious actors have sent text messages and AI-generated voice messages ... techniques known as smishing and vishing, respectively
Verification: Verify the identity of the person calling you or sending text or voice messages (by researching the number independently and calling back); Do not click on any links in an email or text message until you independently confirm the sender's identity.
Sections: whole PSA
Applies to: General public and officials (law-enforcement alert)

Read the source document

FBI Internet Crime Complaint Center (IC3)

Guidance · Alert

Public Service Announcement I-072026-PSA, FBI Warns of Scammers Impersonating the IC3 (update to I-04182025-PSA)

2026-07-20

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent
Testing staff: silent
AI and social engineering: Scammers generate videos for real time video chats with alleged company executives, law enforcement, or other authority figures. ... Scammers rely on fear, urgency, and high-tech tricks like AI-generated video and caller ID spoofing to appear legitimate.
Verification: Listen closely to the tone and word choice to distinguish between a legitimate phone call or voice message from a known contact versus AI-generated voice cloning, as they can sound nearly identical. (detection advice, not an out-of-band control)
Sections: whole PSA
Applies to: General public (law-enforcement alert)

Read the source document

OCC

Guidance · Information paper

Semiannual Risk Perspective from the National Risk Committee, Fall 2024

Fall 2024 (data as of 2024-06-30)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: p.7: Fraudsters could use AI to implement sophisticated frauds by digitally altering voices, biometric systems, or images (also known as 'deepfakes'), or to facilitate social engineering schemes, identity theft, and impersonation of a trusted business or government agency. For example, deepfakes through voice replication have been used to perpetrate fraud by tricking voice biometric systems or by convincing a victim they are dealing with someone they know and trust, such as a family member.
Verification: silent
Sections: p.7 (Operational risk, fraud)
Applies to: National banks and federal savings associations

Read the source document

OCC

Guidance · Information paper

Semiannual Risk Perspective from the National Risk Committee, Spring 2025

Spring 2025 (data as of 2024-12-31)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: p.11: Ongoing training can help bank staff to identify red flags and respond to customers seeking to conduct transactions outside their usual transaction patterns.
Testing staff: silent
AI and social engineering: p.11: While fraud schemes are constantly evolving, social engineering, phishing, account takeover, business email compromise, impersonation (e.g., of business executives, government officials, third parties, or tech support), romance and investment scams, and identity theft schemes remain lucrative. (no AI or deepfake wording on this page)
Verification: silent
Sections: p.11 Fraud Risk Management
Applies to: National banks and federal savings associations

Read the source document

OCC

Guidance · Information paper

Semiannual Risk Perspective from the National Risk Committee, Fall 2025

Fall 2025 (data as of 2025-06-30)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent on AI, deepfakes, phishing and social engineering in the fraud section (p.5): Banks continue to face challenges from elevated levels and sophistication of fraud, including scams. ... On June 16, 2025, the OCC and other federal banking agencies issued a Request for Information (RFI) on Potential Actions to Address Payments Fraud
Verification: silent
Sections: p.5 Fraud Risk
Applies to: National banks and federal savings associations

Read the source document

OCC

Guidance · Information paper

Semiannual Risk Perspective from the National Risk Committee, Spring 2026

Spring 2026 (data as of 2025-12-31)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: p.4: AI lowers the barrier to entry for threat actors and increases the speed, scale, and sophistication of cyber-attacks targeting financial institutions and their customers. AI can also be used to facilitate fraud and enable automated reconnaissance, rapid vulnerability discovery and exploitation, targeted social engineering, and adaptive malware that can evade traditional security defenses.
Verification: The implementation of more stringent security measures, such as multifactor authentication and timely patch management, help mitigate AI-enabled cyber risks for banks. (no payment-verification control)
Sections: p.4 Cyber threats
Applies to: National banks and federal savings associations

Read the source document

FDIC

Guidance · Information paper

2025 Report on Cybersecurity and Resilience (annual report to Congress)

2025 (report text references data as of 2025-08-31; publication month not printed)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent on supervisory expectations for staff training (p.12 describes the FDIC's own internal phishing assessments that simulate real-world phishing emails)
Testing staff: silent as an expectation on banks
AI and social engineering: p.27: nation-state threat actors and cybercriminals are leveraging generative artificial intelligence (AI) technologies to research targets, attack vectors and vulnerabilities, as well as to assist with coding malicious software and phishing campaigns. ... Generative AI, including large language models, can augment live videos via 'deepfakes' or voice cloning tools, making it more difficult for financial institutions to discern real versus fraudulent (including synthetic) identities during customer account opening, processing of transactions, or verification processes.
Verification: silent
Sections: p.12; p.27
Applies to: FDIC-supervised institutions (descriptive)

Read the source document

US Treasury

Guidance · Information paper

Artificial Intelligence in Financial Services: Report on the Uses, Opportunities, and Risks of AI in the Financial Services Sector

2024-12

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: p.27: These threats include criminals thwarting customer identification programs through document and image manipulation or creation (e.g., 'deepfake' images), the use of AI tools to create convincing text for communications and interactions with financial firms, and social engineering customer service agents to gain illicit access to legitimate customer accounts or scam customers themselves. ... AI tools ... could 'supercharge' phishing attacks by simplifying the creation of compelling phishing
Verification: silent
Sections: p.27 (6. Illicit Finance Risks)
Applies to: Financial services sector (descriptive)

Read the source document

US (New York)3 documents

NYDFS

Binding · Rule

23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies (Second Amendment)

Amended 2023-11-01 (180-day default transition; phased to 2025-11-01)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Specific requirement
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: 500.14(a): As part of its cybersecurity program, each covered entity shall: ... (3) provide periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel that is updated to reflect risks identified by the covered entity in its risk assessment.
Testing staff: silent on testing staff. 500.5(a): conduct, at a minimum: (1) penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually (systems, not staff)
AI and social engineering: silent on AI, deepfakes, phishing, voice or SMS by name; 'social engineering' is the only term used (500.14(a)(3))
Verification: silent on out-of-band verification of payment or instruction changes (500.12 MFA is an access control, not a payment-verification control)
Sections: 500.14(a)(3); 500.5(a)(1); 500.4(b); 500.4(d)(3); 500.22
Applies to: DFS-licensed banks, insurers, other licensees (Class A companies have extra duties)

Read the source document

NYDFS

Guidance · Guidance

Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks

2024-10-16

YesStaff trained or tested on AI or deepfakes

YesStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Specific requirement
Verification controls (customer or staff): Specific requirement

What it says

Training: provide training for all personnel, including senior executives and Senior Governing Body members. ... The training should ensure all personnel are aware of the risks posed by AI, procedures adopted by the organization to mitigate risks related to AI, and how to respond to AI-enhanced social engineering attacks.
Testing staff: Training on social engineering, including on deepfake attacks, can be effectively delivered through simulated phishing, and voice and video impersonation exercises.
AI and social engineering: AI-enabled social engineering presents one of the most significant threats to the financial services sector. ... threat actors are increasingly using AI to create realistic and interactive audio, video, and text ... that allow them to target specific individuals via email (phishing), telephone (vishing), text (SMiShing), videoconferencing, and online postings.
Verification: trainings should address the need to verify a requestor's identity and the legitimacy of the request if an employee receives an unexpected money transfer request by telephone, video, or email.
Sections: sections on Social Engineering; Cybersecurity Training; Senior Governing Body oversight; MFA
Applies to: All DFS covered entities

Read the source document

NYDFS

Guidance · Guidance

Industry Letter: Guidance on Managing Risks Related to Third-Party Service Providers

2025-10-21

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: evidence of security awareness training (listed as part of ongoing assessments of third-party service providers)
Testing staff: silent
AI and social engineering: silent on AI-enabled attacks; mentions contracts should address acceptable use of Artificial Intelligence ('AI'), and whether the Covered Entity's data may be used to train AI models
Verification: silent on verification of payment or instruction changes
Sections: TPSP contract and ongoing-assessment sections
Applies to: All DFS covered entities

Read the source document

Australia10 documents

APRA

Binding · Prudential standard

Prudential Standard CPS 234 Information Security

2019-07 (July 2019)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent. Nearest text, para 15: An APRA-regulated entity must maintain an information security capability commensurate with the size and extent of threats to its information assets
Testing staff: silent on staff testing. Para 27 (controls generally): An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program.
AI and social engineering: silent
Verification: silent
Sections: paras 13, 15, 17, 27, 29, 31; footnote 8
Applies to: All APRA-regulated entities (ADIs, insurers, RSE licensees)

Read the source document

APRA

Binding · Prudential standard

Prudential Standard CPS 230 Operational Risk Management

2025-07 (July 2025 version)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent. Para 13: An APRA-regulated entity must identify, assess and manage operational risks that may result from inadequate or failed internal processes or systems, the actions or inactions of people or external drivers and events.
Testing staff: silent on staff testing. Para 30: An APRA-regulated entity must regularly monitor, review and test controls for design and operating effectiveness, the frequency of which must be commensurate with the materiality of the risks being controlled.
AI and social engineering: silent
Verification: silent
Sections: paras 6, 13, 20, 22, 25, 30
Applies to: All APRA-regulated entities

Read the source document

Parliament of Australia (ACCC as SPF general regulator; ASIC/APRA sector regulators to be designated)

Binding · Rule

Scams Prevention Framework Act 2025 (No. 15, 2025), inserting Part IVF into the Competition and Consumer Act 2010

2025-02-20 (assent); commenced 2025-02-21

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent on staff training as an obligation. The only training text is a court remedy, s58 probation order: an order directing a person to establish a compliance program, or an education and training program, that: (i) is for employees or other persons involved in the person's business
Testing staff: silent
AI and social engineering: silent. Scam definition s58AG(2)(b): impersonates a regulated entity in connection with the regulated service
Verification: silent (confirmation of payee not in the Act)
Sections: s2 commencement table; s58AG definition of scam; s58BD governance policies and metrics; s58BE annual senior officer certification
Applies to: Regulated entities in designated sectors (banks first)

Read the source document

APRA

Guidance · Guidance

Prudential Practice Guide CPG 234 Information Security

2019-06 (June 2019)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: Specific requirement
Verification controls (customer or staff): General mention

What it says

Training: Attachment B: An APRA-regulated entity could benefit from developing a training and information security awareness program. ... Sound practice would involve tracking training undertaken and testing the understanding of relevant information security policies, both on commencement and periodically. ... d) awareness of common attack techniques targeted at personnel and facilities (e.g. social engineering, tailgating);
Testing staff: Attachment G (Testing techniques), control objective Limit access to what has been authorised: example controls employee awareness and training; example testing approach Social engineering test. Attachment H metric: Staff responding to phishing tests (% of total staff)
AI and social engineering: Attachment B d) awareness of common attack techniques targeted at personnel and facilities (e.g. social engineering, tailgating); para on incidents: compromise of staff or customer credentials (e.g. as the result of a phishing attack). AI and deepfake: silent.
Verification: h) segregation of duties is enforced through appropriate allocation of roles and responsibilities. This reduces the potential for the actions of a single individual to compromise information security;
Sections: Attachment B Training and awareness; Attachment G Testing techniques; Attachment H Reporting (Education row: Results of training and awareness sessions; metrics Awareness exercises (coverage %, count), Staff responding to phishing tests (% of total staff)); information security principles h)
Applies to: All APRA-regulated entities

Read the source document

APRA

Guidance · Circular

Letter to RSE licensee board chairs: Information security obligations and critical authentication controls

2025-06-10

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): General mention

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent on AI, deepfake, phishing, social engineering. Threat named: Recent credential stuffing attacks have reinforced APRA's concerns about persistent weaknesses in RSE licensees' information security controls, particularly those related to authentication.
Verification: At minimum, APRA expects entities to require MFA or equivalent controls for all high-risk activities (such as changing member details, withdrawals, benefit payment / transfer / rollover requests, or investment switching) and for all administrative or privileged access.
Sections: letter body; deadline no later than 31 August 2025
Applies to: RSE licensees (superannuation trustees)

Read the source document

APRA

Guidance · Circular

Letter to Industry on Artificial Intelligence (AI)

2026-04-30

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: training and education of staff on AI use, misuse, limitations and secure practices.
Testing staff: silent
AI and social engineering: APRA observes that AI adoption is materially changing the cyber threat landscape for regulated entities. The use of AI increases the pathways that cyber attackers can use and lead to more frequent cyber attacks. Also: APRA is also engaging across the sector on the potential for increased cyber threats from high capability AI frontier models such as Anthropic Mythos.
Verification: silent
Sections: letter sections on Board expectations, cyber threat landscape, staff use of AI
Applies to: All APRA-regulated entities

Read the source document

APRA

Guidance · Information paper

Speech: Finding balance at a time of rising risk (Executive Director Cross-industry Risk, to RMA)

2025-09-04

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: General mention
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: One is the ability of bad actors to harness artificial intelligence to increase their penetration, including the use of deep fake voice and video technologies.
Verification: silent. Related: A key example of such investment is for financial institutions to have strong authentication controls commensurate with the evolving threat environment. Recent credential stuffing attacks showed that many super funds weren't meeting the expected standards
Sections: speech text, risk environment and cyber resilience sections
Applies to: All APRA-regulated entities

Read the source document

ASIC

Guidance · Circular

Open letter to AFS licensees and market participants: cyber resilience and frontier AI (26-092MR)

2026-05-08

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent on staff testing. Closest: prepare for incident response by maintaining and exercising incident response plans and playbooks
AI and social engineering: The rapid evolution of frontier artificial intelligence models marks a significant shift in the cyber threat landscape. ... For example, a 'simple' phishing email can now more easily provide access to critical platforms or sensitive data
Verification: silent
Sections: letter body: A clear call to action; Governance and accountability remain critical; Final remarks
Applies to: AFS licensees and market participants

Read the source document

APRA and ASIC (joint)

Guidance · Information paper

Information Paper: Resilience at Frontier AI Speed, Insights from the APRA-ASIC Industry Roundtables (26-201MR)

2026-08 (August 2026)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent on staff testing. Board question: Have these decisions been tested under pressure?
AI and social engineering: Frontier AI poses a real and present risk to Australia's financial system. It is accelerating known cyber, technology and operational risks, increasing the speed, scale and sophistication of cyber threats
Verification: silent
Sections: APRA and ASIC expectations on managing Frontier AI risk; board questions table
Applies to: Financial market entities, APRA-regulated entities

Read the source document

ASIC

Guidance · Alert

Media release 26-063MR: ASIC ramps-up action to protect consumers from AI-powered online investment scams

2026 (release numbered 26-063MR; exact day not shown in page text; covers 1 Jan to 31 Dec 2025 data)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: Scammers are using artificial intelligence to make fake investment ads look more polished, more convincing and harder to spot. Also: ASIC is removing record numbers of harmful social media phishing and investment scam websites
Verification: silent
Sections: release body; takedown statistics
Applies to: Consumers; no firm-facing requirement

Read the source document

Hong Kong4 documents

HKMA

Guidance · Circular

Circular: Cybersecurity Fortification Initiative 2.0 (introducing C-RAF 2.0) with Annex

2020-11-03

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent in the circular and annex (C-RAF 2.0 framework document itself not accessible, see notes)
Testing staff: iCAST (applicable to AIs with inherent risk level assessed to be medium or high). Annex: Introduction of Blue team requirements for iCAST to measure the effectiveness of detection, response and recovery functions of AIs
AI and social engineering: silent
Verification: silent
Sections: circular paras on CFI 2.0 pillars, implementation timeline table; Annex C-RAF 2.0 Risk assessment
Applies to: All authorized institutions

Read the source document

HKMA

Guidance · Circular

Circular: E-Banking Security ABCD (deepfake defence tactics)

2025-08-25

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: I am writing to provide guidance on the enhancements to E-Banking security measures to cover deepfake defence tactics, with immediate effect. ... The Hong Kong Monetary Authority (HKMA) has been closely monitoring the evolving fraud risks posed by deepfake technology. ... those which adopted relevant solutions, and related good practices (as summarised in the Annex), improved their capability to detect sophisticated, real-time deepfake attacks by more than 95% in number.
Verification: silent on staff-side verification. Measures are customer e-banking controls: Authenticate In-App, Bye to unused functions, Cancel suspicious payments, Deepfake detection.
Sections: circular pp.1-3; Measure D; footnotes 1 to 4
Applies to: All authorized institutions

Read the source document

HKMA

Guidance · Circular

Circular: Strengthening Cyber Resilience amid Artificial Intelligence-Empowered Cyber Threats

2026-06-02

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent on staff testing. Where appropriate, suitable scenario testing should be conducted, including as part of prevailing operational resilience programmes.
AI and social engineering: Indeed, the Hong Kong Monetary Authority (HKMA) has long been working with AIs to counter different A.I.-assisted attacks, including those concerning phishing, malware and deepfakes. However, the recent emergence of increasingly capable frontier A.I. models could mark a step change in the global cyber risk landscape.
Verification: silent
Sections: circular pp.1-5; expectations bullets (review cyber defense controls; uplift incident response and recovery; enhance data resilience); initiatives (Task Force on A.I.-Driven Cyber Risks; Cyber Resilience Testing Framework; PCICSO Sectoral Code of Practice)
Applies to: All authorized institutions

Read the source document

SFC

Guidance · Circular

Circular to licensed corporations, SFC-licensed VATPs and associated entities: Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks (SFO/IS/020/2026)

2026-06-02

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: General mention
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Specific requirement

What it says

Training: silent (staff named only as targets: licensed firms, their staff and their clients will be subject to more frequent and targeted attacks)
Testing staff: 16. Licensed firms should regularly test their cybersecurity incident handling procedures and contingency plans through tabletop exercises, simulated attacks or other appropriate means to assess the effectiveness of these procedures and plans.
AI and social engineering: The proliferation of AI-enabled tools may also significantly lower the technical barrier for threat actors to execute various malicious activities, such as phishing, social engineering, deepfake impersonation, and reconnaissance.
Verification: 11. ... (iv) apply maker-checker controls for high-impact actions.
Sections: paras 1 to 4 (developments); 5 to 7; (A) patching 9; (B) access and privilege 10 to 11; (C) 12; (D) 13; (E) 14 to 16; 18; footnotes 1, 3
Applies to: Licensed corporations, VATPs and associated entities

Read the source document

India1 document

SEBI

Binding · Rule

Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113)

2024-08-20

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: Specific requirement
Board reporting: General mention
Verification controls (customer or staff): General mention

What it says

Training: PR.AT Standard 1. Mandatory programs for building awareness of cybersecurity, cyber resilience, and system hygiene among employees shall be established. Such programs shall be conducted on a periodic basis, and shall be updated as per emergence of new threats, state-of-the-art technologies and industry trends. 4. ... a dedicated program on cybersecurity, cyber resilience, and system hygiene shall be made for Board members.
Testing staff: Guideline e. REs shall periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate, etc. Also DE standard 4. MIIs and Qualified REs shall conduct goal-based adversarial simulation red teaming exercise on a periodic basis
AI and social engineering: phishing named: phishing test success rate; REs shall subscribe to anti-phishing/ anti-rogue app services to mitigate potential phishing or impersonation attacks. AI, deepfake, voice, SMS: silent.
Verification: Maker-Checker framework shall be implemented for granting, revoking, and modifying user rights in applications, databases, etc.
Sections: Part I objectives; periodicity table item 9 Cybersecurity training program (PR.AT.S1) All REs Annually; GV.RR standard 6; PR.AT 3.2; PR.AA.S5 maker-checker; DE standard 4 red teaming; Guidelines e. (awareness assessment)
Applies to: All SEBI regulated entities (MIIs, brokers, AMCs, etc.) by category

Read the source document

Japan1 document

JFSA

Guidance · Guidance

Guidelines on Cybersecurity for the Financial Sector (provisional English translation)

2024-10-04

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: Specific requirement
Verification controls (customer or staff): General mention

What it says

Training: 2.3.2 (1) Regularly provide cybersecurity awareness education and training to all officers and employees, including senior management, tailored to their roles and responsibilities. (4) Regularly provide education and training to personnel in IT and security departments to maintain up-to-date knowledge and skills regarding evolving threats and countermeasures
Testing staff: Footnote 16: Examples of KPIs: reporting rate for targeted email training, vulnerability response rate, progress rate of information asset inventory, training participation rate, etc. 2.2.5 (1) Regularly conduct exercises and training ... to verify the effectiveness of the organization's cyber incident response plan and contingency plan
AI and social engineering: 2.3.2 (3) Implement initiatives to raise customer awareness of cybersecurity threats and promote cybersecurity awareness, as needed (e.g., posting phishing alerts on the website). AI, deepfake, voice: silent.
Verification: Strictly control and manage the use of privileged accounts (e.g., multi-factor authentication, dual-control for operations, time-based access restrictions).
Sections: 1.2.2 senior management (d) report at least twice a year on KPIs and KRIs; footnotes 16, 17; 2.2.5 Exercises and Training; 2.3.1 authentication (1); 2.3.2 Education and Training
Applies to: All financial institutions supervised by the FSA

Read the source document

Malaysia1 document

BNM

Binding · Rule

Policy Document: Risk Management in Technology (RMiT) (BNM/RH/PD 028-98)

2026-09-25 (issued); effective 2025-11-28 for the November 2025 revision, with exceptions

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Specific requirement
Sets frequency: Specific requirement
Board reporting: Specific requirement
Verification controls (customer or staff): General mention

What it says

Training: S 15.1 A financial institution must provide adequate and regular technology and cybersecurity awareness education for all staff in undertaking their respective roles and measure the effectiveness of its education and awareness programs. This cybersecurity awareness education must be conducted at least annually and must reflect the evolving cyber threat landscape and emerging risks.
Testing staff: S 11.16 A financial institution must conduct an annual cyber drill exercise to test the effectiveness of its CIRP including the out-of-band communication methods, based on various current and emerging threat scenarios (e.g. social engineering), with the involvement of key stakeholders including members of the board, senior management and relevant third party service providers. The result of the annual cyber drill exercise must be reported to the board in a timely manner. S 11.6 A financial institution must conduct a realistic Red Team simulation attack on its infrastructure at least once every three years
AI and social engineering: S 12.5 ... (a) adopt secure communication channel to mitigate risk of phishing. Footnote 37: A financial institution must remove any clickable hyperlinks in short messaging service (SMS) messages to customers and create awareness on this change to mitigate risk of phishing. S 12.5 (c) practical ways for customers to verify the authenticity of calls made by the financial institution. AI and deepfake: silent.
Verification: S 10.55 A financial institution must employ a multi-factor authentication (MFA) that can defend against social engineering attacks for authenticating user access to critical systems. ... (ii) ensure user credentials provisioned with robust identity verification method to prevent impersonation risks
Sections: S 8.4 (board updates, board participates in awareness training); S 10.55; S 11.6; S 11.16; S 12.1(b); S 12.5; S 12.7; footnote 37; S 15.1 to 15.3
Applies to: Licensed banks, investment banks, Islamic banks, insurers, takaful operators, DFIs, e-money issuers, DPS operators, merchant acquirers, remittance intermediaries

Read the source document

New Zealand2 documents

RBNZ

Guidance · Guidance

Guidance on Cyber Resilience

2021-04 (April 2021; published 28 April 2021)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: A3.3 The entity should develop and maintain a programme for continuing cyber resilience training for staff at all levels, including the board and senior management, throughout each phase of the employment lifecycle (in other words, recruitment, on-boarding, training and development, and off-boarding) and in line with recognised industry standards for cybersecurity. A3.3.1 The training should include current cyber threats, attack tactics, and appropriate incident responses.
Testing staff: silent on staff testing. B3.7 The entity should conduct security tests on their systems and networks to detect weaknesses that could be exploited by a cyberattack
AI and social engineering: silent (phishing, social engineering, email, telephone, deepfake, AI do not appear)
Verification: silent
Sections: Introduction; A1.7; A2.5; A3.1 to A3.3.2; B3.3; B3.7
Applies to: Registered banks, licensed NBDTs, licensed insurers, designated FMIs

Read the source document

RBNZ

Guidance · Consultation

Deposit Takers (Operational Resilience) Standard 2027, Guidance Note (consultation draft)

2026-06 (June 2026 consultation draft)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: silent (no training or awareness requirement located in the draft guidance note)
Testing staff: silent on staff testing. Para 66: Clause 17(1) requires a deposit taker to regularly monitor, review, and test its internal controls.
AI and social engineering: Box 1: We also expect deposit takers to consider external risks arising from the use of AI by malicious actors, where these could affect the continued delivery of critical operations. This could include consideration of whether AI-powered phishing, social engineering, fraud, credential compromise, malware development, cyber reconnaissance, deepfakes, or other forms of malicious activity could increase the frequency, scale, speed or sophistication of attacks against the deposit taker or its service providers.
Verification: silent
Sections: Box 1 Artificial Intelligence and the operational resilience of critical operations (p.21); paras 66, 68, 97.3
Applies to: Deposit takers

Read the source document

Philippines1 document

BSP

Binding · Rule

Circular No. 1213 Series of 2025: Amendments to Regulations on IT Risk Management to Implement Section 6 of the Anti-Financial Account Scamming Act (AFASA)

2025 (Monetary Board Resolution No. 521 dated 22 May 2025; issued June 2025)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: General mention
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent on staff training (customer education only: educational and awareness campaigns to help customers familiarize themselves with the platform's security features, understand the risks and common fraud schemes targeting financial consumers)
Testing staff: silent
AI and social engineering: (vi) Limitation on the use of interceptable authentication mechanism (e.g. One-Time Pins [OTPs] via SMS and email). With the increasing prevalence of social engineering attacks aimed at obtaining login credentials, BSFIs should limit the use of authentication mechanisms that can be shared to, or intercepted by, third parties unrelated to the transaction.
Verification: verify the identity of the recipient of fund transfers ... information necessary for payee verification (customer-facing payee verification; and a coordinated verification process for disputed transactions)
Sections: Section 1 amending MORB 148 definitions (p. Phishing xxx; s. Spear phishing xxx retained); authentication controls (vi); fraud management system provisions; consumer awareness program (Section 4.3.3 and Annex C of Appendix 79/Q-66 referenced)
Applies to: BSP-supervised financial institutions; fraud management system thresholds for BSFIs with high aggregate transaction values

Read the source document

Singapore4 documents

MAS

Binding · Rule

Notice FSM-N06 on Cyber Hygiene (banks) (successor to Notice 655, cancelled 10 May 2024)

2024-05-09 (issue); effective 2024-05-10

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent
Verification: silent on payment verification. Defines multi-factor authentication as the use of two or more factors to verify an account holder's claimed identity (requirement applies to administrative accounts and customer login).
Sections: Notice FSM-N06 sections I to II and requirements on administrative accounts, security patches, security standards, network perimeter, malware protection, multi-factor authentication
Applies to: Banks in Singapore (parallel notices for other FI classes)

Read the source document

MAS

Guidance · Guidance

Technology Risk Management Guidelines

2021-01-18

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Specific requirement
Board reporting: General mention
Verification controls (customer or staff): General mention

What it says

Training: 3.6.1 A comprehensive IT security awareness training programme should be established to maintain a high level of awareness among all staff in the FI. The content of the training programme should minimally include information on the prevailing cyber threat landscape and its implications, the FI's IT security policies and standards, as well as an individual's responsibility to safeguard information assets. 3.6.2 The training programme should be conducted at least annually for all staff, contractors and service providers who have access to the FI's information assets.
Testing staff: 13.3.1 The FI should carry out regular scenario-based cyber exercises to validate its response and recovery, as well as communication plans against cyber threats. These exercises could include social engineering, table-top, or cyber range exercises. 13.4.1 The FI should perform an adversarial attack simulation exercise to test and validate the effectiveness of its cyber defence and response plan against prevalent cyber threats.
AI and social engineering: Footnote 29: Social engineering is a process in which cyber criminals manipulate an unsuspecting person into divulging sensitive details such as passwords through the use of techniques such as phishing, identity theft and spam. 14.1.6 The FI should actively monitor for phishing campaigns targeting the FI and its customers. AI and deepfake: silent.
Verification: 14.2.10 Where alternate controls and processes (e.g. maker-checker function) are implemented for corporate or institutional customers to authorise transactions, the FI should perform a security risk assessment of controls or processes
Sections: 3.1.7; 3.6.1 to 3.6.4; 13.2; 13.3.1; 13.4.1; 13.5; 14.1.6; 14.2.10; footnote 29
Applies to: All financial institutions

Read the source document

MAS and IMDA

Guidance · Guidance

Guidelines on Shared Responsibility Framework (phishing scams)

2024-10-24 (issue); effective 2024-12-16

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent
Testing staff: silent
AI and social engineering: Phishing scam definition: the scammer, pretending to be the impersonated entity, uses a digital messaging platform (e.g., SMS, email, WhatsApp, social media platforms). Deepfake, AI, voice calls: silent.
Verification: 4.2.5 ... the responsible FI must: (a) Block the online banking payment transaction that would result in the crossing of the threshold set out in footnote 8, and all subsequent online banking payment transactions to the scammer until it is able to obtain further verification from the account holder; or (b) Send notification to the account holder, and block or hold for at least 24 hours
Sections: 1.1 to 1.3; phishing scam definition; 4.2.1 (12-hour cooling off); 4.2.2 to 4.2.4 (real-time alerts, reporting channel); 4.2.5 (real-time fraud surveillance); 5.2 (telco SMS duties)
Applies to: Banks and relevant payment service providers issuing protected accounts; mobile network operators

Read the source document

MAS

Guidance · Information paper

Information Paper: Cyber Risks Associated with Deepfakes (MAS/TCRS/2025/06)

2025-09 (published 18 September 2025)

YesStaff trained or tested on AI or deepfakes

YesStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Specific requirement

What it says

Training: 2.2.2 A. Conduct staff and customer awareness campaigns on deepfakes and GenAI-enabled phishing. ... II. FI staff should also be trained to watch out for suspicious requests for sensitive information as well as urgent or unusual demands for money transfers, and to challenge suspected impersonations by verifying the authenticity of caller through a separate and trusted communication channel.
Testing staff: 2.2.2 A.I. On top of phishing exercises, FIs could conduct regular video and voice deepfake simulation exercises on employees. These exercises can be integrated into user awareness campaigns, where staff are conditioned to detect common signs of deepfakes
AI and social engineering: 2.2 Deepfake technology amplifies the potential for social engineering and impersonation scams. Case E: In January 2024, fraudsters used deepfake technology to target an employee ... the fraudsters were able to create deepfake videos of them for use in a video conference to social engineer the employee.
Verification: 2.2.2 D. Strengthen processes and controls for high-risk transactions and for FI staff in high privileged roles through additional verification and separation of duties (SoD). ... For example, if the request is made via video call, it is advisable to confirm the call's legitimacy by contacting the individual through a different medium, such as an in-person conversation. ... SoD can be further supported by implementing role-based access control (RBAC), dual control, and conducting regular audits.
Sections: 1 Introduction; 2.1 Defeating biometric authentication (2.1.2 C red team deepfake testing); 2.2 Social engineering and impersonation scams; 2.2.2 A to D; footnotes 36 (code words) and 37 (dual control); Appendix A
Applies to: All financial institutions

Read the source document

Bahrain1 document

CBB (Central Bank of Bahrain)

Binding · Rule

CBB Rulebook Volume 1 (Conventional Banks), OM-5.5 Cyber Security Risk Management

Added January 2020; expanded July 2021; OM-5.5.21 amended October 2022; OM-5.5.9 amended May 2026

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: General mention
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: OM-5.5.55 The licensee must ensure that all employees receive adequate training on a regular basis, in relation to cyber security and the threats they could encounter, such as through testing employee reactions to simulated cyber attack scenarios. All relevant employees must be informed on the current cyber security breaches and threats. Additional training should be provided to 'higher risk staff'. OM-5.5.56 The conventional bank licensees must ensure that role specific cyber security training is provided on a regular basis to relevant staff including: (a) Executive board and senior management; (b) Cyber security roles; (c) IT staff; and (d) Any high-risk staff as determined by the licensee.
Testing staff: OM-5.5.55 ... such as through testing employee reactions to simulated cyber attack scenarios. OM-5.5.54 Conventional bank licensees must evaluate improvement in the level of awareness and preparedness to deal with cyber security risk to ensure the effectiveness of the training programmes implemented.
AI and social engineering: OM-5.5.18(f) Use of a secure email gateway to limit email based cyber attacks such as malware attachments, malicious links, and phishing scams. OM-5.5.21(a) Limit the use of links in SMS and other short messages (such as WhatsApp) to messages sent as a result of customer request or action; (d) Create customer awareness campaigns to educate their customers on the risk of fraud related to links they receive in SMS, short messages and emails. No AI or deepfake wording.
Verification: silent for payment instructions (OM-5.5.21(c)(ii) 'prior notification to the customer such as through a phone call informing the customer to expect a link' concerns links, not payments)
Sections: OM-5.5.1 to 5.5.9 Role of the Board (OM-5.5.2(c) 'an organization-wide security awareness program'; OM-5.5.4 'Boards should receive comprehensive reports, in every Board meeting, covering cyber security issues such as the following: a. Key Risk Indicators/ Key Performance Indicators; ... c. Status of staff Information Security awareness; ... e. Results from penetration testing exercises'); OM-5.5.18 to 5.5.21A Prevention Controls; OM-5.5.50 (attack simulations, war games); OM-5.5.54 to 5.5.56 Training and Awareness
Applies to: Conventional bank licensees (Volume 2 carries a mirror module for Islamic bank licensees, e.g. OM-5.5.54 'Islamic bank licensees must evaluate improvement in the level of awareness')

Read the source document

Kuwait1 document

CBK (Central Bank of Kuwait)

Binding · Rule

Cyber and Operational Resilience Framework (CORF) v1.0

2025-12-03 (first release)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Specific requirement
Names phishing: Specific requirement
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Specific requirement
Sets frequency: Specific requirement
Board reporting: Specific requirement
Verification controls (customer or staff): Specific requirement

What it says

Training: 4.5.2.1. A security awareness and training program shall be established for all employees, contractors, and relevant third-party vendor staff. 4.5.2.2. The security awareness and training program shall be conducted upon hire and at least annually, covering topics such as information security policies, information security roles and responsibilities, relevant procedures, latest cybersecurity threats in the banking and financial sector. 4.5.2.4. Specialized awareness programs for the Board and Executive/ Senior Management shall be delivered at least annually.
Testing staff: 4.5.2.8. Regulated Entities shall assess and monitor the effectiveness of the security awareness and training programs through knowledge assessments and simulated social engineering attacks (e.g., mock phishing attacks/phishing simulations). 4.5.2.9. Regulated Entities shall retain relevant documented information as evidence of all conducted security awareness and training programs, including attendance records and assessment results.
AI and social engineering: 8.2.2.4. Fraud response playbook shall be developed ... These playbooks shall cover examples of fraud scenarios such as account takeover through phishing, SIM-swapping, or eSIM-related fraud (e.g., cloning of eSIM, unauthorized activation); unauthorized payment transactions; social engineering schemes using AI chatbots or spoofed banking applications; digital payment fraud involving Quick Response (QR) code manipulation or fake merchant accounts; synthetic identity fraud involving the use of AI-generated identities; and deepfake-enabled fraud. Toolkit criterion 55: Attempts for social engineering (Phishing, Vishing, SMShing, Social engineering incidents). 4.5.2.6. Regulated Entities shall conduct customer security awareness campaigns, at least quarterly, addressing potential cybersecurity threats and risks, including phishing, brand misuse, and fraud.
Verification: 8.3.1.3. Regulated Entities shall establish reliable and effective authentication measures by implementing strong Multi-Factor Authentication (MFA) controls to secure access and out-of-band verification methods to authorize critical actions, such as account activation, financial transactions (e.g., fund transfers, bill payments), and beneficiary addition
Sections: 7 Applicability; 4.1.2.5(e) Cybersecurity Steering Committee shall 'oversee cyber incident response readiness, post-incident reviews, and the effectiveness of the awareness program'; 4.1.4.7; 4.1.4.8 (Information Security function updates the Steering Committee at least quarterly); 4.5.2 Training and Awareness (4.5.2.1 to 4.5.2.10); 5.16.1.3(b) 'targeted social engineering or phishing campaigns'; 8.2.2.4; 8.3.1.3; Chapter 3 Toolkit criterion 55
Applies to: All CBK regulated entities (press release: local banks and financial institutions)

Read the source document

Saudi Arabia7 documents

SAMA (Saudi Central Bank)

Binding · Rule

Cyber Security Framework v1.0 (No. 381000091275)

2017-05-24

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: General mention
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: 3.1.6 Principle: A cyber security awareness program should be defined and conducted for staff, third parties and customers of the Member Organization. Control 4: The activities of the cyber security awareness program should be conducted periodically and throughout the year. Control 5: The cyber security awareness program should at a minimum include: ... c. information on relevant emerging cyber security events and cyber threats (e.g., spear-phishing, whaling). Control 6: The cyber security awareness program should be evaluated to: a. measure the effectiveness of the awareness activities; b. formulate recommendations to improve the cyber security awareness program.
Testing staff: silent
AI and social engineering: Only phishing-type terms appear, as examples: (e.g., spear-phishing, whaling) in 3.1.6 control 5c. No voice, SMS, deepfake or AI wording.
Verification: silent (payment verification is handled in the separate SAMA Minimum Verification Controls, see that row)
Sections: 3.1.6 Cyber Security Awareness; 3.1.7 Cyber Security Training; 3.1.4 Roles and Responsibilities (committee monitors 'cyber security programs (e.g., awareness program ...)' and 'the key risk indicators (KRIs) and key performance indicators (KPIs) for cyber security'; CISO 'measuring and reporting the KRIs and KPIs on ... cyber security programs (e.g., awareness program ...)'); 3.1.1 (committee 'meeting frequency (minimum on quarterly basis)')
Applies to: All banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure operating in Saudi Arabia

Read the source document

SAMA (Saudi Central Bank)

Binding · Rule

Counter-Fraud Framework v1.0 (No. 000044021528)

2022-10-11

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: General mention
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: Specific requirement
Board reporting: General mention
Verification controls (customer or staff): General mention

What it says

Training: 4.3.1 Principle: Member Organisations should define and deliver an employee fraud training and awareness programme to enable employees to identify fraud and report it promptly. 4.3.1(b): Training should be provided to all employees at, or shortly after, onboarding and be refreshed at regular intervals. 4.3.1(e): Board and Senior Management should receive fraud training tailored to the seniority of the role.
Testing staff: 4.3.1(d): training must include a knowledge check to assess whether the employee has understood the content (knowledge test only; no simulation or social-engineering exercise required)
AI and social engineering: 4.3.2(c): Customer fraud awareness activity should be tailored to the current fraud trends impacting the Member Organisation and its sector, including but not limited to the fraud typologies observed and the point of compromise which led to the fraud (e.g., SMS, email, social media). Appendix B: Social engineering (e.g., capture of customer credentials; investment scams; purchase scams; invoice scams; advance fee scams). Impersonation (e.g., obtaining personal information to use for own benefit; assuming the identity of another to access products; impersonating a government body to obtain customer information). No AI or deepfake wording.
Verification: 4.4: Member Organisations should adopt a risk-based approach to authentication with higher risk instructions or activity subject to multi-factor authentication; listed high-risk activities include 'Adding or modifying beneficiaries' and 'Change of account holder details (e.g., address or contact details)'. (Customer-side authentication; no staff call-back or dual-control rule for payment instructions.)
Sections: 4.3 Training and Awareness (programme 'conducted periodically and throughout the year', updated 'at least annually'); 4.3.1 Employee Fraud Training and Awareness (a to h); 4.3.2 Customer Fraud Awareness; 3.6 Management Information (b: 'Fraud Management Information should be reported to Senior Management and the CFGC on a periodic basis and on an ad hoc basis as required'); 4.4 Authentication; 4.6 Fraud Prevention Standards; Appendix B
Applies to: Rulebook header: Banking Sector. Framework 1.4 Applicability: 'all Member Organisations operating in Saudi Arabia based on SAMA discretion'. Finance companies and PSPs are addressed separately by the 2025 Counter-Fraud Fundamental Requirements (next row).

Read the source document

SAMA (Saudi Central Bank)

Binding · Rule

Counter-Fraud Fundamental Requirements (Circular No. 106897184)

2025-04-14 (effective 2026-04-13)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: General mention
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: General mention
Verification controls (customer or staff): General mention

What it says

Training: 3.2.5: Member Organizations should periodically conduct Counter-Fraud training to ensure all employees are aware of their responsibilities under applicable Counter-Fraud Policies, Standards and Procedures; promote awareness of fraud risks; create a positive Counter-Fraud culture; and communicate the requirement to report any suspicions of fraud in a timely manner.
Testing staff: silent
AI and social engineering: 3.2.12: Member Organizations should educate customers on the channels they will use to communicate with them and not include clickable links in emails and SMS sent to customers. (Email and SMS named as attack channels; the words phishing, smishing, vishing, deepfake and AI do not appear.) Covering circular refers to 'emerging fraudulent methods'.
Verification: 3.2.8: higher-risk activities require 'multi-factor authentication before they are acted upon'.
Sections: 3.1.7 Management Information ('identify and implement reporting of appropriate Management Information to adequately inform Senior Management of Counter-Fraud risks and performance'); 3.1.8 new typology notification to SAMA; 3.2.5; 3.2.6 customer awareness; 3.2.7-3.2.8 authentication; 3.2.12
Applies to: Finance Sector; Payment Systems and Payment Services Providers (finance companies and PSPs). Mandatory list: 'Member Organizations offering digital payment services that offer the means to send and receive funds; Credit Cards; Microfinance; Buy Now Pay Later (BNPL) Services; or safeguarding funds on behalf of customers'. 'Member Organizations not included in the mandatory list above should take a risk-based approach to the implementation of the additional requirements.' Banks are not addressed (they fall under the 2022 Framework).

Read the source document

SAMA (Saudi Central Bank)

Binding · Rule

Minimum Verification Controls (No. 202200000245)

2022-04-21

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Specific requirement

What it says

Training: silent
Testing staff: silent
AI and social engineering: silent
Verification: 4.10: One Time Password in one channel and using different delivery channel should be used for following transactions: a. Any transaction between wallets exceeding (Defined Value) as a daily limit (for first time as minimum for each beneficiary) b. transfer to IBAN (for first time as minimum for each beneficiary) c. international transfer (for first time as minimum for each beneficiary) d. high risk transactions based on company assessment and use cases. 4.11: SMS notification should be sent to users for all transactions and user account changes.
Sections: 2 Statement of Applicability; 3 Registration/Onboarding Controls; 4 General Controls (4.8 MFA each login, 4.9 OTP, 4.10 out-of-band OTP, 4.11 SMS notification)
Applies to: Finance Sector; Payment Systems and PSPs; Money Exchange Sector; Regulatory Sandbox. 2. Statement of Applicability: 'any member organization that provide E-wallet, lending products, crowdfunding or other fintech business model under SAMA supervision'. Not banks.

Read the source document

NCA (National Cybersecurity Authority)

Binding · Rule

Essential Cybersecurity Controls ECC-2:2024

2024 (replaces ECC-1:2018)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: 1-10-1: A cybersecurity awareness program, delivered through multiple channels, shall be periodically developed and approved by the entity to strengthen the awareness about cybersecurity, cyber threats, and risks, and to build a positive cybersecurity awareness culture. 1-10-3: The cybersecurity awareness program shall include how to protect the entity against the most important and latest cyber risks and threats, including: 1.10.3.1 Secure handling of email services, especially phishing emails. 1.10.3.2 Secure handling of mobile devices and storage media. 1.10.3.3 Secure Internet browsing. 1.10.3.4 Secure usage of social media. 1-10-4: Specialized skills and necessary training shall be provided to personnel in positions that are linked directly to cybersecurity within the entity ... 1.10.4.3 Executive and supervisory positions.
Testing staff: silent for staff (2-11 Penetration Testing objective: 'simulation of actual cyber-attack methods and technologies to discover unknown weaknesses')
AI and social engineering: 1.10.3.1 Secure handling of email services, especially phishing emails. 2.4.3.1 Analyzing and filtering email messages (specifically phishing emails and spam emails) using modern and advanced email protection techniques and mechanisms. No voice, SMS, AI or deepfake wording.
Verification: silent
Sections: Scope of Work and Applicability; 1-9-4 (awareness during on-boarding and during employment); 1-10 Cybersecurity Awareness and Training Program (1-10-1 to 1-10-5); 2-4-3; 2-11
Applies to: Government agencies and their affiliates, and 'all private sector entities owning, operating, or hosting Critical National Infrastructures (CNIs)'; 'The NCA strongly encourages all other entities in the Kingdom to leverage these Controls'. Financial institutions are in scope only where they are CNI.

Read the source document

SAMA (Saudi Central Bank)

Guidance · Guidance

Financial Entities Ethical Red-Teaming Framework (FEER) (Circular No. 562240000067)

2019-05-13

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Specific requirement
Names phishing: General mention
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent
Testing staff: 1.1: Red Teaming is not a penetration test. In contrast to a penetration test (in which one or more specific information assets are tested and assessed), it focuses on replicating a targeted and realistic attack against the entire Member Organization performed in a controlled manner. Kill-chain description: Delivery: The transmission of the crafted attack to the victims by the use of different means, such as: email (attachments), phishing, websites, physical devices or social engineering.
AI and social engineering: Glossary: Social Engineering A general term for attackers trying to trick people into revealing sensitive information or performing certain actions, such as downloading and executing files that appear to be benign but are actually malicious. Ref: ( NIST SP 800-114 ). No AI or deepfake wording.
Verification: silent
Sections: 1.1 Introduction; 1.2 Objective; kill-chain description (Delivery); Glossary
Applies to: Banking Sector; Finance Sector; Payment Systems and PSPs; Credit Bureaus

Read the source document

SAMA (Saudi Central Bank)

Guidance · Circular

Circular: Using Instant Chat Applications to Communicate with Customers (No. 000046025849)

2024-10-29

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: educate the employees of the financial institution about the contents of the above instructions
Testing staff: silent
AI and social engineering: Not to use instant chat applications such as WhatsApp and similar applications in communicating with customers, and to consider them unreliable channels
Verification: silent
Sections: Circular body
Applies to: All financial institutions under SAMA supervision

Read the source document

UAE4 documents

CBUAE (Central Bank of the UAE)

Binding · Rule

Consumer Protection Standards (Notice 1158/2021, under Consumer Protection Regulation Circular 8/2020)

2021 (amended by Notice 2535/2022)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: 6.1.1.9 Licensed Financial Institutions must provide employee training and awareness programs on their Data control framework for accessing and handling Consumer Data and reporting security and policy breaches. The Licensed Financial Institution must promote the importance of protecting Consumer's Data as an ongoing responsibility of Staff with reminders sent on an annual basis. 6.2.1.15 Licensed Financial Institutions must provide adequate and up to date Staff training on its control framework to ensure Consumers' assets are securely handled.
Testing staff: silent
AI and social engineering: silent on phishing, voice, SMS, AI. (Customer-facing: 6.2.1.6 Licensed Financial Institutions must undertake Consumer education initiatives and undertake fraud awareness campaigns every year and more frequently if there is evidence of heightened fraudulent activity.)
Verification: silent
Sections: 6.1.1.9; 6.2.1.6; 6.2.1.7; 6.2.1.15
Applies to: All Licensed Financial Institutions

Read the source document

CBUAE (Central Bank of the UAE)

Binding · Rule

Standards for the Regulations Regarding Licensing and Monitoring of Exchange Business, Chapter 11 Fraud Management (Notice 35/2018 STA)

2018

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: General mention
Sets frequency: Specific requirement
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: 11.5.1 The Licensed Person must ensure that: a) appropriate and documented anti-fraud training is provided to all employees; b) two such trainings are provided to employees during the first year of their employment and annual training is given thereafter; c) training is provided to prevent fraud incidents from taking place at the Licensed Person's business; d) training covers fraud typologies, fraud detection, fraud prevention, the Licensed Person's policies/procedures and reporting procedures at a minimum; and e) employees are assessed annually to test their understanding of fraud prevention measures.
Testing staff: 11.5.1(e) employees are assessed annually to test their understanding of fraud prevention measures (knowledge assessment, not simulation)
AI and social engineering: silent (11.1 defines internal and external fraud only)
Verification: silent
Sections: 11.1 Forms of Fraud; 11.5 Anti-Fraud Training (11.5.1, 11.5.2); Chapter 14 Information Security (14.7 IT Training page returned no security-awareness wording)
Applies to: Exchange houses (Licensed Persons) only

Read the source document

CBUAE (Central Bank of the UAE)

Binding · Rule

Retail Payment Services and Card Schemes Regulation, Article 13 Technology Risk and Information Security (Circular 15/2021)

2021-06-06 (effective)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent in Article 13 as retrieved (no awareness or training wording found)
Testing staff: Payment Service Providers whose monthly average value of Payment Transactions amounts to ten (10) million Dirhams or above shall regularly assess the necessity to perform penetration and cyber-attack simulation testing. Coverage and scope of testing shall be based on the cyber security risk profile, cyber intelligence information available, covering not only networks (both external and internal) and application systems but also social engineering and emerging cyber threats.
AI and social engineering: ... covering not only networks (both external and internal) and application systems but also social engineering and emerging cyber threats.
Verification: A Payment Service Provider shall select and implement reliable and effective authentication techniques to validate the identity and authority of its Retail Payment Service Users. Multi-factor authentication shall be required for high-risk transactions.
Sections: Article 13, Cyber Security Risk; Retail Payment Service User Authentication; Annex II Guidance
Applies to: Payment Service Providers; the testing obligation applies to PSPs 'whose monthly average value of Payment Transactions amounts to ten (10) million Dirhams or above'

Read the source document

CBUAE (Central Bank of the UAE)

Guidance · Guidance

Guidance Note on Consumer Protection and Responsible Adoption and Use of AI and ML by Licensed Financial Institutions

2026-02-11 (issued)

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: silent (training wording relates to AI model management: 'embed compliance measurers and training in all functions responsible for the use, management, and monitoring' of AI)
Testing staff: silent
AI and social engineering: The note addresses institutions' own use of AI, not AI-enabled attacks: 'LFIs should assess and try to utilise, where feasible, AI to identify potential fraud or criminal activity, anti-money laundering disparities or issues and potential suspicious activity through trends and patterns'. No deepfake, voice-clone or impersonation wording.
Verification: silent
Sections: Definitions (GenAI); section 6(e) fraud detection; section 8 Integration with Existing Frameworks
Applies to: Licensed financial institutions including insurance providers

Read the source document

UAE (ADGM)3 documents

FSRA (ADGM Financial Services Regulatory Authority)

Binding · Rule

General Rulebook (GEN) 3.5 Cyber Risk Management (FSRA Rules (Cyber Risk Management) 2025)

2025-07-29 (made); 'This Rule 3.5 takes effect on 31 January 2026'

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Specific requirement
Board reporting: Specific requirement
Verification controls (customer or staff): Silent

What it says

Training: 3.5.13 (1) An Authorised Person must establish and maintain a comprehensive Cyber Risk management training programme and adequate awareness arrangements. (2) The programme and arrangements in (1) must ensure that all relevant Employees: (a) receive training, at least annually, on the Authorised Person's Cyber Risk policies and standards; (b) develop and maintain appropriate awareness of, and competencies for, detecting and reporting Cyber Incidents; and (c) understand their individual responsibilities.
Testing staff: 3.5.14 (2) An Authorised Person must ensure that: (a) it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with Rules 3.5.5 to 3.5.13; (b) testing under the programme is carried out regularly, and in the case of internet-facing systems, at least annually. Guidance: 'vulnerability assessments; scenario-based testing; penetration tests; bug bounty programs; or red team exercises'.
AI and social engineering: silent (Guidance 3.5.13: 'The review should take into consideration the evolving nature of technology as well as emerging Cyber Risks')
Verification: silent
Sections: 3.5.3 Governance and Guidance ('The Governing Body should be regularly updated on current global cyber trends and be included in Cyber Risk training, cyber awareness campaigns'; 'Management information on Cyber Risk and mitigation measures should be presented to the Governing Body'); 3.5.13; 3.5.14 (3) 'regular reporting to senior management on the results of the monitoring and testing'
Applies to: FSRA Authorised Persons (parallel amendments to CIB, COBS, GLO, MIR, PIN, PRU)

Read the source document

FSRA (ADGM) Financial and Cyber Crime Prevention

Guidance · Alert

Notice FSRA/FCCP/33/2025 Cybercrime Prevention: Avoiding Phishing Attacks

2025-04-14

NoStaff trained or tested on AI or deepfakes

YesStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Specific requirement
Voice, SMS, chat: General mention
AI or deepfakes: General mention
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Specific requirement

What it says

Training: Firms must establish an enterprise-wide cybersecurity awareness program. Employees represent a significant cybersecurity risk, as inadvertent actions such as clicking on a link in a phishing email can lead to severe security breaches. Therefore, firms must ensure that cybersecurity awareness programs are implemented regularly to educate employees on recognizing and responding to phishing threats.
Testing staff: silent
AI and social engineering: Given the sophistication of modern phishing tactics and the advancement of artificial intelligence, phishing attacks are becoming harder to detect. A typical phishing attack involves the distribution of fraudulent emails or social media messages that solicit sensitive information. Watch out for emails that appear to originate from a high-ranking person within the organisation, particularly those requesting payment to a particular bank account.
Verification: Ensure employees are familiar with standard operating procedures for communication and transactions, both internally and with external partners. This includes recognizing common channels of communication, verifying requests through trusted methods (e.g., phone calls for financial transactions), and being aware of typical timelines for actions.
Sections: Notice body: The Growing Threat of Phishing; Recommended practices (awareness and training; internal reporting; digital footprint; Reinforce Standard Operating Procedures; 2FA; least privilege; backups)
Applies to: FSRA Authorised Persons and Recognised Bodies

Read the source document

FSRA (ADGM) Financial and Cyber Crime Prevention

Guidance · Alert

Notice FSRA/FCCP/15/2026 Cyber Risk Survey Findings and Recommendations

2026-01-22

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Specific requirement
Sets frequency: General mention
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: Firms should establish minimum standards for cyber security awareness training programmes, focusing on frequency, the content delivered and its effectiveness. This includes how to respond effectively when incidents occur or suspicions arise.
Testing staff: Larger and more complex organisations should implement advanced testing methods that simulate real-world attack scenarios. Survey Q15: What methods of adversarial testing does the firm employ? ... d) Social engineering exercises. Survey Q12: Does the firm conduct training for all employees on technology risk management / cybersecurity and cybercrime awareness / data protection practices? Yes/No - If yes, describe the scope of the training and frequency.
AI and social engineering: Employees often constitute the first line of defence against social engineering attacks. Effective security awareness training is not merely a compliance exercise but a critical component of operational resilience.
Verification: silent
Sections: 3. Protection of ICT Assets against Cyber Incidents (Key Takeaways and Recommendations); 4. Monitoring and Testing; 1. Governance ('Firms need to establish clear board-level representation and responsibility for cyber risk'); Appendix A Q12, Q15
Applies to: FSRA Authorised Persons and Recognised Bodies (survey: 315 firms, 263 respondents)

Read the source document

UAE (DIFC)1 document

DFSA (Dubai Financial Services Authority)

Binding · Rule

General Module (GEN) 5.5 Cyber Risk Management

2023-06-21 (made, RMI361/2023; in force 1 Jan 2024 per VER62/01-24); current module VER72/07-26

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: General mention
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: Specific requirement
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: GEN 5.5.14 (1) An Authorised Person must establish and maintain a comprehensive cybersecurity training programme and adequate awareness arrangements. (2) The programme and arrangements in (1) must ensure that all relevant Employees: (a) receive training, at least annually, on the Authorised Person's cybersecurity policies and standards; (b) develop and maintain appropriate awareness of, and competencies for, detecting and reporting Cyber Incidents; and (c) understand their individual responsibilities.
Testing staff: GEN 5.5.15: An Authorised Person must ensure that: (a) it has in place a comprehensive programme to test the resilience of its IT Systems and Networks and its processes and controls implemented to comply with GEN Rules 5.5.6 to 5.5.14; (b) testing under the programme is carried out regularly, and in the case of internet facing systems, at least annually. Guidance lists 'vulnerability assessments; scenario-based testing; penetration tests; and red team exercises'. No phishing or social-engineering test named.
AI and social engineering: silent (guidance 5.5.14: 'any other Employee who might otherwise be exposed to, or targeted by, a Cyber Incident')
Verification: silent
Sections: GEN 5.5.2 (framework reviewed at least annually); 5.5.4 and Guidance (Governing Body 'should be regularly updated on current global cyber trends and be included in cybersecurity training, cyber awareness campaigns'; 'the DFSA expects the Governing Body to be informed where a key performance indicator signals that a Cyber Risk control may be underperforming'); 5.5.14 and Guidance; 5.5.15 and Guidance
Applies to: All DFSA Authorised Persons

Read the source document

UAE (Dubai)1 document

VARA (Virtual Assets Regulatory Authority)

Binding · Rule

Technology and Information Rulebook (version 19 May 2025)

2025-05-19

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: General mention
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: Schedule 1 (Guidance), Risk category 1: Organisational, 3. Workforce security management standard: VASPs are expected to implement comprehensive workforce security controls, including but not limited to ... b. regular security awareness training specific to common threats;
Testing staff: silent for staff (incident capability: 'e. regular training and capability testing' refers to forensic investigation capability)
AI and social engineering: Schedule 1, User education standard: To reduce customer vulnerability to social engineering and other attacks through improved awareness, VASPs are expected to implement comprehensive user education programmes
Verification: Schedule 1 (Guidance): c. verification for high-value withdrawals outside of prescribed limits and/or 'bands'; d. verification for critical transactions; e. behavioural analysis to detect anomalous withdrawal patterns; and f. graduated approval requirements based on transaction value.
Sections: Part I.A (Technology Governance and Risk Assessment Framework, Rule I.A.1); Schedule 1 guidance risk categories (Organisational; Investigation capability; User education; withdrawal verification)
Applies to: All VASPs licensed by VARA in Dubai

Read the source document

European Union3 documents

European Parliament and Council (supervised by EBA, EIOPA, ESMA and national authorities)

Binding · Rule

Regulation (EU) 2022/2554 Digital Operational Resilience Act (DORA)

2022-12-14 (adopted); OJ L 333 27.12.2022

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Specific requirement
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: General mention
Verification controls (customer or staff): Silent

What it says

Training: Article 13(6): Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i). Article 5(4): Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.
Testing staff: silent (the strings 'social engineering' and 'phishing' do not appear anywhere in the Regulation text)
AI and social engineering: silent (Article 13(7): financial entities 'shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks')
Verification: silent
Sections: Article 5(2)(g) (management body shall 'allocate and periodically review the appropriate budget ... including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff'); Article 5(4); Article 13(5) ('Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3'); Article 13(6); Article 13(7); Article 16(1)(h) (simplified framework: 'develop, according to needs and ICT risk profile, ICT security awareness programmes and digital operational resilience training for staff and management'); Article 64
Applies to: EU financial entities (credit institutions, payment and e-money institutions, investment firms, insurers, CSDs, CCPs, trading venues, crypto-asset service providers and others listed in Article 2); simplified framework for Article 16 entities

Read the source document

European Commission (RTS drafted by ESAs)

Binding · Rule

Commission Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management framework and simplified framework under DORA Article 15 and 16(3))

2024-03-13 (adopted); OJ 25.6.2024

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: General mention
Staff testing: Silent
Names phishing: Silent
Voice, SMS, chat: Silent
AI or deepfakes: Silent
Measures effect: Silent
Sets frequency: General mention
Board reporting: Silent
Verification controls (customer or staff): Silent

What it says

Training: Article 28(2)(e) (simplified framework): the management body ... allocates and reviews at least once a year the budget necessary to fulfil the financial entity's digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training and ICT skills for all staff;
Testing staff: silent (no 'social engineering' or 'phishing' string in the RTS; 'awareness' otherwise appears only as vulnerability awareness in Article 10(2)(a))
AI and social engineering: silent
Verification: silent
Sections: Article 10(2)(a) vulnerability management ('identify and update relevant and trustworthy information resources to build and maintain awareness about vulnerabilities'); Article 28(2)(e)
Applies to: EU financial entities under DORA; Chapter on simplified ICT risk management framework for Article 16 entities

Read the source document

ESAs (EBA, EIOPA, ESMA)

Guidance · Information paper

ESAs factsheet 'Online financial frauds and scams in an Artificial Intelligence world' (with companion crypto factsheet)

2025-12-15

NoStaff trained or tested on AI or deepfakes

NoStaff verify payments through a separate channel

Staff training: Silent
Staff testing: Silent
Names phishing: General mention
Voice, SMS, chat: Specific requirement
AI or deepfakes: Specific requirement
Measures effect: Silent
Sets frequency: Silent
Board reporting: Silent
Verification controls (customer or staff): General mention

What it says

Training: silent (consumer-facing)
Testing staff: silent
AI and social engineering: Online financial frauds and scams are not new, but Artificial Intelligence (AI) has made them smarter and harder to spot. Criminals now use fake messages and websites, false celebrity profiles, and even AI-generated voices or videos that look like your banker, your friends or your family to trick you. They often reach out to you via social media, messaging apps, emails and unexpected calls that sound real. Warning signs: Intonation that sounds unnatural, lacks pauses and seems overly fluent or robotic. Pay attention to 'voice cloning', although AI generated speech may also sound very natural. ... These are often AI-generated videos (deepfakes). Stay alert to existing online financial fraud and scams powered by AI e.g. impersonation, phishing, investment and insurance scams
Verification: Check the source/identity carefully: Always verify where messages, calls, emails, and links come from ... call or text your family and friends using a known number via a trusted channel ... Agree with your family on a 'safe word' - a secret phrase you can use to confirm identity if someone with a familiar voice calls you with an urgent request for money
Sections: Factsheet pages 1 to 3 (Warning signs; Steps to protect yourself)
Applies to: Consumers (published to 'help consumers protect themselves from crypto and other online frauds and scams')

Read the source document

The full report

Every document scored, every quote, and what to do before the rule arrives.

Get your regional briefing

Research, not legal advice. Scores reflect each document's published text as reviewed in October 2026. Report an error: hello@vigilsecurity.io