Skip to content
Vigil

Research report · Ready before the rule

The control no regulator requires (yet)

  • 0 of 29 binding rules require staff to be trained or tested on AI-enabled or deepfake attacks, and none requires staff to verify a payment request through a separate channel.
  • 26 of 28 regulator documents that name AI-enabled attacks are guidance, alerts or papers, not rules. Regulators in New York, Singapore and Abu Dhabi have already described what good looks like.
  • All 78 documents across North America, Asia-Pacific, the Gulf and the EU, scored on nine questions, with the exact quote and source link behind every score.

Get the full report

By submitting this form, you agree that Vigil Security may store and process your details to send you this report and to follow up with you about it. See our privacy policy.

What each of the 29 binding rules says about peopleStafftrainingStafftestingNamesphishingVoice,SMS, chatAI ordeepfakesMeasureseffectBoardreportingUSNYDFS Part 500USUS banking agencies (OCC, FDIC, Fed)USNCUA Part 748, Appendix AUSSEC Regulation S-PUSSEC Regulation S-IDUSSEC Regulation S-K Item 106USFTC Safeguards RuleAUAPRA CPS 234AUAPRA CPS 230AUScams Prevention Framework ActSGMAS Notice FSM-N06, cyber hygieneINSEBI CSCRFMYBNM RMiTfraud*PHBSP Circular 1213SASAMA Cyber Security FrameworkSASAMA Counter-Fraud FrameworkSASAMA Counter-Fraud Fundamental Req.SASAMA Minimum Verification ControlsSANCA ECC-2:2024AECBUAE Consumer Protection StandardsAECBUAE exchange business standardsAECBUAE Retail Payment Services Reg.AEDFSA GEN 5.5AEFSRA GEN 3.5AEVARA Technology RulebookBHCBB OM-5.5KWCBK CORFfraud*EUDORAEUDORA RTS 2024/1774SilentGeneral mentionSpecific requirement

Read the article first