The growing use of artificial intelligence (AI), reliance on external technology providers and emerging cyber threats are creating new vulnerabilities for Australia's financial system, prompting the Australian Prudential Regulation Authority (APRA) to strengthen its supervisory focus on operational resilience.
In its November 2026 System Risk Outlook, APRA warned that rapid advances in AI are changing the nature and scale of operational risks, both within financial institutions and across the wider economy.
The regulator said AI could amplify existing threats, introduce new vulnerabilities and increase the potential for disruption across institutions that depend on common technology platforms and service providers.
APRA's concerns extend beyond individual institutions' use of AI, with the regulator examining how technological developments could interact with financial market pressures and other sources of systemic risk.
As part of its forward-looking approach, APRA will use its 2027 System Stress Test to examine how AI-driven economic disruption could affect banks, superannuation funds, life insurers and the broader financial system.
The exercise will consider severe but plausible scenarios, including rapid AI adoption disrupting established business models and a sharp downward reassessment of AI-related asset valuations.
The inclusion of AI in the stress-testing agenda reflects concerns that the technology could influence financial stability through multiple channels, including changes in investment values, business models and economic activity.
APRA chair John Lonsdale said Australia's financial system remained resilient but warned that the environment was becoming more challenging.
"Australia's financial system remains resilient, but the risk environment is becoming less forgiving," said Lonsdale.
The report noted that persistent global uncertainty and the possibility of multiple shocks occurring simultaneously meant financial resilience could not be taken for granted.
APRA also highlighted the risks associated with financial institutions' reliance on material service providers.
These providers support critical operations across banking, insurance and superannuation, creating potential channels through which disruption could spread across multiple institutions.
The report found that 80 of the top 100 material service providers reported by APRA-regulated institutions were headquartered or had their principal operations outside Australia.
Some individual providers support institutions accounting for more than half of APRA-regulated financial assets, highlighting the potential concentration of operational dependencies.
APRA said it was working to improve visibility of these relationships and strengthen its oversight of system-wide dependencies.
The regulator warned that frontier AI is accelerating the identification and exploitation of software vulnerabilities, potentially reducing the time financial institutions and their service providers have to respond to cyber threats.
It also highlighted risks associated with autonomous AI agents taking actions beyond their authorised boundaries. As an example, APRA cited a June incident in which an OpenAI agent circumvented controls to access an Australian Government website.
While AI could also help institutions identify vulnerabilities and respond to cyber incidents more quickly, APRA said organisations would need effective safeguards and human oversight.
The regulator has been working with industry and other authorities to strengthen preparedness, including through industry roundtables involving more than 380 entities and 600 attendees.
APRA is also encouraging banks, insurers and superannuation funds to identify cryptographic systems that could become vulnerable to sufficiently advanced quantum computers.
The regulator said the transition to post-quantum cryptography could take years and require significant coordination, particularly where legacy systems and external service providers are involved.
It is encouraging institutions to identify vulnerable encryption across their systems, data and material service providers, allowing them to prioritise exposures and prepare for eventual replacement.
APRA's latest outlook points to a broader shift in prudential supervision, with greater attention on how financial institutions manage interconnected financial and operational risks.
Rather than focusing solely on individual technology failures, the regulator is examining how disruption could spread through common service providers, cyber vulnerabilities and changing economic conditions.
For banks, insurers and superannuation funds, this means ensuring that technology governance, third-party risk management, cybersecurity and crisis response arrangements can operate together during periods of severe disruption.
The report also highlights the importance of preparing for scenarios where several pressures emerge simultaneously, rather than relying on separate contingency plans for individual events.
As AI adoption accelerates and technology dependencies deepen, APRA is signalling that operational resilience will remain a central part of its oversight of Australia's financial system.
