Operational resilience, AI and fraud

Introduction

The Central Bank of Ireland’s latest regulatory outlook highlights an evolution in supervisory focus. Capital strength remains important, but regulators are also looking at how firms manage operational disruption, technology risk and fraud in an increasingly digital financial system. 

Operational resilience remains the Central Bank’s highest-rated risk. At the same time, the rapid adoption of artificial intelligence is raising new governance and model risk challenges. Fraud and financial crime are also rising as criminals exploit digital channels and AI-enabled social engineering. 

Several regulatory reforms will take effect between 2026 and 2027, increasing supervisory scrutiny across the sector, including the revised Consumer Protection Code, which is effective from late March 2026. These priorities also reflect broader global trends identified in the Organisation for Economic Co-operation and Development (OECD) Consumer Finance Risk Monitor 2026.

Across each sector, the Central Bank’s message is broadly consistent. Supervisors are not only focusing on isolated compliance exercises but also examining whether firms can demonstrate operational resilience, effective governance and strong customer protections in practice.

For financial institutions, this means preparing for closer scrutiny of how operational and technology risks are managed in practice.

Operational resilience

Operational and cyber resilience remains the Central Bank’s most severe risk category. As firms become more digital and operating models grow more complex, many critical services now rely on a small number of third-party technology providers. Cyber threats are also increasing as geopolitical tensions rise. Distributed denial-of-service attacks (DDoS) against Irish financial institutions grew significantly during 2025, and operational outages have become more common across the sector.

The Central Bank is also paying closer attention to concentration risk in cloud infrastructure. Four US providers now account for roughly 70% of the EU cloud market, creating potential systemic vulnerabilities if disruption occurs. The Digital Operational Resilience Act (DORA), which took effect in January 2025, introduces a framework for managing ICT risk across financial services.

Early supervisory observations suggest many firms have designed resilience frameworks but have not yet embedded them fully across their organisations. Common gaps include limited board oversight of technology risk, incomplete incident reporting processes and weak oversight of third-party ICT providers. Supervisors are increasingly focused on how these frameworks operate in practice. Firms that rely heavily on documentation rather than operational testing may struggle to demonstrate that critical services can continue during disruption.

Artificial intelligence and technology

Supervisors are also examining risks linked to artificial intelligence and advanced data modelling. As firms expand the use of AI in areas such as credit decisions, fraud detection and investment processes, regulators are paying closer attention to governance, explainability and model oversight.

The Central Bank has also been designated as the national authority responsible for overseeing the EU AI Act within the financial sector. This is likely to increase supervisory attention on how firms design, deploy and govern AI systems.

The regulator is expected to focus on three areas:

1. Governance and accountability
2. Explainability and model risk management
3. Conduct risks arising from automated decision-making

Many firms still treat AI primarily as an innovation initiative rather than a risk management issue. Regulators are increasingly examining how firms integrate AI oversight into existing governance and risk frameworks.

Consumer protection and financial crime

Consumer protection remains a central supervisory theme. The revised Consumer Protection Code takes effect in March 2026 and places greater emphasis on customer outcomes, digital service delivery and the treatment of vulnerable customers.

Financial crime is also a growing concern. Fraudulent payments in Ireland reached €57 million in 2024, driven largely by social engineering attacks. As digital financial services expand, regulators are encouraging firms to strengthen fraud detection, improve customer communication and address the root causes of recurring complaints.

Global alignment

For Irish regulated firms, the Central Bank’s priorities are not isolated domestic requirements but part of a broader international regulatory response to evolving risks in financial services. The OECD Consumer Finance Risk Monitor 2026, which gathered perspectives from 60 jurisdictions, highlights many of the same pressures emerging across financial systems.

Financial scams and fraud rank as the most significant risk globally. Around 85% of OECD jurisdictions identify fraud as a leading threat, with nearly 70% reporting increases during 2025. This closely mirrors developments in Ireland, where fraudulent payments reached €57 million in 2024. Both the OECD and the Central Bank highlight the growing role of artificial intelligence in enabling social engineering, phishing, deepfakes and other forms of digital fraud. Artificial intelligence is also emerging as a major governance challenge. The OECD reports similar concerns across multiple jurisdictions, including algorithmic bias, lack of transparency and data integrity risks as AI adoption accelerates.

Other risks identified globally include rising consumer debt, conduct-related risks such as ineffective disclosures, and financial exclusion linked to digital capability gaps. Many jurisdictions are responding through similar regulatory frameworks, including the Digital Operational Resilience Act (DORA), the EU Artificial Intelligence Act and the G20/OECD High-Level Principles on Financial Consumer Protection.