The Bank of Japan's October 2026 Financial System Report states that 'advances in so-called "frontier AI" have further heightened cybersecurity threats' because they 'could increase the speed and scale of cyberattacks', and reviews progress on the nine short-term measures the FSA and BOJ jointly requested of financial institutions on 22 May 2026. It reports that Japanese institutions are assessing internet-facing systems such as internet banking against the nine-measure checklist, but gives no completion rate, and says the Bank will follow up through on-site examinations and off-site monitoring. It also cites a BOJ survey of around 150 institutions (April–May 2026) finding about 80% already using generative AI, rising above 90% counting trials.
OFFICIAL TEXT: boj.or.jp ↗ · FINAL · JAPAN FSA
| Document | BOJ Financial System Report (October 2026) — Financial System Report (October 2026) |
| Issued by | Financial Services Agency of Japan (with the Bank of Japan on frontier AI cyber measures) |
| Type | Report |
| Status | Final |
| Published | Oct 23, 2026 |
| Applies to | Japanese deposit-taking institutions generally; Bank of Japan semi-annual financial-stability assessment, not FSA supervisory guidance as such |
| Official source | boj.or.jp ↗ |
| Use cases | Cybersecurity · Generative & agentic AI |
What are the key points of BOJ Financial System Report (October 2026)?
- States frontier AI 'could increase the speed and scale of cyberattacks', continuing the warning behind the FSA/BOJ's 22 May 2026 nine-measure request.
- Reports institutions are assessing internet-facing systems (such as internet banking) against the nine short-term measures, without giving a completion rate.
- Says the Bank will follow up on institutions' progress through on-site examinations and off-site monitoring.
- Cites an April–May 2026 BOJ survey of roughly 150 institutions: about 80% already using generative AI, rising above 90% counting trials.
What did BOJ Financial System Report (October 2026) change for banks?
The first follow-up assessment of the 22 May 2026 nine-measure request — confirms institutions are engaging with the checklist but stops short of a completion report, which is the review the tracker has been watching for.
Have Japanese financial institutions completed the nine frontier-AI cyber measures the FSA and BOJ requested?
No completion rate has been published. The BOJ's October 2026 Financial System Report says institutions are assessing internet-facing systems against the nine-measure checklist, with the Bank following up through on-site and off-site monitoring.
| Date | Document | Status |
|---|---|---|
| May 22, 2026 | Japan FSA/BOJ frontier AI request — Request regarding 'Short-term Responses by Financial Institutions in Light of Threat Changes from Frontier AI' (「フロンティアAIによる脅威変化を踏まえた金融機関等の短期的な対応」に係る要請について) | In force |
| Mar 3, 2026 | Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector | Final |
| Mar 4, 2025 | Japan FSA AI Discussion Paper v1.0 — AI Discussion Paper (Version 1.0): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector | Superseded |
| Oct 30, 2026 | Machado interview with Bloomberg (Oct 2026) — Interview with Bloomberg — Pedro Machado | Final |
| Oct 23, 2026 | Division of Examinations FY2027 Priorities — Examination Priorities: Fiscal Year 2027 — Division of Examinations | In force |
| Oct 15, 2026 | FSB AI sound practices (final report, Oct 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report | Final |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning