City 'must get serious on cybersecurity'

By the Editorial Team · Friday, October 23, 2026

Katharine Braddick, head of the Bank of England’s Prudential Regulation Authority, announced plans to enhance cybersecurity oversight and establish a new directorate focused on operational resilience in financial firms. These measures come in response to recent service disruptions and reflect a broader regulatory shift that also aims to reduce administrative burdens by reforming accountability frameworks.

The City of London’s new leading regulator has issued a strong caution regarding the cybersecurity measures of banks and insurers, highlighting growing concerns about vulnerabilities within the financial system. Katharine Braddick, who assumed leadership of the Bank of England’s Prudential Regulation Authority (PRA) in July, delivered her first major speech at Mansion House, where she announced that the PRA will substantially intensify its focus on operational and cyber resilience across financial firms.

Braddick revealed plans to establish a dedicated directorate within the PRA that will report directly to her, aimed at strengthening oversight of cybersecurity risks. Both the PRA and the Financial Conduct Authority (FCA) intend to initiate a consultation by the end of the year to better define regulatory expectations around emerging technological threats, drawing on growing expertise and experience in the area.

The call for heightened vigilance followed an outage at Google Cloud’s London-based computing operations earlier this week, which disrupted online services for several financial institutions, including Lloyds, HSBC, and Revolut. Revolut was notably affected, experiencing interruptions to card payments, money transfers, and ATM withdrawals, an incident that exposed weaknesses in the financial infrastructure’s resilience to digital failures.

Nikhil Rathi, head of the FCA, also addressed risks related to rapid technological change in a separate Mansion House speech. He pointed to innovations such as artificial intelligence, describing their impact as more widespread and disruptive than previously witnessed. Rathi emphasized that these developments exacerbate existing market threats, including extreme volatility, concentration risks, novel forms of market abuse, and increased cross-border financial crime, with technology acting as a catalyst amplifying these challenges.

Alongside these cybersecurity concerns, Braddick outlined forthcoming regulatory reforms concerning accountability frameworks in financial institutions. The PRA and FCA plan to scale back aspects of the senior managers and certification regime, a set of rules introduced after the 2007-09 financial crisis to enhance staff accountability. Proposed changes would eliminate the pre-approval requirement by regulators for a number of senior roles, easing hiring processes. Additionally, the certification regime covering approximately 139,000 junior staff positions is set to be dismantled, including the removal of an online public register of certified individuals.

Further adjustments include abolishing the obligation for firms to report first written warnings issued to staff for most roles. These reforms are projected to save firms an estimated £2 billion over the next decade by reducing the administrative burden associated with compliance.

Taken together, these announcements underscore a dual focus within UK financial regulation: strengthening cyber resilience amid technological disruption, while simultaneously streamlining oversight mechanisms for personnel accountability. Regulators appear to be balancing the need for robust protections against evolving digital threats with efforts to reduce regulatory costs for the sector.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.