Group of Seven finance officials have agreed to launch joint tabletop exercises designed to test how governments, central banks and financial institutions would respond to cyberattacks powered or accelerated by artificial intelligence. The decision was confirmed by Japanese Finance Minister Satsuki Katayama after meetings in Bangkok, where finance ministers and central bank governors were gathered alongside the IMF and World Bank annual meetings. The exercises are expected to simulate attacks on critical financial infrastructure and examine whether current response manuals are still sufficient.
Why the G7 is focusing on AI-enabled attacks
Cyber risk is not new to banks, exchanges or payment systems, but AI changes the speed and scale at which attacks can be prepared and executed. Automated tools can help attackers scan networks, write malicious code, generate convincing phishing messages and adapt tactics more quickly once defenders respond.
For regulators, the concern is less about one specific AI model than the possibility that automation lowers the cost of launching sophisticated campaigns. A disruption that once required a highly specialized team could become accessible to a much larger group of attackers.
Tabletop exercises test decisions, not just technology
A tabletop drill typically presents officials with a realistic crisis scenario and forces them to make decisions under time pressure. Participants may be asked how to isolate compromised systems, whether to halt trading, how to communicate with the public and when to involve law enforcement or national security agencies.
The goal is to expose gaps before a real crisis. A bank may have strong technical defenses but still lack a clear process for sharing information with a central bank. A government may have authority to coordinate a response but no tested procedure for restoring cross-border payments.
Private institutions could take part
Japanese officials said private financial institutions may be included depending on the scenario. That matters because most financial infrastructure is operated by commercial banks, payment companies, exchanges and technology vendors rather than governments themselves.
A realistic exercise therefore has to test how public and private actors exchange information while protecting sensitive data. Too little information can slow the response; too much uncontrolled disclosure can create panic or reveal vulnerabilities.
IMF warnings added urgency
The IMF has repeatedly warned that a major cyberattack can damage trust in financial institutions even when the immediate monetary loss is limited. If customers begin to doubt whether account balances, payment instructions or trading records are reliable, normal financial activity can slow rapidly.
AI increases concern because attackers may be able to create more convincing fraud, overwhelm support channels with synthetic communications or use automated agents to probe multiple institutions at once.
Traditional defenses may not be enough
Financial firms already invest heavily in firewalls, intrusion detection, identity controls and backup systems. Regulators now want to know whether those measures remain effective when attacks can change behavior quickly or generate large volumes of deceptive traffic.
The Bank of England and other regulators have begun examining “deep recovery” plans that assume normal cyber defenses fail. Those plans focus on how core services can be rebuilt from trusted data after a severe compromise.
Cross-border coordination is essential
Modern finance is deeply interconnected. A cyberattack on one major bank can affect counterparties in several countries, while disruption at a payment processor can delay transactions across multiple currencies.
The G7 framework allows authorities to test whether national crisis procedures fit together. Differences in reporting rules, privacy laws and emergency powers can slow a coordinated response if they have not been discussed in advance.
AI can also strengthen defense
The same technology that creates new threats can help defenders. Banks increasingly use machine learning to detect unusual payment patterns, prioritize security alerts and identify suspicious login behavior.
The challenge is that both attackers and defenders may be using AI at the same time. That creates an arms race in which speed, data quality and human oversight become critical.
Financial stability is the broader concern
Regulators are not treating cyberattacks solely as an information-technology problem. If a major incident causes payment delays, market closures or widespread uncertainty about financial records, it can become a financial-stability event.
That is why finance ministries and central banks, rather than only cybersecurity agencies, are directly involved in the planned G7 exercises.
What happens next
G7 authorities are expected to develop scenarios, identify participating institutions and compare results across jurisdictions. The findings could lead to revisions in incident-response manuals and new expectations for banks or market operators.
The exercises will not eliminate cyber risk. Their value will depend on whether weaknesses identified in the simulations are actually fixed before attackers exploit them in the real world.
Sources
- Reuters, Oct. 18, 2026
- Japanese Finance Minister Satsuki Katayama’s remarks in Bangkok
- IMF cybersecurity and financial-stability assessments
