AFM warns of cyber risk in financial markets
The regulator calls digital attacks a risk to institutions, market infrastructure and consumers.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
.jpg){kind=link}
The Netherlands Authority for the Financial Markets warns in Trendzicht 2027 that financial institutions and markets remain vulnerable to cyberattacks. The regulator published its annual risk report on Tuesday; it also identifies AI, geopolitical tensions and dependence on technology as key areas of concern.
The AFM uses Trendzicht to describe the main developments and risks facing the financial markets. The 2027 edition was published on 10 November, but its content reflects the situation as at 28 October. New events after that date are therefore not included in the report.
According to the regulator, cyber risks affect not only individual banks, insurers or investment firms. Trading platforms, payment systems, data centres and other parts of the financial infrastructure can also be affected. A disruption or attack can therefore have consequences for several parties at once, particularly when institutions depend on the same technology or supplier.
The warning comes in a broader European and Dutch context. The AFM has previously highlighted the need for better ICT recovery plans among asset managers and shortcomings in the preparations of trading platforms. In May, DNB wrote that geopolitical tensions increase the likelihood of cyberattacks and operational disruptions. The AFM now links those risks to its supervisory agenda for the coming period.
According to the regulator, artificial intelligence increases both capabilities and vulnerability. Financial firms use AI for internal processes, analysis and services, among other things. At the same time, new applications can introduce errors, dependencies and new avenues of attack. The AFM does not say that a specific attack is imminent and publishes no probability estimate for a systemic crisis.
For consumers, the warning may mean that the continuity of financial services depends not only on capital buffers and supervision of market conduct. Digital resilience, recovery procedures and arrangements with ICT suppliers are also decisive. For businesses, the publication may signal continued attention to cybersecurity, outsourcing and the use of AI. The report is a supervisory signal, not a prediction of a specific attack.
Both sides of the figures
▲ Bright spots
- The AFM systematically maps risks, which can help financial institutions improve their ICT recovery and reduce their dependence on suppliers.
- DNB reports that, despite vulnerabilities, banks have average Common Equity Tier 1 ratios of 15.7% in the scenario discussed.
▼ Concerns
- The AFM warns that disruptions can affect several financial parties simultaneously through shared infrastructure.
- DNB identifies geopolitical tensions and digital dependencies as factors increasing vulnerability.
Critical note
This is not an economic growth figure and says nothing about the scale or likelihood of a specific attack. Trendzicht 2027 is also based on the situation as at 28 October 2026.
Who notices what
- Businesses
- Financial firms may face additional costs for cyber resilience, recovery procedures and supervision.
- Households
- A serious digital disruption could temporarily make access to payments, investments or financial information more difficult.
- Investors
- Cyber incidents could disrupt trading and confidence in market infrastructure, but the AFM does not predict a specific market movement.
- Government
- Regulators must align supervision, crisis arrangements and digital resilience.
Every point comes from the article’s sources and was included in the fact check.
One story, several perspectives
What is established
- The AFM published Trendzicht 2027 on 10 November 2026.
- The AFM describes cyber risks, AI and technological dependence as supervisory themes.
- Earlier in 2026, DNB warned of cyber and operational risks amid geopolitical tensions.
Left
Arguments Emphasises that financial institutions and vital digital infrastructure have public consequences and therefore require stricter standards, shared frameworks and greater public oversight.
Values Collective security, consumer protection and limiting the power of large technology and financial companies.
Consequences Less risk that the costs of digital incidents are passed on to households or the government, but potentially higher compliance costs.
Centre
Arguments Emphasises risk-based supervision, sound recovery plans and cooperation between regulators, institutions and technology companies without banning every new application in advance.
Values Continuity, proportionality and institutional responsibility.
Consequences Greater resilience can go hand in hand with room for innovation, provided firms can demonstrate that they are prepared.
Right
Arguments Emphasises the responsibility of directors and market participants themselves, and warns against rules that unnecessarily slow innovation or competition.
Values Individual responsibility, enterprise and an efficient market.
Consequences More flexible supervision can accelerate innovation, but places the consequences of inadequate preparation more firmly on individual companies and their customers.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s core follows the current AFM publication and the additional DNB context. The text makes clear that it concerns risks and supervisory signals, not a prediction of a specific attack.
- confirmed The AFM published Trendzicht 2027 on 10 November 2026. — The AFM states the publication date on the Trendzicht page. source
- confirmed The publication reflects the situation as at 28 October 2026. — This is stated as a limitation on the AFM page. source
- confirmed In 2026, DNB warned of an increased likelihood of cyberattacks and operational disruptions. — This is stated in DNB’s press release on financial stability. source
Editor's note
It is certain that the AFM published Trendzicht 2027 on 10 November and identifies cyber resilience as a risk. The report reflects the situation as at 28 October and does not predict a specific attack.Sources
- Trendzicht 2027 — Autoriteit Financiële Markten
- Grotere kans op cyberaanvallen en marktcorrecties door geopolitieke onrust — De Nederlandsche Bank
More on this in Dutch media
- Het Parool — „afm cyberveiligheid”
- de Volkskrant — „afm cyberveiligheid”
- NU.nl — „afm cyberveiligheid”