G7 finance leaders approve tabletop exercises for AI-driven cyberattacks on banks

G7 finance ministers and central bank governors have approved tabletop exercises to prepare for AI-driven cyberattacks on the financial system, Japanese Finance Minister Satsuki Katayama told reporters on Thursday, according to a Reuters report carried by KFGO. The same plan was reported by Insurance Business, Techzine and The Star. The seven-nation group met on October 15 on the sidelines of the IMF's annual meetings in Bangkok.

What was agreed

Katayama said G7 finance deputies developed the idea of "tabletop exercises on frontier AI" and ministers approved it. G7 finance ministries and central banks will build scenarios that test how authorities would respond, and private financial institutions could join depending on the scenario. The results are meant to show whether existing response protocols work and to revise incident manuals where gaps appear. Reports give no start date and no published scenario details.

Why now

Reuters said the IMF warned earlier in the week that an AI-enabled attack on a critical service at a financial institution could undermine confidence. The Bank of England is working with banks on deep cyber-recovery options, and its deputy governor said banks can no longer assume their defences are immune to AI-enabled attacks.

What it is not

This is a planning exercise, not a response to a known attack. No incident was announced, and nothing in the reports points to a market impact. For small businesses the practical link is payments and card processing: if a bank or processor went down, merchants would feel it first. The exercises are about how regulators coordinate when that happens, and any rule changes would come later.

What a tabletop exercise is

A tabletop exercise is a structured simulation: officials sit in a room, are handed a fictional incident, and talk through who decides what, who is called, and what gets announced. No systems are attacked or shut down. Its value is finding gaps in the hand-offs between ministries, central banks and banks before a real event, which is why the stated goal is to revise manuals. Coverage of the plan says scenarios could include AI-boosted intrusions and attacks on AI infrastructure itself, though no scenario list has been published.

Who it touches

Banks, card networks and payment processors are the obvious participants if private firms join. For a restaurant, a contractor or a retailer, the exposure is concrete: card settlement, payroll runs and line-of-credit draws all depend on a handful of institutions staying online. A coordinated playbook for a multi-country outage would mainly decide how fast those services are restored and how clearly the public is told.

What to watch

• A start date and scenario outline, neither of which has been published.
• Whether private banks are named as participants.
• Any follow-up from the Bank of England, which has said it is working with banks on cyber-recovery options.

Sources: Reuters via KFGO, Insurance Business, Techzine. This is market information, not investment advice.