AFM Report Highlights AI and Third-Party Risks for Dutch Finance
Dutch Regulator Warns Financial Firms of Growing AI and Cyber Risks
Related Entities
Organizations
Products & Tech
Other
Full Report
Executive Summary
On November 9, 2026, the Dutch Authority for the Financial Markets (AFM), the Netherlands' financial conduct regulator, published a report detailing growing IT-related risks within the financial services sector. The report highlights two primary areas of concern: the rapid adoption of Artificial Intelligence (AI) and the pervasive reliance on outsourced, third-party IT providers. The AFM is urging financial firms to bolster their cyber resilience by establishing formal policies for responsible AI use and enhancing their oversight of IT supply chains. The regulator reiterated that accountability for data protection and sound business operations cannot be outsourced and remains with the financial institution.
Regulatory Details
The AFM's report is based on findings from early November 2026 and serves as a supervisory update for the Dutch financial sector. The key concerns and directives include:
Responsible AI Adoption
The AFM acknowledges the competitive pressure to adopt AI but warns that it must be done responsibly. It calls on firms to develop and implement clear policies that address:
- Data Reliability: Ensuring the data used to train and operate AI models is accurate and unbiased.
- Client Transparency: Being transparent with clients about when and how AI is being used in service delivery.
- Employee Knowledge: Ensuring employees understand the capabilities and limitations of the AI tools they use.
Third-Party IT Risk Management
The report expresses significant concern over the common practice of outsourcing critical IT functions, often to a small number of large providers. The AFM noted that many financial firms have limited internal IT security staff, making effective vendor oversight challenging. The regulator emphasized that under Dutch law, including the Act on the Financial Supervision (Wet op het financieel toezicht), financial firms are legally obligated to manage their operations to ensure controlled and sound business practices. This obligation extends to outsourced services. Firms must be able to demonstrate that they are actively monitoring their IT providers and ensuring those providers comply with all relevant regulations, such as the GDPR.
Affected Organizations
The AFM's guidance applies to all financial service providers operating under its supervision in the Netherlands. This includes banks, investment firms, insurance companies, and other financial institutions. The report's findings are particularly relevant for small to medium-sized firms that may lack the resources for a dedicated, in-house cybersecurity team and are therefore more reliant on third-party vendors.
Impact Assessment
The report signals a heightened focus from the AFM on cybersecurity and operational resilience. Financial firms in the Netherlands can expect increased scrutiny of their IT risk management frameworks, particularly concerning AI governance and vendor management. Failure to demonstrate adequate controls could lead to regulatory intervention, enforcement actions, and potential fines. The report also serves as a warning about the systemic risk posed by concentration in the IT provider market; a significant incident at a major cloud or software provider could have cascading effects across the entire financial sector. This aligns with the principles of forthcoming regulations like the EU's Digital Operational Resilience Act (DORA), which places stringent requirements on managing third-party ICT risk.
Compliance Guidance
Financial service providers in the Netherlands should take the following steps in response to the AFM's report:
- Conduct an AI Risk Assessment: Inventory all current and planned uses of AI within the organization. Assess the risks associated with each use case, focusing on data privacy, model accuracy, and ethical implications.
- Develop an AI Governance Framework: Formalize policies for the development, procurement, and deployment of AI systems, incorporating the AFM's recommendations on data reliability, transparency, and employee training.
- Review Third-Party Contracts: Re-evaluate all contracts with IT service providers. Ensure they include robust security requirements, rights to audit, and clear liability clauses for security incidents.
- Enhance Vendor Due Diligence: Implement a more rigorous due diligence process for new IT vendors and a continuous monitoring program for existing ones. This should include reviewing their security certifications (e.g., SOC 2, ISO 27001) and incident response capabilities.
Timeline of Events
MITRE ATT&CK Mitigations
Vulnerability Scanning
Regularly scan both internal and third-party systems to identify and remediate vulnerabilities, a key part of managing IT risk.
User Training
Ensure employees are trained on the risks and proper use of new technologies like AI.
Establish a formal process for third-party risk management, including due diligence, contract reviews, and continuous monitoring, as highlighted by the AFM.
D3FEND Defensive Countermeasures
In the context of managing third-party IT risk as highlighted by the AFM, implementing a strict Domain Trust Policy (D3-DTP) is essential. This goes beyond simple network access and involves defining and enforcing policies about which third-party domains and services can interact with the corporate environment. For financial firms, this means explicitly defining trust relationships with cloud providers and other vendors. It involves configuring identity providers to enforce conditional access policies, ensuring that access from a vendor's environment meets the firm's security standards (e.g., requiring MFA, device compliance). By codifying these trust relationships, firms can limit their attack surface and ensure that their security posture is not diluted by less secure third-party environments, directly addressing the AFM's concern about outsourced responsibility.
To address the risks of AI adoption, Application Configuration Hardening (D3-ACH) is a critical defensive measure. This involves developing and enforcing secure configuration baselines for all AI platforms and applications, whether developed in-house or procured from a vendor. For financial firms, this means disabling unnecessary features, enforcing strict access controls to AI models and training data, and configuring robust logging and monitoring to detect misuse or tampering. For example, access to model training APIs should be tightly restricted, and any changes to a production model should trigger an alert. This technique helps ensure that AI systems are deployed in a 'secure by default' state, mitigating risks related to data reliability and unauthorized access, which were key points in the AFM's report.
Timeline of Events
The Dutch Authority for the Financial Markets (AFM) published its report on financial sector risks.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.