BIS Report on FMI Cyber Resilience: Toolkit and Third-Party Risk

The institutions that clear, settle and record the world’s financial transactions are among the least visible and most important parts of the system. When one of them fails to operate, payments stop. On September 8, 2026, two global standard-setters released a pair of documents aimed at that risk. The Committee on Payments and Market Infrastructures (CPMI), which is hosted by the Bank for International Settlements (BIS), and the International Organization of Securities Commissions (IOSCO) published a cyber resilience toolkit for financial market infrastructures (FMIs) and a discussion paper on how FMIs rely on third-party service providers. Taken together, they form a BIS report on two pressure points that supervisors have been watching: attacks on the infrastructure itself and dependence on outside firms that run parts of it.

The toolkit

The first document is titled “Cyber resilience toolkit: practical considerations for FMIs.” Its stated purpose is to help FMIs strengthen their cyber resilience frameworks and to support them in implementing the operational resilience components of the CPMI-IOSCO Principles for Financial Market Infrastructures, known as the PFMI. Those principles are the international standard for payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories.

The toolkit is a set of voluntary, non-binding tools covering several broad topics relevant to cyber resilience. It is designed to complement the 2016 CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures. That earlier guidance set expectations; the new document is framed as practical considerations that firms can adapt to their own circumstances.

The voluntary character matters. A toolkit does not add requirements to the PFMI, and supervisors are not obliged to apply it. In international financial standard-setting, this type of material often serves as a reference that national authorities and operators draw on when they write their own guidance or examine their own practices. Its influence depends on whether firms and supervisors find it useful.

The discussion paper

The second document, “FMIs’ reliance on third-party service providers: challenges and risks,” takes a different approach. A discussion paper does not tell FMIs what to do. It identifies and examines what the committees call several key challenges related to the provision of third-party services to FMIs, with particular attention to critical services. It states that FMIs have increased their reliance on such providers, and it sets out questions for stakeholders.

The framing is clear. Third-party reliance is treated as a topic on which the standard-setters want input before they decide whether more work, and what kind, is warranted. The paper asks for feedback on the identified risks and on potential further engagement.

That sequence, a discussion paper followed by comments and then a decision about next steps, is how international bodies usually approach a subject where policy is still forming. It also means nothing in the paper should be read as a settled position of CPMI or IOSCO, and the questions it poses are the real content of the exercise: the committees want to know whether the risks are described correctly and what form any further engagement should take, and they have asked respondents to address both points.

Why the two documents belong together

Cyber resilience and third-party dependence are distinct topics, but they overlap. An FMI can invest heavily in securing its own networks and still be exposed through a provider that hosts data, operates software or runs connectivity on its behalf. The 2016 guidance and the PFMI both address operational risk; the new publications look at two places where that risk has become harder to manage, one inside the firm and one outside it.

The pairing also reflects how supervisors increasingly view operational resilience: as the ability of a critical function to continue through disruption, whatever the cause. A cyber attack and a failure at a service provider can produce the same result for users of a payment or settlement system, which is that the service is unavailable. Publishing the two documents on the same day invites FMIs and their stakeholders to consider them in combination.

Practically, an operator reading the toolkit alongside the 2016 guidance would be looking for ways to apply existing expectations, not new ones. The toolkit covers several broad topics, and because it is built to support the operational resilience parts of the PFMI, it is most useful to the teams responsible for showing supervisors that those principles are met. The discussion paper, by contrast, is aimed at a wider group, since service providers and participants are also affected by how reliance is managed.

The consultation

The committees are asking for comments on both documents by December 1, 2026. Submissions should be sent by email to the CPMI Secretariat and the IOSCO Secretariat. The window of roughly twelve weeks from publication gives FMIs, their participants, service providers and national authorities time to respond.

The respondents are likely to include the operators of payment systems and central counterparties, the cloud and technology providers that serve them, trade associations and central banks. The line between voluntary tools and any future expectations is the obvious question for respondents, because the toolkit is non-binding while the discussion paper leaves open whether further engagement is needed. How respondents answer will help determine whether the work stays advisory.

What to watch

After December 1, the committees will review the responses. The toolkit may be revised or left in place as a reference. The discussion paper may lead to further work, such as additional guidance or analysis, or it may conclude that existing standards suffice. Any decision would be announced through the BIS and IOSCO, and the documents themselves will remain available to operators who choose to use them in the meantime.

For central banks, which operate many of the world’s systemically important payment systems and oversee many of the rest, the outcome matters directly. Their own infrastructure faces the same threats and depends on the same kinds of outside providers. The publications are therefore both a contribution to international standards and a prompt for each central bank to look at its own arrangements.