Risk teams at payment institutions managing cyber-risk exposures from FMI-gateway operations and payment-system participation are increasingly relying on AI to update the cyber-risk register, populate operational-risk scenario libraries, generate risk-committee briefings, and prepare ICAAP/ORSA cyber-narrative blocks citing the CPMI-IOSCO 2016 framework. In practice, AI is used to update cyber-risk register entries for FMI-gateway exposures, populate operational-risk scenario libraries for payment-system cyber incidents, generate risk-committee briefings on CPMI-IOSCO 2016 expectations versus actual control state, and prepare ICAAP/ORSA cyber-narrative blocks citing the 2016 framework.
That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for payment-institution risk teams.
Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).
Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows payment-institution risk teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.
For payment-institution risk teams, the failure pattern is operationally consequential. A risk-committee briefing that records the 2016 guidance as containing an explicit NIST CSF citation misstates the international standard's actual framework references. An ICAAP/ORSA cyber-narrative that records the 2016 guidance as containing forensic-analysis-database operational depth overstates the specification level of the international standard. A scenario library that records the 2016 guidance as the unchanged operative standard at the reporting date misstates the regulatory horizon.
The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.
This is the consolidated view of findings. Click the Citation IDs or 'see details →' on any item for the full details for each finding.
For Risk teams at Payment Institutions, an asserted NIST CSF alignment of the 2016 guidance lands inside the programme-foundation evidence package as a regulator-grounded reference. The 2016 guidance does not contain the citation the model asserts. A deliverable that records the asserted alignment as the framework anchor for cyber controls or compliance attestation misstates the regulatory foundation of the programme and creates risk-framework accuracy exposure on subsequent supervisory or internal review.
For Risk teams at Payment Institutions, an asserted NIST CSF alignment of the 2016 guidance lands inside the programme-foundation evidence package as a regulator-grounded reference. The 2016 guidance does not contain the citation the model asserts. A deliverable that records the asserted alignment as the framework anchor for cyber controls or compliance attestation misstates the regulatory foundation of the programme and creates risk-framework accuracy exposure on subsequent supervisory or internal review.
For Risk teams at Payment Institutions, attributing 'secure the periphery, protect the core' to the 2016 guidance or to a 2018 fraud paper places a regulator strategic frame inside the deliverable with the wrong source attribution. The phrase is from a 2018 speech, not a guidance document. A control narrative, board paper, or training pack that rests on the wrong attribution carries direct review exposure as soon as the citation is tested.
For Risk teams at Payment Institutions, attributing 'secure the periphery, protect the core' to the 2016 guidance or to a 2018 fraud paper places a regulator strategic frame inside the deliverable with the wrong source attribution. The phrase is from a 2018 speech, not a guidance document. A control narrative, board paper, or training pack that rests on the wrong attribution carries direct review exposure as soon as the citation is tested.
For Risk teams at Payment Institutions, characterising the 2016 guidance as carrying forensic-analysis-database depth on incident response misreads the standard's level of operational specification and points the deliverable at the wrong source for operational depth. The granular content is in FSB 2020 'Effective Practices'. A programme design or attestation that anchors on the 2016 guidance for that level of detail understates the FSB 2020 gap supervisors will expect to see addressed.
For Risk teams at Payment Institutions, an asserted consistency between the 2016 guidance and the November 2018 FSB Cyber Lexicon collapses a two-year vocabulary gap into a single asserted alignment. A definitional reference in policy, KRI documentation, or control library tagging that uses the asserted alignment as evidence of vocabulary grounding imports terminology that may not match the 2016 source, and exposes the team on a definition-by-definition test against either document.
For Risk teams at Payment Institutions, an asserted consistency between the 2016 guidance and the November 2018 FSB Cyber Lexicon collapses a two-year vocabulary gap into a single asserted alignment. A definitional reference in policy, KRI documentation, or control library tagging that uses the asserted alignment as evidence of vocabulary grounding imports terminology that may not match the 2016 source, and exposes the team on a definition-by-definition test against either document.
For Risk teams at Payment Institutions, missing the May 2026 CPMI-IOSCO consultative document removes an open consultation from the regulatory horizon and misstates the operative status of the standard. A deliverable that records the 2016 guidance as standing without active revision will read as accurate until the consultation is surfaced by a supervisor or internal challenger, and the team is then explaining a missed regulator development that was public from May 2026 onward.
For Risk teams at Payment Institutions, missing the May 2026 CPMI-IOSCO consultative document removes an open consultation from the regulatory horizon and misstates the operative status of the standard. A deliverable that records the 2016 guidance as standing without active revision will read as accurate until the consultation is surfaced by a supervisor or internal challenger, and the team is then explaining a missed regulator development that was public from May 2026 onward.
Every finding on this page compares an AI subject's account of the rule against the regulator's verbatim text from the regulator's own portal. Both are linked. Each delta, its root causes, and impact analysis are documented and published with immutable Citation IDs.