Guidance on Cyber Resilience for Financial Market Infrastructures
Bank for International Settlements — Committee on Payments and Market Infrastructures (CPMI) (BIS-CPMI)
Research Complete
Hallucination findings published
AI Labs white paper available
Rich-narrative analysis of how AI models fail on this regulation, written for
AI model providers. Includes per-finding context and remediation framing.
This report documents hallucinations produced by frontier AI models when asked questions about the Guidance on Cyber Resilience for Financial Market Infrastructures, published in June 2016 by CPMI and IOSCO under the auspices of the Bank for International Settlements. Two...
Read white paper →
AI Failures: Hallucination and Blind Spots Shape
(8 Response Hallucination + 18 Citation Hallucination + 0 Blind Spots = 26 Failure Mode Findings)
Citation Hallucination Modes (18 failures)
Fabricated
0
Pretextual
0
Contradictory
18
AI Blind Spots (0 failures)
Web Retrieval
0
Training Knowledge
0
Hallucination findings
8 findings across
2 AI Models.
Each finding pairs an AI answer against the authenticated regulator-text excerpt that contradicts it.
Does the CPMI-IOSCO 2016 Cyber Guidance explicitly reference or align with the NIST Cybersecurity Framework?
Claude Opus 4.7 (web search on) answered
The 2016 Guidance is principles-based and does not explicitly adopt or normatively cross-reference the NIST Cybersecurity Framework in its text, although it was developed in awareness of NIST CSF, ISO/IEC 27000 series, COBIT and similar bodies of practice.
Regulator text says
Unknown — searches did not confirm a verbatim NIST citation in the 2016 Cyber Resilience Guidance. The five guidance categories are structurally similar to the NIST CSF five functions but may be independently derived.
Does the CPMI-IOSCO 2016 Cyber Guidance use the phrase 'secure the periphery, protect the core', and if not, where does the phrase originate?
Claude Opus 4.7 (web search on) answered
The exact slogan 'secure the periphery, protect the core' is associated with later CPMI work on reducing the risk of wholesale payments fraud relating to endpoint security (notably the CPMI's 2018 'Reducing the risk of wholesale payments fraud related to endpoint security' strategy)
Regulator text says
The phrase 'secure the periphery and protect the core' is from Cœuré's 2018 speech (BIS review r181115a) on 'cryptos, cyber and CCPs'. It describes the CPMI's strategic approach but does not appear in the 2016 Cyber Resilience Guidance.
How does the CPMI-IOSCO 2016 Cyber Guidance define 'cyber resilience', and is that definition consistent with the FSB Cyber Lexicon published in November 2018?
Claude Opus 4.7 (web search on) answered
So the two are aligned and broadly consistent, but the FSB Lexicon version is slightly broader (mission-continuity framing, organisation-agnostic) than the FMI-specific 2016 formulation.
Regulator text says
The FSB Cyber Lexicon was published November 2018 — two years after the 2016 Cyber Resilience Guidance. Its standardised definitions postdate the 2016 guidance and may not match how the 2016 guidance used those terms in 2016.
Is the CPMI-IOSCO 2016 Cyber Resilience Guidance still the operative international standard for FMI cyber resilience, or has it been revised or updated?
Claude Opus 4.7 (web search on) answered
Yes — the CPMI-IOSCO 2016 Guidance remains the operative international standard for FMI cyber resilience. It has not been formally revised or superseded.
Regulator text says
BIS press release of 6 May 2026: CPMI-IOSCO published a consultative document (the May 2026 CPMI-IOSCO consultative document) for public comment on updated guidance. The 2016 guidance is under active revision as of May 2026.
Does the CPMI-IOSCO 2016 Cyber Guidance formally cite or reference the NIST Cybersecurity Framework?
Claude Sonnet 4.6 (web search on) answered
Yes. The CPMI-IOSCO 2016 Cyber Guidance explicitly references and takes into consideration the NIST Cybersecurity Framework as one of several industry best-practice frameworks informing its development. Other frameworks acknowledged include the ISF Standard of Good Practice, COBIT, and ISO/IEC 27001.
Regulator text says
Unknown — searches did not confirm a verbatim NIST citation in d146. The five guidance categories are structurally similar to the NIST CSF five functions but may be independently derived.
Does the CPMI-IOSCO 2016 Cyber Guidance specify detailed operational practices for cyber incident response and recovery, or is that level of detail addressed by a later document?
Claude Sonnet 4.6 (web search on) answered
Yes. The CPMI-IOSCO 2016 Cyber Guidance dedicates specific sections to cyber incident response and recovery...It describes detailed expectations for FMIs including: having a cyber incident response plan, ability to resume critical operations within the 2hRTO, use of a secondary site, recovery and resumption planning, communication protocols during incidents.
Regulator text says
FSB published 'Effective Practices for Cyber Incident Response and Recovery' in October 2020 — four years after the 2016 CPMI-IOSCO Cyber Resilience Guidance. This contains operational detail for the Response and Recovery phase that goes beyond what the 2016 guidance specifies.
How does the CPMI-IOSCO 2016 Cyber Guidance define 'cyber resilience,' and is that definition consistent with the FSB Cyber Lexicon definition published two years later?
Claude Sonnet 4.6 (web search on) answered
The two definitions are broadly consistent in their emphasis on anticipation, adaptation, and recovery...The FSB Lexicon was developed after the 2016 guidance and explicitly drew on the CPMI-IOSCO definition (among other sources including CERT and NIST), making the FSB definition a refinement and harmonisation.
Regulator text says
The FSB Cyber Lexicon was published November 2018 — two years after the 2016 CPMI-IOSCO Cyber Resilience Guidance. Its standardised definitions (e.g., of 'cyber resilience', 'cyber incident', 'critical functions') postdate the 2016 guidance and may not match how the 2016 guidance used those terms in 2016.
Is the CPMI-IOSCO 2016 Cyber Resilience Guidance still the operative international standard, or has it been updated or placed under active revision?
Claude Sonnet 4.6 (web search on) answered
As of the date of this response, the June 2016 CPMI-IOSCO Cyber Guidance remains the operative primary international standard for FMI cyber resilience — it has not been formally revised or replaced.
Regulator text says
BIS press release of 6 May 2026: CPMI-IOSCO published a consultative document for public comment on updated guidance. The 2016 guidance is under active revision as of May 2026.
AI Blind Spots
No AI Blind Spots documented for this regulation yet.
Related rules
Where this rule sits in the regulatory graph. Discovered during Phase A.2
research; resolves to a regulation page where one is published.
Implements / sits under
The international standards or parent rules this regulation implements or sits under.
Parallel rules
Comparable rules at the same level — peer national / international regulators on the same subject.
Implemented by / extended by
Rules below this one in the regulatory cascade — sub-national implementations or downstream guidance.
Affected audiences
These findings affect the following audiences. Click through for the case studies that aggregate findings across all regulations in this jurisdiction.
Practitioners
Sectors × Departments