Europe’s top securities regulator is sounding the alarm about a dangerous new reality: artificial intelligence is making cyberattacks more frequent and faster than ever before. The warning comes as financial supervisors worldwide grapple with how to protect markets from AI-powered threats that evolve at breakneck speed.
Verena Ross, chair of the European Securities and Markets Authority (ESMA), says geopolitical tensions have already heightened cybersecurity risks. Now her agency is actively reaching out to financial firms to assess their cyber defenses in light of rapid AI developments. The concern isn’t just theoretical – recent reports about AI models that can find and exploit unknown security vulnerabilities have rattled the entire financial sector.
AI models pose double-edged threat to financial stability
The financial industry was shaken this month by reports that a new AI model called Mythos, developed by U.S. company Anthropic, can discover and exploit previously unknown cybersecurity flaws in IT systems. This represents a major shift in the threat landscape.
“We are closely watching how bringing AI models into this could increase the potential speed with which such attacks could happen,” Ross said in a recent interview, though she declined to comment on specific AI providers.
The challenge for regulators is keeping pace with technology that changes faster than oversight mechanisms can adapt. Ross acknowledges this reality, saying regulators need to “up our game” to properly monitor what financial entities are doing with AI and build expertise to oversee critical technology providers.
Regulators scramble to identify critical tech providers
ESMA has already taken steps to address tech-related risks in finance. In November, the agency worked with two other EU regulators to identify 19 technology companies as critical third-party providers to Europe’s finance industry. This designation comes under new regulations designed to improve technological resilience across the sector.
However, Ross wouldn’t say whether AI providers might be added to this critical list in the future. The regulatory framework is still evolving as authorities try to understand which technologies pose the greatest systemic risks.
Cyber risks could amplify market volatility
Ross warns that cyber vulnerabilities could coincide with broader market stress, creating a perfect storm for financial instability. She points to several concerning factors:
- Stock markets in the U.S. and elsewhere are trading near all-time highs
- Valuations remain “very, very high” across many assets
- Geopolitical events like conflicts involving Iran have already caused oil price spikes
- Market sentiment could shift quickly, leading to significant selloffs
“There’s a question of what type of events might turn that general positive feeling in the market around,” Ross explained. Large market swings typically trigger regulatory scrutiny for possible insider trading, she noted.
Crypto regulation faces enforcement challenges
Beyond AI and cyber threats, ESMA is also preparing for new challenges in cryptocurrency oversight. National regulators across EU countries have given crypto companies until the end of June to secure proper licenses or stop operating.
The compliance picture is mixed so far. France’s regulator reported in January that nearly a third of unlicensed crypto companies hadn’t even informed authorities whether they planned to get proper authorization.
“One of the challenges we will face from the first of July onwards is how do we then deal with the policing of the perimeter,” Ross said. Starting in July, regulators will need to actively enforce these new rules and shut down non-compliant operators.
The European Commission has proposed giving ESMA more direct supervisory powers over major cross-border financial players, including large crypto companies and trading venues. While the EU’s six biggest economies support this centralization effort, some smaller countries oppose it. Ross believes there’s political momentum to move forward quickly with these changes.