The Dutch Authority for the Financial Markets (AFM) has published its latest review of financial service providers, highlighting the need for clear safeguards for AI use and stronger controls over cyber risks. From 2027, it will also tighten oversight of whether firms promptly notify it about individuals responsible for daily management. Firms too often submit these notifications late, allowing individuals to start work before the required assessment of their fitness and propriety. Providers currently use AI mainly to support internal processes and face pressure to adopt applications. Responsible use calls for adequate staff knowledge and skills, transparency toward customers and reliable data. Meanwhile, cyber threats are increasing as criminals use AI to exploit vulnerabilities in information and communications technology (ICT) systems. Providers often have limited ICT security capacity and outsource critical services, making effective controls over both their own systems and outsourced services necessary. Financial service providers also have a role in strengthening consumers’ financial resilience by helping customers understand their financial position and make sound financial choices.
Dutch Authority for the Financial Markets flags AI and cyber risks, plans stricter oversight of management notifications from 2027
The Dutch Authority for the Financial Markets (AFM) has highlighted the need for responsible AI use and stronger cyber risk controls in its latest review of financial service providers. From 2027, it will scrutinize management notifications more strictly, as individuals too often start work before their fitness and propriety have been assessed. Providers can also support consumers’ financial resilience by improving their understanding of their finances and helping them make sound financial choices.