-
G7 finance ministers and central bank governors have approved tabletop exercises for AI-enabled cyberattacks on financial systems.
-
The simulations will test existing response procedures and could involve private financial institutions.
-
The IMF says AI can make attacks faster and allow weaknesses in shared technology to spread across institutions more quickly.
-
Nigeria is not part of the announced G7 exercise, but the CBN is already assessing regulated institutions on incident response and operational resilience.
October 16, (THEWILL) – The world’s largest advanced economies are preparing to simulate AI-enabled cyberattacks on their financial systems, as regulators shift attention from simply keeping hackers out to making sure banks can still function when defences fail.
Finance ministers and central bank governors from the Group of Seven approved plans for tabletop exercises during a meeting on the sidelines of the International Monetary Fund and World Bank Annual Meetings in Bangkok, Japanese Finance Minister Satsuki Katayama said.
“The G7 finance deputies had been discussing the idea of doing tabletop exercises on frontier AI, which was signed off at the ministerial level,” Katayama told reporters.
The exercises will use attack scenarios developed by G7 financial authorities to test how regulators respond when artificial intelligence is used in a cyber incident. Findings will be used to assess existing procedures and revise response manuals where weaknesses are found.
Private financial institutions could also participate, depending on the scenarios selected.
The announcement does not mean a new AI cyberattack has occurred, and no Nigerian financial institution has been identified as a participant in the planned G7 exercises.
It points instead to a changing assumption among financial regulators. Preventing intrusion remains important, but prevention alone is increasingly being treated as insufficient.
What AI Changes for Cyberattacks
AI does not need to invent an entirely new form of cybercrime to make existing threats more dangerous.
An IMF analysis published in June found that AI could increase the speed, frequency and breadth with which vulnerabilities are discovered and exploited.
That becomes particularly serious in banking because financial institutions do not operate as isolated technology systems. They can depend on the same cloud providers, software, networks and other third parties.
A weakness in technology used across several institutions can therefore become more damaging if attackers are able to identify and exploit it at machine speed.
The IMF described the concern as an increase in the potential “blast radius” of an incident, meaning the amount of damage a successful breach could cause and how far it could spread.
Its October Global Financial Stability Report also listed increasingly sophisticated cyber threats among three major risks capable of disrupting financial services and weakening confidence in the financial system.
That confidence is part of what makes cyber resilience different from ordinary IT security.
A bank may eventually identify and remove malicious software. Customers still have a problem if they cannot make payments, access deposits or complete transfers while the incident is being resolved.
READ ALSO:
Regulators Are Planning for the Breach That Gets Through
Bank of England Deputy Governor Sarah Breeden made the change in thinking unusually explicit this week.
“It’s not enough now to assume that the cyber attackers won’t get through,” she said.
The Bank of England is working with financial institutions on what Breeden called “bare metal recovery” for critical services.
The idea is straightforward even if the technology behind it is not. A bank needs a way to restore essential functions from an environment that is separate from the compromised systems.
If an attack contaminates the primary infrastructure and ordinary backups cannot be trusted, the institution must still know how it will rebuild and reconnect the services people depend on.
For financial regulators, the practical questions therefore move beyond firewalls and malware detection.
How quickly can payments be restored?
Which services must return first?
Can clean records be reconstructed?
Who decides when a compromised system is safe to reconnect?
What happens when several institutions depend on the same provider?
And can banks, regulators and infrastructure operators coordinate those decisions while an attack is still unfolding?
Tabletop exercises are designed to expose failures in those arrangements before a real crisis does.
Nigeria Is Already Testing Some of the Same Weak Points
Nigeria is not part of the G7, and no participation by the Central Bank of Nigeria or Nigerian banks in the newly announced exercises has been verified.
The underlying questions, however, are already relevant to a banking system where payments, customer onboarding, transfers and other services increasingly depend on digital infrastructure.
In March, the CBN deployed a Cybersecurity Self-Assessment Tool for regulated financial institutions.
The assessment covers cybersecurity governance, risk management, technology and third-party controls, incident response and operational resilience.
Those last two areas are especially important in the context of the G7 exercise.
Incident response asks what an institution does once something has gone wrong. Operational resilience asks if critical services can continue or recover despite the disruption.
The CBN has also tightened controls around instant payments.
Rules announced in March and effective from July 1 require financial institutions to operate real-time enterprise fraud monitoring systems, alongside stronger identity verification and other protections for digital transactions.
These measures address fraud and security risk, but the G7 discussion raises another test for Nigerian financial institutions.
It is possible to detect fraud and still suffer a serious systems failure.
Recovery Has To Include the Payment Chain
A customer transferring money from one Nigerian bank to another may experience a transaction as one tap on a phone, but the payment can depend on several institutions and pieces of infrastructure working together.
That makes recovery a system question, not only a bank question.
If an AI-assisted attack disrupted a major service provider or piece of common infrastructure, individual banks could have functioning internal systems and still struggle to complete transactions.
The IMF warned in June that dependence on shared digital infrastructure and common service providers could allow cyber incidents to spread quickly through interconnected financial systems.
It recommended stronger recovery capacity, technical controls to contain breaches, international coordination and closer collaboration between governments and private institutions.
For Nigeria, that suggests cyber readiness cannot be judged only by how much a bank spends on security tools or how many attacks its systems block.
A more revealing test is what happens after the attack that was not blocked.
How quickly can the institution identify what is contaminated, isolate it, reconstruct reliable data and restore essential services without creating a second problem?
The G7 intends to rehearse those decisions before it has to make them in a crisis.
Nigeria’s financial system has reason to ask how its own rehearsal would go.
Joy Onuorah is a business journalist and brand communications specialist covering financial markets, artificial intelligence, digital economy, and the ideas reshaping business across Africa and the global market. Beyond her reporting for TheWill, Joy uses brand strategy, storytelling, copywriting, and high-value SEO to help brands build lasting market authority.
