Germany's financial regulator BaFin will expand its cybersecurity supervision and expects financial institutions to prepare for threats from artificial intelligence and quantum computing.

London's trading industry is coming home!

Speaking at Bitkom's Digital Finance Conference in Berlin on Tuesday, BaFin President Mark Branson said the regulator was expanding its cybersecurity department and would conduct shorter, targeted audits to reach more supervised firms.

BaFin received reports of nearly 900 IT incidents over the past four quarters, with 14% attributed to attacks, Branson said. He warned that frontier AI models and autonomous AI agents could make cyberattacks faster and more sophisticated.

Branson also referred to the reported theft of $6.3 billion in cryptocurrencies from Binance. He said an AI tool had reportedly played a role in the attack, alongside social engineering.

The warnings come as European regulators increase their focus on technology-related risks in financial services. The FCA recently invited firms to test the use of quantum computing in identifying money laundering, while the AMF has highlighted AI-driven cybersecurity risks facing retail financial firms.

BaFin Sets Cybersecurity Expectations

Branson said financial institutions should meet the requirements of the Digital Operational Resilience Act (DORA) and integrate AI into their ICT risk management frameworks. He also called for risk-based software patching, with priority given to critical systems and those accessible from external networks.

BaFin is discussing AI-related risks with financial institutions, industry associations and major European IT service providers. Branson also called for greater European technological independence to reduce reliance on hyperscalers based outside the European Union.

BaFin Urges Quantum-Resistant Encryption

Branson also warned that quantum computing could eventually break encryption methods currently considered secure. Attackers are already collecting encrypted data to decrypt later using quantum computers, an approach known as "harvest now, decrypt later".

BaFin recommends that particularly critical systems migrate to quantum-resistant encryption algorithms by 2030.

Branson also said BaFin had been the market surveillance authority for AI systems in the financial sector since July 2026. Additional requirements for high-risk AI systems are scheduled to apply from December 2027.