BaFin Expands Cybersecurity Oversight, Sets 2030 Encryption Target

Germany's financial regulator BaFin is expanding its cybersecurity supervision and expects financial institutions to prepare for threats from artificial intelligence and quantum computing, President Mark Branson said at Bitkom's Digital Finance Conference in Berlin on Tuesday.

BaFin is expanding its cybersecurity department and will conduct shorter, targeted audits to reach more supervised firms, Branson said. The regulator received reports of nearly 900 IT incidents over the past four quarters, with 14% attributed to attacks.

Branson warned that frontier AI models and autonomous AI agents could make cyberattacks faster and more sophisticated. He referred to the reported theft of $6.3 billion in cryptocurrencies from Binance, saying an AI tool had reportedly played a role in the attack alongside social engineering.

BaFin said financial institutions should meet the requirements of the Digital Operational Resilience Act (DORA) and integrate AI into their ICT risk management frameworks. Branson also called for risk-based software patching, prioritizing critical systems and those accessible from external networks.

The regulator is discussing AI-related risks with financial institutions, industry associations and major European IT service providers. Branson called for greater European technological independence to reduce reliance on hyperscalers based outside the European Union.

On quantum computing, Branson warned that the technology could eventually break encryption methods currently considered secure. Attackers are already collecting encrypted data to decrypt later using quantum computers, an approach known as "harvest now, decrypt later." BaFin recommends that particularly critical systems migrate to quantum-resistant encryption algorithms by 2030.

Branson also said BaFin has been the market surveillance authority for AI systems in the financial sector since July 2026. Additional requirements for high-risk AI systems are scheduled to apply from December 2027.