Japan's financial regulator has instructed banks to review their cyber-security policies following a sustained wave of attacks on Japanese financial institutions and their customers. The push follows a period in which Japanese companies have been compensating customers for losses arising from cyberattacks, with the incidents weighing on the wider economy — 2026 has seen repeated intrusions at Japanese retailers, logistics operators and financial services firms, and the response has increasingly shifted from disclosure to remediation and restitution. The instruction to review policies is a supervisory action rather than a new rule, so it lands on each institution's own risk framework; in practice that means boards must be able to show documented review of authentication, third-party access and incident-response arrangements rather than simply confirming that controls exist. It is a notable divergence from the Australian posture in the same week, where ASD's annual report emphasises detection tempo and pre-positioning rather than direct supervisory pressure on a single sector.

• Source article