Finance authorities from the Group of Seven have agreed to run tabletop exercises testing how governments and central banks would respond to AI-enabled cyberattacks on the financial system. Japan's finance minister, Satsuki Katayama, confirmed the decision after G7 finance ministers and central bank governors met in Bangkok alongside the International Monetary Fund and World Bank annual meetings. The plan moves the group's work on frontier-AI risk from discussion toward practical response testing, although no exercise date has been announced.

From policy discussion to simulated incidents

In an October 16 transcript published by Japan's Ministry of Finance, Katayama said the G7 had decided to conduct tabletop exercises as part of its response to risks created by artificial intelligence. Reuters separately reported that finance deputies had developed the idea before ministers approved it. A Japanese ministry official told the news agency that G7 finance authorities would design simulations of AI-driven cyberattacks, assess how existing protocols perform and use the results to revise response manuals.

Related reporting: Revolut Maps an AI Expansion Beyond Banking

Tabletop exercises generally place officials in a simulated crisis and ask them to make decisions using existing plans, communications channels and legal authorities. They do not involve attacking live banking systems. For this initiative, the central question is whether finance ministries, central banks and supervisors can coordinate quickly if AI helps attackers discover vulnerabilities, automate intrusion attempts or disrupt several institutions at once. Reuters said private financial institutions could be included depending on the scenarios, but participation has not been confirmed.

Why finance officials are testing AI risk

The Financial Times also reported the agreement and linked it to concerns raised during the IMF meetings about AI-assisted attacks on banks and critical market infrastructure. The risk is broader than a single institution losing data. A severe incident could interrupt payments, trading, clearing or settlement, while uncertainty about the scope of an attack could undermine confidence across markets. AI may also compress the time between discovering a weakness and exploiting it, leaving defenders less time to patch systems or isolate affected services.

The G7 already has channels for cooperation on financial-sector cybersecurity, but simulations can expose gaps that written agreements do not reveal. Authorities may need to decide who declares an incident systemic, how confidential threat information is shared across borders, which services receive priority and how markets are kept informed without spreading unverified claims. An exercise can also test whether backup communications and recovery procedures remain usable when normal networks are degraded.

Important details remain open

The announcement does not establish that a specific attack is imminent, and officials did not identify a target, timeline or technical playbook. It also remains unclear whether the G7 will run one common scenario or a series designed by different national authorities. The effectiveness of the project will depend on whether exercises include realistic dependencies among banks, cloud providers, payment networks and market utilities, and whether the findings lead to measurable changes rather than general recommendations.

For banks and other financial firms, the decision signals that AI-related cyber resilience is becoming a coordinated policy issue rather than only an internal technology concern. The most useful outcome would be clearer cross-border escalation procedures and tested recovery plans. Until the G7 publishes the scope, participants and schedule, however, the commitment should be understood as a preparedness initiative, not a new binding standard or evidence that existing defenses have failed.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.