Geopolitical risks and cyberattacks as catalysts: redefinition of regulatory responses (and gaps) in the banking sector

Purpose The authors assume that, as jurisdictions differ in their exposure to geopolitical risks, they will consequently vary in their exposure to high-scale cyber risks. The purpose of this paper is to assess patterns of regulatory response across countries with differing levels of exposure to such risks. The paper also examines how the regulatory responses evolve when riskier scenarios emerge. Design/methodology/approach This paper conducts an empirical analysis of the regulatory landscape relative to high-scale cyber risks by comparing annual reports of major banks of high-risk geopolitical countries of the Western alliance; annual reports of major banks of low-risk geopolitical countries of South American countries; and cases of countries that experienced major financial cyberattacks, to identify different patterns of regulatory response. A limitation of this study is that quantitative indicators from the annual reports were not included in the analysis. In addition, the authors restrict their sample to the three most recent fiscal years for which reports are available for all banks. This is a deliberate methodological choice, as the aim is not to track financial performance or risk exposure over time but to analyze how financial institutions frame their responses to differing geopolitical environments and to extract insights into the regulatory stance of each jurisdiction as reflected in these discourses. Findings This paper contributes to the literature on cyber risk regulation in the financial sector by demonstrating that the more banking systems are exposed to greater geopolitical risk, the greater the propensity of all systems participants – public and private sectors – to adopt measures to strengthen cybersecurity. Regulators in jurisdictions exposed to less geopolitical risks lag behind when it comes to regulating high-scale cyber risk. Originality/value These findings allow to conclude that the flow of response from the authorities usually begins with coordination actions between the private and public sectors, fostering the creation of cooperation networks and redesigning the internal governance of central banks and ministries. Only at a later time, actions related to regulatory reforms of more impact begin to emerge, in stages that may still be embryonic. The cases of Europe, America, Ukraine, Taiwan and Costa Rica are examples.