The Bank of England presses banks for bare-metal recovery plans against AI-enabled attacks

Banks need a bare-metal recovery capability in the face of AI risks, Sarah Breeden, a deputy governor of the Bank of England, said on Thursday¹. The central bank is working with banks on deep cyber-recovery options, Reuters reported^1,2. One summary of the remarks put the warning plainly: the Bank of England is telling banks to prepare for AI-enabled cyber breaches⁴.

The central bank is urging banks to strengthen recovery plans as AI increases both cyber threat risk and the complexity of technology failures in financial services, according to another account of the same remarks³. Breeden, who is the deputy governor for financial stability, was speaking from the International Monetary Fund meetings in Bangkok, where she also told CNBC she had been surprised by how well the UK economy has absorbed the energy price shock⁵.

Why it matters to investors

Bare-metal recovery means rebuilding a bank’s systems from bare hardware rather than restoring from the running environment, and it is a far more demanding standard than the backup arrangements most institutions hold. Making it a supervisory expectation is a cost item: it requires duplicate infrastructure, tested rebuild procedures and staff who can execute them.

The regulator’s reasoning, as reported, is that AI changes two things at once. It raises the probability of a breach, and it makes technology failures harder to unwind³. That combination is what moves the issue from an IT budget line to a financial stability concern, which is the portfolio Breeden holds⁵.

The framing is a warning rather than a rule. Nothing in this coverage describes a consultation, a deadline or a capital requirement attached to the expectation^1,2,3,4. What it does signal is the direction supervisory attention is travelling, and the Bank of England’s starting position is that the work is already being done jointly with the banks¹.

What to watch

The first thing to watch is whether the central bank turns this into a formal requirement with a timetable, since a published expectation is what makes operational resilience spending comparable across banks^1,3.

Breeden’s second message, that the UK economy has handled the energy shock better than she expected⁵, is worth holding alongside the first. A regulator sounding constructive on the economy and cautious on operational risk is pointing at where it thinks the next problem comes from, and it is not the credit cycle⁴.