Cloudbank Digest — RBNZ maps three futures for NZ banking by 2035 +14 more · 20 Sep
Sunday, 20 September 2026 · 15 stories
Showing 15 of 15 stories
Watchlist — key dates ahead
27 Oct 2026Public consultation on the Future of Payments (faster payments, stronger safeguards, competition and innovation) closes, informing the post-API-Centre regulatory settings.
28 Oct 2026RBNZ Monetary Policy Review and OCR decision (2pm), following the September hike to 2.75%.
31 Oct 2026ECB deadline for supervised banks to submit quantum-threat action plans to their Joint Supervisory Team, part of the EU's push toward post-quantum cryptography migration by 2030.
7 Nov 2026New Zealand general election, with banking-sector policy (bank levy/reform proposals, NZ First's floated BNZ-Kiwibank merger) a live campaign issue.
1 Dec 2026Kiwibank and remaining open banking services due to be live under the Customer and Product Data Act regulations (phased rollout deadline).
The Reserve Bank published a Future of Banking study outlining three scenarios for how the sector could evolve by 2035: incumbents adapting incrementally, a digital-banking revolution led by fintechs, or banking increasingly delivered through non-bank digital ecosystems. RBNZ stresses it holds no preferred scenario and the study is not a policy signal.
The Federal Reserve raised its benchmark rate 25 basis points to 3.75%-4% on 16 September, its first hike since 2023, following through on the hawkish signal flagged after Chair Warsh's Jackson Hole remarks; the dot plot points to a possible further move before year-end.
Banks, telcos and digital platforms providing regulated services in Australia were required to join AFCA's dispute resolution scheme from 1 September 2026, the first enforceable milestone under the Scams Prevention Framework, ahead of civil penalties of up to A$50 million per contravention landing from 31 March 2027.
1 Regulatory — NZ horizon & global signals
New Zealand first; global banking, finance & payments items included where there's an NZ read-across.
Regulatory — NZ horizon & global signalshigh
RBNZ maps three possible futures for NZ banking by 2035
Regulatory horizon-scanning · Study published 17 Sep 2026
The Reserve Bank published a Future of Banking study outlining three scenarios for how the sector could evolve by 2035: incumbents adapting incrementally, a digital-banking revolution led by fintechs, or banking increasingly delivered through non-bank digital ecosystems. RBNZ stresses it holds no preferred scenario and the study is not a policy signal.
Why it matters — All three scenarios converge on the same risk list — cyber attacks, fraud and growing dependence on external technology providers — effectively telegraphing where RBNZ supervisory attention is headed over the next decade regardless of which future actually plays out.
US banking regulators propose overhaul of third-party risk guidance
Third-party & operational risk · Proposed 11 Sep 2026; comments due 16 Nov 2026
The OCC, Federal Reserve, FDIC and NCUA jointly proposed guidance to replace their 2023 third-party risk framework, shifting to a risk-based approach that focuses oversight on vendor relationships with the greatest potential for financial, operational or compliance harm rather than applying uniform scrutiny everywhere.
Why it matters — It lands the same week RBNZ's own Future of Banking study flagged 'growing reliance on outside technology providers' as a top emerging risk — a sign the concentration-risk theme is converging across regulators on both sides of the Pacific, with direct relevance for NZ's Australian-owned majors and their shared global vendor contracts.
Focused on banking & payments, but includes cross-industry moves with read-across to financial institutions and their operations.
AI & automation — banking, payments & beyondhigh
US state regulators issue first AI supervisory framework for banks
AI governance · Released 16 Sep 2026
The Conference of State Bank Supervisors released an AI Supervisory Framework giving state examiners a structured process for identifying AI use at state-chartered banks and nonbank financial institutions, and for deciding when deeper review is warranted — filling a gap left by federal guidance that still excludes generative and agentic AI models.
Why it matters — It's an early template for what bank AI examination looks like in practice, at a moment when NZ regulators are still working out the same question — worth watching as a possible reference point as the FMA and RBNZ develop their own AI supervisory approach.
Protean eGov Technologies launched a next-generation AI-driven KYC Onboarding & Reporting Solution built around India's expanding Central KYC infrastructure, unveiled in front of the Reserve Bank of India at Global Fintech Fest 2026.
Why it matters — It's a live example of AI collapsing onboarding cycle times — vendors in this space report cutting KYC turnaround from days to under 24 hours — directly relevant as DIA's new sole-regulator AML/CFT mandate (from 1 July 2026) puts fresh pressure on NZ banks to modernise onboarding without adding friction.
Payments NZ's API Centre to close as open banking stewardship shifts
Open banking governance · API Centre ceases operating 30 Sep 2026
The Payments NZ API Centre, which has run New Zealand's open banking API standards since 2019, will stop operating at the end of September as stewardship of the open banking framework transitions to a post-API Centre governance model under the Customer and Product Data Act regime.
Why it matters — It closes the chapter on the industry-led body that built NZ's open banking standards just as the regime matures — ANZ, ASB, BNZ and Westpac are already live data holders and Kiwibank is phasing in through December 2026 — so who inherits standards governance now matters for how quickly account-to-account payments and open finance use cases scale.
UK FCA opens crypto and stablecoin authorisation window
Digital assets regulation · Applications open 30 Sep 2026 – 28 Feb 2027; regime starts 25 Oct 2027
The FCA published final guidance on its cryptoasset authorisation perimeter and confirmed firms — including stablecoin issuers, trading platforms, custodians and staking arrangers — can apply for authorisation from 30 September 2026 ahead of the UK's mandatory regime taking effect in October 2027.
Why it matters — It's one of the most concrete stablecoin licensing timelines among the seven major economies now regulating the asset class, giving NZ banks and payment providers a clearer sense of what a comparable framework might eventually demand if MBIE or RBNZ moves in the same direction.
RBA rules out near-term retail CBDC, doubles down on wholesale tokenisation
CBDC & tokenisation · Position paper published Sep 2026
The Reserve Bank of Australia published an updated position stating there is no policy case for a retail CBDC at present, while confirming it will keep progressing wholesale tokenised-money work following the Project Acacia pilot completed in May 2026.
Why it matters — It's a live data point for NZ's own 'digital cash' work, which RBNZ has flagged for around 2030 — Australia's decision to prioritise wholesale tokenisation over retail CBDC gives a template NZ policymakers are likely to study closely given the two countries' similarly structured banking systems.
[UPDATE] Fed hikes rates for first time since 2023, lifting to 3.75%–4%
16 Sep 2026 FOMC decision
The Federal Reserve raised its benchmark rate 25 basis points to 3.75%-4% on 16 September, its first hike since 2023, following through on the hawkish signal flagged after Chair Warsh's Jackson Hole remarks; the dot plot points to a possible further move before year-end.
Why it matters — A hawkish Fed narrows the gap with RBNZ's own 2.75% OCR and tends to firm the USD against the NZD, raising offshore funding costs for the NZ banks that borrow in wholesale USD markets — worth watching alongside RBNZ's next OCR review.
NZ growth nowcast points to a lacklustre Q3 after a soft Q2
Kiwi-GDP nowcast, Sep 2026
RBNZ's Kiwi-GDP nowcasting model points to 0.6% growth in the September quarter after a lacklustre Q2, with the Bank noting the recovery is expected to have resumed in Q3 but remains uneven across sectors and regions.
Existing and emerging players across NZ and Australia, plus global names where they're relevant to NZ/AU banking.
Competitor watch — NZ, Australia & globalmedium
ANZ reportedly eyes takeover of business-lender Judo Capital
Reported early Sep 2026
ANZ Group is reportedly considering a takeover of ASX-listed SME lender Judo Capital, Australia's first neobank unicorn, as part of a push to expand business banking.
Why it matters — A takeover would remove one of the highest-profile challenger banks from the ASX and signal the big four are willing to buy scale in SME lending rather than compete against neobanks on price and speed.
Nubank launches US multicurrency account settled in stablecoins
Neobank expansion · Launched 16 Sep 2026
Nubank launched 'Nu Global', a US multicurrency account that converts deposits into Circle's USDC stablecoin or digital euros, paying 3.5% APY on US-dollar balances as part of its broader US market entry.
Why it matters — It's a live example of a major neobank using stablecoins as core account infrastructure rather than a side product — relevant context for NZ policymakers and banks weighing how retail stablecoin use cases might eventually surface here.
Customer-impacting fraud, scam typologies and the liability landscape — NZ-first, with global threat signals.
Fraud & scamshigh
UK Finance data shows scam attempts up 62% amid AI-driven surge
Fraud typologies · Data reported Sep 2026
UK Finance data across more than 100 million accounts at nine financial institutions found scam attempts up 62% year-on-year and phishing volumes up 140%, with AI cited as a major driver of more convincing, harder-to-detect fraud.
Why it matters — NZ's own bank-impersonation and deepfake scam losses have been climbing on a similar AI-driven trajectory — UK Finance's scale of data makes it one of the clearest signals yet that fraud volumes, not just individual scam sophistication, are entering a new regime that NZ's prevention-led Banking Code approach will need to keep pace with.
Scam liability regime · AFCA membership deadline 1 Sep 2026; full obligations from 31 Mar 2027
Banks, telcos and digital platforms providing regulated services in Australia were required to join AFCA's dispute resolution scheme from 1 September 2026, the first enforceable milestone under the Scams Prevention Framework, ahead of civil penalties of up to A$50 million per contravention landing from 31 March 2027.
Why it matters — It's the clearest sign yet that Australia is willing to put real financial teeth behind scam-prevention obligations — a model NZ's own less formal, code-based approach will inevitably be compared against as loss figures keep climbing on both sides of the Tasman.
Slower-burning structural risks and trends worth getting ahead of — technology, resilience and governance.
Emerging risks & trendsmedium
Post-quantum readiness in banking jumps from 28% to 94% in five months
Post-quantum cryptography · Measured Apr–Sep 2026
An independent scan of TLS endpoints across eight sectors found banking's post-quantum cryptography readiness jumped from 28% in April to 94% by early September 2026 — the largest improvement of any sector measured, though a more conservative like-for-like cohort of 293 hosts moved from 50.2% to 86.0%.
Why it matters — It shows the industry can move fast once PQC migration is prioritised — useful context for NZ banks and RBNZ as 'harvest now, decrypt later' risk keeps pushing quantum-safe migration up the agenda, even without a hard local deadline yet.
Microsoft warns of AI-generated CEO-fraud and passkey phishing campaigns hitting cloud identities
Cyber threats · Disclosed 9 Sep 2026
Microsoft disclosed two active campaigns: one blasting over a million AI-generated CEO-impersonation emails in early August to trick accounts-payable teams into fraudulent ACH transfers, and a second using passkey/MFA-themed help-desk social engineering (active since May 2026) to hijack cloud identities and exfiltrate data via SharePoint, OneDrive and Graph API access.
Why it matters — Both techniques target exactly the controls banks and their corporate customers have been told to trust most — passkeys and finance-team authorisation workflows — making this a live playbook that NZ bank fraud and IT-security teams should be actively testing against, not just monitoring.