Siani warns technology dependencies amplify financial sector risks
Technology suppliers accounted for almost 60 percent of reported ICT incidents in the first nine months of 2026, Bank of Italy supervisor Giuseppe Siani told Parliament. He urged stronger controls over outsourcing and AI-related risks.
Failures travel through supplier chains
Giuseppe Siani, the Bank of Italy's head of banking and financial supervision, reported 101 ICT events generating 137 notifications in 2025.
Service interruptions affected about 70 percent of events; cybersecurity accounted for 23 percent and suppliers were involved in over half.
In January–September 2026, 68 events generated 92 notifications: about a quarter concerned cybersecurity and almost 60 percent involved third parties.
Separate outsourcing records identify around 3,600 suppliers and subcontractors, chains reaching five levels, roughly 9,600 contracts and annual spending above €2.6 billion.
About half the relationships support critical or important functions.
These records exclude Italian significant banking groups and institutions supervised through certain European arrangements.
Resilience rules meet AI risks
The Digital Operational Resilience Act (DORA) covers ICT risk management, incident reporting, testing, third-party risk and threat-information sharing.
Siani cited gaps in controls, infrastructure security, remediation and supplier contracts.
Supervisors requested AI-related cybersecurity and resilience action plans by end-2026.
European oversight covers 19 critical ICT providers, none Italian.
The Bank of Italy's market-supervision powers for high-risk AI in lending and other regulated financial services apply from December 2, 2027, complementing DORA and the Cyber Resilience Act.
Compliance alone is not resilience
Siani said formal compliance is insufficient: boards must govern technology dependencies and preserve essential services.
Concentrated suppliers require workable exit strategies, not just contractual safeguards.
He called for coordinated responses across financial firms, technology providers and authorities.