Firm and system resilience: Evolving asset management regulation 2026 report

Firms are continuing to embed operational resilience requirements as regulators urge asset managers to consider the novel risks associated with frontier AI models.

In this year’s edition of KPMG International’s Evolving Asset Management Regulation report, KPMG professionals explore the latest trends in firm and system resilience to uncover opportunities and risks for asset managers.

As asset managers evaluate the growing links between financial and operational resilience, as well as wider themes such as AI and sustainability, many now view resilience as a strategic advantage.

Resilience remains central to nearly every client conversation, spanning operational effectiveness, financial strength, governance, and control environments.

David Neuenhaus

Global Sector Head of Private Capital and Asset Management

KPMG International

Key highlights

Resilience continues as a strategic priority

Operational resilience expands to cover AI-driven cyber risks

Asset managers face inclusion in system-wide stress testing

Financial crime reforms accelerate, especially across the EU

Operational resilience and outsourcing oversight

With new frameworks and packages of rules now firmly established in some jurisdictions, regulators are now focusing on the effective implementation and embedding of the requirements throughout asset managers’ businesses.

Firms are expected to have moved beyond ‘tick box’ regulatory compliance to end-to-end embedding of resilience considerations across their business, including product design and overall business strategy.

Outsourcing remains a key area of focus for resilience requirements. In some jurisdictions, supervisors are raising the bar or doubling down on supervisory reviews in the face of asset managers’ increased reliance on third parties.

Beyond asset management firms themselves, governments and regulators are seeking to ensure that non-financial services entities that provide critical services to FS firms are captured by similar regulatory regimes.

Cyber resilience and information security

With the advent of increasingly advanced AI models, governments and regulators are alert to novel risks that could impact cyber and ICT resilience. The FSB noted the importance of patching efforts in response to escalating threats and vulnerabilities but noted that rushed or poorly executed patching could add to firms’ challenges. The IMF also warned about potential risks to highly interconnected, cross-border infrastructure, and suggested that supervisors should increase their cyber resilience expectations for firms and conduct system-wide tests that include AI-enabled scenarios.

Meanwhile, regulators around the world have issued statements and guidance for firms. Download the full report to see how different regulators are dealing with the topic.

Financial and system-wide resilience

Against a backdrop of external turbulence, regulators continue to focus on the prudential soundness of asset management firms. In recent years, some jurisdictions have introduced new prudential regimes for investment firms. Some of these are now being revised and reworked.

At the same time, there has been a noticeable pivot by some macroprudential regulators looking to include asset managers in system-wide stress tests. These initiatives reflect the significant growth of the asset management industry, particularly private markets, and central banks’ desire to improve their understanding of how these markets work and their potential impacts on financial stability in the event of an economic downturn or other event.

Fighting financial crime

Financial crime continues to move up the regulatory agenda worldwide and there are significant developments to report in some jurisdictions. There are also various supervisory reviews underway to check compliance and uplift standards. Download the full report to learn more.

Opportunities and risks

Potential opportunities
Possible risks for asset managers

New perspectives on resilience

Leading practice firms are pivoting towards recognizing resilience as a fundamental strategic priority that is central to all business decisions, including those related to outsourcing and vendor selection.
Modernizing the operating model

Delivering high standards of resilience can involve upgrading and modernizing legacy infrastructure, which can bring the added benefit of new efficiencies and reduced operational risks.
Data availability and use

Data plays a key role across all aspects of resilience, including the monitoring of critical business services. Greater use of key data points can support better decision-making and stronger risk oversight.

Service interruption or data loss

Firms that suffer disruption incidents may lose clients’ trust and be subject to additional regulatory scrutiny. Robust governance and oversight and effective embedding of resilience strategies across the business can help prevent this.
Increased complexity in the business

As asset managers continue to explore new activities to outsource, they can become increasingly reliant on third party providers. Poor due diligence or oversight of these relationships could expose firms to resilience-related issues.
Financial crime controls

Regulators are upping their expectations around the quality of onboarding controls and due diligence, as well as the extent to which firms use technology to effectively perform these tasks as they grow and scale.