A deadline that affects the whole banking system
While most bank customers are busy thinking about interest rates, fees, or their next transfer, a different clock is ticking in the background. By October 31, 2026, 110 of the largest banks in the eurozone must present the European Central Bank (ECB) with concrete plans on how they intend to defend themselves against cyberattacks carried out with the help of artificial intelligence. The deadline applies to heavyweights such as Deutsche Bank, BNP Paribas, and Santander — institutions where millions of people across Europe keep their money. For bank customers, this is more than a footnote from the supervisory authority: it is about how secure digital banking will actually be in the years ahead.
What the ECB is specifically demanding
A letter to 110 major banks
Claudia Buch, Chair of the ECB's Supervisory Board, informed the institutions directly supervised by the ECB in a letter that the latest AI models represent a long-term shift in the threat landscape — not a temporary phenomenon. The affected banks must now lay out short- and medium-term measures: faster patching of security vulnerabilities, improved AI-assisted monitoring systems, stricter oversight of external IT providers, and clearly assigned responsibilities and budgets for cyber defense. Any bank that fails to present a convincing plan by the end of October can expect closer scrutiny and potentially additional requirements from supervisors.
Why "frontier AI" is raising the stakes
The reason for the pressure from Frankfurt lies in the sheer speed at which modern AI systems now operate. Where criminals once needed days or weeks to find and exploit a weakness in a bank's IT systems, sophisticated AI can now do this within minutes. According to recent industry surveys, roughly nine out of ten financial institutions in Europe already report an increase in AI-assisted attacks — ranging from automated phishing to AI-generated voice clones that let fraudsters impersonate bank staff or even family members. The ECB rates the risk to the entire financial system as serious: a large-scale, successful attack could shake public trust and, in extreme cases, even trigger capital flight from individual institutions.
What this means for you as a bank customer
One interesting detail is the international comparison: according to reports on the ECB letter, the US Federal Reserve and the Bank of England are currently taking a notably softer approach to this issue than European supervisors. For customers in the eurozone, that formally translates into a higher level of protection — provided the banks involved actually implement the required measures on time and supervisors follow up consistently.
The good news first: nobody needs to panic and switch banks right now. Large, supervised banks have been investing in IT security for years, and the ECB initiative is specifically designed to systematize that preparation before something happens — not because a concrete incident has already occurred. Still, it is worth taking a sober look at your own situation, because cybersecurity is no longer a purely technical topic; it affects everyone who banks online.
What you can pay attention to right now
- Use two-factor authentication consistently — even when it feels inconvenient, it remains one of the most effective defenses against automated attacks today.
- Check your account activity regularly, ideally through your banking app, so you catch unusual transactions early.
- Stay skeptical of unusually urgent calls or messages, even when the voice or writing style seems familiar — AI makes forgeries more convincing than ever before.
- Avoid reusing passwords, and use a password manager where possible, so that one compromised account doesn't put several logins at risk.
Security as a quiet selection criterion for accounts and savings
If you are already thinking about switching accounts or opening a new savings product, now is a good moment to look not just at the terms on offer, but also at a provider's digital infrastructure. Modern apps with biometric login, real-time transaction alerts, and transparent communication in the event of fraud are no longer a luxury — they are a genuine quality signal. If you are looking for a new current account, you can get an overview by comparing personal accounts, looking not only at fees but also at what each bank's app actually offers. It is worth taking the same close look at savings products: comparing savings accounts and fixed-term deposits quickly shows which institutions are transparent about deposit protection and their security standards.
Trust matters for loans and mortgages too
This topic is not limited to savings and current accounts. Anyone taking out a loan or planning a mortgage hands over particularly sensitive personal and financial data to their bank — proof of income, credit bureau reports, often details of their entire financial situation. Here especially, it makes sense not to be guided by the lowest interest rate alone, but also to check how seriously a provider takes data protection and IT security. Institutions under direct ECB supervision are already subject to stricter requirements through initiatives like this one — which can be a reassuring, if not the only, factor when choosing a provider.
What you should do now
The ECB's October 31 deadline is, on the surface, a matter between supervisors and banks — but it is a clear signal of just how seriously the threat from AI-powered cyberattacks is now being taken. Use this moment to review your own protective habits: turn on two-factor authentication, keep an eye on your account activity, and stay wary of unusual contact attempts. And if you are already considering a switch, take the opportunity to compare not just rates and fees, but also the digital security of your next account or loan — for example directly through BankSorter's personal account comparison.