Financial Stability Council Trains Its Lens on Cyberattacks and AI

The Financial Stability Oversight Council (FSOC)’s 2025 annual report, released Friday (Dec. 11), was notable for its finding that 20% of student loan are delinquent.

But there were other findings as well. The report offers a generally calm assessment of U.S. financial stability. It said that markets and institutions “performed well,” and that core markets and infrastructure remained resilient through a brief spike in volatility in early April. It added a cautionary note: asset prices have rebounded and in some areas remain elevated relative to fundamentals.

The report also argued that stability policy is shifting from traditional credit-cycle concerns toward market mechanics and operational resilience. The chair’s letter framed financial stability as interdependent with long‑term growth and “economic security,” and said regulators should account for the cumulative burdens and interactions of rules, not just the costs of each one in isolation.

First up is the FSOC’s warning that cyber risk remains a credible systemic channel, even if incidents have not yet produced major financial-stability disruption. It pointed to interconnectivity, advances that enable more sophisticated attacks and the limited substitutability of certain critical third‑party services. Those are conditions the Council said can turn a successful attack into operational outages, liquidity stress and a loss of confidence.

On policy, FSOC endorsed coordinated third‑party service provider examinations among federal banking regulators and called for legislation to ensure Federal Housing Finance Agency (FHFA) has adequate examination and enforcement powers over third‑party risks at its regulated entities.

On bank regulation, the report called for simplification and clearer supervision. FSOC endorsed a “holistic review” aimed at modernizing and simplifying bank capital and supervision, improving tailoring and reducing unnecessary regulatory burden. It also argued that bank regulation has grown increasingly complex and that unintended consequences include some lending migrating away from banks to nonbanks and leverage ratios discouraging low‑risk market intermediation.

The report also pointed to supervisory reforms designed to add clarity: proposals to standardize the definition of “unsafe or unsound practice” and how agencies communicate supervisory findings, alongside actions to remove “reputational risk” from supervisory programs and rescind prior climate‑related financial risk management principles.

FSOC said artificial intelligence (AI) adoption is accelerating across financial services and that regulators are exploring AI to improve supervision and develop early‑warning indicators. The Council’s response is coordination through an AI working group intended to identify high‑value agency use cases and support public‑private dialogue around responsible adoption.

Key market developments FSOC wants watched:

Short‑term funding and cash products: repo markets are large (gross size near $12 trillion) and commercial paper outstanding is about $1.3 trillion; FSOC said these markets can amplify stress through run and rollover dynamics. It also flagged that other short‑term investment vehicles hold more than 40% of the commercial paper market and can face run-like dynamics.

Tokenization moves into cash management: FSOC noted growth in money‑market fund ETFs (over $4 billion in AUM) and tokenized money‑market funds (about $1.7 billion in net assets as of October).

Commercial real estate refinancing risk: CRE mortgage debt totaled $6.2 trillion as of Q2, and FSOC cited a maturity wall of roughly $936 billion in 2026 and $983 billion in 2027.

Corporate credit stress at the margin: the Council highlights pressure on lower‑rated borrowers and elevated leveraged‑loan defaults, often via distressed exchanges.

Stablecoins and payments regulation: FSOC supported the full implementation of the GENIUS Act and said growth in payment stablecoins is becoming a source of incremental Treasury demand. It also highlighted the Act’s framework for certain stablecoin issuers, including highly liquid reserve requirements and monthly reporting on reserve composition.

For banking, payments and FinTech leaders, the report reads as a roadmap rather than an alarm.

Expect policy attention to concentrate on Treasury market infrastructure (including central clearing), operational resilience and third‑party oversight, and governance around AI. In parallel, FSOC is watching whether cash‑management products and refinancing needs in corporate credit and commercial real estate can transmit stress if volatility returns.