Hong Kong’s banking sector scored 2.3 out of 10 in the HKMA’s first Quantum Preparedness Index, showing that most banks remain at an early stage of preparing their cryptographic systems for quantum computing. Separately, Switzerland’s Federal Criminal Court fined Lombard Odier CHF 3 million ($3.7 million) after finding that it had failed to take adequate organisational measures to prevent money laundering by a former employee. The judgment is not final. Elsewhere, Singapore formed an industry task force to address AI-driven cyber risks, while Bank of America agreed to acquire UK cybersecurity consultancy MDSec. Germany’s BaFin prepared for a prospective role supervising financial-sector AI systems, and several banks made capital-management decisions amid lending growth and higher credit costs. Read more on the week’s key developments: 1. HKMA quantum index shows Hong Kong banks at an early stage of preparedness The Hong Kong Monetary Authority launched a quantum-preparedness white paper and the first Quantum Preparedness Index for the banking sector. The initial index score was 2.3 out of 10. Around 32% of surveyed banks had not begun their transition journey, approximately half had no formal post-quantum plan and about one-third had started exploring or piloting quantum-related initiatives. The findings expose an emerging operational-risk gap. Banks will need to identify where existing cryptography is embedded across payment, custody, customer data and cross-border systems before migrating to post-quantum standards. The HKMA did not disclose institution-level results, preventing comparisons among individual banks. It aims to raise the sector’s score to 10 by 2030 through guidance, training and industry engagement. 2. Lombard Odier fined over organisational failures in AML controls The Swiss Federal Criminal Court fined Lombard Odier CHF 3 million ($3.7 million) after finding that the bank had not taken all necessary and reasonable organisational measures to prevent money laundering by a former relationship manager. The court also ordered the confiscation of more than CHF 400 million ($495 million) in assets linked to the underlying offences. The judgment is not final. The ruling places responsibility on the bank’s control framework, extending the case beyond one employee’s conduct. Despite indications of corruption, its AML functions did not ensure that further enquiries into the origin and economic purpose of the funds were completed and documented. The confiscated assets were linked to the underlying offences and were not identified as bank-owned assets. 3. MAS and Singapore banks establish AI-driven cyber-risk task force The Monetary Authority of Singapore and the Association of Banks in Singapore established an industry task force to address cyber and technology threats amplified by artificial intelligence. The move follows a September 2025 MAS circular on deepfake risks and an April 2026 advisory calling on financial institutions to strengthen their cyber defences. The task force shifts Singapore’s response from institution-level warnings toward collective testing of AI-enabled defensive tools and the development of common controls. This could help banks respond more consistently to threats that cross institutional boundaries. However, MAS disclosed no timetable, performance benchmarks or reporting requirements, leaving its effect on operational resilience difficult to measure. 4. Bank of America acquires MDSec to expand cybersecurity expertise Bank of America agreed to acquire MDSec Consulting, a UK information-security consultancy employing approximately 65 cybersecurity professionals. The transaction is expected to close in the fourth quarter of 2026, subject to regulatory approval. MDSec is based in Macclesfield, near Bank of America’s Chester operations, where the bank already maintains a cyber-threat operations centre. The acquisition brings offensive-security testing closer to Bank of America’s threat operations, potentially shortening the cycle between identifying vulnerabilities and strengthening controls. It also gives the bank greater ownership of specialist knowledge that is often sourced externally. However, MDSec’s relatively small workforce means the wider effect will depend on how its expertise is integrated across the bank’s testing and remediation programmes. 5. Canara Bank strengthens capital as lending and NBFC exposure grow Canara Bank reported a Common Equity Tier 1 ratio of 12.91%, up 62 basis points year on year, and a total capital adequacy ratio of 17.17%, up 65 basis points. Global advances increased 17.97%, while the gross non-performing asset ratio declined to 1.57% from 2.69% and the provision-coverage ratio rose to 94.76%. The improvement in capital and asset-quality indicators coincided with a rise in the global credit-to-deposit ratio to 80.25% from 75.93%, as lending grew faster than deposits. Lending to non-bank financial companies increased 30.58% to INR 1.75 trillion ($20 billion). Sustaining this pace will require deposit growth, capital generation and provisioning to keep up with credit expansion and rising exposure to financial-sector counterparties. 6. BaFin prepares for financial-sector AI oversight under the EU AI Act Germany’s BaFin outlined how its responsibilities are expected to expand as Germany implements the European Union’s Artificial Intelligence Act. The supervisor is preparing to undertake market-surveillance responsibilities for relevant AI systems used by banks, insurers and other regulated financial institutions, although the final allocation of responsibilities among German authorities was still being determined. The prospective mandate has direct implications for institutions using AI in credit assessment, financial-crime monitoring, customer interaction and internal operations. Banks will need to connect AI governance with existing requirements for data quality, model testing, information and communication technology risk, outsourcing and management accountability. BaFin is preparing for an expanded supervisory role, but institution-level enforcement under the EU AI Act has not yet begun. 7. Société Générale launches EUR 1.5 billion buyback as credit costs rise Société Générale announced an extraordinary EUR 1.5 billion ($1.72 billion) share-buyback programme and an interim dividend of EUR 0.75 ($0.86) per share after first-half group net income reached EUR 3.49 billion ($4 billion). The buyback would reduce its Common Equity Tier 1 ratio by 39 basis points to 13.2%, around 290 basis points above its regulatory requirement. The distribution comes as risk-weighted assets rose to EUR 406 billion ($465 billion) from EUR 393 billion ($450 billion) at year-end. First-half credit costs increased 6.6% to EUR 745 million ($853 million), while the second-quarter cost of risk reached 27 basis points. Société Générale retains sufficient capital headroom for the buyback, but further distributions will depend on earnings keeping pace with balance-sheet growth and higher provisions. 8. ING gains EUR 1 billion in RWA relief through risk transfer ING reported EUR 15.2 billion ($17.4 billion) of net core lending growth during the second quarter, alongside EUR 15.9 billion ($18.2 billion) of net core deposit inflows. Its Common Equity Tier 1 ratio stood at 13.1%, including approximately EUR 1 billion ($1.15 billion) of risk-weighted-asset relief from a significant risk-transfer transaction. Risk costs remained below the bank’s through-the-cycle average at 15 basis points of average customer lending. The transaction improved capital efficiency by transferring part of the portfolio’s credit risk to external investors. The resulting relief partly offset the risk-weighted-asset effect of ING’s lending growth and preserved capital headroom. 9. BBVA launches EUR 2 billion buyback as impairments rise BBVA announced a EUR 2 billion ($2.29 billion) extraordinary share-buyback programme after reporting first-half net attributable profit of EUR 6.05 billion ($6.93 billion). Its Common Equity Tier 1 ratio stood at 12.90%, above its 11.5% to 12% target range, while customer lending increased 17.7% at constant exchange rates. The higher capital distribution coincided with a 24.2% increase in financial-asset impairments as customer lending grew 17.7%. The group’s cost of risk stood at 1.43%, its non-performing loan ratio at 2.6% and its coverage ratio at 85%. BBVA retains capital above its operating target, but further distributions will depend on earnings and organic capital generation continuing to offset higher provisions, risk-weighted-asset growth and volatility across Mexico, Türkiye and other major markets. 10. Lloyds launches GBP 1 billion buyback as credit costs rise Lloyds Banking Group announced a GBP 1 billion ($1.32 billion) share-buyback programme and increased its interim dividend by 30% after reporting first-half statutory profit before tax of GBP 4.3 billion ($5.68 billion), up 23% year on year. The bank continued to target a Common Equity Tier 1 ratio of around 13% by the end of 2026, indicating that the distribution forms part of a broader plan to reduce surplus capital towards its operating target. The distribution comes as underlying loan impairments increased, including a second-quarter charge of GBP 322 million ($425 million), compared with GBP 133 million ($176 million) a year earlier. Lloyds is also planning balance-sheet growth under its updated strategy, particularly in corporate and institutional banking. Earnings will need to absorb higher distributions and credit costs alongside the risk-weighted-asset demands from planned lending growth. The Risk and Capital Weekly Brief tracks developments affecting banks’ credit risk, capital strength, liquidity and operational resilience.
