CREST Unveils Global Framework to Unify Cyber Resilience in Financial Services

CREST has issued new guidance for the financial services sector, calling for a unified cybersecurity strategy that spans the entire market ecosystem. For fintech professionals, this represents a shift toward collective resilience, moving beyond individual institutional security to address systemic risks inherent in shared infrastructure, third-party technology providers, and the rapid adoption of Artificial Intelligence.

What was announced

The whitepaper, titled ‘Cyber Resilience in Financial Services: A whole ecosystem approach,’ outlines a practical maturity pathway designed to synchronize the efforts of financial institutions, supervisors, and cyber service providers. It identifies three core pillars of responsibility: institutions must maintain resilience across critical business services; supervisors need to establish proportionate risk expectations; and service providers must offer independent assurance and testing capability.

A significant portion of the guidance focuses on the impact of Artificial Intelligence. As AI usage grows among both banks and their vendors, CREST argues that a coordinated approach to testing and responsible use is essential to prevent systemic failure. The paper highlights that cyber resilience depends on more than the strength of individual institutions, as a weakness in one critical part of the shared infrastructure—such as technology or data providers—can affect the resilience of the entire system.

The report also addresses the "maturity gap" in different jurisdictions, where local capacity for complex cybersecurity services may be lacking. To solve this, it proposes mentoring and partnerships between international and local providers. The CREST Cyber Accelerated Maturity Programme (CREST CAMP) is highlighted as a template for this development. This programme integrates standards, training, and mentorship to help local providers and institutions move through a structured "CREST Pathway" toward independent accreditation, aiming to create sustainable capacity in markets currently reliant on external expertise.

"Financial services are among the most interconnected and systemically important parts of any economy, so cyber resilience has to be developed across the whole ecosystem. Financial institutions, supervisors and cyber service providers each have a distinct role, and the strength of the system depends on their capability developing together."

Nick Benson, CEO of CREST

The companies involved

CREST operates as a global non-profit accreditation body, serving as a standard-setter for the cybersecurity industry. It provides certifications for both individuals and organisations, covering critical areas such as penetration testing, incident response, and threat intelligence. By establishing these benchmarks, CREST aims to ensure that financial institutions have access to a pool of vetted, high-quality service providers. The organisation focuses on building local capability alongside international standards to create sustainable market capacity.

The Cyber Risk Institute (CRI) is a non-profit organisation that works alongside industry leaders to develop harmonised cybersecurity frameworks. Its primary offering, the CRI Profile and Maturity Model, is a widely used tool that allows financial firms to map their security posture against global regulatory expectations. Josh Magri serves as the CEO of CRI, leading the organisation’s efforts to reduce the complexity of cyber risk management through proportionate, evidence-based approaches. Together, these organisations represent a push toward standardisation in a sector that has historically struggled with fragmented regulatory requirements and varying levels of technical maturity across different geographic regions.

What FF News has reported before

FF News has previously monitored the evolving landscape of cybersecurity and digital asset privacy, including developments where Citrea Acquires Crest to Launch Self-Custodial Private Bitcoin Mobile Wallet. This earlier reporting underscores the ongoing integration of privacy-focused technology within the financial sector and the shifting ownership of technical infrastructure. While that specific acquisition focused on Bitcoin and self-custodial privacy, it reflects a broader trend of consolidation and technical advancement that CREST’s new guidance seeks to standardise. By tracking these corporate movements, FF News provides a broader view of how individual technical providers are being absorbed into the very ecosystem that CREST now aims to regulate through unified maturity pathways and accreditation standards.

What this means

This announcement signals a move away from the "fortress" mentality of individual bank security toward a more integrated, "herd immunity" model of cyber resilience. By focusing on the ecosystem rather than the entity, CREST is putting pressure on third-party service providers and technology vendors to meet higher, more transparent standards of accreditation. For the fintech sector, this likely means more rigorous auditing of AI-driven tools and a greater emphasis on how local providers in emerging markets are vetted. The challenge remains whether supervisors can harmonise these expectations globally without creating a new layer of bureaucratic friction that slows down innovation.