Strengthening Cybersecurity Measures In The Financial Sector Against AI-Related Threats: Press Conference By KATAYAMA Satsuki, Japan Minister Of Finance And Minister Of State For Financial Services
(Excerpt)
(Friday, April 24, 2026, 1:22 pm to 1:34 pm)
[Opening remarks:]
Minister)
We have just concluded a public-private liaison meeting on strengthening cybersecurity measures in the financial sector against AI-related threats. The meeting was attended by Governor Ueda of the Bank of Japan, a representative from the National Cybersecurity Office, the heads and Chief Cybersecurity Officers of the three megabanks, and Mr. Yamaji of the Tokyo Stock Exchange together with the executive officer responsible for cybersecurity. I stated that, in light of recent discussions at the G7, the G20, and the IMF, this is a threat that is already upon us. The financial industry expressed the same view. In other words, as advances in AI bring change to the financial sector, new forms of preparedness are required, and management judgment will become even more important. More specifically, the financial system is highly interconnected and operates in real time. I am not suggesting that other industries need not take action; that is not my point. However, the scale of potential spillovers is not comparable to that in other sectors. A cyberattack could therefore quickly spill over into market impacts and a loss of confidence. As financial institutions perform critical infrastructure functions, I believe it is more important than ever to accelerate the process from obtaining information on vulnerabilities to applying patches, as well as to strengthen preparedness for incidents when they occur.At today’s meeting, in order for the financial industry, the government, the Bank of Japan, and others to share a common understanding and consider forward-looking responses, I proposed establishing an official-level working group to deepen discussions going forward, which one might call a Japanese version of Project Glasswing for the financial sector. All participants agreed, and the group has accordingly been established. As the Takaichi administration aims to build a strong economy, we must also prevail in the battle over AI. Going forward, we intend to proceed swiftly with our deliberations, centering on this working group. That concludes my opening remarks.
[Questions and answers:]
Q.
You mentioned that Governor Ueda also attended today’s meeting. Could you tell us, to the extent you are able, what he said at the meeting? Also, could you comment on how coordination will proceed internationally going forward, beyond the framework of the government and the Bank of Japan?
A.
I would like to refrain from going into the details of the Governor’s remarks. However, in addition to what he heard at the same meeting I attended, he also noted that this issue had been taken up and discussed among central bank governors. For anything further, I would ask that you contact the Bank of Japan directly. In any event, he expressed his support for this framework and for the establishment of the working group. As for the international dimension, I believe this will naturally be taken up in those forums as well. It could come up at the G7 meeting in Paris in mid-May, and at the G20 as well, as the United States, which currently holds the presidency, is very eager to address this issue. I understand that the Secretary of the Treasury is expected to call on me after Japan’s Golden Week holidays, and later on there will also be the G20 meeting in the United States this summer. Through such occasions, I believe we will remain in close contact on a continuing basis and update our approach whenever new information becomes available.
Q.
What did the heads of the three megabanks say about their current initiatives and their assessment of the situation?
A.
All three megabanks said that they are already gathering as much information as possible on the scale of the threat. In any case, large corporations are subjected to enormous numbers of cyberattacks every day, and they deal with them each time, including by applying patches. So, if there has not been any major problem up to this point, that means they have managed to stay ahead thus far. The concern now, however, is that the capabilities of those launching attacks are on an entirely different level. They said that, in trying to determine exactly what threats this poses, there are limits to what individual banks can do on their own, and that they therefore greatly appreciate having this kind of public-private forum.
Q.
Could you share any current thinking, at this stage, on the working group’s future initiatives and the expected timetable?
A.
I believe the sooner the better. We will need representatives from the relevant groups as well. Also, since it is the IT industry that will be responsible for distributing patches and carrying out the necessary processing, we will need to bring them in too. There are also online financial services, so the scope of this will broaden. Bearing all of that in mind, I expect that officials will move quickly to reach out to the relevant parties and make arrangements for them to come together.
Q.
Just to confirm one point: in terms of the direction of the discussions going forward, you used the phrase “a threat that is already upon us.” Does that mean the discussions will focus not so much on how to make effective use of AI, but rather on restricting its use or on how to regulate it?
A.
That has not yet been decided. Even if we speak of restrictions, it is not clear whether such restrictions would in fact be possible. It is true that the distribution of Mythos is currently limited, but it is also possible that future systems could be made openly available to everyone, as with Linux. Taking that into account, the question is whether it is even possible to limit their spread. There was also a finance minister who raised that point with me during a bilateral meeting, but whether that can actually be done is another matter. On the other hand, if these systems have that level of capability, they may also have defensive capabilities. So I believe we have not yet reached any definitive conclusion on that point. I think that is true not only for us, but also for the U.S. authorities and the European authorities.
Q.
What specifically was said about the threats posed by Mythos?
A.
In short, everyone is already working desperately, day in and day out, to defend against the cyberattacks to which they are exposed. Systems may occasionally be disrupted, but they have somehow managed to cope. What we do not yet fully understand is what would happen if a completely different level of capability were brought to bear. I assume it would mean prolonged disruption to systems, but we do not yet know exactly where or how that disruption would materialize. In Japan, there are very few people who do not have financial accounts, and those accounts are also linked to public systems. So the impact would not be limited to ordinary financial transactions alone; if it were to spread more broadly, the consequences could be extremely serious. It is not hard to imagine, but it has not yet been made concrete. I believe that is the situation.
Q.
I would imagine that regional banks, Shinkin banks, and other small and medium-sized regional financial institutions are particularly vulnerable from a systems perspective. How will this be addressed going forward?
A.
Naturally, the Financial Services Agency supervises all of these institutions, and it must not allow any loss of confidence or any disruption to the credit system. If that were to happen, we could not build a strong economy. That is why this issue has a different significance in the financial sector than it does in other industries, and I believe that is precisely why this issue has been regarded as so important in finance ministers’ discussions at both the G7 and the G20.
Q.
Just to confirm, is the idea that the working group will discuss not only Mythos itself, but AI, cyberattack, and cyber defense issues more broadly?
A.
Yes. It may be that such discussions were needed even before now, but up to this point matters have largely been handled on a case-by-case basis. When we speak with other governments, however, it is clear that this time the scale is different. This has been made possible by advances in AI, but that does not mean other companies will stand still; they too will continue to advance. The question is how far this will go. In other words, we may be entering an environment in which something on this scale should no longer come as a surprise. In the financial sector, the response required is not simply about damage to individual companies; finance is part of the social infrastructure. That is why I believe this is very much a matter for finance ministers— many of whom also serve as ministers responsible for financial services, and in my case I have been appointed to both roles —as well as for central bank governors. The FSB, BIS, and various other bodies will also likely be involved. That is how I see the situation.
Q.
You mentioned that a Japanese version of Project Glasswing would be launched. In terms of who would be responsible for it, is the idea that this would be done by the Financial Services Agency, or that the National Cybersecurity Office, the Bank of Japan, and others would all be involved in putting together something like a comprehensive response plan?
A.
At present, it is the authorities responsible for supervising finance that are raising the issue. Cybersecurity as a whole is, of course, already important, and I am not suggesting that cyber incidents affecting, for example, logistics companies or manufacturers are not serious. They are serious, and we do see companies facing major difficulties, from customer management to shipping restrictions and the like. But at the very least, those situations have not led to a loss of confidence in the financial system. Finance serves a public function. The way disruption spreads in this sector is different. Put another way, because finance is something the state must protect, the implications are different. For the time being, it is simply that we, as the supervisors, are the ones taking the initiative in bringing the relevant parties together. If it would be more rational to do so, I expect that we will also invite various other parties and work in coordination with them.
Q.
When you say “as quickly as possible,” do you have any target in mind, for example, by the summer or within the year?
A.
As for a target date, last week we were discussing the fact that Mythos had emerged only a few weeks earlier, and there is no guarantee that there will not be something else after that. If there is, then we will have to respond to that as well. So this all has to be handled in an agile manner. At the current Mythos level, there may well be discussions about what can be done in response. But that is not where it ends, and that is exactly why everyone is concerned.
Q.
Will meetings be held regularly from now on? Also, will the number of members be increased?
A.
Rather than being held on a regular schedule, they may need to proceed in an agile manner because the situation itself is highly agile. An emergency could arise in some country. In any event, I would like the first meeting to be held as soon as possible, and I am asking the officials to work hard on that.
Q.
Just to confirm, was today’s meeting hosted by the government and the Bank of Japan?
A.
Today’s meeting was hosted by the Financial Services Agency.
Read More