The Group of Seven's finance ministers and central bank governors — representing Canada, France, Germany, Italy, Japan, the United Kingdom and the United States — have agreed to stage tabletop exercises that mimic AI-driven cyberattacks on the financial system, according to an announcement by Japanese Finance Minister Satsuki Katayama.

The objective is to pressure-test how regulators and banks would detect, contain and recover from such a breach. Tabletop exercises are scenario-based drills in which participants walk through a simulated attack step by step, testing decision-making and coordination without touching live systems.

G7 signs off on simulation plan

Katayama said ministers approved the plans during meetings held on the sidelines of the IMF's annual gatherings in Bangkok. Finance deputies had discussed simulations focused on frontier AI before the ministers signed on the proposal. The plan was reported by the Financial Times and Reuters.

Under the agreed proposal, G7 finance ministries and central banks will simulate cyberattacks to test how quickly they can detect breaches, contain them and restore systems. The findings will be used to update existing crisis response plans.

A Japanese finance ministry official who attended the meeting said the exercises will focus specifically on attacks powered by AI.

Private banks and major financial institutions may also participate, depending on the scenario, to test how well the wider financial system can recover from an attack. The drills are designed to assess existing safeguards, update response plans and identify gaps in cross-border cybersecurity.

Why regulators have turned to simulations

The proposed exercises come amid warnings from the IMF and central banks that AI-driven fraud and cybercrime threaten both financial stability and public confidence in major institutions.

On October 14, two days before the announcement, Bank of England Governor Andrew Bailey and IMF Managing Director Kristalina Georgieva warned at meetings involving the IMF and World Bank in Bangkok that AI-driven cybercrime was escalating rapidly and could erode confidence in the financial system.

AI is accelerating cyberattacks by helping criminals automate phishing and produce convincing fake documents, while also identifying software weaknesses faster than human teams can respond.

Not the G7's first drill

On May 18, 2026, the G7's Cyber Expert Group — a body formed in 2015 to coordinate cybersecurity policy among the bloc's financial authorities — simulated a malware attack on technical infrastructure shared across the financial sector, involving 24 organizations from G7 countries, including central banks, financial regulators, finance ministries and private firms.

The proposed drills would take a different approach: testing how financial institutions respond when attackers use AI to launch cyberattacks, rather than focusing solely on defending AI systems against threats.

Katayama had already suggested in July that the G7 planned to discuss common AI security and cyber-defense standards for banks, indicating the October announcement followed months of preparation.

Banks are already getting ready

Banks have already begun acting to deter these risks. On October 13, three days before the announcement, JPMorgan Chase CEO Jamie Dimon told investors on the bank's third-quarter earnings call that the bank had barred external AI agents from directly accessing customer accounts.

Dimon said JPMorgan would not allow outside AI agents to access its systems without restrictions, citing the risks to both customers and the bank. He warned that rogue agents could number in the thousands.

Bank of America has taken its own precautions, hiring hundreds of contractors to fix vulnerabilities that AI tools uncovered in its systems.

The G7 exercise extends this approach to the financial system as a whole, testing how authorities would respond to an AI-driven attack targeting shared payment networks or widely used banking software across several countries at once. Details to watch as the plan moves forward include which scenarios are chosen, which private institutions take part, and whether the exercise findings shape the common AI security and cyber-defense standards for banks that Katayama flagged in July.