The Bangkok Blueprint calls for cooperation against cross-border financial fraud. As ASEAN deepens digital integration and expands its role in the global AI economy, shared technological dependencies present another risk that financial decision makers need to understand before disruption occurs.
On 14 October 2026, the International Monetary Fund and World Bank, working with the Bank of Thailand, launched the Bangkok Blueprint for Fraud-Resilient Financial Services. Its central point is that technology-enabled financial fraud crosses institutional and national boundaries, requiring coordinated responses beyond individual banks.
The Blueprint addresses fraud, not AI infrastructure concentration. Yet its approach offers a useful lesson for another vulnerability. Financial institutions operating under different regulators may depend on the same cloud platforms, AI models, or upstream technology providers. Each institution can maintain sound controls while shared dependencies remain difficult to recognize at the regional level.
The Integration Paradox
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
ASEAN concluded negotiations on its Digital Economy Framework Agreement (DEFA) in May 2026, ahead of its planned signing. The agreement covers electronic payments, digital identity, data governance, cybersecurity cooperation, and emerging technologies. Studies cited by ASEAN suggest the region’s digital economy could double to US$2 trillion by 2030 if the agreement is successfully implemented.
Greater interoperability promises lower transaction costs and more efficient financial services. The ASEAN+3 Macroeconomic Research Office (AMRO) makes a related argument in its ASEAN+3 Financial Stability Report 2026, released on 5 October. Digital connectivity can support deeper financial integration, improving market efficiency and systemic resilience. The same report identifies high asset concentration in AI, rapid financial digitalization, and evolving financial linkages as forces reshaping the region’s risk landscape.
That exposure is visible in growth projections. In an October 2026 economic analysis, AMRO staff estimate that ASEAN+3 growth in 2027 could fall from 4.1 to 2.6 percent if US technology investment, used as a proxy for global AI demand, slows to its 2024 growth rate.
That scenario measures sensitivity to AI investment, not losses from banking technology failure. It nevertheless shows how much the AI economy now matters to regional growth, even as financial institutions adopt technologies supplied by an industry exposed to changing investment conditions.
Integration can diversify financial markets while leaving their supporting infrastructure concentrated.
What Banks May Have in Common
Banks have good reasons to rely on major technology providers. Large cloud and AI companies offer security capabilities, technical expertise, and recovery resources that individual institutions cannot easily reproduce.
Moving critical services to smaller vendors is not automatically safer. Provider quality and systemic concentration are different questions. Even a highly resilient supplier becomes a common exposure when numerous institutions depend on its services.
The Financial Stability Board (FSB) has identified third-party concentration, market correlations, and cybersecurity among AI-related financial vulnerabilities. Its 2025 monitoring report includes a case study on AI-related third-party dependencies and service provider concentration and calls for authorities to address data gaps in monitoring.
Indonesia’s Financial Services Authority, Otoritas Jasa Keuangan (OJK), has also recognized systemic third-party dependencies and correlated AI-driven behavior in its 2025 banking AI governance guidance.
Two mechanisms deserve attention. A common provider can suffer an outage, disrupting several institutions simultaneously. Alternatively, AI systems can continue operating while generating similar responses to market stress, prompting banks to tighten credit or increase liquidity buffers together. The second problem is harder to detect because nothing has technically broken. The technology may be working exactly as its users intended, even as their collective decisions amplify financial instability.
Recent incidents illustrate operational concentration risks. In July 2024, a faulty CrowdStrike software update disrupted computer systems across multiple industries. A month earlier, a ransomware attack on Indonesia’s Temporary National Data Centre disrupted public services, including immigration.
Neither incident was an AI banking failure. Both show how disruptions involving shared technology or centralized services can affect otherwise separate organizations.
No publicly available, comparable ASEAN-wide dataset appears to measure critical AI dependencies across financial institutions. This does not establish that systemic concentration already exists. It leaves policymakers without an accessible regional picture of where common exposure may be developing.
Agentic AI Changes the Speed
On 7 October 2026, the Monetary Authority of Singapore (MAS) issued its final Guidelines on Artificial Intelligence Risk Management for Financial Institutions, effective from 7 October 2027. The guidelines recognize AI systems with greater autonomy in generating outputs, making decisions, and executing actions.
Agentic AI is not yet widespread across critical banking operations. Nevertheless, systems that can access tools and execute authorized workflows introduce different pressures from models that merely recommend actions.
If similar agents eventually support payments, treasury, or risk management across institutions, a common disturbance could produce financial responses before operators fully understand its origin. Actual consequences will depend on deployment and safeguards, but faster execution can reduce the time available for intervention.
Why Singapore Matters
Singapore illustrates why these risks cannot be assessed solely through national supervision.
According to the International Monetary Fund, Singapore’s banking assets reached 512 percent of GDP at the end of 2024. Claims on non-residents amounted to 116.6 per cent of GDP, equivalent to approximately 23 per cent of total banking assets.
Singapore was also the world’s third-largest foreign-exchange center, handling US$1.485 trillion in average daily trading in April 2025.
These figures demonstrate connectivity rather than institutional weakness. A prolonged disruption affecting critical payments, liquidity management, or foreign-exchange services operating through Singapore could have consequences for institutions and businesses elsewhere in ASEAN.
Geopolitics adds another concern. US export controls on advanced computing show how access to technology can be shaped by strategic decisions. Restrictions affecting suppliers need not target ASEAN directly to impose adjustment costs on regional financial institutions.
When Financial Disruption Reaches the Real Economy
According to the United Nations Conference on Trade and Development, ASEAN attracted a record US$243.9 billion in foreign direct investment in 2025. Semiconductors, electronics, and digital infrastructure are among the industries attracting strategic capital as the region expands its role in global AI supply chains.
Major projects often rely on parent-company funding or international capital markets rather than domestic bank lending. Their implementation nevertheless requires cross-border payments, foreign-exchange hedging, trade finance, and working capital for local suppliers.
A prolonged disruption affecting shared financial technology could interfere with these services across several markets. Equipment payments might be delayed, import financing constrained, or contractors forced to manage cash-flow gaps. The Basel Committee’s Principles for Operational Resilience emphasize maintaining critical banking operations and managing third-party dependencies during severe disruptions.
The concern is not that a single technology outage would derail ASEAN’s industrialization. Hidden dependencies could interrupt the financial services supporting investment execution, especially during global economic uncertainty. Discovering them during a disruption forces institutions to investigate shared exposures while restoring essential services. Identifying them beforehand allows decision makers to determine which functions deserve stronger safeguards and where additional resilience spending is justified.
Building on ASEAN’s Existing Cooperation
Europe offers a practical precedent. Under the Digital Operational Resilience Act, European authorities assess critical technology providers’ systemic importance and substitutability. In November 2025, they published their first list of designated critical providers.
ASEAN can draw on this principle without reproducing Europe’s regulatory architecture. Its financial cooperation mechanisms already provide a starting point.
The ASEAN Senior Level Committee on Financial Integration (SLC), co-chaired by Bank Indonesia and the State Bank of Vietnam during 2024–2026, receives risk-monitoring reports on macroeconomic and financial-stability risks within its working committees’ purview and on their implications for regional integration.
ASEAN also has experience in cross-border cybersecurity cooperation. In an August 2023 statement, Bank Indonesia reported an opportunity to coordinate the Cybersecurity Resilience and Information Sharing Platform (CRISP), a forum supporting cybersecurity cooperation and information exchange among ASEAN central banks.
CRISP is a precedent for sharing cyber-threat information, not an existing mechanism for mapping financial institutions’ technology providers. Such an assessment requires banking supervisors and payment-system authorities, in addition to cybersecurity specialists.
The SLC could therefore initiate a voluntary, aggregated assessment through the Working Committee on ASEAN Banking Integration Framework and the Working Committee on Payment and Settlement System, with AMRO providing analytical support where agreed. As ASEAN prepares to reorganize its financial cooperation arrangements from 2027, the assessment could continue under the emerging structure rather than depend on the present committees.
Participating authorities could submit aggregated information under confidentiality arrangements, while banks receive anonymized comparisons revealing common exposures not visible from their own contracts. A limited pilot, supported by resources agreed among participants, could establish whether broader monitoring is necessary.
The results could inform one regional scenario exercise: what happens if a critical cloud or AI service used across several ASEAN markets becomes unavailable for 48 hours?
Such a test should establish which payment, settlement, liquidity-management, and trade-finance functions remain operational, whether backups are genuinely independent, and where disruption would carry the greatest economic consequences. What matters is not simply how many institutions share a provider, but which critical financial functions depend on the same failure domain and how quickly those functions can recover.
The Bangkok Blueprint demonstrates the value of coordination when financial risks cross institutional boundaries. ASEAN can apply that lesson to critical technology dependencies, building on existing cooperation before a common disruption forces the question.
The real test of ASEAN’s digital financial integration will not only be whether its systems can operate seamlessly together, but also whether they can still fail separately.
