Four developments this week highlight a growing challenge for boards and risk managers: technology risks are becoming increasingly connected to financial and operational risks.

🔴 AI Agents | HKMA AI Governance

The HKMA introduced its ART Framework and issued supervisory guidance for responsible AI adoption, centred on accountability, resilience, and trust. It is also exploring governance for increasingly autonomous AI agents.

Read More

🔵 AI & Cyber | The hidden dependency problem
Two critical flaws in PHP, found using AI tools and undetected for over a decade, led cyber agencies in several countries to urge organisations to patch or take systems offline. The challenge is not only applying the fix, but finding everywhere the component runs.

Read More

🟡 Stablecoins | US OCC Rule

The US OCC has reportedly finalised significant regulations implementing the GENIUS Act.

Read More

🟠 Cloud Outage | Google Cloud London Disruption

A reported power-related incident disrupted Google Cloud services in London, affecting several financial institutions and causing banking service interruptions.

Read More

Continuum View

The challenge is not simply identifying new technologies. It is understanding how their failure could translate into financial loss. The starting point should always be the potential loss scenario, followed by appropriate controls and insurance.

News → Risk → Control → Insurance

Three developments this week highlight a growing challenge for boards and risk managers: technology risks are becoming increasingly connected to financial and operational risks.

🔴 AI & Financial Stability | AI investment risk can become financial stress

On 13 October, the IMF highlighted the possibility that disappointing AI investment returns could trigger a market correction, potentially amplified by leverage and concentrated financial exposures. This is a stress scenario, not a forecast.

Read More

🟠 Cyber & Identity Fraud | A data breach can become financial fraud

On 9 October, Japan’s Financial Services Agency urged financial institutions to strengthen cybersecurity, third-party risk management, and customer identity verification following incidents involving exposed identification documents. A further government advisory followed on 14 October.

Read More

🟡 Digital Assets & Banking | Financial services and digital assets are converging

On 14 October, Payward, the parent company behind Kraken, announced an agreement to acquire Lithuania’s Saldo Bank. The transaction remains subject to regulatory approval.

Read More

Continuum View

Risk convergence is becoming the defining emerging-risk challenge. The question is no longer how to manage technology, financial, and operational risks separately, but how one can trigger another. Effective risk management starts with the potential loss scenario, followed by controls and appropriate insurance.

News → Risk → Control → Insurance

Most growth companies buy coverage before they fully understand their risk exposure. Policies get renewed one at a time, and where the risk is (governance, regulatory exposure, where the gaps sit) often never gets mapped. Big Four firms do strong work, but their pricing is built for multinationals. Growth companies in Asia have been stuck in the middle.

Continuum Risk Advisory is different:

→ Independent but experienced.

→ Fixed-fee and scope.

→ Built for Asia’s regulators and growth-stage companies.

Three ways to work with us:

→ Risk Programme Review: see your full risk picture

→ Risk Framework Design: governance ready for your board, regulators and investors

→ Retained Risk Advisory: ongoing risk oversight without a full-time hire

Built for Asia’s regulators and growth-stage companies. Know your risk before you buy cover.

Book a 30-minute discovery call with us. Tell us your next funding, licence or exit date and we’ll show you where your biggest risk gaps sit.

For every one of those directors, listing changes the shape of personal liability. First, civil compensation exposure attaches under the Companies (WUMP) Ordinance Section 40 for untrue prospectus statements. Second, criminal liability attaches under Section 40A, with fines up to HK$700,000 and three years’ imprisonment. Third, continuing disclosure obligations extend throughout the listed life. Finally, shareholder actions become possible only once shares are publicly tradable.

Rebuilding the D&O tower at listing is therefore a placement exercise, not a renewal exercise. Specifically, it needs to happen alongside the IPO working group, not after the listing bell has rung. In short, our October 2026 Risk Insight maps the five areas that matter most for APAC issuers approaching listing.

What This Report Covers

• Why private company D&O does not scale to a listed company exposure profile
• The director’s new liability at listing, including Hong Kong’s WUMP Ordinance Section 40 (civil) and 40A (criminal)
• How Side A, Side B, Side C, and Side A DIC work in a listed company tower, and which side matters most for independent directors
• Where securities claims actually land in the first twelve months post-listing, and how to size the retention for year one
• Why pre-IPO tail cover is the piece of the placement easiest to defer and hardest to add back

Download the PDF →

Three developments this week point to the same shift: emerging technology risk is becoming an operating-governance issue, not something businesses can leave for later.

🔴 AI Governance | MAS Sets AI Risk Expectations

Singapore’s MAS has issued final AI Risk Management Guidelines for financial institutions. The framework goes beyond broad AI principles. Firms are expected to identify AI use, assess materiality, maintain appropriate inventories, establish lifecycle controls, and remain accountable for AI supplied by third parties.

Read More

🟠 AI-Assisted Cyber | Attacks Hit Korean Financial Firms

South Korea is investigating cyber incidents across seven financial firms after data affecting roughly 68,000 customer and corporate records was exposed. Authorities say there are signs AI may have been used, although that remains under investigation. Reporting indicates attackers reached peripheral and back-office systems rather than core banking platforms.

Read More

🟡 Digital Assets | Quantum Readiness Moves Forward

Europol is urging the cryptocurrency industry to prepare now for quantum-computing risks to cryptography. The timing remains uncertain, but the control issue does not.

Read More

Continuum View

Future risk is becoming present-tense governance. The question for boards and risk teams is increasingly: what do we need to control today because changing it after the risk fully arrives will be too late?

News → Risk → Control → Insurance

What This Report Covers

• Why digital asset losses have moved from keys to governance, vendors and approval workflows
• How fraudsters used real domains, licensed brands and AI to make requests look genuine
• What the move of tokenisation and stablecoins into live infrastructure means for operational risk
• Which controls and insurance lines deserve review before renewal

Download the PDF →

Three developments this week point to one emerging-risk theme: your risk perimeter increasingly includes the systems and partners you depend on.

🔴 Digital Assets | When a security control becomes the attack surface

Bitget says the attacker behind its roughly US$387.5m loss exploited a vulnerability in a third-party security product, obtained high-level internal credentials, and then sent fraudulent withdrawal commands. The lesson goes beyond crypto: third-party security technology can itself sit inside a critical transaction-authorisation chain.

Read More

🟠 AI & Financial System | AI risk becomes a dependency problem

The Basel Committee said this week that the expanding financial footprint of AI is bringing greater leverage and increasingly interconnected financing arrangements, while frontier AI can amplify cyber and operational vulnerabilities. AI risk is no longer only about how a model behaves. It is also about what the financial system becomes dependent on.

Read More

🟡 Fintech & Stablecoins | Traditional and digital payments converge

Citi and Coinbase have expanded their partnership to connect stablecoin payments directly with regulated banking rails. That makes stablecoins easier to use, but also creates new operational interfaces between banks, digital-asset infrastructure, and payment providers.

Read More

Continuum View

Outsourcing a technology or service does not outsource the underlying risk. The key questions are: what do we depend on? What can fail? What happens if it does? And where does responsibility sit? Then controls. Then insurance.

News → Risk → Control → Insurance

Directors celebrate the IPO. Six months later, a claim arrives for something the company did before listing. The D&O policy has already expired. Now there’s a problem.

This scenario plays out regularly. A board goes public, the main D&O policy runs for 12 months, and when it ends, the board assumes the risk is managed. But pre-IPO exposure doesn’t disappear when a policy renews or expires. It gets claimed years later—after directors have left office, after the company may have been acquired, or after the policy that protected them no longer exists.

That’s what extended D&O coverage, or “tail coverage,” is for. And it’s the easiest piece of an IPO placement to leave off—and the hardest to add back.

What Tail Coverage Actually Does

Extended D&O coverage keeps your IPO policy active for claims arising from acts that occurred before the policy ended. Without it, claims for pre-IPO conduct made after the policy expires may fall outside coverage entirely.

The policy ends on a specific date. Claims don’t. A director who retires in month six can be sued in year three for a decision made before the IPO. Without tail coverage, that director has no protection.

Tail coverage extends the reporting period—the window during which claims can be reported to the insurer and still receive coverage. Instead of a fixed end date, tail coverage can extend for three, five, or even seven years, depending on what the board purchases.

Why Boards Leave Tail Coverage Off

Tail coverage has a significant cost. It’s typically 150% to 300% of the annual premium—a material expense that comes due upfront, often during the IPO process when the board is focused on other spending.

The purchase also requires a decision. The board must ask: How long do we want extended coverage? Three years? Five years? Seven years? Each option has a different price. And the decision has to be made before the main policy expires. Once the trigger date passes, the insurer won’t write the tail at any price.

Many boards defer the decision, intending to reconsider it at renewal. But renewal happens 12 months after listing, when the IPO momentum has faded, when the board’s attention has moved to operations, and when the cost seems like an afterthought. By then, the opportunity to price and place the tail—at a predictable cost—has passed.

The Cost of Leaving Tail Coverage Off

A departing director who retires at or shortly after the IPO faces personal exposure for years. Under Hong Kong’s Companies Ordinance Section 40, directors who authorize a prospectus remain liable for untrue statements in it for years after they leave office. Without tail coverage, they absorb that risk personally.

A change of control—an acquisition or merger—typically triggers a runoff on the existing D&O policy. The acquiring company’s insurers take over, but they have no obligation to cover historic liability of the acquired company’s directors. If tail coverage wasn’t purchased before the change of control, those directors are exposed.

A delisting or going-private transaction also triggers policy termination. Again, without tail coverage, exposure continues but protection ends.

Tail Coverage Pricing Is Set Upfront

The cost of tail coverage is negotiated and fixed at the time it’s purchased. Once the policy expires or a trigger event occurs, that pricing opportunity is gone. Insurers will not write tail coverage retroactively, and if they do, the cost is substantially higher—or they refuse entirely.

This creates urgency. The board has to decide on tail coverage before the IPO closes, not after. It’s part of the placement conversation, not a post-listing decision.

A Defensible IPO Programme Includes the Tail

An IPO D&O programme that protects directors only while they’re in office is incomplete. Departing directors, regulatory investigations reaching into pre-IPO conduct, and change-of-control scenarios all create exposure that extends well beyond the main policy period.

A defensible programme includes the tail as part of the initial placement. The board discusses it upfront, prices it upfront, and purchases it upfront. This isn’t an afterthought. It’s a core component of the coverage.

Directors who understand this difference are the ones protected when claims arrive years later. Boards that leave tail coverage off are the ones that discover the gap when it’s too late to add it back.

Ready to review your tail coverage? Contact Continuum to ensure your IPO D&O programme includes extended protection for directors.

🔴 AI & Automation | When the model takes an action you didn’t authorise OpenAI has introduced a formal framework for reporting model misalignment and published six examples of unexpected behaviour, including unauthorised API-key use, public file uploads, and unsanctioned communication between agents. The risk question is shifting from “Can the model do the task?” to “What else can it do while trying to complete it?”

Read More

🟠 Fintech & Payments | Authentic channel, fraudulent instruction Revolut confirmed that sensitive customer information was disclosed after fraudulent government requests were sent from a legitimate agency email domain. The lesson: verifying the channel is not the same as verifying the authority behind the request.

Read More

🟡 Tokenisation | Onchain markets move closer to mainstream finance The U.S. SEC has granted temporary conditional relief allowing certain venues to trade tokenised listed U.S. stocks using permissioned onchain infrastructure. That moves tokenisation further from experiment toward market structure, and brings new questions around settlement, liquidity, governance, and operational resilience.

Read More

Continuum View The emerging control question is increasingly: who, or what, is authorised to act, and what independent check exists before that action becomes irreversible? Understand the loss scenario first. Then controls. Then insurance.

News → Risk → Control → Insurance

Want to talk through what this means for your risk exposure? Get in touch with us today.