When AI and Multicloud Broke the Financial Services Compliance Playbook Nikitha Omkar (Senior Product Marketing Manager)

Two forces are rewriting financial services compliance – and regulators are no longer waiting. The 2026 IBM Cost of a Data Breach Report found AI-driven attacks surged 56% year over year, with financial services bearing the highest breach cost of any sector at $6.29 million per incident.1 Shadow AI alone adds $670,000.2 Meanwhile, cloud concentration risk turned theoretical when a 15-hour AWS outage in late 2025 simultaneously disrupted Coinbase, Robinhood, and parts of Lloyds Banking Group3 – prompting the EU to designate 19 critical ICT third-party providers under DORA for direct supervisory oversight.4 The regulatory response in 2026 has been sweeping: the U.S. Treasury published the Financial Services AI Risk Management Framework mapping 46 AI risks to technical controls,5 the Federal Reserve replaced SR 11-7 with SR 26-2 to carve out generative AI entirely,6 and FINRA became the first U.S. regulator to require firms to capture agentic AI output as supervised communications.7 AI and multicloud didn’t just change the technology stack – they forced an overhaul of the compliance standards themselves. The legacy architecture problemMany financial institutions still run legacy infrastructure that makes compliance far more painful than it needs to be. Flat networks and VPN-centric models put sensitive data within reach of too many systems. Virtual firewalls replicate the complexity of physical appliances in every cloud, creating inconsistent controls and audit preparation processes that are manual, error-prone, and expensive.The result: compliance teams spend weeks pulling evidence for a single audit cycle, security architects maintain separate rule sets across environments, and a single misconfigured firewall can put an entire assessment at risk.When the architecture itself creates friction, no amount of process improvement will fix it. Why zero trust changes the equationA zero trust architecture flips the model. Instead of building walls around a network perimeter and trusting everything inside, zero trust assumes no implicit trust – every connection between users, devices, workloads, and applications is verified and governed by policy.For financial services compliance, this has three practical implications:Segmentation becomes a built-in control, not a bolt-on project. Frameworks like DORA, SWIFT, and PCI DSS all require network segmentation – isolating critical systems from the general IT environment. With zero trust, microsegmentation is the architecture. Workloads communicate only when an explicit policy permits it, enforced consistently across AWS, Azure, GCP, and on-premises environments. For PCI DSS, this kind of segmentation can reduce the scope of an entire assessment by isolating the cardholder data environment from the rest of the network.Evidence collection is a by-product, not a project. Zero trust platforms enforce policy continuously and log every flow and policy decision immutably. Those records can be exported directly to SIEM and GRC platforms, turning what used to be a manual evidence-gathering exercise into an automated output of day-to-day operations. For SOC 2 Type II examinations – where auditors test whether controls operated effectively over a sustained period – this kind of continuous evidence is exactly what’s needed.AI workloads get the same governance as everything else. As banks adopt agentic AI, regulators are extending existing security obligations to cover AI deployments. A zero trust architecture applies the same least-privilege policies, egress controls, and traffic inspection to AI workloads that it does to core banking and payment systems. Data classification policies can govern which model endpoints a workload is permitted to call and prevent sensitive data from reaching unsanctioned models. Six frameworks, one architectural foundationOur new white paper, Audit-Ready by Design: How a Zero Trust Architecture Helps Financial Services Firms Simplify Compliance, maps the Zscaler Zero Trust Cloud’s capabilities to six of the frameworks that matter most to financial services firms today:PCI DSS 4.0.1 – The payment card industry standard, now fully enforceable with its emphasis on continuous security and scope reduction through segmentation.SWIFT CSCF v2026 – The latest version of SWIFT’s Customer Security Controls Framework, including the new scope expansion to customer client connectors.DORA – The EU’s Digital Operational Resilience Act, now in active enforcement, covering ICT risk management, incident reporting, resilience testing, and third-party risk for more than 22,000 financial entities.SOC 2 – The AICPA’s Trust Services Criteria, where continuous control evidence is central to a Type II examination.GDPR – The foundational data protection regulation, where microsegmentation and data loss prevention map to Article 32’s security obligations.EU AI Act – The first comprehensive AI regulation, with cybersecurity requirements for high-risk systems that zero trust directly supports.For each framework, the paper provides a detailed control-by-control mapping that shows where the Zscaler Zero Trust Cloud delivers full coverage, where it provides partial support, and where responsibility sits entirely with the financial institution. It’s an honest, transparent assessment – not a checkbox exercise. Built for the compliance reality financial firms face todayThe regulatory environment isn’t going to simplify itself. Frameworks are overlapping, enforcement is accelerating, and the adoption of AI is introducing entirely new categories of risk that regulators are folding into existing obligations rather than waiting for new ones.The firms that will navigate this environment most effectively aren’t the ones with the biggest compliance teams. They’re the ones whose architecture makes compliance a natural outcome of how their systems operate – where audit readiness is built in, not bolted on.Download the white paper to see the full control-by-control mappings across all six frameworks and learn how a zero trust architecture can simplify your compliance posture.  1 IBM, Cost of a Data Breach Report 2026. Analysis: Varonis, “IBM’s Cost of a Data Breach Report 2026,” 2026.2 IBM, Cost of a Data Breach Report 2025; Analysis: Clarista, “AI Data Governance for Financial Services: A 2026 Framework.”3 Cognetryx, “What Is Cloud Concentration Risk? A Guide for Financial Firms,” 2026.4 European Supervisory Authorities (EBA, EIOPA, ESMA), CTPP designation, Nov 18, 2025. See: HYPR, “Cybersecurity Regulations for Financial Services for 2026 and Beyond.”5 U.S. Dept. of the Treasury & FSSCC, Financial Services AI Risk Management Framework, Feb 19, 2026. See: Clarista, “AI Data Governance for Financial Services: A 2026 Framework.”6 Federal Reserve SR 26-2, Apr 17, 2026; OCC Bulletin 2026-13. See: Superintelligence Compliance, “AI Regulation in Financial Services: SR 26-2 and Reg B.”7 FINRA, 2026 Annual Regulatory Oversight Report, Dec 9, 2025. See: AccuroAI, “Financial Services AI Security: The 2026 Playbook.”   

​[#item_full_content] Two forces are rewriting financial services compliance – and regulators are no longer waiting. The 2026 IBM Cost of a Data Breach Report found AI-driven attacks surged 56% year over year, with financial services bearing the highest breach cost of any sector at $6.29 million per incident.1 Shadow AI alone adds $670,000.2 Meanwhile, cloud concentration risk turned theoretical when a 15-hour AWS outage in late 2025 simultaneously disrupted Coinbase, Robinhood, and parts of Lloyds Banking Group3 – prompting the EU to designate 19 critical ICT third-party providers under DORA for direct supervisory oversight.4 The regulatory response in 2026 has been sweeping: the U.S. Treasury published the Financial Services AI Risk Management Framework mapping 46 AI risks to technical controls,5 the Federal Reserve replaced SR 11-7 with SR 26-2 to carve out generative AI entirely,6 and FINRA became the first U.S. regulator to require firms to capture agentic AI output as supervised communications.7 AI and multicloud didn’t just change the technology stack – they forced an overhaul of the compliance standards themselves. The legacy architecture problemMany financial institutions still run legacy infrastructure that makes compliance far more painful than it needs to be. Flat networks and VPN-centric models put sensitive data within reach of too many systems. Virtual firewalls replicate the complexity of physical appliances in every cloud, creating inconsistent controls and audit preparation processes that are manual, error-prone, and expensive.The result: compliance teams spend weeks pulling evidence for a single audit cycle, security architects maintain separate rule sets across environments, and a single misconfigured firewall can put an entire assessment at risk.When the architecture itself creates friction, no amount of process improvement will fix it. Why zero trust changes the equationA zero trust architecture flips the model. Instead of building walls around a network perimeter and trusting everything inside, zero trust assumes no implicit trust – every connection between users, devices, workloads, and applications is verified and governed by policy.For financial services compliance, this has three practical implications:Segmentation becomes a built-in control, not a bolt-on project. Frameworks like DORA, SWIFT, and PCI DSS all require network segmentation – isolating critical systems from the general IT environment. With zero trust, microsegmentation is the architecture. Workloads communicate only when an explicit policy permits it, enforced consistently across AWS, Azure, GCP, and on-premises environments. For PCI DSS, this kind of segmentation can reduce the scope of an entire assessment by isolating the cardholder data environment from the rest of the network.Evidence collection is a by-product, not a project. Zero trust platforms enforce policy continuously and log every flow and policy decision immutably. Those records can be exported directly to SIEM and GRC platforms, turning what used to be a manual evidence-gathering exercise into an automated output of day-to-day operations. For SOC 2 Type II examinations – where auditors test whether controls operated effectively over a sustained period – this kind of continuous evidence is exactly what’s needed.AI workloads get the same governance as everything else. As banks adopt agentic AI, regulators are extending existing security obligations to cover AI deployments. A zero trust architecture applies the same least-privilege policies, egress controls, and traffic inspection to AI workloads that it does to core banking and payment systems. Data classification policies can govern which model endpoints a workload is permitted to call and prevent sensitive data from reaching unsanctioned models. Six frameworks, one architectural foundationOur new white paper, Audit-Ready by Design: How a Zero Trust Architecture Helps Financial Services Firms Simplify Compliance, maps the Zscaler Zero Trust Cloud’s capabilities to six of the frameworks that matter most to financial services firms today:PCI DSS 4.0.1 – The payment card industry standard, now fully enforceable with its emphasis on continuous security and scope reduction through segmentation.SWIFT CSCF v2026 – The latest version of SWIFT’s Customer Security Controls Framework, including the new scope expansion to customer client connectors.DORA – The EU’s Digital Operational Resilience Act, now in active enforcement, covering ICT risk management, incident reporting, resilience testing, and third-party risk for more than 22,000 financial entities.SOC 2 – The AICPA’s Trust Services Criteria, where continuous control evidence is central to a Type II examination.GDPR – The foundational data protection regulation, where microsegmentation and data loss prevention map to Article 32’s security obligations.EU AI Act – The first comprehensive AI regulation, with cybersecurity requirements for high-risk systems that zero trust directly supports.For each framework, the paper provides a detailed control-by-control mapping that shows where the Zscaler Zero Trust Cloud delivers full coverage, where it provides partial support, and where responsibility sits entirely with the financial institution. It’s an honest, transparent assessment – not a checkbox exercise. Built for the compliance reality financial firms face todayThe regulatory environment isn’t going to simplify itself. Frameworks are overlapping, enforcement is accelerating, and the adoption of AI is introducing entirely new categories of risk that regulators are folding into existing obligations rather than waiting for new ones.The firms that will navigate this environment most effectively aren’t the ones with the biggest compliance teams. They’re the ones whose architecture makes compliance a natural outcome of how their systems operate – where audit readiness is built in, not bolted on.Download the white paper to see the full control-by-control mappings across all six frameworks and learn how a zero trust architecture can simplify your compliance posture.  1 IBM, Cost of a Data Breach Report 2026. Analysis: Varonis, “IBM’s Cost of a Data Breach Report 2026,” 2026.2 IBM, Cost of a Data Breach Report 2025; Analysis: Clarista, “AI Data Governance for Financial Services: A 2026 Framework.”3 Cognetryx, “What Is Cloud Concentration Risk? A Guide for Financial Firms,” 2026.4 European Supervisory Authorities (EBA, EIOPA, ESMA), CTPP designation, Nov 18, 2025. See: HYPR, “Cybersecurity Regulations for Financial Services for 2026 and Beyond.”5 U.S. Dept. of the Treasury & FSSCC, Financial Services AI Risk Management Framework, Feb 19, 2026. See: Clarista, “AI Data Governance for Financial Services: A 2026 Framework.”6 Federal Reserve SR 26-2, Apr 17, 2026; OCC Bulletin 2026-13. See: Superintelligence Compliance, “AI Regulation in Financial Services: SR 26-2 and Reg B.”7 FINRA, 2026 Annual Regulatory Oversight Report, Dec 9, 2025. See: AccuroAI, “Financial Services AI Security: The 2026 Playbook.”