What’s driving D&O risk in Asia today and what should you prioritize now?
Asia’s D&O risks are changing, but perhaps not in the way you might expect.
Drawing on data from Asia from WTW’s Global Directors’ and Officers’ Survey 2026, this article sets out the risks boards in Asia continue to prioritize, the areas rising up the agenda and the exposures losing ground.
We look at the continued dominance of cyber and data, the growing focus on corporate crime and bribery and why geopolitical and AI risks remain secondary for many regional boards.
Finally, we point to what you should focus on now to strengthen oversight, manage liability and prepare for increasing regulatory scrutiny.
How has D&O risk changed in Asia since last year?
Asia’s D&O risk map has undeniably shifted since last year’s survey, which may reflect recalibrated priorities rather than a fundamental shift. While cyber and data risks have long been prominent in Asia, the latest findings reinforce their importance alongside governance and regulatory concerns, reflecting broader economic and digital transformation across the region.
Although the core risks perceived by directors and officers in Asia remain the same (i.e. data loss, cyberattacks, health and safety, and systems and controls), regulatory breach risk has slipped down the order. Bribery and corruption has climbed to fifth and a new category, corporate crimes and failures to prevent such crimes, has nudged out traditional litigation risk and courtroom exposure.
Meanwhile, geopolitical and AI/machine learning risks remain outside Asia’s top seven perceived risks despite global noise.
Why are cyber and data still the biggest D&O risks in Asia today?
The top of Asia’s risk ranking still belongs to data and cyber, with data loss and cyberattacks clocking in at 76% and 74% respectively in the latest survey. This marks a departure from the global trend, where health and safety remains the leading concern.
In Asia, the rise of digital risks reflects the pace of technological adoption, placing increasing expectations on boards to oversee cyber resilience, data protection and incident response preparedness. One example is India’s Digital Personal Data Protection (DPDP) Rules, 2025 (the Rules), which operationalize the Digital Personal Data Protection Act, 2023. It sets out how data fiduciaries should collect, process, transfer and retain personal data. Significant data fiduciaries face enhanced compliance responsibilities such as annual audits, mandatory reporting, additional data transfer restrictions and committee oversight.[1] The Rules introduce phased obligations over an 18-month period, with high-impact changes like the establishment of the Data Protection Board taking effect immediately.
Cybersecurity risks also remain high, especially when threat actors use generative AI to conduct targeted attacks. Deepfakes and malware intersect with data leakage risks and can compound financial losses.
Singapore is one of the most affected jurisdictions globally, having experienced around S$913.1 million in cybercrime losses in 2025 alone.[2] To mitigate against these risks, the Monetary Authority of Singapore has released two information papers to raise financial institutions’ awareness on the emerging threats and risks posed by generative AI and deepfakes. Further, the key provisions of the Cybersecurity (Amendment) Act 2024 came into force in Singapore on 31 October 2025, introducing new regulatory regimes for third-party-owned Critical Information Infrastructure and expanded oversight powers for the Commissioner of Cybersecurity.
Why is regulatory breach risk seen as a less urgent D&O risk in Asia?
Perceived regulatory breach risk has fallen in relative importance in Asia to 66%, down from 75% last year, though regulatory breach risks have gone away.
The increasing complexity and continuous evolution of cross-border regulatory frameworks across Asia remain a key concern for boards in Hong Kong. The Securities and Futures Commission (SFC) issued a circular on 30 January 2026 warning sponsors over various operational deficiencies in the rush to capitalize on a booming initial public offering market.[3]
In particular, the SFC is concerned about lackluster preparation in listing documents and responses to regulatory comments, over-reliance on experts and third parties without sufficient assessments of their competency and insufficient capacity of principals supervising transaction teams. It also called out the appointment of unsuitably qualified principals, as well as insufficient staff with appropriate levels of knowledge, skills and experience at the sponsor companies.
The SFC flagged vetting had been suspended on multiple applications while 13 sponsors were ordered to conduct comprehensive internal reviews. This signals that in Hong Kong, at least, capacity and controls will be under increased scrutiny in 2026.
Why are bribery and corruption rising as key D&O risks in Asia?
Bribery and corruption has edged up to the fifth most highly ranked risk in Asia at 67%, reflecting tougher enforcement pressure from regional authorities.
Based on the Transparency International Corruption Perceptions Index and the TRACE Bribery Risk Matrix, corruption is undoubtedly a real and present risk in Asia.[4] However, there are some bright spots, with Singapore, Hong Kong, Bhutan and Japan ranking highly.
China’s recent legislation targeting commercial bribery on both sides of the transaction may play a part in why boards are paying closer attention to this risk category. This third overhaul of the Anti Unfair Competition Law took effect on 15 October 2025, criminalizing not only the offering but also the acceptance of improper benefits and triggering penalties and sanctions under the law’s administrative framework.
The revision lifts maximum corporate fines for serious commercial bribery from 元3 million to 元5 million and, critically for directors and senior managers, adds personal liability for legal representatives and principals for bribery committed by the business. The law also introduces an extraterritorial hook in Article 40 so that unfair competition acts committed outside China that disrupt the domestic market or harm Chinese operators or consumers can be pursued. This aligns with the broader long arm trend seen in China’s data and sanctions regimes and raising the stakes for multinationals with China facing supply chains, sales or counterparties.
In Hong Kong, the Prevention of Bribery Ordinance was updated in June 2025 to bring in an additional four market critical institutions, bringing their office holders squarely within a stricter anti-bribery regime applicable to public bodies and public servants. They now face stricter scrutiny in view of their public function.[5] This is an incremental but telling widening of obligations for entities and employees working in strategic industries in Hong Kong.
What does the rise of corporate crime mean for D&O risk in Asia?
A newly added risk for this year is corporate crime and 'failure to prevent' offenses, which now appears in Asia’s top seven. This new concern displaces civil litigation, third party claims and criminal proceedings that featured at 65% apiece last year.
Business crimes that can be committed by companies include money laundering, foreign bribery and corruption, financing of terrorism and fraud, as well as the rapidly evolving corporate offense of failure to prevent the same misconduct by their employees.
In China, recent developments include the release of the Supreme People’s Procuratorate’s White Paper on Criminal Prosecution Work (2024), which reports that, compared with 2020, the number of people accepted for review and prosecution for crimes that disrupt the socialist market economic order rose by 9.6% in 2024, while prosecutions specifically for market order disruption offenses increased by 21.4%.[6] Over the same period, prosecutions for duty-related crimes increased by 32.7%, and within corporate-related duty offenses such as occupational embezzlement and misappropriation of funds, prosecutions rose by 25%, underscoring how internal misconduct is drawing sharper criminal scrutiny.
Why are geopolitical and AI risks still secondary in Asia’s D&O risk outlook?
Geopolitical risk doesn’t make Asia’s top seven this year, although it sits in the top tier for larger global companies and features prominently in other regions. Notably, the larger revenue cohorts all view geopolitical risk as very important, while Asia’s regional boards tend to prioritize nearer term, controllable operational and compliance exposures.
Top 7 risks in Asia
| Ranking | Risk | Percentage |
|---|---|---|
| 1 | Data loss | 76% |
| 2 | Cyber attack (includes cyber extortion) | 76% |
| 3 | Health and safety | 72% |
| 4 | Systems and controls | 68% |
| 5 | Bribery and corruption | 67% |
| 6 | Civil litigation/third-party claims | 67% |
| 7 | Regulatory breach | 66% |
AI/machine learning also don’t feature in Asia’s top seven perceived risks, continuing last year’s pattern where AI failed to crack the top seven in any region despite intense public attention.
For most regional boards, AI is flagged as a potential issue for the future, but remains second order compared with threats perceived as already material, namely data governance, cyber resilience and safety. This perception is signaled by the proliferation of national AI guidelines and frameworks over legislative acts.
Which D&O risks are becoming less prominent in Asia?
Climate change, breach of human rights, supply chain issues, insolvency/financial distress, shareholder claims and anti-trust laws and regulations all sit outside the regional top seven this year.
What should directors and risk managers prioritize to manage D&O risk in Asia?
The Asia findings reinforce several key priorities for directors and risk managers, including:
- Strengthening cyber governance to ensure cyber and data risks are embedded within enterprise risk management frameworks and the appropriate oversight at board level.
- Balancing traditional and emerging risks — governance, compliance and regulatory exposures remain critical, even as emerging risk categories continue to gain prominence.
- Preparing for increased scrutiny and claims activity to navigate a more complex liability environment, particularly in cross-border contexts.
Footnotes
- Digital Personal Data Protection (DPDP) Rules 2025 Notified. Return to article
- Annual Scams and Cybercrime Brief 2025 Infographic published by Singapore Police Force on 25 February 2026; Trends and Developments. Return to article
- Circular to licensed corporations carrying out sponsor work. Return to article
- Bribery & Corruption Laws and Regulations 2026. Return to article
- Prevention of Bribery Ordinance (Amendment of Schedules 1 and 2) Order 2025. Return to article
- Corporate criminal risk: Pitfalls and course corrections. Return to article
Authors
Contact
