AI in financial services: what it is used for and why it needs governance

What counts as AI

The OECD Recommendation on Artificial Intelligence, as amended in 2023, defines an AI system as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The definition covers a credit model that predicts default as much as a chatbot that writes answers.

There is no single definition that everyone uses. A 2024 paper by the Financial Stability Institute of the Bank for International Settlements (BIS) notes that the lack of a globally accepted definition of AI stands in the way of a better understanding of how AI is used and what risks it brings. Before a firm can govern AI, it has to say which of its systems it counts as AI.

What financial institutions use it for

The Financial Stability Board (FSB), in a 2017 report, grouped uses into four kinds:

• Customer-focused uses, at the front office, such as credit scoring, insurance and client-facing chatbots.
• Operations-focused uses, in the back office.
• Trading and portfolio management in financial markets.
• Regulatory compliance and supervision, by firms (RegTech) or by public authorities (SupTech).

The BIS paper singles out three uses: customer support chatbots, fraud detection including anti-money laundering checks, and credit and insurance underwriting. The FSB's 2024 report found that most current uses of AI in finance focus on improving internal operations and regulatory compliance; generative AI has brought new uses such as summarising documents, retrieving information and writing code, and many institutions appear to be taking a cautious approach to it.

Old risks, made larger

According to the BIS paper, the risks of AI are largely the same ones financial authorities already watch: credit, operational, reputational, conduct and financial stability risks, among others. Some become larger. Model risk can grow because a lack of explainability in some AI models makes it hard to judge whether they are appropriate, and so can data-related risks such as privacy, security and bias.

Explainability recurs throughout. As early as 2017, the FSB warned that the lack of interpretability or auditability of AI and machine learning methods could become a macro-level risk, that is, a risk for the financial system as a whole.

Risks for the financial system

The FSB's 2024 report names four AI-related vulnerabilities that could increase risk for the system as a whole:

• Dependence on outside providers of specialised hardware, cloud services and pre-trained models, in markets that are highly concentrated.
• Market correlations, which the widespread use of common AI models and data sources could increase.
• Cyber risks.
• Model risk, data quality and governance.

The report adds that generative AI could increase financial fraud and disinformation in financial markets. Lesson 4 returns to generative AI and outside providers.

What governance adds

The BIS paper finds that most financial authorities have not issued separate AI rules. The common themes of AI guidance are reliability and soundness, accountability, transparency, fairness and ethics. They are broadly contained in existing financial rules on governance, risk management and consumer protection. In practice, governing AI means answering four questions for each system:

• Which uses are allowed, and which need more control because the harm to customers or the firm could be large.
• Who is accountable for each system, from its design to its retirement.
• How it is checked before use and while it runs.
• What customers and supervisors are told, and how a decision can be explained.

The next lessons take these in turn: the international principles, model risk management for AI, generative AI and outside providers, and how a lender can organise all of this.