AI in Financial Services: Balancing Innovation, Third-Party Risk Management, and Regulatory Scrutiny

The integration of artificial intelligence (AI) in the financial services sector presents both transformative opportunities and significant challenges. As financial institutions increasingly evaluate AI technologies, it is crucial to ensure these innovations comply with existing regulations, manage associated risks effectively, and maintain robust third-party risk management practices. This blog explores the intersection of AI, third-party risk management, information security governance, and regulatory expectations, offering actionable implementation steps.

The Promise and Risks of AI in Banking

There is no doubt that AI technologies, such as machine learning and generative AI, offer substantial benefits for financial institutions such as increased efficiency and effectiveness in fraud detection, enhanced customer service through chatbots, and better risk management capabilities. However, the rapid pace of AI development also brings heightened cybersecurity and fraud risks. According to a report by the U.S. Department of the Treasury, financial institutions must integrate AI-related risks into their existing risk management frameworks to mitigate these challenges effectively​​.

Regulatory Perspective on AI Adoption

Top officials from the Federal Reserve, FDIC, Office of the Comptroller of the Currency (OCC), and Consumer Financial Protection Bureau (CFPB)—have emphasized the importance of regulatory compliance in AI deployment in recent speeches. They continue to stress that financial institutions are responsible for how AI technology is utilized, especially when contracting with third-party vendors.

Systems and applications that leverage AI must comply with established policies and risk management expectations at the institution. With the continuing increase in innovation of AI technologies, the regulators are emphasizing the importance of engagement between banks and regulators to understand and achieve supervisory objectives for AI​​​​. 

Third-Party Risk Management in AI Adoption

AI implementation in community banks will largely depend on third-party partnerships, whether the integration is through existing or new vendor technology solutions or through mainstream AI players like ChatGPT, Microsoft Copilot, and Google Gemini. Expanding third-party risk management to include AI is essential to document and validate increased regulatory concerns.

The Interagency Guidance on Third-Party Relationships: Risk Management highlights the importance of comprehensive risk management practices throughout the life cycle of third-party relationships. This includes planning, due diligence, contract negotiation, ongoing monitoring, and termination​​. Institutions must ensure that third-party AI solutions comply with their risk management policies, especially concerning data privacy and security. There are new areas within AI  that need to be addressed and managed. For example: bias in decisioning tools leveraged at your institution and the data model/learning capabilities of the AI within those tools. Understanding what bias might be present, how that affects your business decisions and what risk the bias exposes is critical to aligning with examiner expectations.

Developing AI Governance and Risk Management Policies

Institutions need to establish AI governance and risk management practices to meet regulatory expectations on third-party risk management.  To safely leverage AI technologies here are key steps to consider:

1. Conduct an AI Risk Assessment: Perform a thorough risk assessment for each AI system.  Start by focusing on the most important risks: financial transaction capability, customer information, and non-public information. This assessment should identify potential risks and outline mitigation strategies​​.
2. Create an AI Policy: Develop a comprehensive policy outlining the acceptable use of AI technologies, including guidelines for ethical use, data protection, and compliance with legal and regulatory requirements. This policy should cover all employees, third-party vendors, and contractors​​. Make sure to include employee training and acceptable use sign-off.
3. Integrate AI Policy into Information Security Risk Management:
   • System Inventory: Maintain a detailed inventory of all information systems that use or interact with AI technologies. This helps in tracking AI usage across the organization and assessing the associated risks.
   • PII Assessments: Leverage Personally Identifiable Information (PII) assessments to understand what types of non-public information are accessed by AI systems. Identify and mitigate potential privacy risks by ensuring that AI systems comply with data protection and your information security policies.
   • Existing Controls: Highlight and leverage existing controls to protect information systems such as:
     • Access Controls, Change Management, & Incident Response.
       1. What access control measures are in place to ensure that only authorized personnel have access to AI systems and the data they process?
       2. What is the patch and update process for the AI model being utilized?
       3. What monitoring is needed to detect security incidents involving AI systems, such as anomalies in model behavior or data breaches.
   • Expanded Risk: Not all AI systems have the same risk and exposure; these items increase the risk of the AI solution: Customer Information, Financial Transactions and Account Data, Decisioning for Approvals (IE Loans), and Generative Learning Models
   • Training: Focus on training for employees, the board, and risk management teams.   AI is evolving quickly, but by creating a training plan, the institution can mitigate the risks of employee misuse.
4. Integrate Third-Party Risk Management: Evaluate third-party solutions based on their AI capabilities and how they manage customer data. Ensure that third parties adhere to your institution’s risk management standards.
5. Monitor Data and Learning Models: Understand how the AI system’s data model is used and processed. Determine whether the AI system continuously learns and adapts from the data provided or operates in a controlled manner.
6. Implement Access Controls: Control who has access to AI systems and the types of data they can input. Decide whether to allow widespread access to tools like ChatGPT, Microsoft Co-Pilot, and restrict usage based on job roles and responsibilities​​.

Conclusion

AI technologies offer exciting possibilities for the financial services sector, but they also require careful management and regulatory oversight. By following best practices and fostering collaboration between financial institutions and regulators, the sector can navigate the complexities of AI adoption responsibly. This balanced approach will help ensure that AI innovations contribute to a safer, more efficient financial system while maintaining public trust and regulatory compliance.

If you’re unsure where to start, Finosec experts have created two tools: an AI Risk Assessment and a Generative AI Policy template, which are available to download.