Preparing For the Inevitable: How and Why the Banking Sector Should Prepare for AI Regulation

Today, the topic of artificial intelligence or AI permeates every conversation about the future of technology and the digital world. The biggest companies in the world have been using AI for years now, with notable everyday examples such as the Face ID feature on Apple’s iPhones or Microsoft’s virtual assistant, Cortana. Alongside this, major industries such as healthcare, food, travel, manufacturing, banking and real estate have welcomed and nurtured large technological transformations, featuring AI.

Why has it taken off so astronomically? This is all because AI can be applied to many business and operational functions that power productivity and business growth, thereby opening new opportunities for companies to become more efficient and less costly to run.

The Evident AI Index, created by the business intelligence firm Evident, benchmarks global banks against each other in terms of AI readiness. Across North America and Europe, JP Morgan Chase currently ranks first with Royal Bank of Canada following next, Citigroup in third place, and UBS Group following in fourth place. The Evident AI Index scores banks across Talent, Innovation, Leadership, and Transparency (which includes a company’s responsible AI policies).

However, with all these benefits come threats to data privacy, security, equality and human rights. Because humans choose what data they feed to the algorithms that instruct AI tools, a level of unconscious bias is inherent in AI decision-making. AI systems can learn and adopt biased information and patterns to generate widespread discriminatory practices against already marginalised populations. In this regard the limitations of using AI in banking relate to the absence of human interaction in decision-making, imperfect data quality, ethical considerations and cybersecurity risks from the sharing of sensitive customer data. For example, if malicious use of AI or biased algorithms lead to more credit and loan approvals for a certain demographic of the population whilst excluding or intentionally marginalising another to boost profit, this will have huge social implications.

Striking the right balance between boosting financial innovation and mitigating risks to both banks and customers is difficult: while AI regulation can help combat a lack of transparency in algorithmic decision-making and bias, ‘too much’ regulation may discourage banks from pursuing AI innovation.

Wavestone’s 2023 Data and Analytics Leadership Executive Survey found that many organisations are already far behind in their attention and commitment to data ethics and policies. As with the phenomena of social media, concerned members of civil society are calling for regulation to come from the ‘top’. Governments from around the world, as well as prominent tech leaders such as OpenAI’s CEO Sam Altman, are increasingly talking about ‘responsible tech’ and ‘responsible AI’: the idea that the use of AI is guided by ethical and human-centred principles.

While new laws and regulations face polarisation and bureaucracy in the US, multiple regulatory bodies have voiced their opinions on the topic of AI. In March 2022, the Consumer Financial Protection Bureau reaffirmed the importance of upholding the Equal Credit Opportunity Act, which prohibits discrimination in credit applications, in the context of using AI technology in the decision-making process. Consumer safety and data privacy are of utmost importance in recent propositions such as the Biden administration’s nonbinding ‘AI Bill of Rights’ that details five guiding principles for the development of AI, and the 2022 American Data Privacy Protection Act (ADPPA), which promises to push for greater transparency in the collection, use and sale of consumer data.

Across the Atlantic, the European Parliament first proposed the regulation of AI in 2021 and committed to enshrining the world’s first comprehensive AI law. The so-called AI Act will classify AI uses based on the level of risks they pose to humans. For example, ‘unacceptable risk’ connotes that the threat to people from the use of AI is so high that it must be banned, and this seeks to regulate AI applications such as social scoring (classifying people based on socio-economic or personal characteristics) and cognitive behavioural manipulation. In the UK, the government has promoted an ‘agile and iterative process’ to find a ‘pro-innovation’ approach to AI regulation. Like the Biden administration, five core principles touching on safety, transparency and accountability will shape the use of AI in the UK to strengthen the UK’s position as a global AI leader and boost innovation, whilst also protecting the consumer.

With much of the literature and policy recommendations focusing on the ethical implications of AI, banks will have to ask themselves whether they can use AI to streamline processes, whilst absolutely ensuring customer data privacy and fair and unbiased decision-making. Establishing a regular review of AI-backed decision processes and applications, and an auditing system, will ensure banks hold themselves and their developers accountable to impacts on society and human rights. Another question that will impact the banking industry is that of customer experience: are customers ready to let go of the human interaction that is already slipping away from local branches or telephone conversations, or will faster and more efficient AI chatbots be welcomed as a better substitute? And how will banks tackle employee fears of AI replacing their job functions?

As mentioned, the development of AI points to a future where large language models enable more human-like conversations and interactions, while automation enables higher productivity. As a recent Wavestone insight advises “the current state of AI represents just the beginning of what is possible, with the frontiers of the field advancing at an unprecedented rate”.