AI Governance in Finance: What to Fix Before Regulators Ask

Artificial intelligence is already embedded across financial services—from fraud detection and customer support to credit decisions and operational efficiency. What’s changed isn’t whether AI is being used, but how closely regulators are now watching how it’s adopted, governed, and monitored.

In October 2025, the Financial Stability Board (FSB) released a report outlining how financial authorities are monitoring AI adoption and the vulnerabilities that concern them most. While the report is aimed at regulators, it sends a clear signal to banks, insurers, asset managers, and fintechs:

AI adoption without clear visibility, governance, and accountability is becoming a risk in itself.

This post translates those regulatory signals into practical steps financial institutions should take now—before monitoring expectations harden into supervisory findings.

What Regulators Care About Isn’t the AI Model—It’s the Dependency

One of the strongest themes in the FSB report is concern about third-party dependencies and service provider concentration. Most financial institutions are not building large AI models in-house. They rely on:

• Cloud providers

• Pre-trained foundation models

• Vendor-embedded AI features

• External data pipelines

That reliance creates hidden risk when institutions can’t clearly answer questions like:

• Which AI-enabled processes are critical to operations?

• Which vendors support them?

• How substitutable are those services?

• What happens if one provider fails or changes pricing?

Many institutions discover too late that AI has quietly become embedded in workflows that were never formally assessed for criticality.

Action to take now: Create an AI use-case inventory tied to business criticality—not just a list of tools. If a process can’t run without AI, it should be governed like any other critical service.

Monitoring Is Still Immature—and That’s a Warning Sign

The FSB notes that most authorities are still in early stages of AI monitoring. Data is often collected through ad-hoc surveys, informal outreach, or indirect indicators like job postings and public disclosures.

That immaturity cuts both ways. For regulators, it creates blind spots. For financial institutions, it creates false confidence. When monitoring frameworks are weak, organizations tend to assume “no news is good news.” In reality, it often means no one is asking the right questions yet.

Action to take now: Don’t wait for standardized reporting templates. Establish internal AI metrics aligned to:

• Use-case materiality

• Degree of automation

• Human oversight

• Data sources and quality

• Vendor dependencies

These will map cleanly to future supervisory expectations.

Governance Gaps Are Emerging Faster Than Policies Can Catch Up

Another recurring concern in the report is model risk, data quality, and governance, especially for generative and agent-based systems. Unlike traditional models, GenAI systems introduce:

• Limited explainability

• New failure modes (e.g., hallucinations)

• Rapid model updates outside institutional control

Many financial institutions still govern AI through technology-neutral frameworks that were never designed for systems that generate outputs rather than calculate them.

Action to take now: Update governance practices to reflect how AI behaves, not just where it’s hosted. This includes:

• Clear human-in-the-loop thresholds

• Usage guardrails by function

• Documented escalation paths for AI-driven errors

Governance that lives only in policy documents won’t hold up.

Cyber Risk and Fraud Are Becoming AI-on-AI Problems

There is a growing concern about AI-enabled fraud, deepfakes, and disinformation campaigns that could erode trust or amplify market volatility. What’s often overlooked is that defensive AI maturity matters as much as offensive AI capability. Institutions deploying AI without strengthening detection, monitoring, and response create asymmetric risk.

Action to take now: Ensure AI adoption roadmaps include:

• AI-driven anomaly detection

• Incident reporting that distinguishes AI-related failures

• Controls for employee use of external AI tools

AI risk doesn’t always come from production systems—it often enters through experimentation.

The Real Risk: Treating AI Adoption as a Technology Project

The most important takeaway from the FSB report isn’t technical. It’s structural.

Authorities consistently point to challenges around definitions, comparability, and criticality assessment. Those challenges persist because many organizations still treat AI as a tool rollout, not an operational change. AI adoption touches:

• Process design

• Workforce behavior

• Vendor strategy

• Risk ownership

• Supervisory dialogue

Without coordinated documentation, training, and change management, AI adoption scales faster than understanding.

Where Many Financial Institutions Get Stuck

Across the sector, the same patterns appear:

• AI pilots succeed, but governance lags

• Documentation exists, but no one uses it

• Risk teams are consulted late

• Business teams move faster than controls

By the time regulators ask questions, answers are fragmented across teams.

How We Help Financial Institutions Get Ahead of This

Our work focuses on making AI adoption visible, governable, and sustainable—before it becomes a supervisory issue.

That includes:

• Mapping AI use cases to operational criticality

• Designing monitoring indicators aligned to regulatory signals

• Building documentation and training that actually change behavior

• Supporting governance models that evolve with the technology

If your institution is experimenting with AI but struggling to clearly explain where it’s used, why it matters, and how it’s controlled, that’s the moment to act.

Want to sanity-check your AI adoption before regulators do?

If you’re in financial services and want to pressure-test your current AI posture—governance, monitoring, or third-party exposure—we’re happy to start with a focused conversation.

Sometimes the most valuable outcome isn’t a new model. It’s clarity.