GRA · Fintech Nexus
Spatial financeWhere capital meets hazard, exposure and transition
AI and automation
Banks, insurers, asset managers and payment firms use machine learning and, increasingly, generative models for credit scoring, fraud detection, trading, customer service, compliance and software development. Model risk is not new, but these systems are harder to explain, change faster, depend on a few model and cloud providers, and can fail together. This page sets out how AI-related risk develops in finance, how models are evaluated and governed, and who holds the decisions.
How the work runs.
Fintech risk and operations
AI and automation · Fintech F1 · Week 14
- Active users700,3163Active
- API uptime, %99.54Normal
- Fraud per 10,000 transactions64Alert
- Complaints open295Watch
Fraud rate by channel
Credit model fairness
| Women | 55 | 3 | Review |
| Rural | 51 | 8 | Review |
| Under 25 | 45 | 9 | Review |
Fig.Fintech risk and operations: example names and illustrative values, not a record or a live system.
AI and automation: how the risk develops.
Financial model and decision risk. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Opacity weakens challenge
Complex models are hard to explain to the boards, validators and customers who must challenge them. When reasons cannot be given, errors and bias in credit or fraud decisions persist longer before anyone notices.
Drift after deployment
Customer behaviour, fraud patterns and markets change after a model is trained. Performance degrades quietly unless monitoring compares live outcomes with validation results and triggers review.
Common models, common errors
Many firms use the same foundation models, data vendors and cloud platforms. Shared dependencies can produce correlated decisions in credit, trading or screening, and one provider outage can stop many firms at once.
Automation outruns control
Agentic and automated workflows act without a human step. Errors, prompt injection or excessive permissions can move money, data or orders before anyone reviews them, so controls must sit inside the workflow.
What AI and automation means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in AI and automation reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Models in production by risk tier | count by tier | quarterly | Firm model inventories | DECLARED |
| High-risk models with independent validation | percent of high-risk models | annual | Model risk management reporting | DECLARED |
| Model performance drift | change in discrimination or error rate against validation | monthly | Firm model monitoring | OBSERVED |
| Disparity in approval or error rates across groups | ratio between groups | per review | Fairness testing | ESTIMATED |
| AI-related incidents in financial services | count by type | quarterly | Incident databases and supervisory reports | REPORTED |
| Concentration of model and cloud providers | share of firms relying on the largest providers | annual | Supervisory surveys | ESTIMATED |
| Firms reporting AI use by business function | percent of surveyed firms | annual | Supervisory surveys | REPORTED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Bank of England and FCA survey of AI in UK financial services | Use cases, governance, third-party dependence and perceived risks reported by firms | Free, terms per publisher |
| FSB reports on AI in finance | Financial stability assessment of AI adoption, concentration and vulnerabilities | Free, attribution under FSB terms |
| OECD AI Incidents and Hazards Monitor | Reported AI incidents and hazards, filterable by sector | Free, attribution under OECD terms |
| AI Incident Database | Curated reports of AI harms and failures | Open, attribution |
| EBA and ESMA risk assessment and supervisory reports | Use of AI and machine learning by EU banks and investment firms | Free, attribution under ESA terms |
| IOSCO reports on AI in capital markets | Use cases, risks and regulatory responses across securities markets | Free, terms per publisher |
Who decides, and what the evidence serves.
Fintech Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Firms' boards and model risk committees | Which AI uses to approve, at what risk tier, and with what human oversight | Model inventories, validation coverage, drift and fairness monitoring |
| Prudential and conduct supervisors | Whether model risk management and customer outcomes meet supervisory expectations | Evaluation guides, incident records, fairness testing practice |
| Standard setters (FSB, BCBS, IOSCO) | Whether existing principles cover AI-specific risks or need updating | Concentration notes, cross-jurisdiction surveys, incident typologies |
| Data protection and equality authorities | Whether automated decisions respect rights to explanation and non-discrimination | Fairness testing practice, explanation designs, complaint records |
Outputs this topic produces
- Model evaluation guides for credit, fraud and customer-facing AI
- Notes on concentration in foundation model and cloud providers
- Governance question sets mapped to supervisory expectations
- Research on generative AI failure modes in financial workflows
The questions experts ask.
- Is the model fit for its purpose, and does it perform as expected on new data?
- Can its decisions be explained to customers, supervisors and the firm's own management?
- Does it treat different groups of customers fairly?
- How does it behave in conditions not seen in training, such as a downturn?
- What happens when many firms use similar models or data?
How model risk arises.
Models simplify reality, and they can fail through errors in design, data or implementation, or through use outside the conditions they were built for. Machine-learning models can capture complex patterns, but they may also learn spurious correlations, degrade as conditions change and resist explanation. Credit models trained during benign periods may misjudge risk in a downturn. Bias in historical data can be reproduced in decisions about credit, pricing and fraud.
Generative AI introduces new failure modes, such as fabricated outputs, sensitivity to prompts and vulnerability to manipulation, and agents that take actions raise questions about authority and control. Many firms rely on a small number of model providers, which creates concentration and third-party risk.
At system level, similar models and data across firms can produce correlated behaviour, amplifying market moves or credit cycles. Supervisors and researchers are studying whether widespread AI use creates new channels of systemic risk.
Methods and their limits.
Model validation
Independent testing of conceptual soundness, performance and outcomes.
Bias testing
Testing outcomes across groups; definitions of fairness can conflict.
Explanation methods
Techniques that explain model outputs; explanations can be incomplete or misleading.
Limits: validation can only test against available data, explanation methods approximate rather than reveal model logic, and systemic effects are hard to observe until stress occurs.
How it is studied, and what the methods cannot say.
- 01Artificial intelligence and machine learningCredit and fraud model evaluation · Drift and challenger monitoringApplied here
- 02Cybersecurity and cryptographyThreat-led penetration testing · Supply chain and dependency analysisApplied here
- 03Payment and financial market technologyDependency mapping of a payment chain · Liquidity stress simulationApplied here
- 04Digital identity and public digital systemsAssurance-level mapping · Remote proofing attack testing · Exclusion analysisApplied here
Questions and answers.
Is AI model risk different from traditional model risk?
What is model drift?
Can generative AI be used in regulated decisions?
Does Fintech Nexus certify AI systems?
Does GRA validate firms' models?
Is AI banned in credit decisions?
How does this relate to Actuarial and Quantitative Risk?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.