The Global Risks Alliance (GRA)
Banks, insurers, asset managers and payment firms use machine learning and, increasingly, generative models for credit scoring, fraud detection, trading, customer service, compliance and software development. Model risk is not new, but these systems are harder to explain, change faster, depend on a few model and cloud providers, and can fail together. This page sets out how AI-related risk develops in finance, how models are evaluated and governed, and who holds the decisions.
AI and automation · Fintech F1 · Week 14
| Women | 55 | 3 | Review |
| Rural | 51 | 8 | Review |
| Under 25 | 45 | 9 | Review |
Fig.Fintech risk and operations. Design wireframe with placeholder names and illustrative values, not a record or a live system.
AI model risk is the potential for loss or harm when machine learning or generative models used in credit, fraud, trading, customer service and compliance are wrong, misused or drift. Model risk is an old problem; these systems are harder to explain, change after deployment and can make the same errors across many firms using common models.
How satellite radar turns a flood into an exposure update. Synthetic scene; no real event or place.
Financial model and decision risk. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Complex models are hard to explain to the boards, validators and customers who must challenge them. When reasons cannot be given, errors and bias in credit or fraud decisions persist longer before anyone notices.
Customer behaviour, fraud patterns and markets change after a model is trained. Performance degrades quietly unless monitoring compares live outcomes with validation results and triggers review.
Many firms use the same foundation models, data vendors and cloud platforms. Shared dependencies can produce correlated decisions in credit, trading or screening, and one provider outage can stop many firms at once.
Agentic and automated workflows act without a human step. Errors, prompt injection or excessive permissions can move money, data or orders before anyone reviews them, so controls must sit inside the workflow.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Model drift | Decline in model performance as the data in use moves away from the training data. |
| Challenger model | An alternative model run alongside a production model to test whether it performs better. |
| Hallucination | A generative model output that is fluent but false or unsupported. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Models in production by risk tier | count by tier | quarterly | Firm model inventories | DECLARED |
| High-risk models with independent validation | percent of high-risk models | annual | Model risk management reporting | DECLARED |
| Model performance drift | change in discrimination or error rate against validation | monthly | Firm model monitoring | OBSERVED |
| Disparity in approval or error rates across groups | ratio between groups | per review | Fairness testing | ESTIMATED |
| AI-related incidents in financial services | count by type | quarterly | Incident databases and supervisory reports | REPORTED |
| Concentration of model and cloud providers | share of firms relying on the largest providers | annual | Supervisory surveys | ESTIMATED |
| Firms reporting AI use by business function | percent of surveyed firms | annual | Supervisory surveys | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Bank of England and FCA survey of AI in UK financial services | Use cases, governance, third-party dependence and perceived risks reported by firms | Free, terms per publisher |
| FSB reports on AI in finance | Financial stability assessment of AI adoption, concentration and vulnerabilities | Free, attribution under FSB terms |
| OECD AI Incidents and Hazards Monitor | Reported AI incidents and hazards, filterable by sector | Free, attribution under OECD terms |
| AI Incident Database | Curated reports of AI harms and failures | Open, attribution |
| EBA and ESMA risk assessment and supervisory reports | Use of AI and machine learning by EU banks and investment firms | Free, attribution under ESA terms |
| IOSCO reports on AI in capital markets | Use cases, risks and regulatory responses across securities markets | Free, terms per publisher |
Fintech Nexus prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Firms' boards and model risk committees | Which AI uses to approve, at what risk tier, and with what human oversight | Model inventories, validation coverage, drift and fairness monitoring |
| Prudential and conduct supervisors | Whether model risk management and customer outcomes meet supervisory expectations | Evaluation guides, incident records, fairness testing practice |
| Standard setters (FSB, BCBS, IOSCO) | Whether existing principles cover AI-specific risks or need updating | Concentration notes, cross-jurisdiction surveys, incident typologies |
| Data protection and equality authorities | Whether automated decisions respect rights to explanation and non-discrimination | Fairness testing practice, explanation designs, complaint records |
Models simplify reality, and they can fail through errors in design, data or implementation, or through use outside the conditions they were built for. Machine-learning models can capture complex patterns, but they may also learn spurious correlations, degrade as conditions change and resist explanation. Credit models trained during benign periods may misjudge risk in a downturn. Bias in historical data can be reproduced in decisions about credit, pricing and fraud.
Generative AI introduces new failure modes, such as fabricated outputs, sensitivity to prompts and vulnerability to manipulation, and agents that take actions raise questions about authority and control. Many firms rely on a small number of model providers, which creates concentration and third-party risk.
At system level, similar models and data across firms can produce correlated behaviour, amplifying market moves or credit cycles. Supervisors and researchers are studying whether widespread AI use creates new channels of systemic risk.
Independent testing of conceptual soundness, performance and outcomes.
Testing outcomes across groups; definitions of fairness can conflict.
Techniques that explain model outputs; explanations can be incomplete or misleading.
Limits: validation can only test against available data, explanation methods approximate rather than reveal model logic, and systemic effects are hard to observe until stress occurs.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.