When AI Meets Finance: Risk Management in the Age of Intelligent Financial Institutions

Getting your Trinity Audio player ready...

Artificial intelligence ("AI"), including machine learning ("ML"), generative AI ("GenAI") and "agentic" workflow tools, is rapidly reshaping how financial institutions underwrite and price risk, detect fraud, screen for sanctions/AML, personalize customer interactions and optimize trading and treasury operations. Alongside clear upside, AI introduces amplified risk exposures: biased or non‑compliant decisions, opaque model failures, data leakage, IP infringement, third‑party risk concentration and heightened regulatory scrutiny.

This article highlights real-world case studies, emerging regulatory risk and a practical set of best practices tailored to banks, lenders, asset managers, insurers and fintechs.

Why AI is different in financial institutions

Financial services amplify AI risk due to several factors:

High-stakes decisions at scale. Credit, pricing, trading and fraud decisions can affect millions of consumers and markets.
Dense regulatory overlay. Financial institutions are heavily regulated and must satisfy fairness expectations while meeting consumer protection, market integrity and privacy obligations.
Model complexity and opacity. ML can be difficult to validate, explain and monitor.
Expanded attack surface. AI often relies on new data pipelines, cloud services and external models/APIs, increasing cyber and third‑party risk.

Case studies: AI/model use leading to losses

AI investment correlates with higher operational losses (system failures, external fraud, client issues)

Finding: A Federal Reserve-published analysis finds banks with higher AI investment experienced higher operational losses, with effects concentrated in external fraud, client/customer issues and system failures.

Impact: Indicates that AI adoption can increase loss frequency/severity absent strong controls.

Key lesson: AI adoption should be paired with robust operational resilience, monitoring and third‑party governance to prevent AI-enabled losses from scaling.^1,2

Algorithmic/automated decisioning — discrimination and consumer harm exposure

Regulatory posture: US federal agencies (DOJ, CFPB, FTC, EEOC) publicly emphasized that automated systems marketed as "AI" can produce unlawful discrimination, and that "advanced technology" isn't an excuse for lawbreaking.

Impact: Increased enforcement and litigation exposure for AI-assisted underwriting, marketing, tenant/consumer screening and credit decisions.

Key lesson: Institutions must be able to explain outcomes, test for disparate impact, govern data provenance and control vendor tools.^3,4

AI-driven investor engagement and recommendations — conflict-of-interest and conduct risk

Regulatory development: The SEC proposed rules addressing conflicts tied to "predictive data analytics" and broadly defined "covered technologies" that optimize or influence investor behavior, potentially including AI/ML and engagement tools.

Impact: For broker-dealers and advisers, AI tools that nudge behaviors may create obligations to identify and neutralize/eliminate conflicts and maintain records.

Key lesson: AI used in distribution, personalization and digital engagement should be treated as a conduct-risk system, not just a marketing tool.^5,6

IP/confidentiality leakage via GenAI use (enterprise context)

Privacy risk: When employees paste proprietary code, research, customer data or investment insights into public GenAI tools, organizations risk loss of trade secrets, contractual breaches and potential IP disputes. NIST's GenAI risk profile stresses managing unique GenAI risks and aligning controls to lifecycle governance.

Key lesson: Treat GenAI prompts/outputs as data flows requiring policy, DLP, retention and vendor constraints, especially in regulated environments.^7,8

Note: Some well-known GenAI IP disputes involve AI vendors rather than financial institutions directly; the practical exposure for financial institutions is commonly downstream: inadvertent ingestion/disclosure of confidential data, or use of outputs that embed copyrighted material without provenance. Risk controls should assume these scenarios can trigger contractual and litigation costs.^7,8

Emerging Regulatory Risk for Financial Institutions

United States: "No AI exemption," plus rising AI-specific expectations

Interagency enforcement posture: Federal agencies have explicitly stated that automated systems can violate existing consumer protection and civil rights laws, and they intend to enforce those laws in AI contexts.^3,4
Model risk management baseline: US banking supervision has long expected robust model governance (development, validation and controls). Traditional guidance (SR 11‑7/OCC 2011‑12) remains influential, and the OCC recently issued updated interagency guidance emphasizing a risk‑based approach and vendor considerations (while noting certain novel GenAI systems may be out of scope).⁹
Market conduct: The SEC's proposal signals the potential for AI personalization and engagement tools to be regulated under conflicts-of-interest frameworks.^5,6
Sector-specific AI governance tooling: Treasury announced a Financial Services AI Risk Management Framework (FS AI RMF) and an AI lexicon to drive consistent, risk-based governance across the sector (aligned to NIST AI RMF).^8,10

European Union: EU AI Act "high-risk" obligations (credit scoring in scope)

The EU AI Act establishes a risk-based regime; in financial services, creditworthiness and credit scoring for natural persons are treated as high-risk use cases, triggering obligations around governance, data quality, transparency, oversight and conformity processes.^11,12

New York: AI and cybersecurity expectations for regulated entities

NYDFS has issued guidance emphasizing AI-related cybersecurity risks and expectations under 23 NYCRR Part 500 (no new rule, but clear supervisory focus). In adjacent insurance contexts, NYDFS has also issued guidance on AI systems and external data in underwriting/pricing that illustrates the direction of travel on fairness, documentation and governance.^13,14

Bottom line

Regulatory scrutiny is converging on the same demands: governance, explainability, testing, monitoring, third‑party oversight and documentation.^10,11,15

Practical AI risk management strategies: The board level playbook for financial institutions

AI governance and accountability (enterprise-level)

Define "AI system" and scope (ML, GenAI, decisioning, agentic workflows, vendor models), and map to owners.^10,11
Create an AI Governance Committee (risk, compliance, legal, cyber, data, business) with clear escalation thresholds.^8,15
Maintain an AI inventory: Purpose, data sources, vendor dependencies, decision impact, customer touchpoints and regulatory mapping.^11,15

Model risk management tailored to ML and GenAI

Apply model risk pillars: robust development, independent validation, governance/controls.^9,15
Require documented conceptual soundness: features, objectives, limitations, assumptions, drift triggers.^2,15
For GenAI: incorporate NIST AI RMF + GenAI profile practices (e.g., red‑teaming, prompt injection testing, hallucination measurement).^7,10

Fairness, bias and adverse action readiness (credit / underwriting / marketing)

Conduct bias and disparate impact testing using representative datasets and clear governance around protected-class proxies.^3,11
Ensure the institution can produce reason codes/explanations suitable for customer communications and regulatory review.^3,15
Vet vendor models and data sources as rigorously as internal models — especially if they influence credit, pricing or eligibility.^8,15

Cybersecurity and AI system security (MLOps/LLMOps)

Treat training data, feature stores and model artifacts as crown jewels; implement encryption, strong access control and monitoring.^1,7
Add controls for prompt injection, data exfiltration, model inversion and supply chain compromise (especially for external APIs).^7,8
Align AI security testing to the organization's cyber program and regulatory expectations (e.g., NYDFS Part 500 risk assessment discipline).^7,13

Third-party and concentration risk

Perform pre‑contract due diligence on: Security posture, training data provenance, subcontractors, incident notification SLAs, audit rights and model update controls.^8,9
Require transparency on: Where data flows, data retention and whether prompts/outputs are used to train vendor models.^7,8

Controls for conduct risk and investor protection (wealth/asset management)

For "digital engagement" and personalization tools: Test for conflicts, nudging behaviors and suitability harm.^5,6
Maintain records of model logic, testing and monitoring — especially where tools optimize engagement or outcomes.^5,15

Incident response for AI-driven harm

Add AI-specific scenarios to IR playbooks:
- Erroneous denials/approvals at scale
- Trading/hedging anomaly
- GenAI leakage of MNPI or customer data
- Vendor model compromise or unsafe update
Establish kill switches: Revert to manual processing/human review when monitoring thresholds trigger.^1,15

AI risk transfer: Insurance implications for financial institutions

AI-driven losses can implicate multiple coverage lines depending on facts and policy language. As claims develop, we expect more clarity to see whether they will affirmatively cover, explicitly exclude coverage or remain silent on AI loss exposures. Below are some but not all policies that may be impacted:

E&O/Professional liability: Claims of negligent advice, unsuitable recommendations, or misstatements derived from AI outputs (Particularly relevant where engagement tools influence investor behavior).^5,6
Cyber/Privacy: Data leakage through GenAI use, AI pipeline breaches and operational disruption tied to AI dependencies.^1,7
D&O/Securities: Governance failures or regulatory investigations tied to AI strategy, disclosure issues and controls.^5,6
Crime/Social engineering: AI-enabled fraud and deepfake-driven payment diversion can intensify loss scenarios (often testing sublimits, definitions and authentication controls). NYDFS and banking research highlight external fraud as a key loss driver in AI contexts.^1,13

As the AI risk landscape matures, the insurance marketplace is also beginning to develop standalone AI Liability products intended to respond more affirmatively to AI-specific failure modes that may not fit neatly within traditional Cyber, E&O, D&O, Crime or General Liability coverage grants. These products remain in an early stage of development, but emerging offerings are focused on exposures such as AI underperformance, hallucinations or inaccurate outputs, model drift, algorithmic error, intellectual property and privacy implications and third-party liability arising from the deployment or use of AI systems.

Practical takeaway: Insurance can help absorb AI-driven loss severity, but underwriters increasingly expect demonstrable AI governance aligned to model risk, cybersecurity and third‑party controls. We expect the insurance market to take various approaches to covering or not covering these exposures, and this may vary by insurance market and the type of insurance policy.

Conclusion

For financial institutions, these products should not be viewed as a substitute for strong enterprise AI governance or careful review of existing insurance wording. Rather, they may become a complementary risk transfer tool, particularly where an institution is deploying AI in customer-facing, decisioning, advisory, fraud detection or operational workflows that could create scaled legal, regulatory, reputational or financial harm. As the market continues to evolve, institutions should work with their insurance advisors to evaluate whether standalone AI Liability coverage, AI-specific endorsements or clarification of existing policy language provides the most effective approach to addressing these emerging exposures.

John Farley

Managing Director — Cyber Liability Practice

New York, NY

Phone Number (212) 763-3424

Eileen Yuen

Managing Director, Financial Institutions Practice

Phone Number (973) 921-8283

Sources

¹Mihov, Atanas and Ping McLemore. "Does AI Cause Higher Operational Losses at Banks?," Federal Reserve Bank of Richmond, accessed 27 Jul 2026.

²McLemore Ping and Atanas Mihov, "AI and Operational Losses: Evidence from U.S. Bank Holding Companies," Federal Reserve Bank of Boston, 3 Sept 2025. PDF file.

³"CFPB and Federal Partners Confirm Automated Systems and Advanced Technology Not an Excuse for Lawbreaking Behavior," Consumer Financial Protection Bureau, 25 Apr 2023.

⁴"Justice Department's Civil Rights Division Joins Officials from CFPB, EEOC and FTC Pledging to Confront Bias and Discrimination in Artificial Intelligence," United States Department of Justice, 25 Apr 2023.

⁵"Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers," Securities and Exchange Commission, 26 July 2023. PDF file.

⁶"SEC Proposes Sweeping New Rules on Use of Data Analytics by Broker-Dealers and Investment Advisers," Sidley, 8 Aug 2023.

⁷"AI Risk Management Framework," NIST, accessed 27 July 2026.

⁸"Financial Services AI Risk Management Framework," Cyber Risk Institute, accessed 27 Jul 2026.

⁹"Model Risk Management: Revised Guidance," Office of the Comptroller of the Currency, 17 Apr 2026.

¹⁰"Treasury Releases Two New Resources to Guide AI Use in the Financial Sector," US Department of the Treasury, 19 Feb 2026.

¹¹"AI Act: implications for the EU banking and payments sector," European Banking Authority, 21 Nov 2025.

¹²"Setting the ground rules: the EU AI Act," KPMG, May 2024.

¹³Alvarez, Daniel K et al. "NYDFS Issues Industry Guidance Letter on Artificial Intelligence Cybersecurity Risks," Willkie Farr & Gallagher LLP, 1 Nov 2024. PDF file.

¹⁴"Insurance Circular Letter No. 7: Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing," New York State Department of Financial Services, 11 Jul 2024. PDF file.

¹⁵"Supervisory Guidance on Model Risk Management," Board of Governors of the Federal Reserve System, 4 Apr 2011. PDF file.