SUNANDO ROY – On Banking, Finance and Society

The rapid advancement and adoption of artificial intelligence (AI) across various sectors, particularly in finance, heralds transformative potential but also introduces significant financial stability risks. The Bank of England’s Financial Policy Committee (FPC) has outlined these risks in its April 2025 Financial Stability in Focus report, emphasizing AI’s growing role in financial institutions, markets, and operational frameworks. This article explores the key financial stability risks associated with AI adoption as identified by the Bank of England, including risks in core financial decision-making, financial markets, operational dependencies, and the evolving cyber threat landscape. It concludes with recommendations for central banks to enhance financial regulation to mitigate these risks, ensuring AI’s safe integration into the financial system.

AI in Core Financial Decision-Making

AI’s integration into banks’ and insurers’ core financial decisions, such as credit underwriting and insurance pricing, offers benefits like enhanced risk management and improved customer offerings. However, the Bank of England highlights significant risks stemming from AI’s complexity and autonomy. Advanced AI models, particularly those with limited explainability, may lead to misestimations of risk if not properly governed, potentially causing systemic issues if common model weaknesses are widespread. For instance, reliance on similar open-source models or data sets could lead multiple firms to misprice credit, tightening credit supply during a crisis, reminiscent of the 2008 Global Financial Crisis. Additionally, biased or poorly calibrated AI models could result in conduct-related risks, such as legal challenges or financial redress, impacting consumer access to financial products. Microprudential regulation, including model risk management and governance frameworks, can mitigate firm-level risks, but macroprudential oversight is crucial to address systemic vulnerabilities arising from collective firm behaviors.

AI in Financial Markets

The use of AI in financial markets, particularly in algorithmic trading and investment strategies, promises greater market efficiency but poses risks to systemic stability. The Bank of England notes that AI-driven trading strategies could increase market participants’ correlation, amplifying shocks during stress events. For example, widespread use of similar AI models might lead to herding behavior, exacerbating fire-sales in bond markets, which are critical for real economy funding. Advanced AI models, if autonomous, could exploit market weaknesses or engage in destabilizing behaviors like collusion, challenging existing market conduct regulations. The Financial Stability Board (FSB) echoes these concerns, suggesting that while AI could enhance risk management, it may also reduce market resilience under stress. The FPC emphasizes the need for ongoing monitoring to adapt to rapid changes in AI-driven market dynamics, leveraging tools like system-wide exploratory scenarios to assess these risks.

Operational Risks from AI Service Providers

Financial institutions increasingly rely on third-party AI service providers for complex models and cloud computing, raising operational risks. The Bank of England warns that concentration in the AI service market could lead to systemic disruptions if key providers fail, as seen in the July 2024 CrowdStrike outage. Such disruptions could halt vital services like payments, impacting financial stability. The International Monetary Fund (IMF) highlights the growing interconnectedness driven by AI outsourcing, which heightens systemic vulnerabilities. The FPC advocates for enhanced operational resilience, supported by the Financial Services and Markets Act 2023, which introduces a regulatory regime for critical third parties. Collaborative efforts, such as the public-private ‘shared responsibility model,’ aim to clarify responsibilities between providers and financial firms, reducing operational risks.

Evolving Cyber Threat Environment

AI’s dual role in enhancing cybersecurity and enabling malicious actors complicates the cyber threat landscape. The Bank of England notes that while AI can improve threat detection, it also empowers cybercriminals to execute sophisticated attacks, such as data poisoning or deepfake-driven fraud. The Organisation for Economic Co-operation and Development (OECD) warns of AI’s potential to amplify cyber risks across sectors, including finance. Systemic implications arise if common AI vulnerabilities are exploited across multiple firms, leading to operational contagion or loss of confidence. The FPC’s participation in initiatives like the Cross Market Operational Resilience Group (CMORG) AI Taskforce underscores the need for collaborative strategies to counter AI-enabled cyber threats, balancing defensive advancements with emerging risks.

Recommendations for Financial Regulation

To manage AI-related financial stability risks, central banks should adopt a multi-faceted regulatory approach:

1. Enhanced Macroprudential Monitoring: Central banks should expand monitoring frameworks, incorporating AI-specific metrics from surveys, supervisory intelligence, and market data. The Bank of England’s AI Survey and AI Consortium provide models for tracking AI adoption and risks. Regular stress testing, including AI-focused scenarios, can assess systemic vulnerabilities.
2. Strengthened Third-Party Oversight: Regulators should designate critical AI service providers under frameworks like the UK’s critical third-party regime, ensuring robust contingency plans and rapid migration capabilities to alternative providers. This aligns with the FSB’s recommendations for managing third-party risks.
3. AI Governance Standards: Central banks should mandate comprehensive AI governance frameworks, emphasizing explainability, data integrity, and bias mitigation. The Bank of England’s TRUSTED principles offer a blueprint for ensuring AI systems are reliable and ethically sound.
4. Cyber Resilience Frameworks: Regulators should develop AI-specific cyber resilience standards, addressing vulnerabilities like data poisoning and prompt injection. Collaboration with bodies like the G7 Cyber Experts Group can harmonize global approaches, as suggested by the OECD.
5. International Coordination: Given AI’s global nature, central banks should engage in international forums like the FSB and G20 to align regulatory standards, ensuring cross-border risks are addressed. The IMF’s work on AI in capital markets underscores the need for global cooperation.

Conclusion

AI’s transformative potential in finance is undeniable, but its adoption introduces complex financial stability risks, as articulated by the Bank of England. From core decision-making to market dynamics, operational dependencies, and cyber threats, AI’s unique features demand proactive regulatory responses. Central banks must enhance monitoring, strengthen third-party oversight, enforce robust governance, bolster cyber resilience, and foster international collaboration to mitigate these risks. By doing so, they can ensure AI supports sustainable economic growth while safeguarding the financial system’s resilience.

References

 

Bank of England. 2025. Financial Stability in Focus: Artificial Intelligence in the Financial System. London: Bank of England. Financial Stability in Focus: Artificial intelligence in the financial system | Bank of England

Financial Stability Board. 2024. The Financial Stability Implications of Artificial Intelligence. Basel: FSB. The Financial Stability Implications of Artificial Intelligence – Financial Stability Board

International Monetary Fund. 2024. Global Financial Stability Report, Chapter 3. Washington, DC: IMF. Global Financial Stability Report, October 2024 – Steadying the Course: Uncertainty, Artificial Intelligence, and Financial Stability 

Organisation for Economic Co-operation and Development. 2020. The Impact of Big Data and Artificial Intelligence (AI) in the Insurance Sector. Paris: OECD. The Impact of Big Data and Artificial Intelligence (AI) in the Insurance Sector | OECD

Bank of England, Prudential Regulation Authority, and Financial Conduct Authority. 2023. Feedback Statement FS2/23 – Artificial Intelligence and Machine Learning. London: Bank of England. FS2/23 – Artificial Intelligence and Machine Learning | Bank of England

Bank of England. 2025. Financial Stability in Focus: Artificial Intelligence in the Financial System. London: Bank of England. https://www.bankofengland.co.uk/financial-stability.

 

Annexure 1: Bank of England AI Survey and AI Consortium – A Note

• The Bank of England, in collaboration with the Financial Conduct Authority (FCA), conducts the AI Survey to monitor AI adoption and associated risks in UK financial services.
• The 2024 survey highlights key use cases, such as internal process optimization, fraud detection, and cybersecurity, with firms anticipating significant benefits over the next three years.
• It also reveals concerns about cybersecurity risks and partial understanding of AI technologies among users, underscoring the need for enhanced governance.
• The survey provides quantitative and qualitative insights into AI’s evolving role, helping the FPC assess systemic risks.
• The AI Consortium is a public-private platform designed to engage stakeholders on AI’s capabilities, development, and deployment.
• It facilitates dialogue to identify emerging risks and share best practices, ensuring the FPC’s monitoring remains forward-looking and responsive to rapid technological changes.

Annexure 2: Need for a Critical Third-Party AI Service Provider Regime

• The growing reliance on third-party AI service providers, such as those offering large language models and cloud computing, poses systemic risks due to market concentration.
• The Bank of England notes that disruptions to these providers, as exemplified by the 2024 CrowdStrike outage, could halt vital financial services like payments.
• A Critical Third-Party AI Service Provider Regime, as introduced by the Financial Services and Markets Act 2023, is essential to mitigate these risks.
• This regime designates key providers as critical, subjecting them to stringent regulatory oversight, including requirements for operational resilience and contingency planning.
• It ensures financial firms can swiftly migrate to alternative providers during disruptions.
• By clarifying responsibilities through frameworks like the ‘shared responsibility model,’ this regime reduces systemic vulnerabilities, aligning with the FPC’s macroprudential objectives and safeguarding financial stability.

Annexure 3: Design of AI-Specific Supervisory Intelligence

• Designing AI-specific supervisory intelligence is vital for monitoring AI-related financial stability risks.
• The Bank of England leverages supervisory engagement with regulated firms and financial market infrastructures to gather detailed insights into AI adoption, focusing on use cases like credit risk management and algorithmic trading.
• This intelligence should be structured to capture AI model governance, data quality, and third-party dependencies, using standardized reporting templates to ensure consistency.
• Thematic supervisory activities, such as reviews of AI in lending or trading, can identify common vulnerabilities.
• Collaboration with cross-border authorities and participation in forums like the G7 Cyber Experts Group enhances intelligence sharing, addressing global AI risks.
• Future enhancements could include AI-related incident reporting and system-wide exercises to simulate AI-driven disruptions, enabling regulators to proactively mitigate systemic risks.

Annexure 4: A Standardized Reporting Template on AI Adoption in Financial Sector – Key Elements

• AI Use Cases and Scope: Detailed description of AI applications (e.g., credit underwriting, algorithmic trading, fraud detection) and their role in core business processes or operational functions.
• Model Governance and Explainability: Documentation of AI model governance frameworks, including processes for ensuring explainability, validation, and bias mitigation, with specifics on autonomous decision-making capabilities.
• Data Quality and Sources: Information on data sources (internal, third-party, open-source), data integrity measures, and mechanisms to address biases or errors in training datasets.
• Third-Party Dependencies: Identification of third-party AI service providers (e.g., cloud platforms, model vendors), including contract details, contingency plans, and migration strategies for operational resilience.
• Risk Management Practices: Outline of risk management controls for AI-related risks, such as model risk, cybersecurity vulnerabilities (e.g., data poisoning), and conduct risks, with stress testing results.
• Cybersecurity Measures: Description of AI-specific cybersecurity protocols, including defenses against prompt injection, deepfake fraud, and data breaches, with incident response plans.
• Regulatory Compliance: Evidence of adherence to existing microprudential and macroprudential regulations, including compliance with model risk management and Senior Managers and Certification Regime (SM&CR) requirements.
• Systemic Risk Indicators: Metrics on potential systemic impacts, such as correlation risks from shared models or concentration risks from third-party providers, with scenario analysis outcomes.
• Incident Reporting: Records of AI-related incidents or near-misses (e.g., model failures, cyber incidents) and remedial actions taken to prevent recurrence.
• Future Adoption Plans: Projections for AI expansion over the next 1–3 years, including planned use cases, expected benefits, and anticipated risks, to support forward-looking supervision.