Bankers need to engage as lawmakers consider AI guardrails

• Key insight: The risks that artificial intelligence poses to the financial services industry are real and becoming more apparent every day. As lawmakers and regulators consider new rules, bankers need a seat at the table.
• What's at stake: There is a considerable difference between using AI to help draft an internal memo and relying on it to make credit decisions, access customer information, or initiate payments without first establishing and enforcing internal guidelines.
• Forward look: One of banking's strongest competitive advantages is trust. We should do everything possible to ensure the public's trust in banks and banking is not lost.
  

The changes being brought about by artificial intelligence are astounding. It has already delivered value to many businesses and professionals, including banks, and we've only just begun to see what it can do. Certain jobs, for example in the coding space, that once took hours can now be done in minutes. Through its use, banks have new opportunities to improve service and strengthen their operations, for example in the call-answering space. We should welcome that progress.

Processing Content

But we should also remember something fundamental about banking: Our industry is founded on trust. Simply and completely. AI that is poorly deployed or managed — or, worse, placed in the hands of those seeking to do harm — can strike directly at that trust.

The tools themselves offered by the major technology companies are daunting and advancing rapidly, with more advanced versions emerging seemingly every day. Increasingly, AI is being used to develop and train more sophisticated models, further accelerating the pace of innovation. At the same time, the advent of AI agents capable of acting independently on behalf of businesses, organizations, and their customers — and, I fear, malicious actors, including state actors — is accelerating, with both agents and those seeking to do harm growing in number and power by the day. As these systems become more autonomous and powerful, the question is not merely what they can do but how we know they are doing what they are supposed to do.

What has been a relatively benign regulatory environment vis-à-vis AI is becoming more fraught, not just because of the considerable hype surrounding AI and the possibility that mishandled AI could create systemic problems but because of increasing efforts by bad actors — and potentially AI agents themselves — to break the law in ways that could cause real harm. The reported incident involving Hugging Face being but one example.

Our cyber risks are made far more daunting by AI, as the AI companies themselves recognize. And cyber breaches at any financial institution, but particularly at banks, can be devastating.

Banks should expect serious new scrutiny and, I believe, a new set of regulations from at least the banking agencies, and perhaps broader AI legislation, in the months and/or years ahead. In Washington, there is sadly more talk of regulating banks in this area than nonbanks — something we can't let happen as an industry or a country. The risks do not respect charter choice, and a framework that places the burden primarily on regulated banks while leaving other important actors outside its reach will not only inadequately protect the public but also further create the imbalanced regulatory environment that exacerbates overall risk and makes more costly and less competitive the most civic part of our financial system.

Of course, we need not wait for legislation to act and should not. Banks themselves should establish clear principles for the ethical use of AI, with policies, risk tolerances and controls proportionate to how consequential each application may be. There is a considerable difference between using AI to help draft an internal memo and relying on it to make credit decisions, access customer information, or initiate payments without first establishing and enforcing internal guidelines. Banks benefit from recognizing these new risks and managing them accordingly. Doing this makes "meat axe" and one-sided regulation less likely, while protecting banks and their customers in ways that should also provide competitive advantages.

That means knowing where AI is being used, what information it can access, who is responsible for its decisions, and, importantly, when a human needs to step in. Banks will also need to monitor AI activity and communications closely and maintain records that can be reviewed when necessary. We have long required extensive recording and supervision of communications on trading desks. That experience may offer a useful model for overseeing increasingly autonomous AI systems.

Read more:

• Colony Bank uses gen AI to shave days off SBA loan approvals
• Amid AI boom, Morgan Stanley leans into role of its people
• Goldman's Solomon wants 'clear human accountability' on AI
• Impostors got past First Horizon's help desk, suits allege

Test, test and test again should be the mantra. Tests should be designed in advance, with the level of scrutiny reflecting the complexity of the system and the risks involved. Independent audits of AI controls and governance will also be important. And the work can't stop once a system is deployed. As models are updated, exposed to new data or connected to other tools, banks will need to continue evaluating how they perform. The National Institute of Standards and Technology's ongoing work on AI risk management should be helpful in this regard.
One prudent starting point may be to start by using AI to write code that automates existing, well-understood bank processes and strengthens them against the very risks that AI exacerbates. That code can be tested against established procedures, with audit trails and human oversight. AI may also identify ways to improve those processes, but decisions about significant changes should remain with people who understand the business and the risks involved.

One of the key actors in Washington in this arena is Rep. Bill Foster of Illinois, who serves as ranking member of the House Financial Services Subcommittee on Financial Institutions and could well become its chairman in the months ahead. A physicist, former Fermilab scientist, and entrepreneur, he brings an unusual depth of technical expertise to his work on financial services policy.

Rep. Foster has given considerable thought to these issues and will be introducing legislation aimed at strengthening the financial sector's ability to identify and respond to emerging AI-related risks. He has also developed a particularly thoughtful proposal for addressing AI risks in banking, including enhancements not only to the safeguards banks should maintain but also to the tools and information available to regulators. His thinking recognizes the need for greater transparency and more timely information so that regulators can better identify and manage risks as they emerge.

I believe Rep. Foster, one of the smartest and most thoughtful members of Congress on these issues, will welcome input from the banking industry as this work progresses.

I strongly recommend that every banking institution engage on this issue. The major trade associations are already involved, but banks themselves should bring their practical experience to the debate. We don't need regulation for regulation's sake, nor do we want rules so restrictive that they stand in the way of innovation. What we need is a sensible framework that recognizes both the enormous potential of AI and the very real risks it presents to customers and the financial system.

Whether Congressman Foster's proposals become law in their present form or help shape something different, I would be surprised if we did not see significant legislation or regulation in this area. Banks should be helping to shape that framework now, rather than waiting until the rules have been written. They should also use this opportunity to make themselves more resilient in this AI age. As I noted earlier, one of banking's strongest competitive advantages is trust. We should do everything possible to ensure the public's trust in banks and banking is not lost.