The Role of AI in Financial Services

What AI does in financial services

Artificial intelligence helps financial firms recognise patterns, make predictions and generate content. Its role ranges from scoring a card payment for fraud to summarising documents for a compliance analyst. Banks, payment institutions, lenders, insurers and investment firms can all use it.

AI is not a licence category, nor does it remove responsibility from the firm deploying it. An authorised lender remains responsible for its credit decisions; a payment provider remains responsible for meeting its applicable security, conduct and financial crime obligations.

The useful question is therefore not simply whether a service uses AI. It is what the system does, what authority it has, and what happens when it is wrong.

The main types of AI

Predictive machine learning

Machine-learning models identify relationships in historical data and apply them to new cases. A fraud model might estimate whether a transaction is suspicious using its amount, device characteristics, merchant type and departure from a customer's usual behaviour.

The output is usually a score or classification, not a proven fact. A separate policy determines whether the firm approves the transaction, requests authentication or sends it for review.

Generative AI

Generative AI produces text, code, images or other content. In finance, applications include drafting customer replies, extracting information from contracts and summarising research.

A language model generates plausible responses; it does not inherently verify truth. Connecting it to approved documents can improve grounding, but does not eliminate fabricated details, missing qualifications or outdated answers.

Rules and automation

Not all automated finance is AI. A rule that flags transfers above a defined threshold is conventional software. Robotic process automation can move information between systems without learning from data.

Financial firms often combine these approaches: rules enforce mandatory restrictions, models identify unusual patterns, and people investigate exceptions.

Where AI is used

Fraud detection and payment security

Payment fraud detection requires decisions quickly enough to avoid disrupting legitimate purchases. A model can compare a payment with account history and signals such as a new device or an unfamiliar beneficiary.

A typical workflow is:

1. A payment request reaches the provider.
2. Rules and models assess available risk signals.
3. The provider approves, blocks or requests additional authentication.
4. Investigation results and customer reports inform future monitoring.

There are two competing risks: allowing fraud through and declining legitimate activity. A system that blocks too aggressively can leave customers unable to pay essential bills.

Performance must therefore include false declines and customer outcomes, not just detected fraud. Criminals also adapt, so models require monitoring after deployment.

Credit assessment and lending

AI can support affordability checks, application processing and estimates of default risk. With appropriate permission and legal safeguards, transaction data obtained through open banking may help a lender understand income variability or recurring commitments.

For example, a model might categorise incoming payments and distinguish regular earnings from transfers between the applicant's own accounts. The lender then applies its underwriting policy and applicable affordability requirements.

More data does not automatically produce fairer lending. Transaction patterns can reveal sensitive information or act as proxies for protected characteristics. Historical lending records may also reflect earlier discrimination.

Lenders need relevant inputs, reliable explanations, fairness testing and ways to correct inaccurate data. A technically accurate model can still produce unlawful or unsuitable decisions.

Financial crime compliance

AI can help prioritise transaction-monitoring alerts, compare identity documents and identify networks of connected accounts. It can also assist analysts reviewing complex ownership structures.

These tools do not replace the legal requirements for customer due diligence, sanctions compliance or suspicious activity reporting. An alert is a reason to investigate, not proof of criminal conduct.

Generative AI may prepare a case summary, but an accountable reviewer should verify supporting evidence before using it in a regulatory submission or consequential decision.

Customer service and operations

Customer-facing assistants can explain product features, retrieve account information and guide users through routine processes. Internal tools can classify complaints, extract invoice fields and help staff search policies.

The risk changes when an assistant moves from answering questions to taking action. Explaining how to change a payment limit is different from changing it.

Action-taking systems need identity checks, narrowly defined permissions, confirmation steps and audit trails. Customers also need a practical route to a human, particularly for disputed transactions, financial difficulty or suspected fraud.

Investment and insurance services

Investment firms may use AI to organise research, monitor portfolios or support risk analysis. Insurers may use it in underwriting and claims triage.

These applications remain subject to the rules governing the underlying activity. A conversational interface does not make personalised investment recommendations unregulated, and automated claims screening does not remove obligations concerning fair treatment.

Back-tested investment performance is particularly easy to overinterpret. Models can fit historical noise, overlook trading costs or fail when market conditions change.

How a financial AI system should be controlled

Define the decision and its consequences

A firm should distinguish between a tool that assists an employee and one that independently changes a customer's position.

Summarising a policy document generally presents different risks from rejecting a loan or restricting an account. Controls should reflect the potential harm, including financial loss, exclusion, privacy intrusion and difficulty obtaining redress.

Govern data and validate the model

Before deployment, a firm should establish:

• Where training and operational data originate, and whether their use is lawful.
• Whether the data represent the customers and situations the model will encounter.
• How accuracy, discrimination, security and failure modes will be tested.
• Who approves deployment and can suspend the system.
• What evidence must be retained to reconstruct a decision.

Testing should include unusual cases, missing information and performance across relevant customer groups. Validation should have sufficient independence from the people building the system.

Monitor changes and provide meaningful review

Models can deteriorate when customer behaviour, fraud methods or economic conditions change. This is often called model drift.

Firms should monitor outcomes, investigate complaints and reassess systems after material changes. Updating a third-party model can alter behaviour even when the firm's own interface remains unchanged.

Human oversight must be more than approving a machine-generated recommendation. Reviewers need enough information, time and authority to challenge it, with a fallback process if the model becomes unreliable.

The additional risks of generative AI

Generative AI introduces weaknesses that differ from those of conventional scoring models.

Fabricated answers: An assistant may invent a product condition or regulatory requirement. Important answers should be checked against authoritative material, with uncertainty made clear.

Confidentiality failures: Prompts and uploaded files may contain personal data, account details or commercially sensitive information. Firms need clear contractual and technical controls over retention, access, processing locations and any reuse for training.

Prompt injection: Instructions hidden in an email or document can attempt to redirect an assistant. External content should not be allowed to override security policies or authorise transactions.

Excessive permissions: An assistant connected to payment or account-management tools can cause harm even if its language sounds reasonable. Read-only access, transaction limits and separate approvals reduce the consequences of mistakes.

Buying a hosted AI service does not transfer regulatory responsibility to its supplier. Financial firms still need appropriate vendor assessment, continuity arrangements and exit planning.

How regulation differs by jurisdiction

AI regulation sits alongside financial services, data protection, consumer protection and outsourcing rules. Classification matters: a bank, an electronic money institution and an investment adviser do not have identical obligations.

European Union

PSD2 governs relevant payment services, while EMD2 provides the framework for electronic money institutions. Neither is a general authorisation to use customer data for AI. GDPR requirements apply separately, including safeguards concerning certain solely automated decisions with legal or similarly significant effects.

The EU AI Act adds a risk-based framework. Certain uses, including evaluating individuals' creditworthiness, can fall within its high-risk provisions, subject to the statutory scope and exceptions. Application is phased, so firms should verify which obligations apply to their use case and date of deployment.

DORA also matters for in-scope financial entities using external ICT services. EBA guidance and the relevant national supervisor are important reference points.

United Kingdom

The regulatory perimeter depends on the activity performed, not the use of AI. FCA-authorised firms must consider applicable conduct requirements, including the Consumer Duty where relevant. PRA-supervised firms may also face prudential and model-risk expectations.

Data protection, outsourcing and operational resilience requirements can apply alongside these obligations. Firms should check FCA, PRA and Information Commissioner's Office guidance rather than assuming a single AI approval covers deployment.

United States

Oversight is divided among federal and state authorities and depends on the institution, product and activity.

For lending, the Equal Credit Opportunity Act and Regulation B are central to anti-discrimination and adverse-action obligations. A complex model does not excuse a creditor from providing required, specific reasons for adverse action. The Fair Credit Reporting Act may also apply when consumer reports are involved.

Banking supervisors' model-risk guidance provides another important framework. State privacy and insurance rules can add requirements.

Switzerland

FINMA supervision depends on the firm's regulated activity and licence category. A FinTech licence is a specific Swiss regulatory category, not a general licence for AI-powered financial services.

Governance, risk management, outsourcing and operational resilience remain relevant. Swiss data protection law also contains provisions concerning automated individual decisions; firms should assess the applicable information and review requirements.

United Arab Emirates

The UAE has distinct regulatory jurisdictions. Federal arrangements, the Dubai International Financial Centre and Abu Dhabi Global Market should not be treated as interchangeable.

Depending on the activity and location, relevant authorities can include the Central Bank of the UAE, the DFSA and the FSRA. Firms must identify their licensing perimeter and applicable data protection, outsourcing and consumer protection requirements before deployment.

Singapore

MAS supervision follows the underlying financial activity. AI deployments should be assessed against applicable technology risk management, outsourcing and conduct requirements, alongside personal data protection obligations.

MAS's FEAT principles address fairness, ethics, accountability and transparency in AI and data analytics. Such principles support governance but are not a substitute for licensing or compliance with binding rules.

What customers and business buyers should ask

Useful questions include:

• Is AI informing the decision or making it?
• What data does it use, and can inaccuracies be corrected?
• Can the firm explain a consequential outcome?
• Is meaningful human review available?
• Can the system move money or change account settings?
• Who handles complaints, failures and compensation claims?

The strongest financial AI services are not necessarily the most autonomous. They match automation to the task, preserve accountability and make errors easier to identify and resolve.