Banking

AI risk management in banking

AI does not remove risk from a bank. It moves it. The credit risk is still there. The operational risk is still there. But now there is also model risk, data risk, and the risk that nobody can explain why the system did what it did.

By Zakir Hoosen, Director, Fuzzelogic Solutions. Board-level guidance in plain English.

AI creates new risks in a bank. It does not eliminate old ones. A credit scoring model does not remove the risk of bad loans. It moves the risk from a human decision to a machine decision. The risk is still there. The question is whether the bank understands it, can measure it, and can explain it to a regulator.

This guide covers the risks AI creates in banking, what the research says, and the framework a board should use to manage them.

The risks AI creates in banking

Three risks stand out.

First, model risk. The AI system makes decisions based on patterns in data. If the data is biased, the decisions are biased. If the data is outdated, the decisions are outdated. If the data is incomplete, the decisions are incomplete. The model does not know it is wrong. It just produces a result with confidence.

Second, explainability risk. A customer is denied a mortgage. A regulator asks why. If the answer is "the model decided," that is not an answer. It is a problem. The bank must be able to explain the decision in terms a customer, a regulator, or a court would accept.

Third, operational risk. AI systems fail. They fail silently. They produce wrong answers that look right. They make decisions at speed and at scale. A human error affects one case. A machine error affects every case the machine touches.

One in five organisations has no governance framework. In banking, that is a regulatory risk, not just an operational one.

What the research says

The gap between AI ambition and AI delivery is, in most cases, a risk management problem. Boards approve projects without understanding the risks. The risks materialise. The project fails.

Rushing and uninformed is the worst combination for risk management. A board that does not understand the risks cannot manage them. A board that blocks everything out of fear manages risk by avoiding it, which is not management at all.

Most AI implementations do not deliver. The risk was taken. The return was not. That is the worst outcome in risk management: you took the risk and did not get the reward.

The risk management framework

Fuzzelogic uses five tests for AI-readiness, which map directly to risk management in banking.

1. Reachable. Can the data the AI needs actually be found when it needs it? If not, the model is working on incomplete information. That is a data risk.
2. Trustworthy. Do you know the data is accurate, current, and complete? If not, the model is working on bad information. That is a model risk.
3. Explainable. Can someone explain why the system made a particular decision? If not, the bank cannot explain it to a regulator. That is a compliance risk.
4. Changeable. Can the system be changed when the business, the rules, or the risks change? If not, the bank is locked into a system that cannot adapt. That is an operational risk.
5. Governed. Has someone decided what the system may and may not do? If not, the system is operating without guardrails. That is a governance risk.

Each test maps to a risk a banking board should understand. If the board cannot pass the test, the risk is not managed.

What a banking board should do

First, classify every AI use by risk. A system that recommends a product to a customer is not the same as a system that decides who gets a mortgage. Grade each use by what happens if it fails, who it harms, and whether a regulator would ask about it.

Second, name the risk owner. Every AI use needs a named individual who answers for the risk. Not a committee. A person. If that person leaves, the accountability transfers on the same day.

Third, set the review cycle. Risk management is not a one-time event. It is a rhythm. Set the dates, assign the people, and stick to them. Model risk changes as data changes, as markets change, and as customers change.

Fourth, build the escalation path. When the system produces a result that does not look right, who is told? How fast? What happens next? If the answer involves a person manually checking, the process is not scalable. If the answer involves nobody, the process is dangerous.

The honest version

Fuzzelogic is an Isle of Man firm that has spent nineteen years modernising banking, insurance, healthcare, retail, manufacturing, and government platforms. We have worked with nine regulated financial institutions. We tell boards what most consultants will not: the honest answer is sometimes that a process should not use AI at all, and when that is the case, we put it in writing.

Your systems were built for a world before AI. Most can get there. We tell you which ones cannot.

Start with the assessment. Two to four weeks, fixed price, and you own the verdict and the roadmap whether or not we build any of it. When you are ready to talk AI, call Fuzzelogic Solutions and ask for Zak. www.FuzzelogicSolutions.com | info@FuzzelogicSolutions.com | +44 (0)1624 618950

Read next: AI governance for banking boards and AI compliance in banking.