By Alison Barker, Special Adviser, BDO

Recent publications by the Bank of England and the Financial Conduct Authority (FCA) have explored the impacts of artificial intelligence (AI) on financial services. While the full extent of these impacts remains unknown, these insights provide a foundation for practical steps that firms can take. 

Regulators embrace AI

The Bank of England and the FCA have both released publications that offer valuable insights into AI's role in financial services. The FCA's Mills Review examines AI developments in retail financial services and their potential implications for consumers and the FCA by 2030. Meanwhile, the Bank of England Governor's speech, Can AI Make Cutlery? takes an economist's perspective on AI as a growth agent and its effects on the economy.

Key takeaways from the Mills Review

The Mills Review: AI and the Future of Retail Financial Services primarily focuses on considerations for the FCA, with a short-term recommendation to review consumer use of AI within 6 months. It highlights the flexibility of the Consumer Duty and the senior managers regime to address poor AI-driven outcomes. The review provides a comprehensive analysis of various AI technologies, quantum computing, and use cases. It also explores the organisational shift in roles and skills, particularly the role of humans in the loop.

The review raises concerns about competition issues, with dominant AI innovation concentrated in the hands of a few, echoing concerns raised by the Competition and Markets Authority. It also highlights the potential for poor consumer outcomes without recourse to redress from AI outside the regulatory perimeter. The review suggests that regulators may need the power to monitor, investigate, and sanction AI providers, similar to their oversight of critical third parties. Cyber risk, fraud, and financial crime are identified as significant concerns, with AI potentially being used to exploit vulnerabilities.

Despite these concerns, the review acknowledges AI's potential to transform financial services, offering process efficiencies, improved governance, risk management, and empowering consumers to make better choices. The ultimate battle in retail financial services will be for AI, and the firms that control it, to own the mediated customer interface, while regulators strive to keep pace with the rapid changes.

Observations from the Mills Review

 

1. AI will transform firms: Many firms are experimenting and innovating with AI.
2. Consumer journeys will become AI agent-led: AI agents will interact with each other and consumers, leading to delegated decision-making and potentially greater consumer empowerment, as well as increased consumer risk.
3. AI reshapes market power and competition: AI could foster beneficial competition but may also create dependencies on suppliers, shifting market power.
4. Threats and defences both accelerate: The risks of fraud and crime are rapidly evolving, but AI can also play a significant role in defence.

Insights from Andrew Bailey's speech

Andrew Bailey's speech, Can AI Make Cutlery? explores AI's role in economic growth, drawing parallels with historical technological developments like electricity and the steam engine. These technologies generate growth through innovation and obsolescence, where old ways are replaced by new ones, triggering a cascade of transformations. Bailey notes that revolutionary technologies take time to deliver productive transformation, citing the example of electricity, which took four decades to bring about productive economic growth.

Effects of AI on economic growth

 

1. Displacement: AI replaces people where tasks can be done more cheaply and efficiently.
2. Reinstatement: AI creates new tasks requiring new skills, such as data scientists.
3. Productivity: AI increases effectiveness and efficiency, necessitating more people to handle increased outputs, like more doctors to treat AI-generated diagnosis outputs.
4. Replacement: AI changes the demand for skills and labour in the workforce.

Strategic considerations for firms

This phase of AI development is characterised by innovation, trial and error, disruption, and adoption. Firms must strategically assess where AI use cases can be best deployed and then engage in measured planning, assessment, and assurance to evaluate AI performance, manage disruption, and move into productive adoption.

Reassessing assurance and control frameworks

AI requires a comprehensive reassessment of assurance operations. As AI continuously adapts, human engagement becomes more challenging. Data accuracy is crucial for AI's effective operation, and changing data can lead to undesirable outcomes from AI drift. The traditional three lines of defence model is increasingly seen as inadequate in a fast-moving AI world. Organisations must build controls and thresholds for real-time evaluation, monitoring, and critical analysis to identify AI drift and hallucinations, creating a holistic risk and control framework.

Regulatory expectations and governance

Regulators emphasise that accountability and responsibility rest with boards and senior management to ensure AI transformations align with regulatory expectations. The existing framework of principles and rules is deemed sufficient to govern AI adoption. Boards must ensure that AI is deployed and operated effectively, evidencing reasonable steps taken. The ICAEW has published ten essential questions to assist in AI deployments, focusing on top-level strategy and policy, as well as considerations for higher-risk systems.

Initial steps for firms

 

1. Commission an AI inventory: Set a hard deadline and include shadow AI discovery in the scope.
2. Tier the AI inventory: Prioritise assessment based on risk, such as legal, regulatory, or financial risks.
3. Establish an AI deployment toolkit: Cover deployment approach, evaluation criteria, and control environment.
4. Evolve governance and control frameworks: Include thresholds, calibration, and continuous feedback loops.
5. Enhance assurance capabilities: Consider the role of second and third lines in providing independent assurance in real-time environments.
6. Implement kill switches: High-risk systems may require hardwired kill switches, while lower-risk systems may set flags for review.
7. Change audit cycles: Move to continuous assurance to reduce the risk of poor AI deployments.
8. Make AI risk a standing board item: Include live metrics, not just an annual deep dive.
9. Assess capabilities: Evaluate skills and experience needed from the board down, including AI training.

For further discussion on this topic, please contact Alison Barker, Special Adviser; Catherine Wilks, Partner, Digital; or Gareth Miller, Director, Governance Risk and Compliance.