In October 2025 the Financial Stability Board (FSB) published a report, Monitoring Adoption of Artificial Intelligence and Related Risks in the Financial Sector, advising supervisory authorities on how to monitor AI adoption, risk management practices and potential vulnerabilities at financial institutions.
Why finance needs dedicated AI risk monitoring
Financial sector AI adoption has three features: it spreads quickly, its chain is long and its externalities are strong.
Rapid spread means risk exposure accumulates faster than traditional supervisory cycles. A long chain means model risk, data risk, cyber risk and third-party dependency risk interweave. Strong externalities mean one institution’s risk can transmit and amplify through peers and markets.
Supervisors therefore need not a static rulebook but a method for continuous monitoring, which is the report’s focus.
Risk dimensions the report addresses
Model risk. Including bias, limited explainability, model drift and behavioural uncertainty under extreme market conditions.
Data risk. Including data quality, lawful sourcing, and privacy and security risks from mixing training and business data.
Cyber and third-party dependency. Financial institutions rely heavily on external model vendors and cloud services, and supply chain concentration is itself a systemic risk.
Governance and accountability. Who is accountable for AI decisions, how the board oversees management’s AI adoption, and whether risk functions can assess AI systems.
Why soft law binds in practice
The FSB report is not legally binding, but the path to constraint is clear: supervisors adjust expectations and inspection priorities accordingly; institutions fold the recommendations into internal governance and reporting; and peer practice forms a de facto standard. See our note on financial AI security guidance.
For vendors supplying AI to financial institutions, this means client security questionnaires will become more granular, especially on explainability, third-party dependency and incident response.
How companies should respond
First, fold AI risk into the existing risk governance framework rather than creating a separate AI compliance system. See our note on the AI application service provider action plan.
Second, maintain a model inventory and model risk management process covering development, validation, launch, monitoring and retirement. See our algorithm filing service.
Third, watch supply chain concentration, avoiding over-reliance on a single model vendor or cloud service. See our note on the G7 supply chain recommendations.
Fourth, prepare data capability for supervisory reporting, bringing AI adoption and risk indicators into extractable, verifiable structures. See our multi-jurisdiction service.
Financial AI supervision is moving from whether use is permitted to how it is used and monitored. Observability will become a core compliance capability.
This article is based on the FSB report Monitoring Adoption of Artificial Intelligence and Related Risks in the Financial Sector and on public information. It is for general reference only and does not constitute legal advice.