It’s been barely one year since we entered the Generative AI Age. On November 30, 2022, OpenAI launched ChatGPT, with no fanfare or promotion. Since then, Generative AI has become arguably the most talked-about tech topic, both in terms of opportunities it may bring and risks that it may carry.
The landslide success of ChatGPT and other Generative AI applications with consumers and businesses has put a renewed and strengthened focus on the potential risks associated with the technology – and how best to regulate and manage these. Government bodies and agencies have created voluntary guidelines for the use of AI for a number of years now (the Singapore Framework, for example, was launched in 2019).
There is no active legislation on the development and use of AI yet. Crucially, however, a number of such initiatives are currently on their way through legislative processes globally.
EU’s Landmark AI Act: A Step Towards Global AI Regulation
The European Union’s “Artificial Intelligence Act” is a leading example. The European Commission (EC) started examining AI legislation in 2020 with a focus on
- Protecting consumers
- Safeguarding fundamental rights, and
- Avoiding unlawful discrimination or bias
The EC published an initial legislative proposal in 2021, and the European Parliament adopted a revised version as their official position on AI in June 2023, moving the legislation process to its final phase.
This proposed EU AI Act takes a risk management approach to regulating AI. Organisations looking to employ AI must take note: an internal risk management approach to deploying AI would essentially be mandated by the Act. It is likely that other legislative initiatives will follow a similar approach, making the AI Act a potential role model for global legislations (following the trail blazed by the General Data Protection Regulation). The “G7 Hiroshima AI Process”, established at the G7 summit in Japan in May 2023, is a key example of international discussion and collaboration on the topic (with a focus on Generative AI).
Risk Classification and Regulations in the EU AI Act
At the heart of the AI Act is a system to assess the risk level of AI technology, classify the technology (or its use case), and prescribe appropriate regulations to each risk class.
For each of these four risk levels, the AI Act proposes a set of rules and regulations. Evidently, the regulatory focus is on High-Risk AI systems.
Contrasting Approaches: EU AI Act vs. UK’s Pro-Innovation Regulatory Approach
The AI Act has received its share of criticism, and somewhat different approaches are being considered, notably in the UK. One set of criticism revolves around the lack of clarity and vagueness of concepts (particularly around person-related data and systems). Another set of criticism revolves around the strong focus on the protection of rights and individuals and highlights the potential negative economic impact for EU organisations looking to leverage AI, and for EU tech companies developing AI systems.
A white paper by the UK government published in March 2023, perhaps tellingly, named “A pro-innovation approach to AI regulation” emphasises on a “pragmatic, proportionate regulatory approach … to provide a clear, pro-innovation regulatory environment”, The paper talks about an approach aiming to balance the protection of individuals with economic advancements for the UK on its way to become an “AI superpower”.
Further aspects of the EU AI Act are currently being critically discussed. For example, the current text exempts all open-source AI components not part of a medium or higher risk system from regulation but lacks definition and considerations for proliferation.
Adopting AI Risk Management in Organisations: The Singapore Approach
Regardless of how exactly AI regulations will turn out around the world, organisations must start today to adopt AI risk management practices. There is an added complexity: while the EU AI Act does clearly identify high-risk AI systems and example use cases, the realisation of regulatory practices must be tackled with an industry-focused approach.
The approach taken by the Monetary Authority of Singapore (MAS) is a primary example of an industry-focused approach to AI risk management. The Veritas Consortium, led by MAS, is a public-private-tech partnership consortium aiming to guide the financial services sector on the responsible use of AI. As there is no AI legislation in Singapore to date, the consortium currently builds on Singapore’s aforementioned “Model Artificial Intelligence Governance Framework”. Additional initiatives are already underway to focus specifically on Generative AI for financial services, and to build a globally aligned framework.
To Comply with Upcoming AI Regulations, Risk Management is the Path Forward
As AI regulation initiatives move from voluntary recommendation to legislation globally, a risk management approach is at the core of all of them. Adding risk management capabilities for AI is the path forward for organisations looking to deploy AI-enhanced solutions and applications. As that task can be daunting, an industry consortium approach can help circumnavigate challenges and align on implementation and realisation strategies for AI risk management across the industry. Until AI legislations are in place, such industry consortia can chart the way for their industry – organisations should seek to participate now to gain a head start with AI.
The Banking, Financial Services, and Insurance (BFSI) industry, known for its cautious stance on technology, is swiftly undergoing a transformational modernisation journey. Areas such as digital customer experiences, automated fraud detection, and real-time risk assessment are all part of a technology-led roadmap. This shift is transforming the cybersecurity stance of BFSI organisations, which have conventionally favoured centralising everything within a data centre behind a firewall.
Ecosystm research finds that 75% of BFSI technology leaders believe that a data breach is inevitable. This requires taking a new cyber approach to detect threats early, reduce the impact of an attack, and avoid lateral movement across the network.
BFSI organisations will boost investments in two main areas over the next year: updating infrastructure and software, and exploring innovative domains like digital workplaces and automation. Cybersecurity investments are crucial in both of these areas.
As a regulated industry, breaches come with significant cost implications, underscoring the need to prioritise cybersecurity. BFSI cybersecurity and risk teams need to constantly reassess their strategies for safeguarding data and fulfilling compliance obligations, as they explore ways to facilitate new services for customers, partners, and employees.
The primary concerns of BFSI CISOs can be categorised into two distinct groups:
- Expanding Technology Use. This includes the proliferation of applications and devices, as well as data access beyond the network perimeter.
- Employee-Related Vulnerabilities. This involves responses to phishing and malware attempts, as well as intentional and unintentional misuse of technology.
Vulnerabilities Arising from Employee Actions
Security vulnerabilities arising from employee actions and unawareness represent a significant and ongoing concern for businesses of all sizes and industries – the risks are just much bigger for BFSI. These vulnerabilities can lead to data breaches, financial losses, damage to reputation, and legal ramifications. A multi-pronged approach is needed that combines technology, training, policies, and a culture of security consciousness.
Training and Culture. BFSI organisations prioritise comprehensive training and awareness programs, educating employees about common threats like phishing and best practices for safeguarding sensitive data. While these programs are often ongoing and adaptable to new threats, they can sometimes become mere compliance checklists, raising questions about their true effectiveness. Conducting simulated phishing attacks and security quizzes to assess employee awareness and identify areas where further training is required, can be effective.
To truly educate employees on risks, it’s essential to move beyond compliance and build a cybersecurity culture throughout the organisation. This can involve setting organisation-wide security KPIs that cascade from the CEO down to every employee, promoting accountability and transparency. Creating an environment where employees feel comfortable reporting security concerns is critical for early threat detection and mitigation.
Policies. Clear security policies and enforcement are essential for ensuring that employees understand their roles within the broader security framework, including responsibilities on strong password use, secure data handling, and prompt incident reporting. Implementing the principle of least privilege, which restricts access based on specific roles, mitigates potential harm from insider threats and inadvertent data exposure. Policies should evolve through routine security audits, including technical assessments and evaluations of employee protocol adherence, which will help organisations with a swifter identification of vulnerabilities and to take the necessary corrective actions.
However, despite the best efforts, breaches do happen – and this is where a well-defined incident response plan, that is regularly tested and updated, is crucial to minimise the damage. This requires every employee to know their roles and responsibilities during a security incident.
Tech Expansion Leading to Cyber Complexity
Cloud. Initially hesitant to transition essential workloads to the cloud, the BFSI industry has experienced a shift in perspective due to the rise of inventive SaaS-based Fintech tools and hybrid cloud solutions, that have created new impetus for change. This new distributed architecture requires a fresh look at cyber measures. Secure Access Service Edge (SASE) providers are integrating a range of cloud-delivered safeguards, such as FWaaS, CASB, and ZTNA with SD-WAN to ensure organisations can securely access the cloud without compromising on performance.
Data & AI. Data holds paramount importance in the BFSI industry for informed decision-making, personalised customer experiences, risk assessment, fraud prevention, and regulatory compliance. AI applications are being used to tailor products and services, optimise operational efficiency, and stay competitive in an evolving market. As part of their technology modernisation efforts, 47% of BFSI institutions are refining their data and AI strategies. They also acknowledge the challenges associated – and satisfying risk, regulatory, and compliance requirements is one of the biggest challenges facing BFSI organisations in the AI deployments.
The rush to experiment with Generative AI and foundation models to assist customers and employees is only heightening these concerns. There is an urgent need for policies around the use of these emerging technologies. Initiatives such as the Monetary Authority of Singapore’s Veritas that aim to enable financial institutions to evaluate their AI and data analytics solutions against the principles of fairness, ethics, accountability, and transparency (FEAT) are expected to provide the much-needed guidance to the industry.
Digital Workplace. As with other industries with a high percentage of knowledge workers, BFSI organisations are grappling with granting remote access to staff. Cloud-based collaboration and Fintech tools, BYOD policies, and sensitive data traversing home networks are all creating new challenges for cyber teams. Modern approaches, such as zero trust network access, privilege management, and network segmentation are necessary to ensure workers can seamlessly but securely perform their roles remotely.
Looking Beyond Technology: Evaluating the Adequacy of Compliance-Centric Cyber Strategies
The BFSI industry stands among the most rigorously regulated industries, with scrutiny intensifying following every collapse or notable breach. Cyber and data protection teams shoulder the responsibility of understanding the implications of and adhering to emerging data protection regulations in areas such as GDPR, PCI-DSS, SOC 2, and PSD2. Automating compliance procedures emerges as a compelling solution to streamline processes, mitigate risks, and curtail expenses. Technologies such as robotic process automation (RPA), low-code development, and continuous compliance monitoring are gaining prominence.
The adoption of AI to enhance security is still emerging but will accelerate rapidly. Ecosystm research shows that within the next two years, nearly 70% of BFSI organisations will have invested in SecOps. AI can help Security Operations Centres (SOCs) prioritise alerts and respond to threats faster than could be performed manually. Additionally, the expanding variety of network endpoints, including customer devices, ATMs, and tools used by frontline employees, can embrace AI-enhanced protection without introducing additional onboarding friction.
However, there is a need for BFSI organisations to look beyond compliance checklists to a more holistic cyber approach that can prioritise cyber measures continually based on the risk to the organisations. And this is one of the biggest challenges that BFSI CISOs face. Ecosystm research finds that 72% of cyber and technology leaders in the industry feel that there is limited understanding of cyber risk and governance in their organisations.
In fact, BFSI organisations must look at the interconnectedness of an intelligence-led and risk-based strategy. Thorough risk assessments let organisations prioritise vulnerability mitigation effectively. This targeted approach optimises security initiatives by focusing on high-risk areas, reducing security debt. To adapt to evolving threats, intelligence should inform risk assessment. Intelligence-led strategies empower cybersecurity leaders with real-time threat insights for proactive measures, actively tackling emerging threats and vulnerabilities – and definitely moving beyond compliance-focused strategies.
As they continue to promote innovation in the Financial Services industry, the Monetary Authority of Singapore (MAS) introduced the Financial Sector Technology and Innovation Scheme 3.0 (FSTI 3.0) earlier this week, pledging up to SGD 150 million over three years. FSTI 3.0 aims to boost innovation by supporting projects that use cutting-edge technologies or have a regional scope, while strengthening the technology ecosystem in the industry. This initiative includes three tracks:
- Enhanced Centre of Excellence track to expand grant funding to corporate venture capital entities
- Innovation Acceleration track to support emerging tech based FinTech solutions, and
- Environmental, Social, and Governance (ESG) FinTech track to accelerate ESG adoption in fintech
Additionally, FSTI 3.0 will continue to support areas like AI, data analytics, and RegTech while emphasising talent development. We can expect to see transformative financial innovation through greater industry collaboration.
MAS’ Continued Focus on Innovation
Over the years, the MAS has consistently been a driving force behind innovation in the Financial Services industry. They have actively promoted and supported technological advancements to enhance the industry’s competitiveness and resilience.
The FinTech Regulatory Sandbox framework offers a controlled space for financial institutions and FinTech innovators to test new financial products and services in a real-world setting, with tailored regulatory support. By temporarily relaxing specific regulatory requirements, the sandbox encourages experimentation, while ensuring safeguards to manage risks and uphold the financial system’s stability. Upon successful experimentation, entities must seamlessly transition to full compliance with relevant regulations.
Innovation Labs serve as incubators for new ideas, fostering a culture of experimentation and collaboration. They collaborate with disruptors, startups, and entrepreneurs to develop groundbreaking solutions. Labs like Accenture Innovation Hub, Allianz Asia Lab, Aviva Digital Garage, ANZ Innovation Lab, and AXA Digital Hive drive create prototypes, and roll out market solutions.
Building an Ecosystem
Partnerships between financial institutions, technology companies, startups, and academia contribute to Singapore’s economic growth and global competitiveness while ensuring adaptive regulation in an evolving landscape. By creating a vibrant ecosystem, MAS has facilitated knowledge exchange, collaborative projects, and the development of innovative solutions. For instance, in 2022, MAS partnered with United Nations Capital Development Fund (UNCDF) to build digital financial ecosystems for MSMEs in emerging economies.
This includes supporting projects that address environmental, social, and governance (ESG) concerns within the financial sector. For instance, MAS worked with the People’s Bank of China to establish the China-Singapore Green Finance Taskforce (GFTF) to enhance collaboration in green and transition finance. The aim is to focus on taxonomies, products, and technology to support the transition to a low-carbon future in the region, co-chaired by representatives from both countries.
MAS has also promoted Open Banking and API Frameworks to encourage financial institutions to adopt open banking practices enabling easier integration of financial services and encouraging innovation by third-party developers. This also empowers customers to have greater control over their financial data while fostering the development of new financial products and services by FinTech companies.
Regulators in Asia Pacific Taking a Proactive Approach
While Singapore is at the forefront of financial innovations, other regulatory and government bodies in Asia Pacific are also taking on an increasingly proactive role in nurturing innovation. This stance is being driven by a twofold objective – to accelerate economic growth through technological advancements and to ensure that innovative solutions align with regulatory requirements and safeguard consumer interests.
Recognising the potential of fintech to enhance financial services and drive economic growth, the Hong Kong Monetary Authority (HKMA) established the Fintech Facilitation Office (FFO) to facilitate communication between the fintech industry and traditional financial institutions. The central bank’s Smart Banking Initiatives, including the Faster Payment System, Open API Framework, and the Banking Made Easy initiative that reduces regulatory frictions help to enhance the efficiency and interoperability of digital payments.
The Financial Services Agency of Japan (FSA) has been actively working on creating a regulatory framework to facilitate fintech innovation, including revisions to existing laws to accommodate new technologies like blockchain. In 2020, FSA launched the Blockchain Governance Initiative Network (BGIN) to facilitate collaboration between the government, financial institutions, and the private sector to explore the potential of blockchain technology in enhancing financial services.
The Central Bank of the Philippines (Bangko Sentral ng Pilipinas – BSP) has launched an e-payments project to overcome challenges hindering electronic retail purchases, such as limited interbank transfer facilities, high bank fees, and low levels of trust among merchants and consumers. The initiative included the establishment of the National Retail Payment System, a framework for retail payment, and the introduction of automated clearing houses like PESONet and InstaPay. These efforts have increased the percentage of retail purchases made electronically from 1% to over 10% within five years, demonstrating the positive impact of effective cooperation and innovative policies in driving a shift towards a cash-lite economy.
The promotion of fintech innovation highlights a collective belief in its potential to transform finance and boost economies. As regulations adapt for technologies like blockchain and open banking, the Asia Pacific region is promoting collaboration between traditional financial institutions and emerging fintech players. This approach underscores a commitment to balance innovation with responsible oversight, ensuring that advanced financial solutions comply with regulatory standards.
