Fintech Industry Association holds first 'AI financial regulation' forum
Only 10% of financial firms develop their own AI models
33% fully dependent on outside vendors for cloud and other core components
46% unable to fully track their own AI usage
Experts call for shift to operations-based supervision of AI risk
Financial firms are rapidly expanding their use of AI — integrating it into credit scoring systems to assess companies' future value using advanced data analytics, and deploying fraud detection systems that analyze historical patterns to prevent financial crime in real time.
Yet despite AI becoming a core pillar of finance, only about 10% of financial firms have built their own AI capabilities in-house, leaving the sector heavily dependent on outside vendors. As a result, nearly half of all financial firms cannot fully account for how AI is being used within their own organizations, prompting calls to urgently establish a regulatory framework to address the gap.
At a forum titled "The Future Direction of AI Financial Regulation," held Monday at the National Assembly Members' Office Building by the Korea Fintech Industry Association, Chae Sang-mi, a professor at Ewha Womans University's Department of Business Administration, said the operational infrastructure needed to link AI usage tracking, supply chain management and incident sharing in financial AI "still needs improvement."
Chae identified heavy reliance on outside vendors as the most pressing issue. According to a survey on AI adoption in the domestic and international financial sector that she presented, only 10% of financial firms that have adopted AI services have developed their own models. Most depend on external vendors, and 33% of those firms rely entirely on outside providers for all core components — including cloud infrastructure, AI models, and training and operational data.
That dependence on third-party supply chains has left 46% of financial firms unable to fully track exactly where and how AI is being used within their own organizations, Chae said. "When financial regulators supervise financial firms going forward, they need to clearly understand not just whether AI is being used, but where the models, data and services are sourced from, and who holds authority to modify the models and to what extent," she said.
Chae identified five key gaps that currently need to be addressed: a lack of standardized criteria for inventorying AI usage and assessing its importance; insufficient audit standards for model and data lineage, change history and operational logs; inadequate management of concentration risk in external model, cloud and data supply chains; legal uncertainty that impedes the sharing of deepfake and voice-phishing signals; and unclear allocation of liability when agentic AI executes transactions or contracts.
To address these issues, Chae said AI risk management at financial firms should shift from a system centered on pre-approval documentation to one based on operational evidence. Rather than requiring financial firms to submit source code, regulators should require firms to demonstrate that their models are operating safely, she said. She added that financial firms should be required to register their AI usage and periodically update importance assessments, and that when significant model changes occur, reporting, verification and consumer notification requirements should be applied on a tiered basis according to risk rating.
The Financial Services Commission and the Financial Supervisory Service plan to implement "AI Financial Guidelines" in the second half of this year. Kang Hyun-jung, an attorney at Kim & Chang, described the guidelines as "recommendatory guidance based on best practices and sector-specific self-regulation, serving as a norm for risk management direction." She particularly emphasized the importance of establishing AI decision-making bodies and dedicated organizational units as called for in the guidelines. Under the guidelines, a financial firm's internal AI decision-making body would deliberate and resolve key matters — including the enactment and revision of AI-related internal rules and the approval of high-risk, high-impact AI services — and formulate risk management policies and report to the board. Firms would also be required to establish an independent dedicated risk management unit to oversee all aspects of risk management and monitor compliance with relevant legal obligations.
won@heraldcorp.com
