AI in Financial Services: A Library of Supervisory Guidance
Financial supervisors and international bodies have published a lot on AI over the past two years. October 2026 alone brought final texts from the FSB, MAS, the HKMA and the FCA. I keep a list of these documents for my own work. This is that list, cleaned up so others can use it.
It contains 77 documents from supervisors and international financial institutions. Legislation such as the EU AI Act is not included. Each entry gives the date, the issuer, the type of document, the sector it covers, the official title with a link to the publisher's own page and one sentence on what it does. Within each section, the newest documents come first. Last updated: 10 November 2026.
International bodies
| Date | Issuer and type | Document |
|---|---|---|
| 15 Oct 2026 | FSBReport to the G20 · All sectors | Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final reportTwelve sound practices in two groups, organisation-wide AI governance and risk management across the AI lifecycle, which the FSB describes as a practical toolkit firms can tailor to their own risk profile. |
| Sep 2026 | BIS FSIOccasional paper · All sectors | When machines attack: frontier AI cyber threats and policy responses in the financial sector (FSI Occasional Paper No 28)Examines the cyber threats that frontier AI models pose to the financial sector and the policy responses available to authorities. |
| 16 Jul 2026 | OECDPolicy paper · All sectors | Artificial intelligence and open finance: Synergies, trade-offs and policy implications (OECD AI Papers No. 61)Examines how AI and data-sharing in finance interact, finding mutually reinforcing benefits alongside greater complexity, trade-offs and amplified risks, and explores a forward-looking scenario of agentic AI in an environment of growing data-sharing. |
| 30 Jun 2026 | IMFIMF Note · All sectors | Artificial Intelligence and Cybersecurity in the Financial Sector (IMF Note 2026/005)Finds that AI is reshaping cyber risk in finance, with the main stability concern being scale effects through shared infrastructure and common service providers, and recommends controls that limit the impact of breaches and stronger international coordination. |
| 25 May 2026 | IOSCOFinal report · Securities | Supervisory Toolkit for AI Use in Capital Markets (FR/02/2026)A three-layer toolkit for supervisors covering governance and risk management, third-party risk, disclosure, and recordkeeping and reporting, from traditional machine learning to agentic AI. |
| 24 Apr 2026 | OECDReport · All sectors | Artificial Intelligence in Italian Financial MarketsFunded by the EU and carried out by the OECD in cooperation with the European Commission: 39% of the 450 respondents to the project survey use AI in everyday operations, with insurance highest at 70%, and the report sets out policy considerations aimed mainly at Italian financial authorities. |
| 26 Mar 2026 | BIS FSIFSI Insights paper · All sectors | In data we trust? Emerging policy and supervisory approaches to AI data use in financial services (FSI Insights No 73)Finds that the main concerns are data privacy, quality and security, made worse by dependence on a few large providers, and suggests authorities give clearer expectations, particularly for generative AI. |
| 27 Jan 2026 | OECDPolicy paper · All sectors | Supervision of artificial intelligence in finance: Challenges, policies and practices (OECD AI Papers No. 54)Concludes that OECD countries generally have appropriate rules for AI in finance, but that supervisors may face challenges in interpreting and applying them. |
| 24 Dec 2025 | IMFTechnical note · Securities | Regulatory Considerations Regarding Accelerated Use of AI in Securities Markets (Technical Notes and Manuals No. 2025/016)Compares how regulators and supervisors in advanced and emerging economies respond to the growing use of AI in securities markets. |
| 1 Dec 2025 | OECDPolicy paper · All sectors | Artificial intelligence in Asia's financial sector: A review of country policiesReviews the policy frameworks for AI in finance in 15 Asian jurisdictions. |
| 2025 | World BankReport to the G20 · All sectors | Artificial Intelligence for Financial Sector Supervision: An Emerging Market and Developing Economies PerspectiveBased on a survey of 27 financial sector authorities in emerging and developing economies, 17 of them in Africa, on how supervisors adopt AI and supervise its use. |
| 10 Oct 2025 | FSBReport to the G20 · All sectors | Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial SectorReviews how authorities monitor AI adoption, proposes indicators and includes a case study on dependence on, and concentration among, AI service providers. |
| 10 Oct 2025 | BISReport to the G20 · Supervisors | The use of artificial intelligence for policy purposesExamines how central banks, financial regulators and supervisory authorities use AI in their own policy work, with real-world examples, and names data governance, investment in human capital and IT infrastructure among the challenges. |
| 3 Oct 2025 | IMFWorking paper · Supervisors | AI Projects in Financial Supervisory AuthoritiesProposes a project management method for supervisors that use AI in their own work, stressing explainability, bias mitigation, governance and adequate resources. |
| 8 Sep 2025 | BIS FSIOccasional paper · All sectors | Managing explanations: how regulators can address AI explainability (FSI Occasional Paper No 24)Argues that regulators may need to accept trade-offs between explainability and model performance where risks are well managed, with extra safeguards for regulatory capital models. |
| 2 Jul 2025 | IAISApplication paper · Insurance | Application Paper on the supervision of artificial intelligenceApplies the Insurance Core Principles to AI across five topics: proportionality, governance and accountability, robustness and security, transparency and explainability, and fairness, ethics and redress. |
| 12 Jun 2025 | BIS FSIFSI Brief · Supervisors | Starting with the basics: a stocktake of gen AI applications in supervision (FSI Briefs No 26)Takes stock of how financial supervisors use generative AI in their own work. |
| 12 Mar 2025 | IOSCOConsultation report · Securities | Artificial Intelligence in Capital Markets: Use Cases, Risks, and Challenges (CR/01/2025)Maps how market participants use AI and the most cited risks: malicious use, model and data issues, concentration and third-party dependence, and human and AI interaction. |
| 31 Jan 2025 | World BankReport · Supervisors | AI for Risk-Based Supervision: Another "Nice to Have" Tool or a Game-ChangerLooks at how AI can change risk-based supervision, the main supervisory approach of the past two decades. |
| 12 Dec 2024 | BIS FSIFSI Insights paper · All sectors | Regulating AI in the financial sector: recent developments and main challenges (FSI Insights No 63)Finds that most authorities have not issued AI-specific rules, because existing frameworks already cover most of the risks. |
| 14 Nov 2024 | FSBReport to the G20 · All sectors | The Financial Stability Implications of Artificial IntelligenceIdentifies four AI-related vulnerabilities that could increase systemic risk: third-party dependence and provider concentration, market correlations, cyber risk, and model risk, data quality and governance. |
| 22 Oct 2024 | IMFGlobal Financial Stability Report · Securities | Global Financial Stability Report, October 2024, Chapter 3: Advances in Artificial Intelligence: Implications for Capital Market ActivitiesA chapter of the IMF's flagship stability report on what advances in AI mean for capital market activities. |
| 5 Sep 2024 | OECDPolicy paper · All sectors | Regulatory approaches to Artificial Intelligence in financeAnalyses regulatory approaches to AI in finance in 49 OECD and non-OECD jurisdictions, based on an OECD survey. |
European supervisors
| Date | Issuer and type | Document |
|---|---|---|
| 31 Jul 2026 | EBA, EIOPA, ESMAJoint statement · All sectors | ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (JC 2026 25)Calls for a cross-sectoral, risk-based and consistent supervisory approach so that financial entities prevent, detect and manage cyber risks from frontier AI models, linked to DORA. |
| 7 Jul 2026 | ESRBWarning · All sectors | Warning on systemic cyber risks stemming from frontier artificial intelligence models (ESRB/2026/3)Adopted on 25 June 2026, after the ESRB raised its assessment of systemic cyber risk from "elevated" to "severe"; it says authorities should reflect the risks from frontier AI models in their supervisory and oversight work, and comes with a note on frontier AI models with cyber capabilities. |
| 7 Jul 2026 | ECB Banking SupervisionLetter to banks · Banking | Addressing AI-enabled cybersecurity threats (SSM-2026-0301)Calls on significant banks to assess without delay how AI changes the cyber threat landscape and to draw up a comprehensive action plan under DORA. |
| 20 Feb 2026 | ESMARisk analysis · Securities | AI adoption and trends in securities markets: EU evidence (ESMA50-481369926-30599)ESMA's analysis of how firms in EU securities markets are adopting AI. |
| 2 Feb 2026 | EIOPAMarket survey · Insurance | Generative AI Market Survey: Outlook, Use Cases and Risk Management (EIOPA-BoS-25-679)Based on 347 insurers in 25 countries: almost two-thirds already use generative AI, mostly at proof-of-concept stage, and 64% of use cases are back-office rather than customer-facing. |
| 4 Dec 2025 | ESRBAdvisory Scientific Committee report · All sectors | Artificial intelligence and systemic riskAnalyses 11 features of AI against the main sources of systemic risk and singles out five that could amplify it (concentration and entry barriers, model uniformity, monitoring challenges, overreliance and excessive trust, and speed), calling for a measured policy response that may include adjustments to prudential regulation. |
| 21 Nov 2025 | EBAFactsheet · Banking | AI Act: implications for the EU banking and payments sectorMaps the AI Act's high-risk requirements against EU banking and payments law, finds no significant contradictions and no immediate need for new EBA guidelines. |
| 20 Nov 2025 | ECB Banking SupervisionSupervision Newsletter · Banking | AI's impact on banking: use cases for credit scoring and fraud detectionSupervisory data show a sharp rise in banks' use of AI for credit scoring and fraud detection between 2023 and 2024; in workshops with 13 banks, about half had AI policies or committees. |
| 25 Sep 2025 | EBAFactsheet · Banking | Rising application of AI in EU banking and payments sectorReports that 92% of EU banks are deploying AI, with use cases such as credit scoring, fraud detection and AML/CFT. |
| 6 Aug 2025 | EIOPAOpinion · Insurance | Opinion on Artificial Intelligence governance and risk management (EIOPA-BoS-25-360)Explains how existing insurance law (Solvency II, IDD, DORA) applies to AI systems that are not prohibited or high-risk under the AI Act, using a risk-based and proportionate approach; it sets no new requirements. |
| 25 Feb 2025 | ESMARisk analysis · Securities | Artificial intelligence in EU investment funds: adoption, strategies and portfolio exposures (ESMA50-43599798-9923)Analyses how EU investment funds use AI in their investment strategies and how exposed their portfolios are to AI. |
| 15 Jul 2024 | EIOPAFactsheet · Insurance | Factsheet on the regulatory framework applicable to AI systems in the insurance sectorA high-level overview of the rules for AI in insurance: sector legislation applies whatever the AI Act classification of a use case, and the AI Act adds requirements for high-risk systems. |
| 30 May 2024 | ESMAPublic statement · Securities | Public Statement on AI and investment services (ESMA35-335435667-5924)Reminds firms that MiFID II requirements on organisation, conduct of business and acting in the client's best interest apply when they use AI with retail clients. |
| May 2024 | ECBFinancial Stability Review · All sectors | The rise of artificial intelligence: benefits and risks for financial stabilitySets out when AI risks at individual firms can become systemic and suggests targeted regulatory initiatives if current rules prove insufficient. |
National supervisors
| Date | Issuer and type | Document |
|---|---|---|
| 4 Nov 2026 | OCC (US)Bulletin · Banking | Super Intelligence: Supervisory Framework (OCC Bulletin 2026-54)A framework of sixteen components in six pillars for examiners evaluating banks' use of AI, which the OCC now calls "super intelligence", mainly generative and agentic systems; it sets no supervisory expectations for banks, and the OCC intends to update it regularly. |
| 2 Nov 2026 | DFSA (Dubai)Survey findings · All sectors | New DFSA AI Survey 2026 findings: AI adoption among DIFC financial services firms has more than doubled since 2024The third annual survey of DFSA-authorised firms: 71% of respondents use at least one form of AI, up from 52% in 2025 and 33% in 2024; 61% of AI adopters have an AI governance framework; and 53% are exploring, testing, piloting or deploying AI agents, with 14% at deployment stage. |
| 2 Nov 2026 | HKMA (Hong Kong)Discussion paper · Banking | Discussion Paper on Agentic A.I. Governance in the Banking SectorSeeks views before 1 February 2027 on governing agentic AI in banks, centred on "intent-anchored accountability", with proposals on stop mechanisms, a "Know Your Agent" approach and a registry of material AI agents; it introduces no binding requirements. |
| 2 Nov 2026 | SFC (Hong Kong)Survey report · Securities | SFC survey highlights wider AI adoption and challenges to responsible scalingFindings of the SFC's first Large Firm AI Readiness Survey, covering 20 large firms with 78 affiliated licensed corporations: 30% already use agentic AI and 25% are piloting it, and 95% expect their AI use to accelerate over the next 12 months. |
| 30 Oct 2026 | DFSA (Dubai)Insights paper · All sectors | Frontier and agentic AI: cyber resilience in the financial sectorWritten with the Cambridge Digital Innovation and Regulation Initiative, it examines how frontier and agentic AI could change cyber resilience in finance through four dimensions (speed, reach, authority and trust); the DFSA states that it is not regulatory guidance. |
| 26 Oct 2026 | Bank of England, FCASurvey report · All sectors | Artificial intelligence in UK financial services - 2026The fourth joint survey, based on 196 firms: 86% use AI, up from 75% in 2024; 80% have AI agents deployed, mostly as decision support with humans deciding; and third parties now provide 53% of high-materiality AI systems, up from 35%. |
| 19 Oct 2026 | FCA (UK)Good and poor practice · All sectors | AI in financial services: good practice and areas for improvementExamples for firms that develop, deploy, procure or use AI, covering consumer outcomes, accountable senior managers, human review and operational resilience; the FCA says the examples do not create new requirements. |
| 15 Oct 2026 | HKMA (Hong Kong)Circular · Banking | Responsible Adoption of Artificial IntelligenceIntroduces the "ART" framework (Accountability, Resilience and Trust) for banks, with updated supervisory guidance, lessons from the GenAI Sandbox and a concept note on governing agentic AI. |
| 7 Oct 2026 | MAS (Singapore)Guidelines · All sectors | Guidelines on Artificial Intelligence Risk Management for Financial InstitutionsSupervisory expectations for all financial institutions and all forms of AI, taking effect on 7 October 2027; firms remain accountable for AI used in the services they deliver. |
| 27 Aug 2026 | APRA and ASIC (Australia)Information paper · All sectors | Resilience at Frontier AI Speed: Insights from the APRA-ASIC Industry RoundtablesSummarises nine roundtables on frontier AI held in June and July 2026 with more than 380 entities; the key message is that the industry needs to move from awareness of frontier AI risk to action, with themes including cyber fundamentals, governance and escalation, and shared dependencies. |
| 24 Aug 2026 | Bank of JapanFinancial System Report Annex · Banking | Use and Risk Management of Generative AI by Japanese Financial Institutions: Based on the Results of FY2026 SurveyThe Bank's third survey since fiscal year 2024, covering 150 financial institutions: over 90% are using or trialling generative AI, and its use is expanding from general administrative tasks to core operations that use customer data. |
| 6 Jul 2026 | FCA (UK)Review · All sectors | AI and the future of retail financial services (The Mills Review)Sets out how AI could reshape retail financial services by 2030 and beyond and makes seven priority recommendations to the FCA, among them adapting the regulatory perimeter, enabling the foundations for agentic finance and building an AI-enabled supervisory model. |
| Jul 2026 | OSFI (Canada)Technology risk bulletin · Banking, insurance | Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational ResilienceDescribes sound practices for managing the risks of generative and agentic AI, covering governance, data integrity, software change, AI agents' access, cyber operations and third-party resilience; OSFI states that its bulletins are not regulatory expectations. |
| 24 Jun 2026 | BSP (Philippines)Guidance paper · Banking | Governance Principles for Artificial Intelligence (AI) in Financial Services (Memorandum No. M-2026-031)Sets out the "STARS" principles (sustainability, transparency, accountability, responsibility and security) to guide BSP-supervised institutions in building their own AI governance frameworks; the principles are non-binding and compliance is voluntary. |
| 18 Jun 2026 | NFRA (China)Guiding opinions · Banking, insurance | Guiding Opinions on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance IndustriesSets out 32 measures in seven areas, from governance and data to computing infrastructure and risk management, including category-based and tiered risk management and human oversight and intervention at critical stages of high-risk applications. |
| 18 Jun 2026 | FSC (South Korea)Guidelines · All sectors | FSC Holds Meeting on AX with Financial Companies and Introduces Updates to AI Guidelines in Financial SectorIntroduces the updated, self-regulatory AI guidelines for all financial companies, including fintechs, in effect from 22 June 2026, with seven principles: governance, legitimacy, AI as a means of assistance, credibility, financial stability, good faith and security. |
| 4 Jun 2026 | DFSA (Dubai)Dear SEO letter · All sectors | DFSA regulatory expectations on artificial intelligence risk management in the DIFCSets out how the DFSA's existing rules apply to authorised firms' use of AI in four areas (governance and accountability, risk management, operational risk, and third-party arrangements and outsourcing); the DFSA says it does not propose new or amended rules at this stage. |
| 15 May 2026 | Bank of England, FCA, HM TreasuryJoint statement · All sectors | Joint statement on Frontier AI models and cyber resilienceA joint statement by the UK authorities on the cyber resilience risks that frontier AI models create for the financial sector. |
| 30 Apr 2026 | APRA (Australia)Letter to industry · All sectors | APRA Letter to Industry on Artificial Intelligence (AI)Expects board AI literacy, an inventory of AI use, human oversight of high-risk decisions, oversight of suppliers and tested contingency plans for critical AI providers. |
| 13 Apr 2026 | AFM (Netherlands)Report · Securities | AI in Capital Markets: Balancing Innovation and IntegrityAn exploratory report on how AI could affect market integrity across the trading lifecycle (pre-trade, execution and post-trade); the risks it names include self-learning models that produce manipulative trading behaviour even if unintended, poisoned data and models that work as black boxes. |
| 7 Apr 2026 | AFM (Netherlands)Report · Securities | AI in the Dutch asset management sector: increasing use and growing risksBased on a survey of 323 institutions: 53% use AI or plan to within a year, mainly for data analysis and information processing, while a quarter have no policy on AI use and two-thirds have none for generative AI. |
| Apr 2026 | OSFI (Canada)Technology risk bulletin · Banking, insurance | Frontier Artificial Intelligence: Implications for Technology, Cyber Security, and Operational ResilienceRaises awareness of the risks that frontier AI models pose to technology, cyber security and operational resilience, and describes sound practices on governance, faster patching, detection and response, and third-party resilience. |
| 3 Mar 2026 | FSA (Japan)Discussion paper · All sectors | AI Discussion Paper: Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Version 1.1)Discussion points on the sound use of AI in finance, first published in March 2025; version 1.1 adds the results of the FSA AI Public-Private Forum. |
| Mar 2026 | AMF (Québec)Guideline · Banking, insurance | Guideline for the Use of Artificial IntelligenceSets expectations on institution-wide governance and risk management, risk-based classification of AI systems, their lifecycle and the fair treatment of clients, supplementing the AMF's Model Risk Management Guideline; it takes effect on 1 May 2027. |
| 19 Feb 2026 | US TreasuryLexicon and framework · All sectors | Treasury Releases Two New Resources to Guide AI Use in the Financial SectorAnnounces an Artificial Intelligence Lexicon of common definitions and the Financial Services AI Risk Management Framework (FS AI RMF), which adapts the NIST AI Risk Management Framework to the financial sector. |
| 11 Feb 2026 | CBUAE (UAE)Guidance note · Banking, insurance | Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.Principles for licensed financial institutions, including insurers, on AI that affects consumers: governance and board accountability, fairness, transparency, data, continuous monitoring and human oversight, including an inventory of AI models and the ability to stop any AI system through human intervention. |
| 21 Jan 2026 | DNB (Netherlands)Survey findings · Insurance | Verzekeraars en AI: DNB deelt nieuwste inzichten (in Dutch)Findings of DNB's 2025 study of insurers' use of AI: nearly 80% of large and medium-sized insurers had at least one AI application in regular processes at the start of 2025, against 21% of small insurers, and just over 70% say they take EIOPA's AI principles into account in their governance. |
| 18 Dec 2025 | BaFin (Germany)Non-binding guidance · Banking, insurance | Guidance on ICT Risks in the Use of Artificial Intelligence at Financial EntitiesHelps banks and insurers apply DORA's ICT and third-party risk rules to AI across the whole AI lifecycle. English version published 30 January 2026. |
| 24 Nov 2025 | FSCA and Prudential Authority (South Africa)Report · All sectors | Artificial Intelligence in the South African Financial SectorThe first joint report by South Africa's conduct and prudential supervisors on the use of AI in the financial sector. |
| 11 Sep 2025 | OSFI (Canada)Guideline · Banking, insurance | Guideline E-23: Model Risk ManagementPrinciples-based model risk guideline whose definition of a model includes AI and machine learning, with expectations on explainability, data bias and monitoring; effective 1 May 2027. |
| 13 Aug 2025 | RBI (India)Committee report · All sectors | Report of the Committee to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial SectorSets out seven principles ("Sutras") and 26 recommendations across six pillars. |
| 18 Dec 2024 | FINMA (Switzerland)Guidance · All sectors | Governance and risk management when using artificial intelligence (FINMA Guidance 08/2024)Names the model, data, IT and cyber, third-party, legal and reputational risks of AI and asks institutions to identify, manage and monitor them, drawing on measures FINMA has seen in supervision. |
| 21 Nov 2024 | Bank of England, FCASurvey report · All sectors | Artificial intelligence in UK financial services - 2024Survey of how firms in UK financial services use AI. |
| 12 Nov 2024 | SFC (Hong Kong)Circular · Securities | Circular to licensed corporations: Use of generative AI language models (24EC55)Sets expectations on senior management accountability, model risk, cybersecurity and data, and third-party providers, with extra safeguards for high-risk uses such as investment advice. |
| 29 Oct 2024 | ASIC (Australia)Report · All sectors | Beware the gap: Governance arrangements in the face of AI innovation (REP 798)Review of AI use and governance at 23 financial services and credit licensees. |
| 19 Aug 2024 | HKMA (Hong Kong)Circular · Banking | Consumer Protection in respect of Use of Generative Artificial IntelligenceExpects banks to extend the HKMA's 2019 big data and AI principles to customer-facing generative AI. |
| 11 Jul 2024 | NYDFS (New York)Insurance circular letter · Insurance | Insurance Circular Letter No. 7: Use of AI Systems in Insurance UnderwritingExpects insurers to govern their use of AI and external consumer data in underwriting and pricing, test for unfair discrimination, oversee vendors and disclose their use to consumers. |
| 27 Jun 2024 | FINRA (US)Regulatory notice · Securities | FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Regulatory Notice 24-09)Reminds broker-dealers that FINRA's technology-neutral rules and the securities laws apply to their use of generative AI; it creates no new requirements. |
| 9 Apr 2024 | DNB and AFM (Netherlands)Report · All sectors | The impact of AI on the financial sector and supervisionSets out criteria and focus areas for supervising AI and confirms that existing rules apply in full. |
| 4 Dec 2023 | NAIC (US)Model bulletin · Insurance | Model Bulletin on the Use of Artificial Intelligence Systems by InsurersExpects insurers to govern AI through a written AI systems programme and confirms that AI-supported decisions must comply with existing insurance law; states adopt it one by one (adoption map). |
Missing something, or want to go deeper?
Is a document missing, have you spotted a mistake, or do you have an idea that would make this library more useful? Let me know and I will update it.
And if you want to dig deeper into what these expectations mean for your firm or authority, I am happy to talk.
Andres Lehtmets helps financial firms and supervisors make new technology and new rules work together. Former Senior InsurTech Expert at EIOPA.