Definition
AI in Finance is the use of machine learning — and now language models — to make or support financial decisions: approving a loan, blocking a card transaction, escalating a payment for money-laundering review, scheduling a large order into the market, reading a filing. It is the oldest continuously deployed machine learning application in industry: FICO's Falcon has scored card transactions with a neural network at issuing banks since 1992, two decades before deep learning became fashionable anywhere else.
What separates finance from every other AI domain is that regulation shapes the architecture. Elsewhere you ship the most accurate model you can build; in a supervised institution you ship the most accurate model you can defend — one whose individual decisions attribute to specific inputs, whose development is documented, whose drift is monitored, and whose failure is a regulatory event rather than a bad quarter.
The cost of ignoring that is concrete: an underwriting network that beats the incumbent scorecard on AUC but cannot produce the specific principal reasons a lender owes a rejected applicant never ships, because accuracy was never the binding constraint.
How It Works
Start from the decision rather than the model: in finance the decision determines what you are permitted to build.
Credit. A US lender that denies an application must say why in specific terms, under the Equal Credit Opportunity Act and its Regulation B; the official commentary treats more than four principal reasons as unlikely to help the applicant, so the notice is a short ranked list of causes. The CFPB closed the obvious escape hatch in Circular 2022-03: algorithmic complexity is not a defence for failing to give reasons. Every decision must therefore answer "which few inputs moved this applicant across the line, and in which direction". That is why gradient boosting over bureau features, with per-decision attributions, has outlived a decade of deep learning hype in underwriting, and why explainable AI is compliance infrastructure here rather than a research interest.
Governance. Any model driving decisions sits inside a model risk framework. The US template was the Federal Reserve and OCC's 2011 guidance SR 11-7, superseded on 17 April 2026 by SR 26-2, which keeps the same core disciplines while scaling them to the institution's risk profile: independent validation before deployment, documentation another team could rebuild the model from, an inventory of every model in use, and ongoing monitoring afterwards. That is the honest answer to why bank AI is slow — the training run is the cheap part. See AI governance for how this sits alongside the newer AI-specific regimes.
Fraud, and late labels. A card authorisation is scored while the terminal waits, so the budget is milliseconds. Supervision is the awkward part: Regulation E gives a consumer 60 days from the periodic statement to report an unauthorised electronic transfer, and network dispute windows run longer, so a transaction made today may not be confirmed as fraud for two or three months. Retrain monthly on confirmed labels and your freshest trustworthy data describes a fraud landscape already a quarter old, while the attacker rotates tactics in weeks. Proxy labels, unsupervised anomaly detection and fast rule overlays bridge that gap; none of them closes it.
Real-World Applications
Consumer underwriting. The CFPB's 2019 update on its first no-action letter, covering Upstart's machine learning underwriting model, reported that the tested model approved 27% more applicants than the lender's traditional model at 16% lower average APRs. What changes is who gets a loan at all — thin-file applicants a scorecard cannot rank. The comparison was the firm's own against its own benchmark, exactly the claim independent validation exists to interrogate.
Card fraud. Falcon-class systems moved the decision from "call the customer tomorrow" to "decline this authorisation now". The error costs are lopsided in an unusual way: a false negative costs the fraud amount, a false positive costs a declined customer, a support call and sometimes the relationship.
Anti-money-laundering monitoring. Here the arithmetic is most revealing and least often stated. Suppose a bank clears 10 million transactions a month, 1 in 10,000 of them genuinely suspicious — 1,000 cases. A rule set catching 90% of those while firing on 1% of the 9,999,000 clean transactions produces 900 true alerts and 99,990 false ones: a queue of 100,890 items in which fewer than 1 in 100 is real. At 15 minutes of review each that is about 25,000 analyst-hours a month, roughly 155 full-time reviewers, nearly all of them spending the day closing clean cases. The value of machine learning here is almost never new detection; it is ranking an alert stream that already exists so a smaller fraction has to be read. Google Cloud's AML AI, launched in 2023 with HSBC as its named customer, is sold on exactly that trade — the vendor reports a two- to fourfold rise in true positives alongside a large cut in alert volume.
Trading and execution. Predicting price direction is rare, hard and mostly not what machine learning does in production. Execution is the opposite: slicing a parent order across venues and time to minimise implementation shortfall yields millions of labelled outcomes a day against a measurable objective, and it works. Surveillance is the third leg — Nasdaq's SMARTS platform is used by exchanges and regulators to flag spoofing and layering patterns no human tape-watcher would see.
Document work. This is where large language models actually landed in banks, almost always behind a human reviewer. JPMorgan's COiN contract-intelligence system, reported in 2017, extracted terms from commercial loan agreements in a workflow the bank put at roughly 360,000 hours of lawyer time a year. Morgan Stanley deployed an OpenAI-based assistant over its internal research library for advisers from 2023, and Bloomberg published BloombergGPT the same year — 50 billion parameters trained on a 363-billion-token financial corpus, the clearest public case of domain pretraining in the sector.
Key Concepts
- Scope of validation: the supervisory guidance counts data, implementation and use as part of what was signed off, so an approved model pointed at a new product goes through the process again.
- Adverse action reason codes: the ranked causes of a denial; a scoring method that cannot emit them is unusable in consumer credit whatever its accuracy.
- Label maturity: days for chargebacks, months for disputes, years for loan defaults — which is why credit models are tested across whole economic cycles.
- Champion/challenger: running a candidate in shadow against the incumbent on live traffic, the standard way a bank buys evidence without taking risk.
Challenges
The fairness problem here is not abstract. ECOA prohibits discrimination on protected characteristics, and a model that never sees race or sex can still learn a proxy for it through ZIP code, employer or device — producing disparate impact that shows up in fair-lending testing rather than in the training loss. The mitigations are correspondingly specific: proxy-variable screens, disparate-impact analysis on approval rates and pricing, and a documented search for less discriminatory alternatives before launch. Generic statements about bias in AI do not survive a fair-lending examiner; test results do.
Finance also has an adversary most AI domains lack. Fraudsters, launderers and manipulative traders probe the model deliberately and adapt to whatever gets through, so deployment itself changes the distribution the model was trained on. Add non-stationarity — a credit model trained entirely inside a benign part of the cycle has never seen the conditions that will test it — and stability matters as much as accuracy. Concentration compounds both: when many institutions score risk with the same bureaus, vendors and platforms, a shared error is systemic rather than private.
Future Trends
The regulatory perimeter is widening, but on a clock that has already slipped. The EU AI Act (Regulation (EU) 2024/1689) lists creditworthiness assessment of natural persons, plus risk assessment and pricing in life and health insurance, among the high-risk uses in Annex III — which brings conformity assessment, documentation and human oversight duties to systems many firms govern only by internal policy today. Those high-risk obligations are forthcoming rather than in force: the Digital Omnibus agreed in May 2026 postponed them for stand-alone Annex III systems to 2 December 2027, from the earlier 2 August 2026, so the work of building the file an examiner will demand is due before that date rather than done. The Article 50 transparency duties — telling a customer they are dealing with an AI system — sit on a separate track and were not postponed. Overstatement carries a price too, as the SEC's March 2024 settled charges against two investment advisers for misrepresenting their use of AI showed.
The harder question is how those frameworks stretch to generative systems. Classical model validation assumes a stable specification, a measurable error rate and a reproducible output; an assistant that summarises filings has none of them in the same form. So the pattern actually taking hold is narrow — retrieval-augmented generation over a controlled document set, citations back to source, a human who signs the output. Expect that shape to spread through KYC onboarding, credit memo drafting and regulatory reporting well before anything autonomous touches a customer decision.