Treasury Reports on State of AI-Cyber Security Risks in Financial Services
The Treasury Department ("Treasury") reported on the state of AI-cybersecurity risk and recommended that financial institutions broaden risk management and cybersecurity practices, consider greater integration of AI solutions into cybersecurity practices and collaborate on threat information sharing.
Pursuant to Executive Order 14110 ("Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence"), Treasury produced its report, titled "Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector." In the report, Treasury outlined next steps to address AI-related operational risk, cybersecurity and fraud challenges. The steps included, among others:
- Addressing the growing capability gap. Treasury warned that there is a widening gap between large and small financial institutions when it comes to their ability to use AI systems. The Department acknowledged that large institutions are developing their own AI systems, while smaller institutions may be unable to do so because they lack the internal data resources required to train the large models. Additionally, Treasury highlighted that financial institutions that have already migrated to the cloud may have an advantage when it comes to leveraging AI systems in a safe and secure manner.
- Narrowing the fraud data divide. Treasury said that the "capability gap" between large and small institutions is particularly significant in the area of fraud prevention, where there is insufficient data sharing among firms. Treasury warned that as financial institutions work with their internal data to develop these models, large institutions hold a significant advantage because they have far more historical data. Smaller institutions generally lack sufficient internal data and expertise to build their own anti-fraud AI models.
- Regulatory coordination. Treasury raised concerns about regulatory fragmentation, as different financial-sector regulators at the state and federal levels and internationally, consider regulations for AI.
Related Articles
-
SEC Chair Gary Gensler warned investment advisers, broker-dealers and public companies that misstating their use of AI in investment strategies or company operations may violate securities laws.
-
CFTC Commissioner Kristin N. Johnson warned against the "potential perils of integrating innovation without proper guardrails."
-
On March 13, the EU Parliament adopted the Artificial Intelligence Act. The AI Act is the EU’s first comprehensive legislation setting rules regulating artificial intelligence on an EU-wide basis. It will impose new and significant obligations on those developers, distributors and users of AI systems that affect people in the EU.
-
FINRA executives highlighted risks firms face with generative AI and large language models and how FINRA is approaching these challenges.
-
SEC Chair Gary Gensler warned of broad challenges and increased risk resulting from the use of AI models in the financial sector. He highlighted the need to update regulatory guidelines, establish strict oversight mechanisms and enhance disclosure requirements for companies utilizing AI.