Banks should stop treating AI as a standalone technology challenge and instead strengthen resilience across the ecosystems that support it, according to Rayan Bhattacharya, who argues governance, accountability, and operational preparedness will ultimatel
Artificial intelligence is
transforming financial services at extraordinary speed, but the industry's
greatest challenge may not be managing AI itself. Instead, success will depend
on whether institutions can strengthen the resilience of the increasingly
complex ecosystems that support AI-enabled decision making.
That is the view of Rayan
Bhattacharya, Head of Global Resilience Frameworks & Assurance and UK Lead
at Santander Corporate and Investment Banking, who believes firms should resist
the temptation to create entirely new risk disciplines around AI.
Speaking ahead of CeFPro’s Next Gen
OpRisk Europe event being staged in London on October 13 and 14, he instead argues
that they should recognize how the technology intensifies risks they already
understand and adapt existing governance accordingly.
"Rather than treating AI as a
novel risk type, we view it as a strategic 'meta-risk' that amplifies the
speed, scale, and interconnectedness of existing risks," Bhattacharya
explains.
"AI increases the surface area
and velocity of risks we already manage, including data quality, technology and
cyber, third-party, model, and operational resilience risks."
His assessment reflects a growing
realization across financial services that AI is less a separate category of
risk than a force multiplier.
Existing control frameworks remain
relevant, but they must evolve to operate in an environment where decisions are
generated faster, dependencies are more interconnected, and failures can spread
more rapidly across organizations.
"The challenge is therefore less
about creating entirely new frameworks and more about adapting existing ones to
a faster-moving environment," he says.
One of the most pressing concerns
involves organizations' growing dependence on external AI providers.
As banks increasingly integrate
third-party AI capabilities into critical business activities, they often
relinquish visibility into how those systems operate while remaining fully
accountable for the outcomes they produce.
Bhattacharya argues this creates a
difficult balance between innovation and oversight. Vendor concentration,
significant switching costs, and limited influence over providers' governance
structures all increase operational risk.
Financial institutions may outsource
technological capability, but responsibility for decisions cannot be outsourced
alongside it.
"The key challenge is that firms
increasingly outsource capability while retaining accountability for
outputs," he says.
While stronger third-party risk
management frameworks, accountability regimes, and regulatory expectations will
continue to mature, Bhattacharya believes the most effective immediate defense
remains surprisingly human.
"While enhanced TPRM,
accountability regimes, and regulation may help over time, the most effective
near-term control for both third-party and shadow AI remains firm-wide training
that reduces human failure," he says. "This should be reinforced by
meaningful consequence-management mechanisms that promote positive
behaviours."
Governance presents another
significant challenge as AI adoption accelerates.
Rather than focusing solely on the
quality of data feeding AI systems, Bhattacharya believes organizations should
concentrate on understanding how AI-generated outputs influence important
business decisions.
"The biggest immediate challenge
for large banks is figuring out how to best internally govern AI use cases and
outputs of AI models, which are provided largely by a small number of third
parties over whom banks have limited visibility," he explains.
