Decision-making in modern financial services – Using tech while staying within the lines

Notably in Australia, the uptake of cloud AI has been a particular area of focus for regulators, in recognition of this risk profile. The fundamental risk management and due diligence questions, as articulated by APRA Executive Director of Cross-industry Risk, Chris Gower, remain broadly the same and include: 

• Are appropriate cybersecurity controls in place – is there good cyber hygiene?  
• Has the entity considered AI risk introduced by third parties? 
• Who has access to critical information and systems?

While using the public cloud offers potential benefits including scalability, reliance on third-party providers of cloud platforms to manage critical data poses a range of risks associated with the reduced transparency for both firms and their clients. There may be limited oversight of the third party's internal operations, security, and system weaknesses.

In Singapore, the MAS recognises that regulated firms may rely on third-party AI but stresses the need for firms to comply with existing regulatory expectations on managing the risks from outsourcing and use of third party services, and highlights key areas for firms to consider such as transparency, fairness, supply chain assessments, concentration risks and complexity.  

The risks associated with Cloud AI continue to attract the attention of regulators. In November 2025, the Australian Securities and Investments Commission (ASIC) published its licensing and registration update report which stressed the potential harms associated with the use of AI by financial service providers – its impact on decision-making, including bias and discrimination; provision of false information; exploitation of behavioural biases and consumer vulnerabilities; and erosion of consumer protection and trust. Following the release of ASIC detailed report analysing 624 AI use cases in banking, credit, insurance and financial advice,  both ASIC and APRA continue to urge firms to ensure their governance keeps pace with the accelerating adoption of AI, notably by filling in gaps in arrangements for managing AI-specific risks such as data quality and specific contestability arrangements for AI, and also to identify potential consumer harm. As indicated in its Corporate Plan, in 2026, APRA will be assessing the appropriateness of risk management and oversight practices of a group of larger firms to support reasonable adoption of AI across the financial system.

Concerns about the centralisation of sensitive data are also at the front of mind for governments, regulators and financial services firms, not least following news of a breach impacting the U.S. Office of the Comptroller of the Currency (OCC) in which hackers accessed supervisory systems leaving confidential bank information exposed.  In Australia, APRA will continue to assess entities' compliance with its new prudential standard for operational risk management which covers risks associated with AI and cybersecurity as well as business continuity risks more broadly. The UK government's Guidance on multi-region cloud and software-as-a-service will also inform the approach of the UK regulators.

The legislative landscape is also shifting in ways that will impact firms' decision-making. In Australia, for example, the amended Privacy Act 1988 (Cth) – which mandates the 'open and transparent management of personal information' – is imposing new obligations on regulated Australian entities to make disclosure about how personal information is used in automated decision-making that could reasonably be expected to significantly affect the rights or interests of an individual.

The implementation of cloud AI requires firms, wherever they are based, to make an informed and sensitive decision considering the need to balance innovation and efficiency with consumer protection and regulatory compliance. 

Quantum computing

Quantum computing – once realised – will deliver exponentially faster computing and increased capacity for complexity. 

As quantum utility gets closer, policymakers are beginning to turn their minds seriously to this technology. For example, the UK government, in its National Quantum Strategy said that it aims to position the UK, over the next decade, as a 'quantum superpower'. A UK Financial Conduct Authority (FCA) October 2025 research paper identified the use of quantum computing within financial services as a UK growth opportunity, describing its potential to 'transform critical operations, create competitive advantage, and help position the UK as a world-leading hub for financial innovation'.

For decision-makers in financial services firms, this vastly increased speed over complex data presents both opportunities and risks. Last year's FSR Outlook article focused on the risks that quantum utility pose for existing cryptographical solutions and the need for financial services firms to focus on the work necessary for migration to quantum-safe cryptography as an immediate priority. The G7 Expert Group, co-chaired by the Bank of England and the U.S. Treasury, released a roadmap for transitioning to post-quantum cryptography in the financial sector in January of this year, underscoring the importance of this risk for policymakers and regulators.

As with other new technologies, decision-makers in firms must be mindful that quantum computing may amplify existing dynamics (for example, data governance and security, design of financial models, market conduct, and consumer disputes) in novel ways. Explainability is likely to prove a particular challenge in respect of quantum use cases.