Financial Services risk:
Unintended consequences of innovation and new technologies

The lines between financial institutions and technology companies are blurring, and in some cases even merging. Technology companies are moving into financial services – the likes of Apple, Google and Amazon are offering or developing banking and other financial services, while Facebook is launching its own virtual currency, Libra. The FinTech sector continues its rapid ascent, while incumbents are partnering with technology firms to enhance their offerings and improve efficiency.

Cloud computing and Artificial Intelligence (AI)-powered robotics are being used to automate processes, carry out analysis and make decisions, while connected devices and biometrics can collect a wealth of information on a customer’s health or behavior. The proliferation of new technologies in financial institutions, in particular AI, robotics and biometrics, will have a profound effect on the sector’s risk profile. On the one-hand, new technology applications can be a positive for risk management, such as where they improve security, compliance controls, or encourage customers to improve their risks, but they also can bring potentially new or little understood exposures, according to Shanil Williams, Global Head of Financial Lines at AGCS.

Every time a new technology is developed or applied, it can creates risks and unintended consequences, adds Marek Stanislawski, Global Cyber Underwriting Lead at AGCS: “With each new technology, we move the goalposts and potentially increase the attack surface for cyber criminals. For example, there are a lot of potential benefits to digital and virtual currencies, but they also can help fuel cybercrime, extortion and ransomware.”

The rollout of 5G technology, in particular, has the potential to change the risk landscape. “This is not just about new technologies, like AI and machine learning,” says Thomas Kang, Head of Cyber, Tech and Media, North America at AGCS. “With 5G, there will be an explosion of data availability, which can power AI, but the implications are not yet well understood, and there will be new risks from a policy and regulatory perspective. We are approaching a threshold as more and more connected devices create huge amounts of data on individuals’ health, behavior and preferences. Such data creates opportunities for financial institutions, but if its use is not always well thought through and tested, it may fall foul of privacy statutes, like the EU’s General Data Protection Regulations.”

Increasing use of technology and data needs to considered against the backdrop of developing data protection and privacy regulations. “Technology is evolving light years ahead of policy and regulation. Regulations in this area are continually changing – for example, notification and privacy laws are being updated in the US and many other countries – but we probably do not yet have the extent of regulation that we will need, especially in specific areas like biometrics or ‘know your customer’ rules [for cryptocurrencies],” says Kang. The applications of new technologies such as AI, biometrics and virtual currencies will likely raise new risks and liabilities in future, in large part from compliance and regulation.

With AI, we already have seen the risks of unconscious bias, resulting in regulatory investigations in the US related to the use of algorithms for credit scoring. There have also been a number of lawsuits in the US related to the collection and use of biometric data.

The growing acceptance of digital or cryptocurrencies will ultimately present operational and regulatory risks for financial intuitions. The value of bitcoin has surged during the pandemic, up over 100% in the first three months of 2021, with the total cryptocurrency market valued at almost $1.5trn [1]. According to Deutsche Bank [2], bitcoin is now the third-largest currency in terms of the total value in circulation. Digital currencies are also gradually making their way into the real world. In February, Tesla announced that it had purchased $1.5bn worth of bitcoin, and that it would start accepting it as a payment method for its vehicles. Last year PayPal announced it would allow customers to buy, sell and hold virtual assets, including bitcoin. The worlds of digital currencies and traditional financing are beginning to merge, according to Williams.

“Digital currencies are emerging as a new asset class, and we are starting to see traditional investors and banks get more involved. However, cryptocurrencies are surrounded by uncertainty, with questions around potential asset bubbles and regulation, as well as concerns for potential money laundering and the risks of theft or loss of access. There are even potential environmental, social and governance (ESG) issues, as ‘mining’ or creating cryptocurrencies uses large amounts of energy,” says Williams.

Companies involved in the trading, mining, processing and storage of digital assets will increasingly face a number of potential liability and regulatory exposures. Central banks and financial regulators are turning their attention to digital currencies, which are seen as an opportunity, as well as a threat. India, for example, recently announced it would require companies to disclose their crypto holdings to the government as part of their financial statements. “Financial institutions that facilitate the trading and processing of virtual assets or take custody of cryptocurrencies will face the prospect of potential third party liabilities,” says Williams. “There is a lot of debate around cryptocurrencies in the market, and there have already been losses in the sector from theft, fraud and lost coins and keys.”

Cryptocurrencies also come with compliance risk, in particular with respect to anti-money laundering requirements and sanctions rules that prohibit facilitating payments to terrorist groups, criminals or sanctioned individuals or organizations. “As banks dive deeper into crypto and digital currencies, ‘know your customer’ processes become even more important,” says Kang.