FSB AI Governance Banking: Financial Stability Board AI Systemic Risk, Concentration Risk, and G20 AI Framework

AI concentration in a handful of cloud providers, correlated model behavior that amplifies a credit cycle, and opacity that blinds supervisors and institutions alike — these are the FSB's three systemic AI risk channels, and they're board questions, not just compliance items.

The Financial Stability Board's October 2024 report, "The Financial Stability Implications of Artificial Intelligence," is the most detailed cross-jurisdictional assessment of AI deployment in banking that any international body has produced. Drawing on a survey of member regulators and institutions across G20 jurisdictions, it set the agenda that national and supranational AI governance frameworks have been building toward since.

The FSB's lens is macro-prudential, which is a genuinely different question from the one institutional frameworks like SR 11-7 or HKMA's CR-G-14 ask. Those frameworks ask whether one institution's AI is well-governed. The FSB asks whether AI, collectively, makes the financial system more fragile — a question that matters to bank boards for two reasons: it shapes what national supervisors who sit on FSB (RBI included) prioritize in examination, and it's the macro context a risk committee needs before it can honestly answer "what's our AI risk profile" rather than just "is our AI model validated."

Concentration Risk: What Happens If Your Three AI Vendors Are Really One Vendor's Infrastructure

The FSB's most immediate flagged risk is structural, not behavioral: most of the financial sector's AI stack runs through a small number of cloud and AI platform providers — AWS, Google Cloud, Microsoft Azure for compute, and a handful of foundation model providers on top. A disruption at any one of them — technical failure, security incident, regulatory action, geopolitical event — could hit a large share of the sector's AI-dependent operations simultaneously. The FSB's recommendation was straightforward: regulators should require institutions to assess and disclose AI concentration risk, and build macro-level monitoring of AI infrastructure dependency across the system.

The EU's response is already visible in DORA's critical third-party provider framework, which brought systemic oversight to exactly the infrastructure layer the FSB flagged. The board question this implies is simple and uncomfortable: if your three "different" AI vendors all run on the same underlying hyperscaler, do you actually have vendor diversity, or three contracts pointed at one point of failure?

Herding: When Every Bank's Model Has the Same Blind Spot

The FSB's second channel is correlated behavior — AI systems trained on similar data, using similar features, producing similar outputs in response to the same signal. In credit, that means many banks' models could tighten lending simultaneously in response to the same economic indicator, amplifying a contraction rather than each bank making an independent judgment. In trading, algorithmic strategies responding to the same signals can amplify volatility rather than dampen it. In AML, the risk is sharper than it looks: if most banks run the same vendor's transaction monitoring model, they share the same detection blind spots — a typology the model misses at one institution is missed everywhere that model runs, which is a systemic detection gap, not an isolated institutional failure.

The FSB's recommendation here was model diversity as a deliberate risk mitigation, not an accident of procurement. The board question: does a single-vendor AI strategy save cost at the price of correlated blind spots across the whole portfolio — and has anyone actually quantified that trade-off, or just assumed vendor consolidation is strictly good for efficiency?

Opacity: You Can't Monitor Systemic Risk in a Model You Can't Read

The FSB's third channel is the hardest to fix with a policy memo: when AI models aren't interpretable, neither the institution nor the supervisor can actually observe whether the model is amplifying systemic risk. An opaque model doesn't just create institutional governance risk — it blinds the exact monitoring function the FSB is trying to protect. The FSB's recommendation was to favor interpretable AI where feasible, deploy explainability tooling where opacity is unavoidable, and ensure supervisors retain genuine access to examine model behavior, not just its outputs.

This reframes explainability as something other than a compliance checkbox: it's a systemic risk mitigation measure in its own right. The board question: if your supervisor asked to see exactly how your highest-exposure AI model reached its last ten decisions, could you produce that today, or would you be building the tooling to answer the question after it was asked?

Regulatory Coordination: Why Fragmentation Is Its Own Risk

The FSB's coordination recommendation addresses a risk regulators create for themselves: incompatible AI governance requirements across jurisdictions that add compliance complexity without adding financial stability. The FSB's ongoing coordination work aims at a reference framework national regulators can adapt rather than duplicate from scratch — and India's position here is active rather than passive. RBI sits on the FSB plenary, and India's 2023 G20 presidency put AI governance on the international agenda at a moment when India's own transaction-volume scale (UPI, Aadhaar-linked banking) gave the FSB's systemic risk analysis a genuinely different scale reference than most G20 members could offer.

India Context: UPI's Scale Makes the FSB's Channels Concrete, Not Abstract

India's banking AI concentration exposure has a government-infrastructure dimension most G20 peers don't share: several public sector banks have deployed AI through shared government technology initiatives — DFS's fintech department, RBI's Innovation Hub — which means a failure in that shared infrastructure has systemic reach across a meaningful share of public sector banking, not just one institution. UPI adds a second concentration point: fraud detection for the entire UPI ecosystem runs substantially through NPCI, so a performance degradation there is a systemic fraud exposure across every bank on the rails simultaneously, not an isolated incident.

India's private banks — HDFC, ICICI, Kotak, Axis — carry the same hyperscaler concentration exposure the FSB flagged for European and American banks, since they largely run on the same three cloud providers. RBI's FREE-AI framework addresses institutional reliability, but the FSB's system-wide lens — tracking AI provider concentration across the entire India banking system, monitoring for correlated credit-tightening behavior, requiring provider-concentration disclosure — is a different and currently less-developed layer that RBI's own framework will likely need to grow into.

Action Checklist: Board Questions That Separate Real AI Governance From Checkbox Compliance

1. Map AI vendor concentration down to the infrastructure layer — "three vendors" isn't diversity if they all run on the same hyperscaler.
2. Quantify the cost of single-vendor AML/credit model consolidation against the systemic blind-spot risk it creates, rather than assuming consolidation is a pure efficiency win.
3. Build explainability tooling before a supervisor asks for it, not in response to the request.
4. Put AI concentration and correlation risk on the board risk-reporting agenda explicitly — not folded into a general operational risk report.
5. Track RBI's and FSB's coordination work directly rather than relying on secondary summaries, since India's framework is still converging toward (not yet matching) the FSB's system-wide monitoring approach.