Bank and Fund Associations Urge FSB to Keep Its AI Guidance Flexible
Commentary by Vijay Dewan
The American Bankers Association and the Managed Funds Association filed comment letters on the FSB's consultation report on sound practices for responsible AI adoption, each urging the Financial Stability Board to keep its draft AI guidance flexible (see prior coverage).
Both associations support the FSB's goal but warned against a one-size-fits-all approach. The ABA argued that the guidance should work for banks of all sizes, with programs matched to a bank's size, complexity, and risk, and no single template. The MFA stated that the sound practices skew toward large-bank governance models that are not practicable for smaller, nimbler firms, and that a rigid approach could limit AI adoption to the largest institutions.
The ABA offered specific fixes such as sharpening the definition of "machine learning" and aligning FSB's terms with a common AI lexicon. The ABA urged the FSB to add case studies from community banks. The ABA also urged the FSB to consolidate overlapping practices.
The MFA warned that the draft risks becoming mandatory through detailed implementation expectations and granular documentation. The MFA pointed to the practice on incorporating AI risk into risk-management frameworks, which calls for documenting AI use across its lifecycle in ten categories, plus added logging for generative AI and agents. The MFA noted that asset managers are fiduciaries whose duties already require calibrated governance, and that principles adapt better than a checklist.
Commentary
The striking thing about both letters is that neither disagrees with the FSB. The report repeatedly insists that its practices are a non-prescriptive "menu," and both associations endorse that framing. The fight is over the document's afterlife. Non-binding international guidance has a way of migrating into national supervisory expectations and examiner workpapers, where "you may adapt these" becomes "explain why you deviated." Sound Practice 3 is the perfect exhibit: it directs institutions to document AI use throughout the lifecycle, followed by a list of ten categories that documentation "can include," plus enhanced GenAI logging. The list is nominally illustrative, but that is precisely the danger; an illustrative list in a standard-setter's report becomes a de facto examination checklist, and the burden of proportionality shifts from the supervisor to the institution.
The fix is not "more flexibility," which too often means fewer controls. It is to make proportionality operational rather than ornamental: state the control objective in each practice, identify the factors that raise or lower the required intensity (materiality, autonomy, and whether the institution develops, customizes, or merely deploys the system), and illustrate several valid implementations rather than one implied org chart. A community bank searching internal policies with a vendor tool and a G-SIB wiring an autonomous agent into payment infrastructure do not present the same governance problem. The report says as much, but its operative text establishes one presumptive control architecture from which smaller firms must justify departures. Left uncorrected, guidance meant to promote responsible adoption will make large-bank compliance infrastructure the price of admission for AI.