Financial Regulation Update: Artificial Intelligence in FinTech

21 May 2019

The EU has been focusing on AI regulation development. The European Commission’s High-Level Expert Group on Artificial Intelligence delivered its Ethics Guidelines for Trustworthy AI in April 2019. The guidelines build a horizontal foundation for AI, applying to all sectors, but it is recognised that a sectorial approach may be needed.                      

Domestically, the Central Bank of Ireland has recognised that regulated financial service providers (RFSPs) are considering the introduction of further technological innovations, including AI, but have not yet provided any standalone guidance for its use in the financial services industry.

The use of AI

With the capabilities of AI constantly evolving, it is predicted that AI will revolutionise the financial services industry in the coming years. Financial decisions which were previously made by human beings will be capable of being made through the use of AI. Examples might include decisions as to whether to grant credit to consumers, and under what terms, or decisions as to what products should be offered to certain consumers.

AI is also becoming increasingly relevant in the area of robo-advice. This is where investment advice or portfolio management services are provided through an automated or semi-automated system. Essentially, this automated system can use AI to produce its advice and services.


The EU and UK have been taking steps towards standalone regulation for AI, so we may see Ireland follow suit in future.

There is no prohibition on the use of AI by RFSPs. However, they must comply with their general obligations, including the GDPR’s rules on automated processing in Article 22, and have the necessary systems and controls in place to ensure appropriate oversight.


Robo-advice qualifies as “investment services” within the meaning of MiFIID II, so RFSPs providing these services will need to make sure that their use satisfies the suitability requirements set out in the Directive. 

MiFIID II also imposes prescriptive rules on “know your client and know your product”. As part of this, RFSPs may design questionnaires to be completed by clients to assist in a suitability assessment. While the extent of the information gathered must be proportionate, it is important that they gather all the necessary information from the client.

Clients must be given information about the suitability assessment to help them understand the purpose of the requirements. As robo-advice and AI are new technologies, additional information needs to be given to clients to satisfy the RFSPs’ obligations. These include:

  • Explanations of the degree and extent of human involvement
  • The fact that their answers will have an impact on determining the suitability of investment decisions, and
  • A description of the sources of information used to generate investment advice or to provide the portfolio management service  

Questionnaire design

In the context of robo-advice and AI, where there is limited human interaction, the design of the questionnaire is of particular relevance. RFSPs must ensure that the information gathered allows for advice which is suitable for clients on the basis of their knowledge and experience, financial situation and investment objectives and needs. The questions should be sufficiently clear and the questionnaire should be designed to require additional clarification where necessary. RFSPs should also consider whether they need to make human interaction available for clients when responding to the questionnaire, or whether additional steps need to be taken to address inconsistent responses.

Consumer Protection Code

Similarly, where a RFSP is subject to the Consumer Protection Code in its dealing with customers, it will need to make sure that its use of AI satisfies the “knowing the consumer and suitability” rules.

Before offering, recommending, arranging or providing a product or service to a consumer, RFSPs must have sufficient information gathered to ensure that the product or service is suitable for the consumer. The type of information they must have gathered relates to consumers’ needs and objectives, personal circumstances, financial situation and their attitude to risk.

Therefore, in the context of AI, RFSPs will need to make sure they have sufficient human oversight of the process to make sure that the necessary information is being gathered and considered in the decision making process. Adequate systems and controls will be needed to demonstrate compliance.


As FinTech and RegTech firms are typically more advanced in their understanding and development of innovative solutions, the Central Bank has recognised that it is expected that RFSPs will likely outsource to them when it comes to innovations like AI.

To comply with their regulatory obligations when it comes to these outsourcing arrangements, RFSPs need to ensure that they have the appropriate level of oversight and risk management in place with robust outsourcing obligations applying.

Innovation Hub

The CBI has responded to the increasing focus on FinTech and recognised the need to engage with innovators and experts in the field. An Innovation Hub has been established for RFSPs to share information and engage directly with the Central Bank outside of the existing formal regulatory engagement process.

The Central Bank has reported a steady flow of engagement with the Innovation Hub, which is facilitating a more complete view of how innovation is unfolding and likely to impact the financial services industry. The Innovation Hub is supported by an internal FinTech Network drawing on expertise from over 20 divisions across the CBI, helping to disseminate the information across the organisation. The Central Bank has also been hosting regular FinTech and innovation events, including an Innovation Hub event focusing on RegTech, with presentations by a number of RFSPs on their business models and use of technology.

The Innovation Hub is being used by the Central Bank to gain a full understanding of the relevant technological developments and innovations, including the use of AI, so that regulation and supervision can respond accordingly. 


The EU is pursuing a comprehensive action plan for the development of AI.

In the meantime, it is important for RFSPs to ensure that they have adequate systems and controls in place to ensure their use of AI complies with their existing regulatory obligations. Existing policies and procedures should be reviewed to ensure they are consistent with AI use. It is important also that management responsibility is clearly outlined, with management being capable of understanding AI capabilities and how to challenge its operation.

Discuss the impact of AI on FinTech in more detail with a member of our FinTech team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.  

Discuss your FinTech queries now with Rowena Fitzgerald.

  • LinkedIn