When Better Detection Fails to Become Better Supervision
This series studies how financial supervisory authorities use artificial intelligence (AI) projects and other supervisory technology—usually shortened to suptech—to carry out risk-based supervision. Its central question is narrower and harder than whether an authority can deploy a model: when does an AI capability actually improve the authority’s ability to see a risk, judge its significance, and act? The answer matters to any reader who must evaluate a supervisory technology proposal, because faster processing or more alerts can coexist with weak evidence, unclear accountability, and no change in the market being supervised.
Why supervisory authorities are reaching for AI
Financial institutions increasingly combine digital services, large and varied datasets, cloud computing, and AI. That changes the object of supervision as well as the tools available to supervisors. Authorities must monitor institutions and markets whose risks can emerge across transactions, documents, consumer interactions, and connected firms. A supervisory process built only around periodic manual review may struggle to keep pace with that volume and speed.
The IMF paper AI Projects in Financial Supervisory Authorities reports cited research that 164 financial authorities in 105 countries had implemented suptech tools. It also reports uneven adoption: in 2024, 75 percent of advanced economies and 58 percent of emerging markets and developing economies had adopted suptech tools, compared with 79 percent and 54 percent respectively in 2023. The paper says that 60 percent of respondents were exploring how to incorporate AI into supervision, while the share using generative AI (GenAI)—systems that can generate or transform content—rose from 8 to 19 percent between 2023 and 2024. A separate stocktake cited in the paper found 32 of 42 respondents experimenting with, using, or developing GenAI tools.
Those numbers show momentum, not effectiveness. They also may come from different samples and definitions, so they should not be read as a single maturity score. Adoption tells us that authorities are trying to extend their toolkit. It does not tell us whether a tool improves the accuracy of a risk assessment, reaches neglected cases, reduces harmful delay, or leads to a defensible intervention.
The possible uses span the major activities of risk-based supervision. Risk-based supervision means directing attention and resources toward the risks most relevant to an authority’s mandate rather than treating every activity as equally urgent. The IMF paper places AI in licensing, micro- and macro-prudential supervision, anti-money-laundering and countering-the-financing-of-terrorism work, and conduct supervision.
The examples are revealing precisely because they are different. The Bank of England is described as using AI for macro-financial and macro-prudential surveillance, including GDP forecasts, banking distress, and financial crises. The Bank of Thailand uses AI to analyze board meeting minutes for regulatory compliance. The European Central Bank applies natural-language processing to fit-and-proper questionnaires and flags issues for authorization work. The Malaysian Securities Commission uses AI to monitor corporate-governance practices and the quality of listed-company disclosures. One system searches text; another supports forecasting or surveillance; another helps staff review a high-volume authorization process. They cannot be evaluated as though they were one product with one outcome.
Suptech is broader than AI. CGAP defines it as technology used to improve supervisory effectiveness and efficiency, including innovative technologies such as AI and natural-language processing, but also traditional technologies used in new supervisory methods. This distinction prevents two errors. The first is assuming that a useful supervisory improvement must involve a sophisticated model. The second is assuming that adding AI to an existing workflow automatically changes what the authority can legitimately conclude.
A signal is not a supervisory outcome
Market monitoring makes the difference especially clear. CGAP describes it as an ongoing, systematic look at an industry, sector, or market rather than a focus on one financial-services provider. It can support benchmarking and trend analysis, identify emerging consumer risks, monitor developments such as AI in lending, assess compliance, and track consumer behavior or sentiment. It complements institution-focused supervision, which examines the risk profile or conduct of a particular provider.
An AI system can help at the evidence stage. It might organize regulatory reports, scan a large set of complaints, identify themes in consumer contracts, monitor public advertising, or flag a pattern in filings. The output can be valuable because it makes a broad or fast-moving field more visible. But a flag is not yet a finding, and a finding is not yet an intervention.
CGAP makes this boundary explicit: market monitoring itself does not change market practices or produce positive consumer outcomes. Its tools gather evidence that supervisors can use for action at the institution or market level. A single social-media signal or mystery-shopping exercise may be useful for generating a question, but if it points in the same direction as regulatory reporting and other evidence, the basis for action is stronger. The authority still has to decide what the signal means, whether it falls within the authority’s mandate, how serious it is, and what response is proportionate.
This is not an argument against automation. It is an argument about where automation sits. An AI tool may reduce the time needed to find relevant documents, widen the set of cases staff can review, or expose a pattern that manual sampling would miss. Those are meaningful changes in supervisory capacity. Yet each depends on a further link: someone must own the result, understand its limits, check it against the question being asked, and have both the authority and the operational capacity to respond.
The links can fail in different ways. Poor reporting data can produce a precise-looking answer about the wrong population. A model can generate false alerts that consume the attention it was meant to free. Public data can be unrepresentative because some consumers do not use the channel being monitored, and it can be manipulated by parties who know how the system works. An opaque output can be difficult to challenge when the decision has material consequences. Even a well-supported signal can have no effect if it reaches no responsible decision-maker or if the supervisory process has no route from analysis to action.
The crucial distinction is therefore not “human versus machine.” It is capability versus consequence. A person may remain in the loop and still rubber-stamp an unexplained output. Conversely, a modest automated check can improve supervision when it is tied to a clear rule, a responsible owner, and a workflow that makes the result usable. The question is whether the whole arrangement produces a better-grounded supervisory judgment, not whether the system contains AI.
The chain that determines whether AI matters
The relationship can be represented as a chain. Each link asks a different question, and a strong link cannot compensate indefinitely for a missing one.
The first link is the supervisory objective. “Use AI” is not an objective. A useful objective might be to reduce the time required to review fit-and-proper questionnaires while maintaining the quality of issue detection, or to identify emerging consumer risks across a market early enough to support a thematic review. Without that anchor, the authority cannot say what success means or what the system is not intended to answer.
The second link is data that is fit for that purpose and governed throughout its life. CGAP recommends treating regulatory reporting as the baseline for market monitoring and fixing quality problems before investing in a wider toolset. The IMF paper likewise calls data governance the bedrock of AI deployment: data must be secure, private, accurate, available, and usable, with enough ownership and metadata to make its origin and limitations visible. A larger dataset does not repair an unrepresentative one.
The model then turns data into a prediction, classification, summary, or other output. That output becomes useful only after evaluation asks whether it performs the intended task, whether it behaves acceptably across relevant groups, whether people can understand and challenge it, and whether its level of explainability fits the materiality of the use. Finally, deployment must connect it to staff, systems, monitoring, and maintenance. Data and behavior can change after launch, so a model that worked in testing may decay in operation.
The last two links are the ones technology discussions most often skip. A validated signal must reach human judgment, and judgment must connect to an action that the authority can take. The result should then feed back into the data, model, and workflow. This is why the IMF paper describes an AI project as an interplay of technology, processes, and people, and why it recommends an iterative approach rather than treating deployment as a finish line.
The practical judgment supported by this series follows from the chain. Before asking whether an authority should buy, build, or scale an AI system, ask what supervisory problem it solves, what evidence it relies on, who is accountable for its output, how it will be challenged, and what action follows when the signal is credible. The first answer an authority needs is therefore not a model score. It is a well-framed project that can be tested against the real work of supervision.