When Consent Becomes Authority
AI makes open finance more valuable by making shared data easier to interpret and use, but the same connection can enlarge the consequences of a mistake. This chapter compares the trade-offs that appear when financial data is used for modelling, personalisation, and infrastructure, then asks what changes when an AI system can call a tool and execute a transaction. The practical goal is to distinguish a recommendation that a person can review from delegated authority that must be bounded, monitored, interrupted, and assigned to someone who can answer for the result.
More data can improve a model—and enlarge the harm
The first trade-off is between model performance and data minimisation. AI systems often benefit from data that is broad, diverse, timely, and granular. Open finance can fill gaps in a customer’s financial picture and give a model better context for a credit assessment or a personalised service. Data-protection principles push in the opposite direction: collect and process only what is necessary for a specified purpose, retain it only as long as needed, and avoid turning a legitimate access request into a standing claim over a person’s financial life.
This is not a simple choice between accuracy and privacy. A smaller data set can protect the customer but omit information needed to assess a thin-file borrower fairly. A larger data set can improve prediction for one group while making another group more visible to price optimisation or discriminatory inference. A model may appear more accurate in aggregate because it learns from customers with rich digital histories, while performing poorly for people who use fewer digital services or decline data sharing. If an opt-out is treated as a risk signal, privacy can carry a financial premium: the customer who shares less may receive worse access or terms.
The risk pathway continues after the model is trained. Granular, connected financial data can reveal relationships that a person never intended to disclose as a single fact. A breach involving one account is serious; a breach involving a consolidated financial profile can expose income, obligations, payments, investments, and behavioural patterns together. That information can support targeted fraud, synthetic identities, or highly personalised scams. Open finance increases the number of entities and interfaces through which data can move, while AI can increase the speed with which an attacker or model extracts meaning from it.
The second trade-off is between local control and cross-border interoperability. Storing and processing data locally can support sovereignty, legal oversight, and confidence that sensitive information remains within a defined jurisdiction. But if every country or institution isolates data and model workflows, an AI system may have less diverse information, higher operating costs, and difficulty serving a business or person whose financial life crosses borders. A multinational small business, for example, may be assessed using only a fragmented domestic view even when its cash flows span several markets.
Cross-border data movement introduces its own risks. Different consent systems, data-protection rules, technical standards, and liability arrangements can make it unclear which authority controls a transfer or how a customer can seek redress. Interoperability is therefore not the absence of local safeguards. It requires compatible consent management, security protocols, trust frameworks, and governance rules that preserve responsibility when data crosses a boundary.
The third trade-off is between internal capability and third-party dependence.