1. What is Ethical AI Governance in Banking?

"Practice of designing AI systems with ethical frameworks, legal policies, and social concepts" - Responsible AI in banking

EBA reported in 2025 that 92% of EU banks already deploying AI for customer profiling, fraud detection and creditworthiness assessment.

It covers all AI in banking:

• Credit scoring / underwriting
• Fraud / AML transaction monitoring
• Chatbots / Robo-advisory
• Algorithmic trading
• AVM - Automated Valuation Models for mortgage

2. Regulatory Pillars - Global

A. EU AI Act - Effective 1 Aug 2024 - Most Important

• Art 6: Credit scoring and insurance underwriting = High-Risk AI System
• Requirements for High-Risk:
  • Human oversight mandatory
  • Conformity assessment before deployment
  • Training data must be representative, bias-tested
  • Explainability - Borrower has right to explanation under Art 86
  • AI literacy for staff
• Penalty: Upto €35M or 7% global turnover

B. India - RBI FREE-AI - Framework for Responsible and Ethical Enablement of AI - 13 Aug 2025
Committee chaired by Prof Pushpak Bhattacharya IIT Bombay, constituted 6 Dec 2024.
Report recommends:

1. Board-approved AI policy within each bank - mandatory
2. Consolidated RBI AI guidance for uniform standards
3. Capacity building for responsible AI governance
4. 7 Sutras: Trust is Foundation, People First, Accountability, Fairness, Transparency, Privacy, Robustness

RBI Governor confirmed on 23 Oct 2026 that safeguards already in place.

C. US - SR 11-7 / OCC 2011-12 Model Risk Management + CFPB

• Banking regulators expect AI systems to be explainable, auditable, compliant
• SR 11-7: All models including AI/ML must have model validation, ongoing monitoring, independent review
• CFPB Advisory Opinion 2023: AI-driven adverse actions like loan denials must comply with ECOA, regardless of model opacity - You cannot say "AI denied, we don't know why"
• ECOA - Equal Credit Opportunity Act: Prohibits discrimination on race, color, national origin, sex, marital status, age, receipt of public assistance. ZIP Code, education, cash-flow patterns may create impermissible disparities

D. Canada - OSFI E-23 Revised Guideline on Model Risk + July 2026 Bulletin on Gen AI + Oct 2026 Risk Outlook
Under E-23, using third-party model does NOT transfer model risk obligations to vendor. Under B-10 and PIPEDA, FRFI retains accountability.

3. 7 Principles of Ethical AI Governance Checklist

As per Coventus AI Governance Checklist for Banking:

1. Fairness & Bias Mitigation: Test for disparate impact - proxy discrimination check
2. Explainability: XAI for trades >10% market volume - SEC AI Rule 2025 fines up to $1M
3. Transparency: Disclose AI use to customer - Under EU AI Act and RBI FREE-AI
4. Accountability: Human-in-loop for high-risk decisions, Model Owner = Business head, not data science
5. Privacy Compliance: GLBA, GDPR, CCPA, DPDP Act 2023 India
6. Robustness & Safety: Stress testing, drift monitoring, 7% intraday volatility spikes flagged in 2025 by SEC
7. Regulatory Alignment: OCC, FDIC, Fed, CFPB, EBA, RBI guidance

4. Landmark Case Laws - Where Banks Lost

Case 1: Apple Card Bias - Goldman Sachs / Apple - 2019-2021 - USA - Proxy Discrimination
Women received lower credit limits than men despite same financial profile. Gender was not explicit variable, but indirect discrimination via spending patterns.
NY DFS investigated. Settlement: Goldman had to re-evaluate algorithm.
Ratio: Banning collection of gender data (US prohibits collection in non-mortgage lending) does NOT protect from proxy discrimination liability. You are liable for disparate impact.

Case 2: Griggs v. Duke Power Company - US Supreme Court 1971 - Foundation of Disparate Impact
First use of term disparate impact under Title VII. Court ruled neutral practice that disproportionately affects protected group is illegal even without intent.
Applied to AI: Even if AI model does not use race, if outcome disproportionately denies Black borrowers, it's violation of ECOA. CFPB uses this precedent for AI lending.

Case 3: Massachusetts AG $2.5 Million Settlement - July 10, 2025 - AI Discrimination
AG announced settlement for proxy discrimination. Lender used AI model that used variables highly correlated with race - e.g. shopping habits, social network.
Lesson: CFPB now calls this "digital redlining". Bank must audit for proxy variables.

Case 4: Turner v. Nuance Communications, 735 F. Supp. 3d 1169 (N.D. Cal 2024) and Gladstone v. Amazon Web Services, 739 F. Supp. 3d 846 (W.D. Wash 2024)
Plaintiffs claimed AI hiring / lending tools biased. Courts allowed disparate impact claims to proceed against AI vendors. Banks using vendor AI still liable.

Case 5: SEC vs AI Trading Cases - 2025
SEC AI Rule 2025 requires explainable AI disclosures for trades exceeding 10% market volume. After incidents where AI-driven trades contributed to 7% intraday volatility spikes, SEC mandated ethical frameworks. Fines up to $1M.

Case 6: India - No Binding Precedent Yet, but Regulatory Direction

• Shrimati Devi Pension Case: Pension Rs 1000 transferred to someone else due to banking system error, infringing Art 21 right to life. Court held bank liable for system error - extends to AI error.
• RBI Guidelines 2022 & 2023: Promote fair lending, consent-based data usage, auditability of algorithms in digital lending.
• MeitY Draft Digital India Bill 2023: Explicitly acknowledges algorithmic harm and proposes risk-based AI regulation.

Case 7: HSBC Bias Claim - UK Employment Tribunal 6 Aug 2026
HSBC Beats Bias Claims From Worker Who Relied On AI - Tribunal struck out race and disability discrimination claims where staff relied on AI-generated advice, finding fundamental misunderstanding. Shows courts skeptical of AI as defence - human must remain accountable.

5. How to Implement - Practical Framework for Bank Board

1. Inventory: List all AI models - credit, fraud, marketing - Classify as High-Risk under EU AI Act if doing business in EU
2. Bias Audit: Run disparate impact test - 80% rule - If approval rate for protected group <80% of highest group, investigate
3. Explainability: For every loan denial, provide 4 specific reasons under ECOA Reg B, not "AI model score low"
4. Human Oversight: High-risk decisions need human sign-off - Cannot auto-deny mortgage
5. Third Party Risk: Vendor model = Your liability under OSFI E-23 and SR 11-7
6. Documentation: Model Risk Management file with data lineage, training data bias test, validation report

Liability if you fail:

• US: CFPB fine + ECOA private lawsuit - punitive damages
• EU: ESMA fine up to 7% turnover + civil liability under CSDDD which introduces civil liability for intentional or negligent failure
• India: RBI FREE-AI will become binding guidance - expect RBI penalty for model risk failure under Risk Management and audit.