German Regulator BaFin takes on Big Data and AI

The German Federal Financial Supervisory Agency (BaFin) has issued a report for consultation on the challenges and implications posed by big data and artificial intelligence (BDAI) for the regulation of German financial markets. BaFin collaborated with experts from the Boston Consulting Group, Partnerschaft Deutschland and the Fraunhofer Institute für Intelligente Analyse- und Informationssysteme on the report.

While anticipating benefits for banks, insurers, capital markets and ultimately customers following these developments, BaFin also highlights challenges for established market players as well as the need to carefully assess how these developments might influence financial supervision.

BaFin identifies an array of questions which might need to be answered to meet the looming challenges and opportunities ahead, foremost in ensuring sufficient understanding of BDAI. Regulatory challenges are specifically identified for financial stability and market regulation, firm supervision and the protection of customers.

What are the perceived consequences of BDAI for German financial markets?

Overall, it is expected that financial markets will become ever more effective, exploiting further niches. Companies who will be able to integrate BDAI and gain consumer trust should be able to reap great benefits.

  • Drastic changes: BaFin assumes that the combined phenomena of Big Data (the availability of large quantities of data) and the development of better means to use such data by means of Artificial Intelligence, will lead to drastic changes in the financial landscape.
  • Disintermediation of value chains: While banks and insurers are only beginning to make use of BDAI (e.g. in bank core processes, compliance and to reduce risk as well as administrative costs), capital market participants have already done so to a larger extent. BaFin sees that BDAI will accelerate the trend of disintermediation of value chains in traditional market players.
  • Potential challenge by Tech Companies: Even though BaFin states that financial institutions are well placed to take advantage of BDAI, it also recognises that the rise of the importance of BDAI might pose an advantage to large tech companies outside the financial sector as they have the means and data to challenge traditional financial market players in this area.
  • BDAI providers potentially systemically relevant: As for most digital business models, BaFin sees the risk of “winner takes it all” markets. Here, it is interesting to note that BaFin states the possibility that BDAI provider (even though outside of a regulated market) may need to be considered systemically relevant.

This perceived shift in considering systemic importance is likely to have consequences for the regulatory treatment of financial institutions (see paragraph on “Reconsidering systemic importance” below).

What challenges does BDAI pose for regulation
  • Monitoring and supervision: The main perceived challenge lies in understanding BDAI models properly so that they can effectively be monitored and supervised. This goes beyond a specific regulatory problem but is of wider importance for society.

As BDAI is highly complex, it will be increasingly important to be able to understand how, why and based on what factors BDAI makes decisions. Being able to show and proof this will be key not only for the regulator, but also in other areas of life, e.g. in court. For example, it must be ensured that algorithms do not factor in illegal data such as the gender of consumers.

Similarly, it will be a challenge for companies to ensure their BDAI work as desired. Here, the development of sufficient testing mechanisms is key.

  • Identifying and closing regulatory gaps: The agency recognizes the problem that current regulation might not capture BDAI companies’ business models appropriately. It therefore determines that identifying and closing those respective regulatory gaps early on is crucial.
  • Reconsidering systemic importance: Due to BDAI, risks resulting from the interaction and interconnectedness of market participants will likely become a more important factor to consider. In the BDAI context, these risks may also stem from interactions of new types of systemically important companies. This might include providers of data, platforms and algorithms.

What’s more, these risks may no longer reside within the organisational structure of supervised firms they are likely to stay unidentified by these firms.

As a result, BaFin deems the issue of systemic importance due for reconsideration: neither supervisory key figures nor supervisory instruments like capital surcharges alone are sure to bring about the intended effects in an environment characterised by BDAI and the described heightened relational risks going along with it. BaFin therefore considers it imperative to address and potentially mitigate these risks from a supervisory and regulatory point of view.

  • International coordination: BaFin also finds the risk of regulatory arbitrage looming on the horizon due to the varying approaches to BDAI being taken in different jurisdictions. In order to establish a level playing field (“same business, same risk, same rule”) it calls for an international dialogue on these issues.
What does BaFin expect from firms?
  • Internal control processes: BaFin considers it important for firms to incorporate the right supervisory-regulatory framework properly addressing BDAI issues. To this end, it sees documentation and control processes as indispensable.
  • Understanding innovations: Financial institutions should make sure they understand and come to grips with innovations not least to ensure the profitability and stability of their business.
  • Corporate governance: The change of BaFin’s regulatory focus indicated in the report also means that banks will have to adjust their internal corporate governance accordingly. Notably, it might not be sufficient to simply document BDAI models and their use. Firms might be required to ensure the explainability and traceability of BDAI decisions for third-party experts. Companies will have to make sure competent authorities and law enforcement agencies are able to understand the BDAI models.
  • Board responsibility: Likewise, experimental models in whose inner workings firms have no insights (“black boxes”) will not be accepted by BaFin – responsibility will remain with the board of the regulated entity.
  • Data security: Not surprisingly, BaFin will ask firms to address increased information security risks associated with the use of BDAI. To this end, BaFin indicates that it might use its supervisory instruments (e.g. approval of BDAI models as if already done e.g. for bank’s internal models) as a lever to enforce its BDAI approach with respect to financial institutions.
BaFin will not forget consumers

The agency cautions against the risks for consumers in the BDAI context: for instance, mass individualisation may allow companies to disproportionally extract the consumer surplus, e.g. due to deeper customer insights. In the case of (mass) individualisation, each customer could be asked to pay the maximum price they are prepared to pay. It may be difficult for customers to detect the (hidden) price adjustment due to the (mass) individualisation of products and services.

What’s more, BDAI enterprises are warned to pay attention to programming and controlling algorithms in a way that prevents them from discriminating using unlawful data and/or insights. It must also be excluded that such unlawful data points are gained through the use of various external sources.

What’s happening next?

BaFin’s comprehensive study on Big Data and Artificial Intelligence illustrates the regulator’s increasing awareness of the digital revolution and its consequences for financial stability. It explicitly states that the report is not to be seen as an indication of BaFin’s current regulatory practice. However, it clearly shows at what questions BaFin is going to look in the future when BDAI will become more and more present in firm's business models.

Via the consultation, which is open until 30 September 2018, BaFin is seeking to initiate discussions about BDAI and is inviting companies, associations and members from academia, as well as other national and international supervisory authorities, to participate actively.