AI in financial services: a dangerous shortcut?
Bringing AI into the bank may look like innovation, but without governance guidelines it can open the door to problems.
AI agents that help with everyday tasks are about to meet the need to manage accounts, yields, investments and anything else that can make banking easier. However, 95% of attempts to bring AI into companies have been creating security failures. So does it make sense?
Opening source code to AI in financial services is a dangerous shortcut: here’s why (and what the law says)
The risky side of having AI inside your bank
Artificial intelligence is already in almost everything: it recommends what to watch, helps answer messages and even organizes our routines. But what happens when it enters the bank and starts handling money, credit and investments? It sounds amazing, but that’s where the risks begin.
The first is privacy. To work well, AI needs access to highly sensitive information, such as transactions, balances and financial history. Imagine if that data leaked or were misused. The damage to the customer, and to the bank, would be enormous.
Another point is security. An AI assistant can be targeted by criminals trying to trick the system into releasing money or stealing information. If that bot is connected directly to financial operations, such as transfers or credit approvals, the risk of fraud is even greater.
There is also the problem of overconfidence. People may believe AI never makes mistakes, but that isn’t true. Sometimes it can misinterpret an instruction or even make up an answer that looks real. In a banking context, a mistake like that can be costly.
Then there are the rules of the game. The financial sector is full of regulations and requirements. If an AI makes a decision such as denying credit or recommending an investment, the bank has to explain clearly why it happened. And believe us, an AI can’t always justify itself simply and transparently.
And we can’t forget the ethical side. If the technology isn’t well trained, it can end up being unfair, favoring some customers over others, or pushing products that don’t fit a person’s profile.
In the end, the risk isn’t in having an AI assistant inside the bank, but in how it’s used. With reinforced security, clear rules and transparency, AI can be a great ally. Without those safeguards, though, it can become a much bigger problem than the solution it promises.
Why is it so risky?
- Vulnerability to fraud and cyberattacks: making code accessible can reveal internal logic (authentication, sensitive calculations), making intrusions or manipulation easier.
- Automatic compliance risks: AI can incorporate code snippets under restrictive licenses (GPL, AGPL) without anyone noticing, creating unexpected obligations to open-source code or provide mandatory attribution. (globalpolicywatch.com, threatrix.io)
- Intellectual property (IP) uncertainty: courts are still working out whether AI-generated code is derived from protected works, which could lead to massive financial and reputational litigation. threatrix.io
- Compromised transparency and traceability: critical systems (e.g., payments, anti-fraud) require robust logs, clear legal controls and individual accountability, all of which are lost with automated generation without formal governance. threatrix.io
Which Brazilian laws and rules prevent this exposure?
Lei Geral de Proteção de Dados (LGPD, Brazil’s General Data Protection Law): Lei 13.709/2018
- Clearly defines rights over personal data, including where AI may process it.
- Requires security incidents to be reported to the ANPD (Brazil’s National Data Protection Authority) and to data subjects within a reasonable time. (law.stanford.edu, Wikipedia)
- Heavy penalties: fines of up to 2% of revenue in Brazil, capped at R$50 million per violation. (Wikipedia)
Projeto de Lei 2.338/2023: Brazil’s AI Legal Framework bill
- Classifies systems as “excessive risk” (prohibited) or “high risk” (heavily regulated). Financial services fall into the high-risk category, requiring algorithmic impact assessments, detailed documentation, internal governance and human oversight. Mattos Filho
- The ANPD coordinates the National AI Regulation and Governance System (SIA), reinforcing enforcement of the bill. Wikipedia
New requirements in the AI bill:
- Mandatory transparency, traceability, the right to contest automated decisions, civil liability and continuous auditing.
- Severe penalties: up to R$50 million or 2% of revenue, suspension of the system, public disclosure of the violation and a block on operating in the sandbox.
Recent ANPD decisions confirm the hard line
- In July 2024, the ANPD immediately suspended Meta’s new privacy policy on using personal data to train AI, with a daily fine of R$50,000.
- It’s a clear warning: when there is a risk of irreparable harm or massive rights violations, preventive measures can be imposed strictly.
Conclusion: simple, but essential
Opening source code to AI in financial services: whoever takes this path is taking a big risk. Especially when critical systems run on personal data, automated decisions and core financial logic, there is no room for improvisation.
Brazilian law, whether the LGPD or the AI bill still moving through Congress, requires robust governance, transparency, impact assessment, civil liability and human oversight. These are not suggestions: they are legal mandates with real penalties.
Bringing intelligence into financial management takes detailed human work that considers each client’s real challenges. Entrusting your returns to an AI assistant isn’t the best way to optimize your finances. Trusting a specialist, on the other hand, can be essential.
