AI creates systemic risk for banks

• Moody's warns banks of systemic risk from AI vendor dependency
• Reliance on firms like Microsoft and Google creates single points of failure
• Banks must treat AI providers as critical infrastructure to ensure stability

The rush to integrate artificial intelligence into banking is creating a new class of systemic risk. A recent warning from Moody's suggests banks are dangerously dependent on a few tech giants, urging a fundamental shift in managing these vendors.

A New Category of Systemic Risk

In a pointed analysis, credit rating agency Moody's has cautioned the global banking sector about its rapidly growing reliance on a small number of artificial intelligence providers. The agency warns that banks are becoming captive to a handful of Silicon Valley firms, creating a systemic dependency that poses a significant credit risk. This concentration of power in a few key suppliers, such as Microsoft, Google, Amazon, and OpenAI, means that an outage or security failure at a single provider could have cascading effects across the entire financial system. Moody's argues that the benefits of AI in cutting costs and boosting revenue are clear, but these advantages come with risks that financial institutions are only beginning to grapple with.

What is a Critical Infrastructure Partner?

The term 'critical infrastructure partner' typically refers to entities essential for the functioning of society and the economy, such as energy grids, transportation networks, and payment systems. In banking, these have traditionally included core processing system providers, data centres, and major payment networks like Visa or Mastercard. These partnerships are managed with extreme rigour, involving deep due diligence, contingency planning, and regulatory oversight. By urging banks to view AI providers through this same lens, Moody's is signaling that AI is no longer a peripheral IT service but a core component of a bank's operational foundation. The dependency is becoming so profound that the failure of an AI partner could jeopardize a bank's ability to operate.

The Tangible Risks of AI Dependency

Moody's report highlights several specific dangers. The most immediate is 'vendor dependence risk,' where a few dominant AI providers could eventually dictate prices, squeezing bank profits. This is especially likely as currently unprofitable AI firms face investor pressure to generate returns. Another major concern is operational resilience. An outage at a major cloud or AI model provider could halt everything from credit assessments to fraud detection systems simultaneously for numerous banks. Beyond these issues, Moody's also flags that AI can amplify existing risks like data privacy breaches, cybersecurity gaps, and even rapid 'deposit flight,' where AI-powered tools make it easier for customers to quickly move their money to higher-yielding accounts, threatening a bank's funding stability.

From Vendor Management to True Partnership

Treating an AI provider as critical infrastructure requires a complete overhaul of the typical vendor-client relationship. It means moving beyond standard service-level agreements to a more integrated partnership model. Banks must conduct far deeper technical due diligence and demand greater transparency into how AI models work. This includes developing robust contingency plans for potential outages, which might involve having arrangements with alternative providers or building capabilities with open-source models. Banks hold some leverage, primarily through their vast reserves of proprietary data, which is essential for training effective AI. However, the core message from Moody's is that the level of scrutiny and integration must match the level of risk, which is now systemic.

Implications for the Indian Banking Sector

For India's rapidly digitalizing banking landscape, this warning is particularly timely. Indian banks have been aggressive adopters of AI for everything from customer service chatbots and loan processing to risk management. As they deepen their reliance on third-party AI and cloud platforms, the risks of vendor concentration become a national concern. The Reserve Bank of India (RBI) already maintains a strong focus on operational resilience and technology risk management. Moody's report will likely reinforce the need for regulators to scrutinize the dependency of Indian financial institutions on a small number of global tech providers. The call to action is clear: banks must build resilience and avoid placing the stability of their core operations in the hands of just a few, powerful tech partners.