N/HNajmul Hussain

framework · ai in banking · 2 min · 5 steps

Turning Treasury's AI risk framework into a working programme

The new financial services AI risk framework has 230 control objectives. Here is how to adopt it without drowning in them.

use_this_when→ You have AI use cases in production or late pilot and no single inventory of them→ Model risk, technology risk and compliance each review AI separately, with different vocabularies→ Your board has asked how the bank would evidence responsible AI to a supervisor

Najmul HussainFeb 22, 2026 · 2 min read

An operator seated at a desk facing a bank of monitors in a control room — Photo: ThisIsEngineering / Pexels

tl;dr

→ On 19 February 2026 Treasury released a Shared AI Lexicon and the Financial Services AI Risk Management Framework (FS AI RMF).
→ The framework adapts the NIST AI RMF for financial services and includes a matrix of 230 control objectives.
→ It is voluntary, but frameworks like this tend to become the reference point for examinations, so adoption should start now.

On 19 February 2026 the US Treasury released two resources for AI in financial services: a Shared AI Lexicon and the Financial Services AI Risk Management Framework, known as the FS AI RMF^[1]. Both are voluntary. The framework adapts NIST's AI Risk Management Framework to the operational, regulatory and consumer protection concerns specific to financial services.

The framework has four parts: an adoption-stage questionnaire, a risk and control matrix of 230 control objectives linked to risk statements, a user guide and a control reference guide. It was developed with more than 100 financial institutions, trade associations, advisers and tool providers^[2].

Why act on a voluntary framework

Treasury's Chief AI Officer, Paras Malik, said the resources are designed to help institutions "move faster with AI by reducing uncertainty". That is the right way to read them. In financial services, industry frameworks developed with regulators have a habit of becoming the reference point examiners use. Banks that adopt early will be explaining their approach in their own terms, rather than retrofitting to someone else's interpretation.

The risk is the opposite reaction: treating 230 control objectives as a checklist to complete before anything else can happen. That would slow AI adoption without making it safer. The steps below are how I would turn the framework into a programme that is proportionate and evidenced.

01
Adopt the lexicon first
Agree internal definitions using Treasury's Shared AI Lexicon before touching controls. Most AI governance friction is three functions using the same words to mean different things.
02
Build one inventory of AI use cases
List every AI use case, including vendor features and staff use of general-purpose assistants, with an owner, purpose, data used and customer impact.
03
Tier use cases by impact
Use the framework's adoption-stage questionnaire to assess where you are, then tier use cases by consumer, financial and operational impact. Controls should scale with tier.
04
Select controls by tier, not all 230 at once
Start with the control objectives that apply to your highest-tier use cases, map them to existing model risk, data and third-party controls, and record gaps. Reuse before you build.
05
Evidence and review
Decide what evidence each control produces, how often it is reviewed and which forum signs off. An unevidenced control will not survive an examination.

your_progress0%

0 of 10 actions done · saved on this device

key_takeaways

01Voluntary frameworks often become the examiner's checklist; early adopters shape their interpretation.

02Proportionality is the point: control depth should follow use-case impact.

03Most of the work is joining up existing model, data and vendor risk processes, not inventing new ones.

the_ledgerGet the next one in your inboxOne sharp idea on banking strategy, every other Tuesday.

sources

AI in Banking Risk & RegTech

want_to_run_this?Run it with your team in a half-day workshop.Ask about a workshop →

relatedBefore you switch on a vendor's AI agent: a five-step check From prompt engineering to context engineering Amex's $350m AML penalty puts card flows inside the risk assessment