Governing Connected Intelligence in Financial Services: A Cross-Jurisdictional RegTech Framework for AI-Driven Risk Management
DOI:
https://doi.org/10.63503/aisem.63Keywords:
Connected Intelligence, AI Governance, Non-Human Identity, RegTech, ISO/IEC 42001, Financial Services, Cross-Jurisdictional ComplianceAbstract
Artificial intelligence, big data, cloud platforms and digital connectivity have converged into what this chapter calls Connected Intelligence (CI), and that convergence has rewritten how risk shows up in financial services. The older regulatory frameworks assume a world of human-paced transactions within a single institution; they fit poorly into a world where autonomous AI agents make consequential financial decisions in milliseconds, non-human identities now outnumber human users by very large margins, and attackers can execute a full attack chain in under thirty minutes. To address this gap, the chapter draws together existing work in AI governance, threat intelligence, and financial regulation and proposes CI-GovBridge: a five-layer governance framework that links non-human identity governance, human accountability, algorithmic explainability, RegTech automation, and cross-jurisdictional alignment into a single architecture purpose-built for financial institutions. The framework extends the five-layer logic of Agarwal and Nene [1] to the specific demands of financial services. The chapter also maps regulatory convergence across seven jurisdictions, walks through a documented pattern of incidents that illustrates governance failure, and lays out a phased implementation roadmap that tracks active and upcoming regulatory deadlines.References
[1] Agarwal, A., & Nene, M. J. (2025). A five-layer framework for AI governance: integrating regulation, standards, and certification. Transforming Government: People, Process and Policy, 19(3), 535–555. https://doi.org/10.1108/TG-03-2025-0065
[2] CISA, NSA, & FBI. (2024). PRC state-sponsored actors compromise and maintain persistent access to U.S. critical infrastructure (Advisory AA24-038A). Cybersecurity and Infrastructure Security Agency. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
[3] CrowdStrike. (2026). 2026 global threat report. CrowdStrike Intelligence. https://www.crowdstrike.com/resources/reports/global-threat-report
[4] Crowley, C. (2025). SANS 2025 SOC survey. SANS Institute. https://www.sans.org/white-papers/sans-2025-soc-survey
[5] Cyber Strategy Institute. (2026). 2026 NHI reality report. Cyber Strategy Institute.
[6] Darktrace. (2025). Annual threat report 2025: AI cybersecurity trends. Darktrace Research. https://www.darktrace.com/resources/annual-threat-report
[7] Entro Security. (2025). NHI & secrets risk report H1 2025. Entro Security.
[8] European Parliament. (2024). Regulation (EU) 2024/1689 — EU AI Act. Official Journal of the European Union. https://eur-lex.europa.eu
[9] European Parliament and Council. (2022). Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2022/2554
[10] European Parliament. (2016). Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR). Official Journal of the European Union.
[11] HKCERT. (2025). Hackers' new partner: Weaponized AI for cyber attacks — six emerging AI-assisted attacks. Hong Kong Computer Emergency Response Team Coordination Centre. https://www.hkcert.org
[12] IMDA Singapore. (2026). Model AI governance framework for agentic AI. Infocomm Media Development Authority.
[13] ISO/IEC. (2023). ISO/IEC 42001:2023 — Artificial intelligence management systems. International Organization for Standardization.
[14] Kroll. (2026). State of cyber resilience 2026. Kroll LLC. https://www.kroll.com/en/insights/publications/cyber/state-of-cyber-resilience
[15] McKinsey & Company. (2026). State of AI trust in 2026. McKinsey & Company. https://www.mckinsey.com
[16] MeitY India. (2025). India AI governance guidelines. Ministry of Electronics and Information Technology. https://www.meity.gov.in
[17] Moody's Analytics. (2025). Human in the loop: Why human oversight still matters. Moody's Analytics.
[18] National Assembly of the Republic of Korea. (2024). Act on promotion of industrial digital transformation and utilization of artificial intelligence. Enacted December 2024, effective January 22, 2026.
[19] NIST. (2023). AI risk management framework 1.0. National Institute of Standards and Technology. https://www.nist.gov/itl/ai-risk-management-framework
[20] OPSWAT. (2025). The evolving threat landscape: How hackers are using artificial intelligence. OPSWAT Threat Research. https://www.opswat.com/blog/ai-hacking
[21] Protego. (2026). Non-human identities: The hidden security crisis powering AI agent attacks in 2026. Protego.
[22] Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
[23] Unit 42/Palo Alto Networks. (2025). Agent Serpens: Agentic AI threats. Palo Alto Networks.