Business/Technology · NEWS EXPLAINER
ASIC to review how Australian banks use AI in lending and customer decisions
Australia's corporate regulator is reviewing how banks use and plan to use artificial intelligence in customer-facing decisions, including lending. ASIC says automation can improve banking, but existing consumer-protection and financial-services obligations still apply as AI use expands.
Australia's corporate regulator is launching a formal review of how banks use artificial intelligence in dealings with customers, with particular attention to new and proposed AI use cases, decision making and lending. Reuters reported that the Australian Securities and Investments Commission sent banks a letter setting out the review and its focus on potential customer impacts.
The review is not an allegation that any bank has already broken the law through AI. ASIC's stated concern is how banks capture the benefits of automation without weakening customer protections. The regulator has separately said that existing financial-services, consumer-protection and corporate-governance laws continue to apply while broader AI regulation develops.
The review is about real bank decisions, not AI in the abstract
ASIC's letter, as described by Reuters, focuses on new and proposed AI use cases and the impact those systems may have on customers. That puts customer-facing decisions—especially lending and other processes that can affect access, pricing or treatment—at the center of the review.
The regulator is not starting from the position that all automation is harmful. Reuters says ASIC recognizes benefits from AI and automation. The regulatory question is whether banks can adopt those tools without creating unfair, opaque or poorly governed outcomes for customers.
Existing banking and consumer rules still apply
ASIC has said publicly that the arrival of AI does not suspend the laws already governing financial services. Existing rules on consumer protection, financial-services conduct and corporate governance remain in force while policymakers consider whether additional AI-specific regulation is needed.
That means a bank cannot treat an AI-generated decision as exempt simply because a model, agent or automated workflow helped produce it. The review is therefore less about waiting for a future AI rulebook and more about how existing obligations apply to new technology.
Customer decisions and cyber risk are two different AI concerns
ASIC's 2026 Key Issues Outlook identifies several AI-related risks at once. One is customer harm from automated decisions and AI-driven interactions. Another is operational and cyber risk as AI makes attacks faster or more sophisticated.
Those concerns can overlap, but they are not the same. A lending model could raise fairness or governance questions even if it is never hacked, while an AI-enabled cyberattack could threaten operational resilience without involving a customer-credit decision. Keeping those risk channels separate makes it easier to understand what the bank review is actually testing.
ASIC has already been gathering evidence from the financial sector
iTnews reports that ASIC previously held nine roundtable events with around 600 participants from across Australia's financial-services industry to examine AI practices and workforce behaviour. The discussions covered governance, cybersecurity and the speed at which AI-led threats can evolve.
The next practical checkpoint is what ASIC asks banks to change after the review, if anything. Until the regulator publishes findings or enforcement outcomes, readers should distinguish the review's scope from any conclusion that a particular bank or AI system has failed.
