The financial regulatory complex is panicking, and it is a magnificent exercise in missing the point.
Recently, the UK Financial Conduct Authority (FCA) and the Bank of England joined a growing chorus of global watchdogs warning of a terrifying "arms race." The narrative is simple, clean, and entirely wrong: sophisticated financial institutions are deploying artificial intelligence so quickly and covertly that underfunded regulators cannot possibly keep up. Watchdogs claim they need bigger budgets, massive tech stacks of their own, and new, specialized frameworks just to stay in the running.
This is a convenient fiction. It serves two purposes. First, it gives bureaucrats an immediate alibi for future oversight failures. Second, it justifies endless budget expansions for state-sponsored tech procurement.
The uncomfortable reality is that there is no arms race. Regulators do not fail because their algorithms are slower than Goldman Sachs' algorithms. They fail because they are attempting to solve a structural accountability problem with a software patch. Trying to match a trillion-dollar banking sector line-of-code for line-of-code is an inherently flawed strategy.
The Fallacy of Computational Parity
The lazy consensus among compliance consultants suggests that to regulate automated high-frequency trading, machine learning credit scoring, or generative AI compliance routing, the regulator must possess an equally sophisticated mirror system. They call this "SupTech" or supervisory technology.
It is a money pit.
I have watched tier-one financial institutions pour hundreds of millions of dollars into single machine learning pipelines, only for those pipelines to degrade within six months due to data drift. The idea that a public sector watchdog can recruit the data science talent, secure the compute infrastructure, and maintain the operational agility to police these models in real time is a fantasy.
More importantly, it is completely unnecessary.
Regulators do not need to understand the weightings of a neural network to penalize a bank for discriminatory lending practices. They do not need to reverse-engineer a black-box trading algorithm to see that market manipulation occurred. In every other sector of law enforcement, we police the outcome, not the neurological chemistry of the perpetrator. If an autonomous vehicle crashes, the investigator looks at the telemetry and the liability framework; they do not build a rival autonomous vehicle to shadow it on the highway.
By framing AI supervision as a technical arms race, regulators are voluntarily stepping onto a treadmill they are guaranteed to fall off.
The Proliferation of Phantom Risk
When public authorities publish warnings about financial AI, they invariably focus on systemic instability—concepts like "algorithmic collusion" or flash crashes caused by homogenous AI models reacting to the same market signals.
Let us dismantle the premise of algorithmic collusion. For two deep learning models to collude in a market without explicit human instruction, they must independently determine that anti-competitive behavior yields the highest reward function, execute that behavior across complex order books, and continuously adapt to keep the collusion hidden from other market participants.
Is it theoretically possible in an isolated simulation? Yes. Is it happening in live macro markets right now? No.
The real risk in financial services is far more mundane, and it is entirely ignored by the "arms race" rhetoric. The danger is model monoculture driven by regulatory laziness.
When regulators demand that banks explain their AI models to a high degree of specificity, banks do the predictable thing: they all buy the exact same "explainable" off-the-shelf models from a handful of dominant vendors. These vendors design their systems to satisfy the regulator’s checkbox requirements.
Imagine a scenario where eighty percent of mid-tier lenders use the exact same credit-risk evaluation engine because it is the only one pre-approved by compliance lawyers. When an unprecedented macroeconomic shock occurs—one not captured in the vendor's training data—every single one of those banks will contract credit simultaneously, using the exact same logic.
The regulator’s insistence on micro-managing the technology creates the very systemic vulnerability they claim to be fighting. The threat is not that the AI is too smart or too fast; it is that the regulatory environment forces the market to become stupidly uniform.
Shift the Liability, Stop Auditing Code
How do we actually fix this? You stop trying to build a better algorithm, and you change the rules of personal liability.
Right now, the compliance industry views AI as a shield. When an automated system breaches a short-selling rule or executes an illegal trade, the corporate response is a prolonged shrug: "The model behaved unpredictably during a black-swan event. We are conducting an internal audit."
This is tolerated because regulators treat AI as a distinct, almost mystical entity that requires specialized understanding.
To break this loop, enforcement agencies must apply a brutal, low-tech standard: absolute strict liability for the Senior Management Function.
If an algorithm under your purview violates a market rule, it is legally identical to you standing on the trading floor and screaming the order yourself. No allowances for "emergent behavior." No passing the buck to the third-party data vendor. No mitigation credits because you used a "validated" testing environment.
If a C-suite executive knows that an erratic model will result in personal, uninsurable fines and a lifetime ban from the industry, the corporate appetite for deploying unvetted, hyper-aggressive systems drops to zero overnight. The "arms race" ends because the people holding the purse strings suddenly refuse to run the race.
The Cost of the Current Strategy
There is a significant downside to the contrarian approach I am advocating. If you enforce strict liability and stop trying to build co-regulatory tech stacks, financial innovation will slow down. Some firms will delay deploying genuinely useful predictive models out of sheer risk aversion.
But look at the alternative. Under the current trajectory, we are headed for a regulatory state that is both incredibly intrusive and completely ineffective. Watchdogs will spend billions in taxpayer money trying to build shadow infrastructure. They will demand access to proprietary codebases, creating massive cyber security honey pots. They will issue thousands of pages of guidelines that are outdated before the ink dries.
And when the next major market dislocation occurs, the watchdogs will stand before parliament, point at their empty pockets, and say, "We just didn't have the compute power to see it coming."
Stop buying the software. Start rewriting the indictments.
