What does ASIC REP 798 say about AI in banking?

What are the key points of ASIC REP 798?

• ASIC analysed 624 AI use cases from 23 licensees in banking, credit, insurance and financial advice, current or in development as at December 2023, and met 12 of the licensees in June 2024.
• Finding 1 and 2: AI use varied significantly and is accelerating; 57% of all use cases were less than two years old or in development, and there is a shift to more complex and opaque techniques, particularly generative AI (92% of generative AI use cases were less than a year old or not yet deployed).
• Finding 3: deployment strategies were mostly cautious; AI generally augmented human decisions or increased efficiency rather than making autonomous decisions, and most use cases did not directly interact with consumers.
• Findings 4 to 6: not all licensees had adequate arrangements for AI risks; some assessed risk through the lens of the business rather than the consumer (for example algorithmic bias); governance varied widely. Only 12 licensees had AI policies referencing fairness and only 10 referenced disclosure of AI use to consumers.
• Finding 7: the maturity of governance and risk management did not always align with the nature and scale of AI use; in two cases governance lagged AI use, creating the greatest risk of consumer harm.
• Finding 8: licensees relied heavily on third parties for AI models; 30% of use cases used third-party models, for four licensees all of their models were third-party, and for 13 licensees at least half were; not all had appropriate governance to manage the risks.
• ASIC reminds licensees that existing obligations are technology neutral: general licensee obligations, consumer protection provisions including prohibitions on unconscionable conduct and on false or misleading representations, directors' duties of care and diligence, and responsibility for outsourced functions.
• ASIC sets 11 governance questions: taking stock, strategy, fairness, accountability, risks, alignment, policies, resources, oversight, third parties and regulatory reform.

What did ASIC REP 798 change for banks?

REP 798 is the benchmark for how ASIC will look at AI governance at financial services and credit licensees, including banks' consumer-facing businesses. It did not change any legal requirement, but ASIC's message that licensees should not take a 'wait-and-see approach' to reform and that governance arrangements should lead AI use signals what it will look for. It was followed in 2026 by APRA's AI letter to industry (30 April 2026) and the joint APRA-ASIC frontier AI statement (27 August 2026), which cover the prudential and cyber side.

What does ASIC Report 798 expect of financial services licensees using AI?

ASIC Report 798 expects licensees to make sure governance leads AI use rather than trailing it. ASIC reviewed 624 AI use cases at 23 licensees (as at December 2023) and found a rapid acceleration in use, a shift towards complex and opaque techniques such as generative AI, gaps in how some licensees assessed consumer risks like algorithmic bias, and heavy reliance on third-party models. It says licensees should consider the existing technology-neutral framework (general licensee obligations, consumer protection provisions including false or misleading representations and unconscionable conduct, and directors' duties), treat third-party models with the same expectations as internal ones, and work through eleven questions on strategy, fairness, accountability, risk, policies, resources, oversight and third parties. The report creates no new obligations.

REP 798 is the conduct-side counterpart to APRA's prudential standards. ASIC's foreword says current licensee obligations, consumer protection laws and director duties are technology neutral and that licensees 'should not take a wait-and-see approach' to legislative and regulatory reform. ASIC says it will continue to monitor how regulated entities use AI, contribute to the Australian Government's development of AI-specific regulation, collaborate with domestic and international counterparts and, where necessary and appropriate, take enforcement action.

The report's case study is a licensee whose AI credit-default model was a 'black box' with limited monitoring and incomplete documentation yet stayed in use for several months, illustrating the gap between adoption and governance. The sample is not representative of AI use generally, which is why the report is a pointer to supervisory focus rather than a market measure.

For banks, REP 798 is best read alongside APRA's CPS 230 (service providers and operational resilience), CPS 234 (information security) and April 2026 letter on AI; ASIC covers conduct and consumer outcomes, APRA covers prudential resilience.

WHAT THIS MEANS IN PRACTICE

• Run the eleven questions as a self-assessment and record who answered each and what evidence supports it.
• Keep an inventory of AI use cases with a risk rating that considers consumer impact, not only business risk, and assess bias and explainability for models that affect credit or product decisions.
• Apply the same validation and monitoring expectations to third-party AI models as to internal ones, and keep a documented third-party supplier process.
• Make sure representations about AI use, model performance and outputs are accurate, and decide how to disclose AI use to affected consumers.
• Brief directors and officers: ASIC says their duty of care and diligence extends to the adoption, deployment and use of AI.