What does IOSCO FR06/2021 say about AI in banking?

What are the key points of IOSCO FR06/2021?

• Issued by the Board of IOSCO as Final Report FR06/2021, dated September 2021, following a Consultation Report of June 2020.
• The Board approved a mandate in April 2019 for Committee 3 (Market Intermediaries) and Committee 5 (Investment Management) to examine best practices for supervising AI and ML.
• Risk areas identified in the consultation: governance and oversight; algorithm development, testing and ongoing monitoring; data quality and bias; transparency and explainability; outsourcing; and ethical concerns.
• Measure 1: regulators should consider requiring designated senior management responsible for oversight of the development, testing, deployment, monitoring and controls of AI and ML, with a documented internal governance framework and an appropriately senior sign-off individual or group.
• Measure 2: regulators should require firms to test and monitor algorithms continuously, with testing in an environment segregated from live deployment to confirm behavior in stressed and unstressed market conditions and regulatory compliance.
• Measure 3: regulators should require adequate skills, expertise and experience; compliance and risk functions should be able to understand and challenge the algorithms and to conduct due diligence on third-party providers.
• Measure 4: regulators should require firms to understand reliance on third-party providers, monitor their performance, and have a clear service level agreement and contract setting out scope, performance indicators, and rights and remedies.
• Measures 5 and 6: regulators should consider what disclosure of AI and ML use is required, including meaningful information to customers and clients and the information regulators need, and should consider requiring controls so data is of sufficient quality to prevent biases.

What did IOSCO FR06/2021 change for banks?

FR06/2021 was the first international regulatory guidance specific to AI and ML in securities markets. It set the six-measure structure that IOSCO's 2026 Supervisory Toolkit now cross-references, and it supplied the vocabulary (senior management accountability, segregated testing, third-party SLAs, disclosure, data quality) that national securities regulators use. For a bank with securities businesses, it is the international template behind local supervisory questions.

What does IOSCO FR06/2021 require of firms using AI and machine learning?

IOSCO Final Report FR06/2021 requires nothing of any firm directly. It sets six measures that IOSCO members are encouraged to consider, proportionately, in supervising market intermediaries and asset managers that use AI and machine learning: designated senior management with a documented governance framework (Measure 1); continuous testing and monitoring in an environment segregated from live deployment (Measure 2); adequate skills and the ability to challenge algorithms and third parties (Measure 3); understanding and managing third-party reliance through clear service level agreements (Measure 4); consideration of disclosure to clients and regulators (Measure 5); and controls over data quality to prevent bias (Measure 6). Published on September 7, 2021, the guidance is not binding but underpins IOSCO's 2026 Supervisory Toolkit. It matters to banks through their securities-regulated affiliates.

FR06/2021 followed a June 2020 consultation and confirms its proposed guidance, amended for responses. It is addressed to regulators, which is why Measures 1, 5 and 6 say regulators should 'consider' requiring or deciding something while Measures 2, 3 and 4 say regulators 'should require' it; either way it is non-binding, and IOSCO tells members and firms to consider proportionality. The report's sector scope is market intermediaries and asset managers, so it is a securities-conduct document and not a bank prudential one.

The six measures are the skeleton of later regulation. Senior-management accountability and independent challenge echo model-risk expectations; segregated pre-deployment testing and continuous monitoring anticipate later supervisory expectations for validation and drift monitoring; the third-party measure parallels outsourcing rules; and the disclosure and data-quality measures are the conduct-side counterparts of fair-lending and consumer-protection duties. A bank's securities affiliate that already meets its national securities regulator's outsourcing and governance rules will normally be close to these measures.

In May 2026 IOSCO published a Supervisory Toolkit for AI Use in Capital Markets (FR/02/2026) that restates these six measures in a box, shows where its supervisory concerns map to them, and extends coverage to generative and agentic AI. FR06/2021 therefore remains the conceptual base even as the toolkit supplies the practical examination tools.

WHAT THIS MEANS IN PRACTICE

• Name a senior owner for AI and ML in the securities business and document the governance framework, including sign-off for deployment and substantial updates.
• Test AI and ML in a segregated environment under stressed and unstressed market conditions before release, and monitor continuously afterwards.
• Give compliance and risk functions the skills and access to challenge algorithms and to carry out due diligence on vendors.
• Put clear service level agreements, performance indicators and remedies in every AI or ML vendor contract.
• Decide what AI-use disclosure clients and regulators need, and document data-quality controls aimed at preventing bias.