What does Japan FSA AI Discussion Paper v1.1 say about AI in banking?

What are the key points of Japan FSA AI Discussion Paper v1.1?

• Section II.2 explains the revision: the FSA AI Public-Private Forum (June to December 2025) found AI use advancing quickly, with customer-facing use, nearly absent at the November 2024 survey, reaching limited-scope service provision or consideration, and risk-management practice beginning to form through trial and error.
• Section III.3 is new: expansion of AI utilisation into customer-facing services and AI agents (2025 described as the first year of AI agents), including interest in agentic AI to automate financial processes.
• Customer-facing risk-mitigation measures are grouped into Design and Pre-testing (for example RAG-based restriction of response scope, output filtering, a choice between AI and human service), Appropriate customer guidance and risk warnings (disclosing AI-generated responses may contain errors, customer-understanding checkpoints, the ability to switch to a human), Review and Monitoring (retention of conversation logs, response monitoring) and Governance.
• Section IV.1.②.v (regulatory compliance): for securities firms outsourcing AI system development to a system subsidiary, the paper's view is that non-public information need not necessarily be stripped from customer conversation data beforehand, because the exception for maintaining and managing information-processing systems (Cabinet Office Ordinance on Financial Instruments Business Etc., Article 153(1)(7), item (ト)) has been interpreted to include system development.
• The paper also discusses access by data scientists to conversation data that may include corporate-related information, and whether a generative-AI recommendation constitutes 'solicitation' under the Financial Instruments and Exchange Act, which it says depends on the specific facts.
• Section IV.2 sets out the FSA's response direction and adds industry-level knowledge sharing among expectations of business operators; the structure also covers enterprise-level issues (data management, governance, internal rules, talent, ROI, model and risk management, third-party selection, cybersecurity, financial crime) and system-level issues (explainability, fairness and bias, hallucination, personal information, regulatory compliance).
• It keeps the Version 1.0 position that the FSA's basic stance is technology-neutral and that existing laws apply regardless of whether AI is used, and invites comments by email to the Fintech and Innovation Office.

What did Japan FSA AI Discussion Paper v1.1 change for banks?

Version 1.1 shifts the FSA's discussion from whether firms should adopt AI to how to deploy it safely in customer-facing and agentic settings, drawing on a six-month public-private forum. It gives banks and securities firms concrete reference points for risk mitigation and flags regulatory interpretations the FSA considers workable, while still imposing no new obligations.

What does the Japan FSA's AI Discussion Paper Version 1.1 say about AI in banks?

Version 1.1 of the Japan FSA's AI Discussion Paper (3 March 2026) is a non-binding update of the March 2025 paper, based on the FSA AI Public-Private Forum of June to December 2025. It records that customer-facing AI is reaching limited, carefully scoped deployment, groups risk-mitigation measures for customer-facing services into four perspectives (design and pre-testing, customer guidance and risk warnings, review and monitoring, and governance), discusses AI agents, and offers views on securities-sector regulatory questions on outsourcing data, access to corporate-related information and solicitation. It keeps the FSA's technology-neutral stance: existing laws apply regardless of whether AI is used, and the FSA will first consider revising principles and guidelines. It adds no new obligations, and it is the current FSA reference for how Japanese banks should think about generative AI governance.

The FSA says on its page that it has updated Version 1.0 and revised it as Version 1.1 based on insights gained through the FSA AI Public-Private Forum. The new content reflects a phase in which institutions are moving from experiments to concrete, executive-led initiatives, and the paper's regulatory-compliance discussion shows the FSA offering interpretations for specific securities-sector scenarios while saying that appropriateness is a case-by-case, substantive judgment.

As with Version 1.0, it should be read together with existing rules such as the FSA's cybersecurity guidelines for the financial sector. In May 2026 the FSA and Bank of Japan separately issued a short-term request on frontier-AI cyber threats, which is not part of this paper.

WHAT THIS MEANS IN PRACTICE

• Compare customer-facing AI controls with the four groups of mitigation measures in the summary.
• Record AI and data use purposes and manner clearly before asking the FSA for interpretation, as the paper suggests.
• Keep conversation logs and monitoring for customer-facing AI.
• Watch for FSA guideline revisions, which the FSA says it will consider before any legal response.