The Same Wrong Answer: What Shared AI Models Do to Financial Crime Controls

On 13 July 2026 four technology companies came under the direct oversight of UK financial regulators for the first time. The Critical Third Parties (Designation) Regulations 2026 named Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. The critical services they supply to banks, insurers and market infrastructures now sit under the joint oversight of the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA). HM Treasury, announcing the designations on 10 July, gave the reasoning without decoration: as reliance on cloud services deepens, trouble at one major supplier can reach many firms at once. It is a serious regime addressing a real dependency. Yet four days before that announcement, the FCA published a document describing a different failure altogether, and the new regime does not reach it.

The regulator has already named it

The failure in question has already been described, and by the regulator itself. Systemic risk has conventionally been read through a prudential lens concerned with stability and confidence; artificial intelligence (AI), the Mills Review argues, poses something broader. Published on 6 July 2026 and led by FCA executive director Sheldon Mills at the request of the FCA Board, the Review gives the point a single passage in its executive summary. Shared reliance on similar models, datasets and infrastructure providers could generate "correlated behaviour, herding, opacity and common points of failure" across financial services. A change or failure in a widely used model, it adds, could move through firms and markets quickly.

The Review goes further, noting that this concentration risk may require the operational resilience and critical third party regimes themselves to be revisited. Yet three days later the critical third party regime went live, unrevisited. Designation reaches the provider whose service stops. It does not reach the model that keeps running and is wrong in the same way everywhere.

An outage announces itself

The distinction is one of detectability, and it carries the whole argument. A cloud failure is loud. It has a start time, an incident ticket, a recovery objective and a regulatory notification. The Treasury's own framing of the new regime is built entirely around that shape of event: identifying disruption, managing it and recovering critical services. Availability is the object throughout. Correctness never appears.

Yet a correlated model failure has none of those properties. Where a widely deployed model misreads a document type, misclassifies a customer pattern or applies a judgement in a way its developers never intended, nothing stops. Alerts still generate, decisions still complete, audit trails still populate. Every firm's control operates exactly as designed and produces the same defect at the same moment, and no incident log anywhere records an event. The failure is legible only from above, by comparing outcomes across institutions that have no sight of each other.

The Bank's own forum has arrived at the same distinction. Minutes of its meeting of 3 June 2026, published on 5 August, record a workshop separating two kinds of contagion. Fast-moving contagion unfolds within minutes of a provider or infrastructure outage. Slow-moving contagion arises from correlated errors that spread gradually, and may surface only through comparison across firms. The regime that went live in July is built for the first kind.

Designation does not close the gap by reaching further up the stack. Two of the four entities also sell model services, and the Regulations designate companies rather than listing what is covered, leaving the regulators to scope oversight to systemic services. Even where a model reaches a firm through a designated entity, the question asked of that service is whether it stays up, not whether its output is right. The regime has reached the socket, not the judgement.

Concentration is deepest in compliance

The most reliable UK measurement of that judgement layer remains the third joint Bank of England and FCA survey, published on 21 November 2024. It found 75 per cent of responding firms already using AI, and a third of all use cases implemented by third parties, against 17 per cent two years earlier.

The concentration figures matter more. The top three providers accounted for 73 per cent of named cloud providers, 44 per cent of model providers and 33 per cent of data providers. The model figure had been 18 per cent in 2022. Cloud concentration was in fact slightly lower than in 2022; concentration among model providers more than doubled inside a single survey cycle. The layer that eased is the layer now designated.

Yet where that concentration sits is the part that should trouble financial crime functions. Risk and compliance recorded the second highest proportion of third-party implementations of any business area, at 64 per cent, behind only human resources. The same firms named anti-money laundering and fraud among the areas of greatest current benefit from AI, alongside data insight and cybersecurity. Asked to rank systemic risks, they put cybersecurity first, critical third-party dependencies second and common data sets and models third.

Two of those three now have enforceable machinery. Cyber risk has an operational resilience framework and a joint supervisory statement; third-party dependency has a designation regime. Common models have a workstream and a survey question.

Herding is not only a market problem

The Bank of England has begun work on the question, and the framing is revealing. Responding to the Treasury Committee's report of 20 January, Deputy Governor for Financial Stability Sarah Breeden set out the Bank's approach on 1 April 2026. It is working with international counterparts on simulation methods, to establish when AI agents trading in financial markets might move together and amplify a stress. That is herding as a market phenomenon: emergent, unintentional, procyclical.

But financial crime presents the same structure with an adversary attached. Correlated positioning in markets arises from many participants reacting to similar signals. A correlated gap in detection can be hunted deliberately. Where a criminal establishes that a structuring pattern, a forged document or a mule typology passes undetected through one widely deployed model, that finding travels to every institution running the same model beneath its controls. The probing is cheap, repeatable and private, and it leaves no trace, because a control that fails to fire generates nothing to review.

The regulators have already named this pattern in cyber. The Financial Policy Committee judged at its June meeting that vulnerabilities may now be found and exploited faster than firms can respond, and that patching at that pace could itself become a source of systemic operational risk. The logic transfers to controls, and worsens. A software vulnerability at least has a patch cycle. A control weakness found by an adversary has no equivalent, because nobody has classified it as a defect.

No single firm can see it

This is where firm-level governance meets its limit, and the limit is structural rather than a failure of effort. Model risk management, including the PRA's expectations for banks under SS1/23, asks whether a firm's model is appropriate, validated and monitored for drift. Yet every question it poses can be answered correctly by a firm that is nonetheless exposed, because not one of them is about anyone else. Correlation is a property of the population, not of the portfolio. A firm can hold impeccable documentation on a model that many of its competitors are also running, and remain entirely unaware of the fact.

Measurement therefore has to happen above the firm, and it is thin. The Financial Stability Board reported on 10 October 2025 that direct indicators of AI-driven correlation, such as measures of interaction between models, are simply not available yet, leaving authorities working from proxies. It proposed a plain alternative: count how many institutions use each widely used pre-trained model, and record its features and training data sources. The same report found that only a few authorities ask firms to rank herding and common models among AI risks at all, that fewer than half collect monitoring data annually, and that none collect it more often than that. The fourth Bank and FCA survey is due to run during 2026, and the AI Consortium is due to consolidate its workshop findings, concentration among them, into a publication. Until they do, the most recent published measurement of model concentration in UK financial services describes 2024.

Diversity has become a control

Three things follow for firms, and none requires waiting for a rule.

First, an inventory of a firm's own AI systems is no longer the hard part. The harder question runs one layer up: which foundation model sits beneath each purchased service, and whether three of the four vendors on a panel are wrapping the same one. Four contracts look like diversity. Yet supplier diversity counted at the contract is not diversity counted at the model, and procurement has not been asking which number it is buying.

Second, material controls deserve a second opinion that is not correlated with the first. In financial crime that means treating rules-based detection, network analytics and experienced human typology review as deliberate diversification rather than as legacy awaiting decommission. A weaker control that fails differently is worth more than a stronger control that fails identically.

Third, testing has to move outside the firm. Institutions test their own models against their own data and their own historical cases; nobody tests whether one evasion works across the sector, and no single firm can. The AI Consortium reached the same point in June, proposing that the supervisory question shift from whether an individual firm can deploy a system safely to whether the wider system can observe, test and contain it. Firms wanting influence over how that lands should be contributing typologies to cross-market testing now, through the Cross Market Operational Resilience Group, rather than waiting to be surveyed.

The answer nobody questioned

The Critical Third Parties regime is a real achievement, and its logic is the logic of every operational resilience framework built since the financial crisis: establish what could stop, keep it running, and recover quickly when it does not. That logic assumes failure announces itself.

Yet shared models break the assumption, and they break it quietly. The harder version of the shift the Mills Review describes, from harm inside one firm to harm across the system, is not a provider going dark. It is thousands of institutions receiving the same flawed answer, acting on it faithfully, evidencing it beautifully, and learning months later that every control performed exactly as specified.

Resilience regulation was built for the day the lights go out. If the next systemic failure announces itself, that machinery will hold. If it does not, there will be nothing to declare, nothing to recover and nothing in any incident log to find. That is the day every institution in the market is handed the same wrong answer, and files it.

Does your firm know which upstream models sit beneath its financial crime controls, and whether one shared failure mode could disable all of them at once?

If that cannot be answered from your model inventory today, we can help you establish the position and evidence it; contact us.

At OpusDatum, we examine financial crime controls at the level where correlation actually bites, testing whether detection, screening and decisioning would fail in the same direction across a firm's estate and its supply chain. Our concern is not whether a model was governed but whether anyone knew who else was running it, and what a firm could show a supervisor asking that question cold.