Financial sector governance faces technological challenges including AI, decentralised finance and open finance, commissioner of the Financial Sector Conduct Authority (FSCA) Unathi Kamlana said on Thursday. Kamlana delivered a public lecture at the University of Cape Town, entitled, “Governing the invisible: leadership, innovation and accountability in the financial sector.” He said the three interconnected technological frontiers of AI, decentralised finance and open finance were redefining how financial products were designed, distributed and consumed, reshaping business models and the relationships between financial institutions and their customers. Their defining characteristic is that all are increasingly invisible, operating in the background. “At the same time, they are redistributing risk, altering market structures and challenging many of the assumptions on which our regulatory frameworks have traditionally been built,” Kamlana said. AI had evolved into its becoming decision-making agents. “In the financial sector, that distinction is important. We are moving from systems that assist human judgement to systems capable of exercising delegated judgement on behalf of financial institutions. “An agentic system can execute trades without waiting for human instruction. It can assess a credit application and make a lending decision in milliseconds. It can interpret images of accident damage, determine liability, authorise settlement and initiate payment all within a fully automated decision chain. Multi-agent systems are already replacing complex human decision processes in major financial institutions, not as a future possibility, but as a present operational reality,” Kamlana said. For regulators, this raised the question of accountability and who would take responsibility for AI decisions. Kamlana referred to this as an “accountability fracture” — a growing separation between those who made decisions and those who could ultimately be held responsible for them. “As decision-making becomes increasingly distributed across algorithms, and a broader ecosystem of technology vendors, AI model developers, cloud service providers, data providers and financial institutions, traditional notions of accountability become progressively more difficult to apply.” However, Kamlana stressed that financial institutions had to remain accountable for the decisions made in their name, regardless of how many technology providers contributed to those decisions. The FSCA together with the South African Reserve Bank and the Prudential Authority, the FSCA is developing a joint discussion paper on AI in the financial sector, including specific considerations on agentic AI. High-level governance principles relating to the use of AI by financial institutions will be developed. On decentralised finance and crypto assets, Kamlana said decentralised finance challenged the notion of financial intermediation and created accountability challenges, while crypto assets also posed regulatory challenges. “Rather than seeking to regulate the technology itself, we have focused on licensing and supervising the identifiable entities that provide crypto asset services.” More than 300 crypto asset service providers had so far been licensed by the FSCA with an estimated 7.8-million South Africans now owning or trading in crypto assets. Stablecoins were increasingly being used for cross-border payments and remittances across the SADC region. Self-executing computer codeBut Kamlana noted that an increasing share of activity within this market was no longer taking place through licensed, centralised intermediaries but through decentralised finance protocols, where the intermediary function was no longer performed by an identifiable institution but by distributed networks and self-executing computer code, known as smart contracts. “The intermediary has not disappeared; it has simply become invisible,” he said. “We are now increasingly regulating activity performed through invisible digital infrastructure — where there may be no company, no board of directors, no CEO, no registered office and, in many instances, no natural person to supervise or hold accountable. And code, at least for now, cannot apply for, or hold, an FSCA licence.” He cited the 2022 example of the decentralised lending and trading platform Mango Markets losing approximately $116m — almost R2bn — after an attacker manipulated prices in a way that the protocol’s smart contracts were designed to accept. “Increasingly, regulators around the world are recognising that where identifiable individuals or groups exercise effective control over a protocol, whether by controlling governance tokens, approving software upgrades or setting key operational parameters, they should also bear corresponding regulatory responsibilities,” Kamlana said. “If a protocol performs the economic role of an exchange, a lending platform or another regulated financial service, then it must meet the standards that are commensurate with that activity. The invisibility of the intermediary cannot become a shield against the obligations associated with that activity. I believe this will be the next chapter of crypto regulation, not only in South Africa but globally. “If AI asked ‘who decided this?’ and decentralised finance asked ‘who’s responsible when there is no middle man?’, open finance asks ‘who owns the data to begin with and have they consented to its use?’,” he said Open finance was built on the idea that customers’ financial data was theirs and should therefore work for them, with the information largely remaining with the institution. Open finance turned that model on its head, enabling — subject to a customer’s consent — financial data to be shared securely with other financial institutions and authorised third-party providers to provide new financial services. “Financial information can move seamlessly between institutions, platforms and third-party providers, often without consumers fully appreciating where their information is going, how it is being used or who ultimately benefits from it. That creates important governance challenges,” Kamlana said. “If third-party providers become trusted custodians of consumers’ financial information, they cannot remain outside an appropriate regulatory framework simply because they are technology companies rather than traditional financial institutions. Their role may differ from that of a bank or insurer, but the risks they create for consumers, markets and confidence in the financial system can be equally significant,” he said. Kamlana insisted that those who deployed the new technologies had to account for it. Business Day