ISO 42001 for banks and financial services: credit and fraud models, model risk and the evidence an auditor samples

Why banks and financial institutions ask for ISO/IEC 42001

ISO/IEC 42001 sets requirements for an AI management system; the requirements guide covers the text. In banking the pressure comes from three directions.

The first is the board and its risk committee, who approve credit and fraud models but rarely see every AI system in use, its owner and the residual risk accepted. The second is counterparties: corporate clients and fintech partners send due-diligence questionnaires that ask how AI is governed, and an accredited certificate answers faster than a policy document. The third is regulation. The EU AI Act lists creditworthiness assessment and credit scoring of natural persons among its high-risk uses and requires deployers of those systems to assess the impact on fundamental rights before first use.

A certificate does not satisfy a regulator on its own, but it shows that the controls a supervisor will ask about already operate.

What sits inside the scope for a bank

Scope starts with an inventory. In a bank it typically covers application and behavioural scoring, credit decisioning engines, fraud and anti-money-laundering monitoring, collections prioritisation, chatbots, document reading in onboarding, and generative AI tools used by staff. For each system the scope records your role: developer and provider of an in-house model, or user of a model licensed from a vendor or embedded in a core banking or card platform.

Three scope mistakes recur. Certifying the data science team alone, while the business lines that decide with its models sit outside. Leaving out vendor models because the bank "only uses" them, when the standard expects externally provided services to be controlled. And omitting fraud models because they fall outside the EU AI Act's credit-scoring item, when their errors still block payments and freeze accounts. The method is in ISO/IEC 42001 scope: which AI systems and roles are in, and the mistakes that cost you.

Where the requirements bite in banking

All nine control groups are covered in ISO/IEC 42001 Annex A: the 38 controls explained.

Working alongside model risk management, the EU AI Act and DORA

Most banks already run a model risk management framework with an inventory, tiering and independent validation. ISO/IEC 42001 places it inside a management system with a policy, objectives, internal audit and management review, and extends it to vendor tools and generative AI. The impact assessment adds the customer view that validation reports seldom record.

For EU operations, the EU AI Act gives deployers of high-risk credit systems duties of human oversight, log retention and informing affected people, and gives those people a right to clear and meaningful explanations of certain decisions; ISO/IEC 42001 certification gives no presumption of conformity. See ISO/IEC 42001 and the EU AI Act: what the certificate does not give and EU AI Act for banking, credit and insurance. The Digital Operational Resilience Act requires financial entities to manage ICT third-party risk, so AI vendors can sit in the same supplier register; see DORA compliance. Where the bank holds ISO/IEC 27001, the AIMS extends that system; see ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS.

What a banking engagement looks like

Duration depends on the number of AI systems, how complete the model inventory is, the vendor documentation available, whether an ISO/IEC 27001 system runs and the certification body's calendar. Model risk, data science, credit, fraud operations, compliance, legal, procurement, information security and internal audit must be involved, with a risk committee sponsor. With Design™, Sterling guides your teams to own the assessments and records; with Drive™, Sterling carries more of the inventory, documentation and readiness testing.

ISO 42001 for banks: questions buyers ask