Banks must notify before using AI to chat with customers

In the draft Circular on safety, risk management and conditions for AI application in the banking industry, the State Bank said this regulation applies to systems such as virtual assistants, automatic switchboards, chatbots…

Banks and e-wallets also need to notify customers in advance if they use AI to identify emotions or classify biometrics. They must publish content (images, audio, video…) created by AI to avoid confusion.

Also according to the draft, banks are not allowed to use AI to exploit customers’ weaknesses (due to age, disability, or economic status…) for the purpose of inviting them to use inappropriate, high-risk financial products and services.

Customers have the right to complain about bank decisions made based on AI. In this case, the bank must use personnel (human) to review and provide solutions.

These regulations are expected to take effect from March. With the AI ​​system deployed before this time, the effective date will be delayed to September 2027 for banks and e-wallets to review and comply.

The State Bank believes that the tightening of AI use in the banking system is designed to control and minimize arising risks. This is to ensure customers are treated fairly, and to protect vulnerable groups.

In Vietnam, many banks started testing chatbots (automated consultants) and virtual assistants about 10 years ago. Most units use chatbots according to existing scenarios, responding based on a fixed set of rules through keyword recognition in the input text. Currently, Generative AI is gradually becoming popular, aiming to replace the role of consultants to answer information about transactions, card services, interest rates, exchange rates…

According to the State Bank, many banks and e-wallets are promoting the application of AI in many different operations such as eKYC, credit scoring, loan appraisal, and payment fraud detection. The management agency believes that this also creates risks and challenges in information system security, output data distortion, and infringement of customer privacy.