If your bank uses AI with customers, or plans to, ASIC has now told its board when it expects to start looking. The banking sector letter, addressed to bank boards and executives and signed by Commissioner Kate O’Rourke, puts Use of AI by banks first among its new activities for 2026-27, with an expected commencement in the second quarter of that year. Read as the financial year beginning 1 July 2026, the second quarter runs from October to December 2026; that is our reading, as the letter gives no months. For bank customers, the point is the subject: the review is about what AI does to them.

What the banking letter says

The review will be focused on new and proposed use cases of AI by banks and the impact on customers.

ASIC, banking sector priorities letter, 30 September 2026 (PDF page 2)

The item is three short paragraphs. It says ASIC will continue its oversight of AI adoption in financial services by commencing a banking sector AI review, and that We will collaborate with APRA to minimise duplication from any work they are undertaking relating to risks presented by the use of AI. It says ASIC is keen to ensure that key consumer protections are maintained as AI is deployed, particularly for customer-facing interactions, decision-making and lending processes. ASIC’s release summarises it more narrowly: ASIC will review the use of AI in customer-facing activities. The letter is the document banks were sent, and its wording is wider.

In the letter

Who
Banks
What
New and proposed use cases of AI, and the impact on customers
When
Expected commencement in Q2 2026-27
With whom
APRA, to minimise duplication

Not in the letter

Which banks
Not named, and no number given
Months
None given; Q2 only
Published findings
Not mentioned for this review. The same letter says ASIC will publish its debt collection findings in the third quarter of 2026-27

The dashed card lists what the AI item does not say. Source: ASIC, banking sector priorities letter, 30 September 2026, PDF pages 2 and 3, read in full.

The letter also says where ASIC has been in between. Its 2024 report on AI governance, it says, found AI adoption across the financial services sector was growing while governance and risk assessment lagged, including in assessing consumer risks, and Since then, ASIC has continued to engage with banks on their AI use through supervisory engagements.

Five letters, and where AI sits in each

ASIC published five sector letters on 30 September: banking, superannuation, general insurance, life insurance and markets. Its release says ASIC has engaged with APRA and other regulators in deciding the activities included in the letters, and that where there was overlap, activities were recast, removed or will be done collaboratively. We read all five and counted every use of the term AI.

Every use of “AI” in ASIC’s five 2026-27 sector letters
  1. BankingA review with its own heading: Use of AI by banks, expected Q2 2026-27p2p2p2p2p2p2p2p2p2
  2. MarketsAI-driven manipulation; defensive AI; attacks enabled by frontier AIp3p3p3p3p3
  3. Super“AI usage”, one of four other areas of focusp4
  4. Life“the impact of AI usage”, a continuing area of focusp2
  5. General ins.No mention of AI

 in a new-activities section: 14  in a continuing or other section: 2

Each mark is one use of “AI” as a word in our text extraction of the letter, labelled with its PDF page, and filled where it sits under the letter’s new activities or new areas of focus; “AI-driven” counts once, and the title of ASIC’s 2024 report, quoted inside the banking item, counts. No letter spells out “artificial intelligence”. The headings are ASIC’s: the banking, superannuation, general and life insurance letters use “New activities” and “Continuing areas of focus”; the markets letter uses “New areas of focus for 2026-27”. Our count, 9 October 2026. Source: the five ASIC sector letters, 30 September 2026.

The markets letter, signed by Commissioner Simone Constant, carries the second-heaviest AI load, all of it in its new areas of focus. We will assess and address AI-driven manipulation and market integrity risks, including deepfakes and misinformation, it says, using generative AI, social media monitoring and cross-market analysis. We read that list as the tools ASIC will use, not the means of manipulation; the sentence allows either. On resilience, it is direct: We expect intermediaries to explore defensive AI for threat intelligence, vulnerability detection and incident response. It also says ASIC will test its crisis response frameworks, and expects industry to do the same, including for attacks enabled by frontier AI. That follows ASIC’s May letter on frontier AI and cyber, and sits beside the trading rules ASIC amended for agentic AI in September.

The other three are lighter. The superannuation letter lists AI usage among its other areas of focus, beside misconduct targeting vulnerable members, scams and cyber resilience. The life insurance letter keeps a continued focus on the impact of AI usage. The general insurance letter does not mention AI; the nearest it comes is a sector that operates amid rapid technological change.

The 2024 baseline

The banking letter points back to Report 798, Beware the gap, published in October 2024. ASIC analysed 624 AI use cases that 23 licensees in banking, credit, insurance and financial advice were using or developing as at December 2023. Two of its key statistics are about the policies those 23 had in place.

Of the 23 licensees ASIC reviewed in 2024, how many had AI policies that referenced…

12 fairness, or related concepts such as inclusivity and accessibility

10 disclosure of AI use to affected consumers

Each square is one of the 23 licensees. Source: ASIC, REP 798, executive summary, key statistics (PDF page 4); data as at December 2023. ASIC chose licensees it judged most likely to be using AI, so these are not rates for any sector.

That last caveat is ASIC’s own: The sample was not representative of AI use generally, or of the sectors in the review. The report also found that Some licensees assessed risks through the lens of the business rather than the consumer, and that 61% of the licensees planned to increase their AI use in the following 12 months. The 2026 review is the follow-up for one of the sectors in that sample.

The dates

  1. Dec 2023The point in time for REP 798’s 624 use cases from 23 licensees
  2. Jun 2024ASIC meets 12 of the licensees to discuss their use cases and governance
  3. Oct 2024REP 798 Beware the gap published
  4. 30 Sep 2026ASIC publishes its five 2026-27 sector letters
  5. Q2 2026-27Banking sector AI review: expected commencement

Dates as the sources give them: December 2023, June 2024 and October 2024 from REP 798 (PDF pages 1 and 4); 30 September 2026 and Q2 2026-27 from the banking letter.

Our view

A review of what AI does to bank customers is the right next step after REP 798, and the letter’s wording is worth taking literally. It covers proposed use cases, so a bank’s AI roadmap is in scope, not only what is already live. A bank that wants to be ready would list those uses now and check how it assessed their risk to customers, because looking through the lens of the business rather than the consumer is exactly what REP 798 found some licensees doing.

It is also narrower than the report it follows. REP 798 drew on banking, credit, general and life insurance and financial advice. The 2026-27 letters give a dated AI review to banks alone, a line each to super and life insurance, and nothing to general insurers. ASIC may have good reasons, including APRA’s work, but the letters do not give them. And the letter should say whether the findings will be published. ASIC published what it found last time, as REP 798, and this same letter commits to publishing its debt collection findings. Banks’ customers have the same claim on the AI ones.

How we did this

On 9 October 2026 we read ASIC’s 30 September release (26-232MR) and all five sector letters in full: banking (4 pages), superannuation (4), general insurance (4), life insurance (3) and markets (7). We counted “AI” as a whole word in a text extraction of each letter and checked each hit against the PDF, and searched each for “artificial intelligence” (no matches). From REP 798 (43 pages) we read the foreword, the executive summary and key statistics, Table 1 and the methodology appendix, not the whole report. The quarter-to-months reading is ours. We did not read the Council of Financial Regulators material the release links to, or APRA’s own AI work, so we make no claim about what APRA is doing.

“Our view” is opinion based on the documents cited. We have not asked ASIC about anything here.

Sources

  1. ASIC, 26-232MR ASIC releases 2026-27 supervisory priorities to support better regulation and give industry greater certainty, media release, 30 September 2026 (read 9 October 2026): the five letters; engagement with APRA and other regulators; the banking summary.
  2. ASIC, ASIC’s 2026-27 banking sector priorities, letter to bank boards and executives, 30 September 2026, 4 pages (read in full 9 October 2026): Use of AI by banks; the APRA collaboration; the debt collection findings.
  3. ASIC, ASIC’s 2026-27 markets sector priorities, letter to boards and executives, 30 September 2026, 7 pages (read in full 9 October 2026): AI-driven manipulation; defensive AI; frontier AI.
  4. ASIC, superannuation sector priorities letter for 2026-27, 30 September 2026, 4 pages (read in full 9 October 2026): AI usage among other areas of focus.
  5. ASIC, life insurance sector priorities letter for 2026-27, 30 September 2026, 3 pages (read in full 9 October 2026): the impact of AI usage as a continuing focus.
  6. ASIC, general insurance sector priorities letter for 2026-27, 30 September 2026, 4 pages (read in full 9 October 2026): no mention of AI.
  7. ASIC, REP 798 Beware the gap: Governance arrangements in the face of AI innovation, October 2024, 43 pages (read in part 9 October 2026): the 23 licensees and 624 use cases; key statistics; finding 5; the sample caveat.

Read the letters differently, or work on AI at a bank and have a view on the review? Tell us and we will check it against the documents and log the outcome here.