Artificial Intelligence in Italian Financial Markets

Annex A. Project background and survey methodology

Project overview

As the lead supervisory authority for the stability and efficiency of Italy’s financial system, Banca d’Italia aims to strengthen its capacity to understand, analyse, and assess the impact of AI on financial markets and participants, with particular attention to underlying infrastructure and the overall value chain. To achieve this, the central bank requested support from the European Commission under the framework of Regulation (EU) 2021/240 establishing the Technical Support Instrument (TSI Regulation). Following approval of this request, the European Commission and the OECD collaborated on an 18‑month project (the “Project”) to help Banca d’Italia identify, understand, and address policy and supervisory implications of AI use across the financial market value chain, ultimately enhancing stability, resilience, and efficiency. The Project’s outcomes are relevant for other Italian financial regulatory and supervisory authorities, including the Ministry of Economy and Finance (MEF), the Commissione Nazionale per le Società e la Borsa (CONSOB), the Istituto per la Vigilanza Sulle Assicurazioni (IVASS), and the Commissione di Vigilanza sui Fondi Pensione (COVIP), and has benefited from close collaboration with the above authorities.

The implementation of the Project was steered by the Project Advisory Group (AG), composed of representatives from Banca d’Italia (Giuseppe Grande, Luca Filidi, Mauro De Santis, Michela Marinello), the European Commission SG REFORM (Cristina Pacella, Giuseppe Sciascia) and the OECD.

This Project aligns closely with the European Commission’s key policy objectives to foster digital innovation for consumer benefit and market efficiency, including AI-driven innovations, as articulated in the Digital Finance Package (2020) and the Artificial Intelligence Act (2024), and any ongoing discussions in the context of the Digital Omnibus proposal (2025). Innovation facilitators are also recognised as a priority by the European Supervisory Authorities (ESAs).

Context of the survey

From 15 April to 22 May 2025, the OECD conducted an online survey of Italian financial institutions using the LimeSurvey platform. The survey aimed to capture the scale and characteristics of AI deployment in Italian financial markets, including the number and type of projects and investments. It also assessed stakeholders’ awareness of AI opportunities, the data and monitoring practices currently in use, co‑operation between incumbents and FinTechs, and perceived opportunities and barriers to adoption. This survey was, as regards this Project, the most encompassing tool in mapping the status of AI in Italian financial markets.

The survey was divided into five sections. The introduction gathered institutional details such as sector, location and the presence of AI data science teams. The second section focussed on current AI uses, including use cases in production or development, investment levels, reliance on third-party providers, and technical aspects such as general-purpose models and open-source components. Respondents also reported on training data, explainability methods, autonomy levels and observed benefits. The third section explored expected future uses over the next three years. The fourth examined governance frameworks, accountability lines, safeguards against unintended AI activity and cyber resilience measures. The final section addressed regulatory and non-regulatory constraints, training initiatives and the role of Open Finance frameworks in enabling proprietary AI models.

Insights from the OECD industry survey build on previous data collection initiatives by Italian authorities, including the BdI FinTech survey (Banca d’Italia, 2025[1]), CONSOB’s study on AI in asset and wealth management (CONSOB, 2022[2]), IVASS’s survey on machine learning in insurance (IVASS, 2023[3]) and the CIPA-ABI survey on IT in banking (Convenzione Interbancaria Per l’Automazione, 2023[4]). The OECD survey adds value by covering the entire financial sector and providing granular insights into issues particularly relevant to financial market participants.

The OECD survey received 450 responses, ensuring strong representation across all financial sectors. This coverage is broader than previous surveys, which focussed on specific segments such as banking or insurance. Findings largely align with earlier studies: AI is widely used in operational processes like document management and compliance (Convenzione Interbancaria Per l’Automazione, 2023[4]). However, its deployment in core financial market activities remains limited, though expected to grow. The OECD survey also offers detailed insights into GPAI use, investment patterns, governance structures and reliance on third-party vendors, complementing previous findings and enriching the understanding of systemic constraints to AI adoption.

Profiles of survey respondents

A total of 450 responses were received, representing a 49% response rate, calculated in relation to the total number of supervised financial sector entities (including foreign firms with activity in Italy supervised by Banca d’Italia). Some questions were mandatory and answered by all participants, while others were optional and received fewer responses.1

Survey respondents provide strong representation across the Italian financial sector. The top five represented subsectors are asset managers (100 respondents), banks (99), credit or securitisation related business (69), insurance and reinsurance (44) and pension fund (42). Other subsectors are mutual banks (25), electronic money and payment institutions (16), investment advisors and wealth managers (10), securities investment firms (9), crowdfunding services providers (8) and financial market infrastructures (4). The “Other” category, with 24 respondents, includes fiduciary companies, other payment institutions and one broker-dealer. Mutual funds, Alternative Investment Markets and other funds were grouped under “Asset manager”.

When analyses and insights are focussed on financial market participants, these consider respondents from the following sectors only: investment advisory, asset management, wealth management, securities investment firms, broker-dealers, exchanges, multilateral trading facilities, central counterparties and central securities depositories.

Regarding company size, most sectors include a mix of micro, small, medium and large entities. Banks and insurers are mainly large or medium-sized, while asset managers, investment advisors, securities firms and pension funds are predominantly small or micro companies. All FMIs are either large or medium-sized.

Categorisation of respondents by sector

Respondents were asked to specify the sectors of activity in which they operate. Where a respondent has more than one sector of activity, they were asked to specify which of these is their main sector of activity. Accordingly, this report categorises respondents according to the main sector of activity.

The main sector of activity for some respondents has been manually reclassified to better reflect the sector in which they operate and/or the services they provide. This includes:

• Two respondents that self-identified as “Financial technology/FinTech”. These have instead been attributed to the financial sector in which they are most active.2

• Two respondents that self-identified as operating in the Factoring, Leasing and Loans sectors, which have been moved to Credit and Securitization category according to BdI instructions.

• Sixteen respondents that self-identified as “Other”. These respondents stated that they operate under Article 106 of the TUB by doing financial intermediation,3 thus being relocated to the Credit and Securitization category as per BdI’s instructions.

Categorisation of AI use cases across business macro‑areas

The survey includes questions relating to the use of AI for various purposes. Question 6.1 asks respondents “For what purposes are you currently using AI?”. Question 17.1 asks respondents “For what purposes are you planning to use AI in the next 3 years?”. For both questions, a multi-choice list of 52 different purposes was provided. Two follow-up questions (6.2 and 17.2) asked respondents to confirm, for each of the above purposes, whether they use or plan to use AI models that are:

• general-purpose

• provided by third parties

• deployed by, and/or implemented in collaboration with third parties

• internal (i.e. not client-facing).

Questions 6.2 and 17.2 allowed respondents to select only from among the purposes which they had previously selected in questions 6.1 and 17.1.

For ease of reading, in this report the purposes are classified into 23 “business macro-areas”. Table A A.1 lists the purposes, the macro-areas, and how purposes are categorized by macro-area.

Table A A.1. Categorisation of AI “purposes” by “business macro-area”

Business macro‑areas used in this report	Purposes listed in the survey	Categorisation of purposes by macro‑area
Front office (value creation): New product development Targeted Marketing / Sales (customer segmentation) Asset allocation Customer onboarding / authentication Customer support Trading strategies, execution Middle/back office (productivity enhancement): Compliance and Reporting Data analytics (information point) Risk modelling and management Fraud detection and prevention AML/ CFT ESG data processing and analytics Synthetic data generation Translation Coding HR management Trading P&L, reconciliations Post-trade processing Sector-specific and other Credit underwriting and pricing Insurance underwriting, pricing and distribution Insurance policy and claims management Collection of pension contributions Other	‒ AML/CFT controls (identification/ transaction monitoring/ reporting) ‒ Fraud detection/ prevention/ surveillance ‒ Risk modelling and management ‒ Early warning systems ‒ Data management (e.g. quality improvement) ‒ Coding/ software development ‒ Synthetic data generation ‒ Translation ‒ Summarisation ‒ Text content generation ‒ Internal GPTs ‒ Capital/ Liquidity management ‒ Cyber security (incl. network) ‒ Internal process optimisation / productivity support ‒ Compliance, internal audit and regulatory reporting ‒ HR management ‒ IR/Communications ‒ Management of client agreements ‒ Marketing and sales ‒ Client profiling/ segmentation ‒ Customer service (incl. chatbots) / client communication ‒ Client onboarding/ KYC ‒ New product development ‒ Investment research ‒ Market analysis/ insights ‒ Sentiment analysis ‒ Predictive analytics/ forecasting ‒ Financial advice (incl. budgeting, retirement planning etc.) ‒ Robo‑advice ‒ Market-making ‒ Auction strategies/pricing ‒ Security underwriting/placement ‒ IPOs/SPOs ‒ Credit underwriting (scoring/creditworthiness assessment) and pricing ‒ Trading strategies ‒ ESG/ sustainable investing modelling/ analytics ‒ Pattern recognition ‒ Hedging ‒ Trading execution (algorithmic trading) ‒ High Frequency Trading ‒ Market conduct monitoring (e.g. Market Abuse Detection) ‒ Post-trade processing ‒ Collateral securities haircut ‒ Clearing ‒ Custody ‒ Payments/settlement execution ‒ Payments monitoring/verification ‒ Asset management and Investment portfolio management ‒ Insurance underwriting (risk assessment) and pricing ‒ Insurance distribution ‒ Insurance policy management (after underwriting and before claims) ‒ Claims management ‒ Collection of pension contributions ‒ Other	Macro‑areas shown with bullets, purposes shown in italics with dash. New product development ‒ New product development Targeted Marketing / Sales (customer segmentation) ‒ Marketing and sales ‒ IR/Communications ‒ Client profiling/ segmentation Asset allocation ‒ Asset management and Investment portfolio management ‒ Investment research ‒ Robo‑advice ‒ Financial advice (incl. budgeting, retirement planning etc.) ‒ Market analysis/ insights Customer onboarding / authentication ‒ Client onboarding/ KYC Customer support ‒ Customer service (incl. chatbots) / client communication Trading strategies, execution ‒ Security underwriting/placement ‒ IPOs/SPOs ‒ Trading strategies ‒ Hedging ‒ Trading execution (algorithmic trading) ‒ Predictive analytics/ forecasting ‒ Auction strategies/pricing ‒ Market-making ‒ High Frequency Trading Compliance and Reporting ‒ Management of client agreements ‒ Compliance, internal audit and regulatory reporting Data analytics and output generation ‒ Data management (e.g. quality improvement) ‒ Summarisation ‒ Text content generation ‒ Internal GPTs ‒ Sentiment analysis ‒ Internal process optimisation / productivity support ‒ Pattern recognition Risk modelling and management ‒ Risk modelling and management ‒ Early warning systems Fraud detection and prevention ‒ Cyber security (incl. network) ‒ Fraud detection/ prevention/ surveillance ‒ Payments monitoring/verification ‒ Market conduct monitoring (e.g. Market Abuse Detection) AML/ CFT ‒ AML/CFT controls (identification/ transaction monitoring/ reporting) ESG data processing and analytics ‒ ESG/ sustainable investing modelling/ analytics Synthetic data generation ‒ Synthetic data generation Translation ‒ Translation Coding ‒ Coding/ software development HR management ‒ HR management Trading P&L, reconciliations ‒ Clearing ‒ Collateral securities haircut ‒ Capital/ Liquidity management Post-trade processing ‒ Post-trade processing ‒ Custody ‒ Payments/settlement execution Credit underwriting and pricing ‒ Credit underwriting (scoring/creditworthiness assessment) and pricing Insurance underwriting, pricing and distribution ‒ Insurance underwriting (risk assessment) and pricing ‒ Insurance distribution Insurance policy and claims management ‒ Insurance policy management (after underwriting and before claims) ‒ Claims management Collection of pension contributions ‒ Collection of pension contributions Other ‒ Other

Table A A.2. Categorisation of regulatory constraints to AI adoption

All regulatory constraints listed in the survey

Categories introduced in the charts

‒ Lack of regulatory clarity ‒ Definitional issues around what is considered an AI model ‒ Lack of supervisory guidance ‒ insufficient regulation ‒ Possible ex-post regulatory intervention (e.g. enforcement) ‒ Conflicts between existing sectorial rules/regulatory requirements ‒ Conflicts between existing sectorial and non-sectorial rules/regulatory requirements ‒ Lack of regulatory alignment between different jurisdictions ‒ Insufficient regulation ‒ Reporting obligations ‒ Cost of regulatory compliance ‒ Increased reporting requirements associated with the use of AI ‒ Data protection ‒ Copyright/IP ‒ Prudential rules ‒ Risk management frameworks ‒ Rules around model risk management ‒ Model/ data drifting ‒ Rules against bias, discrimination, unfair outcomes ‒ Rules around governance ‒ Fiduciary duty ‒ Rules requiring explainability ‒ Transparency requirements ‒ Rules on operational resiliency ‒ Cyber-resilience rules ‒ Third party risk management frameworks

Categories in the charts are shown with bullets, constraints in the survey are shown with dash. Concerns related to clarity and alignment of regulations ‒ Lack of regulatory clarity ‒ Definitional issues around what is considered an AI model ‒ Lack of supervisory guidance ‒ insufficient regulation ‒ Possible ex-post regulatory intervention (e.g. enforcement) ‒ Conflicts between existing sectorial rules/regulatory requirements ‒ Conflicts between existing sectorial and non-sectorial rules/regulatory requirements ‒ Lack of regulatory alignment between different jurisdictions ‒ Insufficient regulation Compliance and reporting ‒ Reporting obligations ‒ Cost of regulatory compliance ‒ Increased reporting requirements associated with the use of AI Data & IP rules ‒ Data protection ‒ Copyright/IP Prudential and risk management ‒ Prudential rules ‒ Risk management frameworks Model-related rules ‒ Rules around model risk management ‒ Model/ data drifting Governance, fairness and market conduct ‒ Rules against bias, discrimination, unfair outcomes ‒ Rules around governance ‒ Fiduciary duty Explainability and transparency ‒ Rules requiring explainability ‒ Transparency requirements Operational and third party-related resilience ‒ Rules on operational resiliency ‒ Cyber-resilience rules ‒ Third party risk management frameworks

Table A A.3. Categorisation of non-regulatory constraints to AI adoption

All non-regulatory constraints listed in the survey

Categories introduced in the charts

‒ Shortcoming in internal data governance processes ‒ Data format ‒ Lack of data management processes ‒ Access to data ‒ Data quality (accuracy, consistency) ‒ Cost of AI deployment (vendor costs) ‒ Cost of data acquisition ‒ Cost of/ access to AI-related hardware ‒ Cost of AI development (in-house) ‒ Ethical considerations ‒ Fiduciary duty ‒ Unclear liability risks for damage resulting from non-proprietary ‒ Legal liability (related to data breaches/IP and copyright/harm to clients or business) ‒ IP/ copyright ‒ Corporate culture ‒ Competing internal priorities ‒ Change management ‒ Insufficient skills within firm ‒ Insufficient senior management/Board of Director skills/understanding ‒ Lack of internal governance processes for AI deployment ‒ Lack of use case ‒ Talent acquisition ‒ Legacy infrastructure incompatibility/ difficulties in integration of AI systems ‒ Risks to business continuity ‒ Risk of dependency on third parties ‒ Risk of overreliance on AI systems ‒ Increased cyber-risk ‒ Reputational damage risks ‒ Deepfakes ‒ Questionable reliability of model output ‒ Limited/lack of model explainability ‒ Hallucinations ‒ Fraud/ risk of market manipulation ‒ Potential for biased/harmful/subpar outcome for clients ‒ Accountability for third party developed model ‒ Lack of understanding of third-party models compared to in-house developed models ‒ Governance issues related to third party service provision ‒ Lack of transparency of datasets used in third party models ‒ Limited transparency related to third party models

Data-related constraints ‒ Shortcoming in internal data governance processes ‒ Data format ‒ Lack of data management processes ‒ Access to data ‒ Data quality (accuracy, consistency) Cost-related constraints ‒ Cost of AI deployment (vendor costs) ‒ Cost of data acquisition ‒ Cost of/ access to AI-related hardware ‒ Cost of AI development (in-house) Ethical, compliance and liability constraints ‒ Ethical considerations ‒ Fiduciary duty ‒ Unclear liability risks for damage resulting from non-proprietary AI system deployment ‒ Legal liability (related to data breaches/IP and copyright/harm to clients or business) ‒ IP/ copyright Organisational, skills and cultural constraints ‒ Corporate culture ‒ Competing internal priorities ‒ Change management ‒ Insufficient skills within firm ‒ Insufficient senior management/Board of Director skills/understanding ‒ Lack of internal governance processes for AI deployment ‒ Lack of use case ‒ Talent acquisition ‒ Legacy infrastructure incompatibility/ difficulties in integration of AI systems Operational & business risks ‒ Risks to business continuity ‒ Risk of dependency on third parties ‒ Risk of overreliance on AI systems ‒ Increased cyber-risk ‒ Reputational damage risks Model reliability limitations ‒ Deepfakes ‒ Questionable reliability of model output ‒ Limited/lack of model explainability ‒ Hallucinations Market integrity & consumer/ investor protection ‒ Fraud/ risk of market manipulation ‒ Potential for biased/harmful/subpar outcome for clients Third-party model-related constraints ‒ Accountability for third party developed model ‒ Lack of understanding of third-party models compared to in-house developed models ‒ Governance issues related to third party service provision ‒ Lack of transparency of datasets used in third party models ‒ Limited transparency related to third party models

References

[1] Banca d’Italia (2025), FinTech Survey, https://www.bancaditalia.it/pubblicazioni/indagine-fintech/index.html?com.dotmarketing.htmlpage.language=1 (accessed on 18 December 2025).

[2] CONSOB (2022), “Artificial intelligence in the asset and wealth management”, Quaderni Fintech, https://www.consob.it/web/consob-and-its-activities/ft9en (accessed on 18 December 2025).

[4] Convenzione Interbancaria Per l’Automazione (2023), Rilevazione sull’IT nel settore bancario italiano - Profili tecnologici e di sicurezza, anno 2023, https://www.cipa.it/rilevazioni/tecnologiche/2023/index.html (accessed on 18 December 2025).

[3] IVASS (2023), “Survey on the use of Machine Learning algorithms by insurance companies in their relations with policyholders”, https://www.ivass.it/pubblicazioni-e-statistiche/pubblicazioni/altre-pubblicazioni/2023/indagine-algoritmi/Esiti_indagine_Algogovernance_ENG.pdf?language_id=3 (accessed on 18 December 2025).

Notes

← 1.  The OECD survey was shared with over 900 institutions across the Italian financial sector and accessed by 731 institutions, receiving 450 responses.

← 2.  Based on the financial services and activities disclosed on the company websites.

← 3.  Respondents that stated they’re licensed and/or operate under Article 106, perform financial intermediation or self-identify as Confidi, a consortium that serves as warrantor for credit lines.