How to build an AI risk taxonomy for financial services compliance

Financial services firms operate under detailed regulatory requirements covering customer treatment, conduct risk and consumer outcomes. Applying those requirements consistently across thousands of customer interactions creates a challenge for compliance teams, particularly when monitoring involves AI.

An AI risk taxonomy provides a structured way to define what firms need to monitor. It connects regulatory obligations to specific risk categories, observable evidence and assessment criteria that both human reviewers and AI systems can apply.

The quality of those definitions influences what AI can identify, how reliably it evaluates different interactions and whether compliance teams can explain the findings.

For FCA-regulated firms, developing an effective taxonomy starts with understanding which risks need to be monitored and what evidence would indicate a potential failure.

TL;DR: What is an AI risk taxonomy?

An AI risk taxonomy is a structured classification of risks that defines what an AI system should identify, how those risks can be recognised and when they require further investigation.

For financial services compliance, a well-designed taxonomy should:

• Connect risks to regulation: Map categories to applicable FCA rules, guidance and internal policies.
• Define observable evidence: Describe the behaviours, events and outcomes that could indicate each risk.
• Support consistent assessment: Give AI systems and human reviewers clear criteria to follow.
• Account for context: Consider evidence across individual interactions and complete customer cases.
• Guide human review: Define severity, escalation requirements and the evidence needed to investigate findings.
• Remain current: Update definitions as regulatory expectations, products and customer risks evolve.

An AI risk taxonomy helps turn regulatory requirements into practical monitoring criteria. It does not replace regulatory interpretation, governance or human judgement.

What is an AI risk taxonomy in financial services?

A risk taxonomy organises potential risks into defined categories and subcategories. It creates a common language for identifying, assessing and reporting risks across an organisation.

For example, a financial services firm’s conduct risk taxonomy might include customer understanding, complaints handling, vulnerable customer treatment and unsuitable advice.

Each category can then be broken into specific risks that reviewers and monitoring systems can assess.

A customer understanding category might include risks such as:

• Material product limitations were not adequately explained.
• A customer expressed confusion that remained unresolved.
• Important information was provided too late to support an informed decision.
• Communications failed to account for a customer’s relevant needs.

An AI risk taxonomy adds the detailed assessment criteria needed to evaluate these risks using technology.

It should specify what evidence supports a finding, what surrounding context matters and what conditions would rule out a potential failure.

How does a risk taxonomy differ from a risk register?

A risk register records the risks an organisation faces, their severity, ownership and associated controls.

A taxonomy provides the classification and definitions used to identify and categorise those risks consistently.

A register might record inadequate treatment of vulnerable customers as an operational or conduct risk. A taxonomy breaks that concern into identifiable types of failure, such as not recognising a support need or failing to provide an agreed adjustment.

The two can work together. The taxonomy defines the risk categories and assessment criteria, while the register records exposure, ownership and management action.

How to align an AI risk taxonomy with FCA requirements

The FCA sets expectations through its Principles for Businesses, Consumer Duty and relevant sector-specific requirements.

Under PRIN 2A.9, firms subject to Consumer Duty must regularly monitor the outcomes retail customers receive from their products, communications and customer support.

The FCA does not prescribe a single risk taxonomy or monitoring methodology. Firms must determine what information and assessment processes are appropriate for their business, products and customers.

A practical taxonomy translates those obligations into risks that can be identified and assessed.

Examples of FCA-aligned conduct risk categories

These are illustrative examples, not Aveni’s proprietary taxonomy or a complete mapping of FCA requirements. Applicable obligations depend on a firm’s activities, permissions and customer base.

The evidence required also varies considerably.

Some risks can be identified initially through customer conversations. Others require information from documents, product records, pricing data or wider customer outcomes.

For example, AI may identify a potentially misleading explanation of a product fee during a call. Determining whether the product provides fair value requires a broader assessment of price, benefits, costs and customer outcomes.

A taxonomy should reflect the evidence needed for each risk rather than assume every regulatory requirement can be evaluated through conversation analysis alone.

How to build an FCA-aligned AI risk taxonomy in six steps

A useful taxonomy connects regulatory obligations to identifiable behaviour, assessment criteria and operational action.

1. Identify the regulatory obligations that apply

Start with the firm’s permissions, products, services and customer journeys.

Map relevant FCA requirements, including Consumer Duty, the Principles for Businesses and applicable sourcebooks such as COBS, MCOB, ICOBS and DISP.

Use the regulatory sources to identify where poor conduct or customer harm could arise.

2. Define specific risk types

Break broad regulatory requirements into risks that can be individually assessed.

A category such as poor customer understanding is too general to provide consistent monitoring criteria.

A more specific risk might be:

A material product limitation was not communicated clearly before the customer made a decision.

This definition gives reviewers a particular event or failure to investigate.

3. Establish observable evidence

Identify the information that could indicate each risk.

For customer understanding, relevant evidence might include customer questions, explanations provided by an adviser or agent, contradictory information and supporting documents.

Separate potential indicators from evidence that confirms a failure.

A customer asking for clarification, for example, does not necessarily indicate poor treatment. The subsequent explanation and the customer’s circumstances may show that the interaction was handled appropriately.

4. Define assessment and severity criteria

Document the conditions that determine how a risk should be assessed.

These might include:

• What evidence supports a potential risk?
• What additional context is required?
• What would indicate that the concern was resolved?
• How serious could the consequences be for the customer?
• When should a human reviewer investigate or escalate?

Severity should reflect potential customer impact and relevant circumstances, rather than relying solely on the presence of a particular phrase.

5. Validate the criteria with specialists

Risk and compliance subject matter experts should review the definitions and test them against representative examples.

Different reviewers should be able to apply the criteria and reach reasonably consistent conclusions.

Disagreements can identify ambiguous definitions, missing exceptions or evidence requirements that need to be clarified.

6. Test the taxonomy within the monitoring process

Once definitions are agreed, test whether the monitoring approach can identify the intended risks.

For AI-assisted monitoring, this means evaluating the model against examples that specialists have reviewed and labelled.

Include straightforward cases, ambiguous cases and examples where a potential risk was appropriately resolved.

The aim is to establish whether the system applies the definitions reliably, rather than simply recognising words associated with each category.

Example: Turning FCA customer understanding requirements into a measurable risk

The FCA’s consumer understanding requirements under PRIN 2A.5 expect firms to communicate information in ways that support effective, timely and properly informed decisions.

To assess those requirements consistently, a firm needs to define the specific communication failures its monitoring should identify.

Consider a customer discussing a financial product with an adviser or customer service representative.

A model could identify an apparent omission or a statement suggesting confusion.

The reviewer may then find that the customer received a clear written explanation before making their decision.

Both pieces of evidence are relevant to the assessment.

The FCA’s March 2026 review of consumer understanding reinforces the need for meaningful testing and monitoring. It identified weaknesses in firms’ use of management information, including measures that provided limited evidence of whether customers understood communications.

Defining risks at this level helps firms evaluate the quality of customer communications using more specific evidence.

Why an AI risk taxonomy must distinguish risk signals from confirmed failures

A risk signal identifies something that may warrant investigation. A confirmed failure requires enough evidence to establish that the relevant requirement or standard was not met.

Confusing those two stages can produce misleading monitoring results.

Consider a customer who says they have recently lost their job.

That information may indicate financial difficulty or a characteristic of vulnerability. It does not establish that the firm has failed to treat the customer appropriately.

A fuller assessment needs to examine how the firm responded, whether appropriate support was offered and what happened afterwards.

The FCA’s guidance on the fair treatment of vulnerable customers explains the importance of understanding customer needs and responding appropriately.

For AI-assisted compliance monitoring, the assessment process should distinguish between:

• Potential risk: Evidence suggests a possible concern.
• Confirmed issue: Further assessment establishes that the relevant criteria were not met.
• Resolved concern: The surrounding evidence shows that the firm addressed the issue appropriately.
• Insufficient evidence: The available information does not support a reliable conclusion.

Clear definitions can reduce unnecessary reviews while helping teams investigate genuine concerns more effectively.

“Clear risk definitions are essential for evaluating AI consistently. Compliance specialists and model developers need to agree what evidence indicates a concern, how context affects the assessment and where human judgement is required. That gives us a stronger basis for testing whether a model can identify the risks it is designed to assess.”

Technical Product Manager, Models Team, Aveni

How an AI risk taxonomy supports case-level compliance monitoring

Customer risk often develops across several interactions rather than appearing in one conversation.

A customer might disclose financial difficulty during a phone call, request further assistance by email and later make a complaint about the response.

Reviewing those interactions separately may identify several individual concerns. Assessing the complete case provides evidence about whether the firm recognised the customer’s circumstances, took appropriate action and resolved the issue.

A case-level taxonomy needs to account for the relationships between those events.

For example, a review might establish:

1. When the initial concern was identified.
2. Whether the information was recorded or passed to the appropriate team.
3. What action the firm took.
4. Whether subsequent communications were consistent with that action.
5. What outcome the customer received.

This is relevant to Aveni’s recent developments in compliance monitoring.

In September 2026, Aveni introduced enhanced case-level outcome testing in Detect, enabling firms to assess calls, emails, webchat, SMS and supporting documents together within a single customer case.

The approach also supports more complex investigations in sectors such as motor finance and insurance, where complaints, servicing interactions and supporting evidence may be distributed across several channels. Aveni’s case-level outcome testing article for motor finance and insurance explores those applications.

For the taxonomy, case-level monitoring requires definitions that consider both individual events and the overall customer journey.

A potential risk identified during one interaction can be reassessed against subsequent evidence, giving reviewers a stronger basis for deciding whether further action is needed.

How to evaluate whether AI models apply a risk taxonomy accurately

Defining risks is only the starting point. Firms also need evidence that AI systems assess those risks reliably.

Overall accuracy can obscure important weaknesses.

A model might perform well on common, straightforward interactions while missing less frequent but potentially serious conduct risks.

Evaluation should therefore examine individual risk categories and the types of errors that occur within them.

These measures should be assessed using representative, appropriately labelled evaluation data.

The quality of the reference examples is particularly important.

If specialists disagree about whether a case contains a particular risk, those differences should be investigated before treating the resulting labels as a reliable standard for evaluation.

A strong evaluation process includes examples where risk is present, where it is absent and where additional context changes the assessment.

It should also test performance after material changes to risk definitions, relevant policies or the model itself.

The NIST AI Risk Management Framework provides a broader reference for evaluating and managing AI risks throughout the system lifecycle.

For financial services, the practical objective is to establish whether a model can support the specific regulatory and operational task it has been given.

How risk taxonomies improve QA prioritisation and Consumer Duty outcomes monitoring

A structured taxonomy can support the allocation of human review capacity.

Rather than selecting interactions solely through random sampling, automated monitoring can identify cases that meet defined risk criteria and prioritise them according to their potential impact.

The taxonomy helps establish which risks should receive attention first.

For example, a case involving repeated signs of financial difficulty, an unresolved complaint and a potentially inappropriate response may warrant more urgent investigation than a minor documentation issue.

The assessment should reflect the available evidence, severity and relevant escalation requirements.

Aveni’s approach to prioritising high-risk calls for QA review explains how risk-based assessment can help QA managers focus reviewer capacity on interactions that warrant attention.

Connecting monitoring findings to customer outcomes

Risk classification can also support more useful management information.

Under Consumer Duty, firms need to understand the outcomes customers receive and identify where action is required.

The FCA’s July 2026 outcomes-monitoring review highlighted good practice in using structured monitoring frameworks to identify potential harm, improve customer experiences and assess the effectiveness of interventions.

A taxonomy can help organise that evidence by recording the relationship between:

• the risk identified
• the evidence supporting the assessment
• the investigation or escalation
• any corrective action
• the subsequent customer outcome

This allows firms to analyse recurring concerns across products, teams and customer journeys.

For example, repeated customer understanding concerns might indicate a problem with a particular communication, while a concentration of vulnerability-related issues could point to weaknesses in customer support processes.

The same approach supports the type of evidence-based Consumer Duty outcomes monitoring that compliance teams need for management reporting and regulatory oversight.

How to keep an AI risk taxonomy aligned with changing FCA guidance

A taxonomy needs ongoing ownership and maintenance.

FCA guidance develops, firms introduce new products, and monitoring results reveal risks that existing categories may not capture adequately.

A taxonomy created for one set of products or customer journeys may require changes when the business or its regulatory obligations evolve.

A practical maintenance process should include the following controls.

Changes to a taxonomy should be traceable.

If a risk definition changes, reviewers and governance teams should be able to establish what changed, why it changed, who approved it and which version applied to a previous assessment.

A useful starting point for regulatory monitoring is the FCA’s Consumer Duty publications and resources, alongside the live FCA Handbook and any sector-specific guidance relevant to the firm.

Common mistakes when building an AI risk taxonomy

Several design problems can limit the usefulness of an otherwise well-structured taxonomy.

A firm’s taxonomy should also reflect the risks relevant to its actual activities.

A mortgage lender, protection insurer and wealth management firm may share conduct risk categories, but each operates under different requirements and customer circumstances.

A generic taxonomy needs careful adaptation before it can support meaningful monitoring.

How Aveni Detect supports taxonomy-based compliance monitoring

Aveni Detect uses financial-services-specific AI to assess customer interactions and cases against configurable QA and compliance frameworks.

It supports the identification of potential complaints, vulnerability, conduct and Consumer Duty risks, while providing evidence for human investigation.

The Detect compliance monitoring platform enables firms to configure assessment criteria, review findings, adjust or override assessments and report on quality and risk trends.

The connection between risk definitions and evidence helps compliance teams understand why a potential concern has been identified.

For Aveni’s Models Team, this type of work involves ensuring that model evaluation reflects the regulatory and operational meaning of the risks being assessed.

The aim is to give reviewers consistent, evidence-backed assessments while retaining human responsibility for material decisions and action.

FAQs about AI risk taxonomy in financial services

What is an AI risk taxonomy?

An AI risk taxonomy is a structured classification of risks that an AI system is designed to identify or assess. It includes risk definitions, observable evidence and assessment criteria that help models and human reviewers apply consistent standards.

What is a conduct risk taxonomy?

A conduct risk taxonomy organises the behaviours, events and outcomes that may indicate inappropriate conduct or customer harm. In financial services, it can cover customer understanding, vulnerable customer treatment, complaints, unsuitable advice and other relevant risks.

Does the FCA require firms to use an AI risk taxonomy?

The FCA does not prescribe a specific AI risk taxonomy. Firms must comply with applicable regulatory requirements, including relevant monitoring and governance obligations. A structured taxonomy can support those responsibilities by translating obligations into consistent assessment criteria.

How does an AI risk taxonomy support Consumer Duty?

An AI risk taxonomy can help firms identify, categorise and investigate potential risks to good customer outcomes. It can also support consistent monitoring of customer understanding, support, vulnerability and other conduct-related concerns across customer interactions.

How many risk categories should a taxonomy include?

There is no fixed number. Categories should reflect the firm’s regulatory obligations, products, services and customer journeys. Each category should be specific enough to support meaningful monitoring without creating unnecessary duplication.

Can AI identify conduct risk automatically?

AI can identify potential conduct risk using defined criteria and evidence from customer interactions and related records. A flagged risk does not automatically establish a regulatory breach. Human investigation and additional evidence may be required to reach a reliable conclusion.

How often should an AI risk taxonomy be reviewed?

Firms should establish a documented review schedule and update the taxonomy when relevant regulations, internal policies, products or customer risks change. Material changes should trigger a review of the associated monitoring criteria and model evaluation.

Who should own an AI risk taxonomy?

Risk and compliance specialists should own the regulatory interpretation and approve relevant risk definitions. Models and engineering teams can support implementation and evaluation, while QA and operational teams provide feedback on how the criteria perform in practice.

What is the difference between a risk signal and a confirmed compliance failure?

A risk signal indicates that an interaction or case may require investigation. A confirmed failure means the available evidence establishes that the relevant requirement or assessment criterion was not met. The surrounding context and subsequent actions can affect that conclusion.

Building more reliable AI compliance monitoring starts with clear risk definitions

An effective AI risk taxonomy gives compliance teams a consistent way to translate regulatory requirements into risks they can identify, assess and investigate.

The work requires regulatory interpretation, specialist input, appropriate evidence and ongoing evaluation.

When firms define risks clearly, they can apply monitoring criteria across larger volumes of interactions, investigate potential concerns more consistently and connect their findings to customer outcomes.

AI can support that process at scale. The quality of the assessment still depends on how well the firm defines what it needs to monitor.

For firms looking to apply those principles across customer interactions and complete cases, Aveni Detect combines configurable assessments, supporting evidence and human review within a single compliance monitoring workflow.