Cindy (Xin) Tu, Director of IT and Data Audit at Discover Financial Services, speaks with Mudit Gupta, Partner, FS Consulting AI Practice Leader at EY, in a video interview about her role, the evolving AI landscape in financial services, data governance as a cornerstone of AI, and data security and transparency in GenAI use cases. 

Discover Financial Services is an American financial services company that owns and operates Discover Bank, an online bank that offers checking and savings accounts, personal loans, home equity loans, and credit cards.

With nearly 18 years of experience and over a decade of that in the financial services industry, Tu currently serves as the Director of IT and Data Audit at Discover Financial Services. Outside of her professional responsibilities, she mentions being actively engaged with industry organizations, including CDO Magazine, the EDM Council, and the American Bankers Association.

The evolving AI landscape in financial services

In the face of rapidly advancing AI technologies, Tu shares her perspective on the evolving interplay between innovation and risk management. Emphasizing the unique challenges of the financial services sector, she stresses the regulatory compliance pressure and having sensitive and confidential customer data.

This constant regulatory and data sensitivity pressure, Tu notes, creates a delicate balancing act between pushing the boundaries of technological innovation and ensuring robust risk controls. She then mentions observing a noticeable shift toward stronger governance structures.

“AI risk and governance frameworks have become significantly more robust compared to a year ago,” Tu notes. She recalls last year as a period of experimentation, where organizations were still figuring things out with only basic structures like occasional council meetings in place. In contrast, this year shows signs of more strategic and comprehensive risk management practices.

According to Tu, institutions are starting to take a more deliberate approach to classifying GenAI use cases, segmenting them into categories and aligning each with the right governance structure. She elaborates that it doesn’t matter whether it’s a model, an SDOC, or a data governance artifact, everything should pass through a distinct AI governance framework.

Innovation bottlenecked at the proof-of-concept stage

Despite the progress in governance, Tu acknowledges that AI use cases in the financial industry often fail to move beyond early development. Many use cases are generally stuck at the POC level.

She attributes this to the multiple layers of risk assessment required, including data, IT security, and newly introduced AI-specific risks, which slow down the deployment process. Reflecting on the industry’s current state, Tu says, “There’s still a struggle as an industry that we’re trying to figure out.”

Why data governance is the cornerstone of AI in financial services

“The foundation of any AI implementation is really to have complete, timely, and high-quality data,” Tu affirms. Adding on, she discusses the widely accepted view within the industry, “Data governance is the foundation of AI governance.” She shares that before organizations can effectively adopt GenAI, they must first ensure their data infrastructure is sound.

To establish that foundation, she recommends focusing on four key pillars:

• Data quality
• Data integrity
• Data security
• Data privacy

Delving deeper, Tu points out that data security and privacy are directly tied to risk management and compliance. This is especially critical in the financial services sector, where, she says, “We hold so much sensitive and confidential data, we have a duty to safeguard these.”

At the same time, she emphasizes that data quality and integrity must be maintained at every stage of data movement: “Making sure that as the data’s flowing through system A to system B, it has the complete and accurate data.”

Whether it’s for financial, board, or regulatory reporting — or even for strategic business decisions — the reliability of data cannot be compromised, says Tu.

Thereafter, she advocates for embedding strong data controls into the broader AI governance framework. “Baking this type of control in your governance framework is going to be the key, and that’s going to be the best practice,” she affirms.

Furthermore, Tu emphasizes ensuring that data is classified the right way and that the controls are implemented and monitored for effectiveness.

Data security and transparency in GenAI use cases

As a key stakeholder in the AI Council, Tu shares that one of the most frequently raised concerns during GenAI use case reviews is data security and privacy. She states that the team consistently asks critical questions: What data is being used? How is it protected? And how is it disposed of to avoid any data privacy or security issues?

Next, Tu observes that within the broader financial services industry, there are very few GenAI implementations that directly utilize customer data or are customer-facing. The reason, she says, is because those scenarios carry a significantly higher risk. Any misstep involving customer data can lead to substantial reputational damage, financial loss, and serious regulatory consequences.

Wrapping up, Tu also highlights the growing importance of transparency in AI, and being open with customers about how their information is used is becoming essential. Offering clear disclosures and providing customers with opt-in and opt-out choices, in her view, is key to building and maintaining trust.

CDO Magazine appreciates Cindy (Xin) Tu for sharing her insights with our global community.