TL;DR
Andrew Bailey has put frontier models on the G20 agenda as a systemic risk rather than a productivity story. Writing as chair of the Financial Stability Board, the Bank of England governor argues that most countries have no governing protocols for how advanced models are built and released, and that cyber-risk is the channel carrying the danger into banking.
What the letter says
The two pages landed with G20 finance ministries and central banks ahead of this week’s gathering in North Carolina. Bailey’s characterisation of the technology is unusually direct for a central banker: frontier models are “showing increasingly sophisticated autonomy and problem-solving abilities, as well as threat capabilities”.
His complaint is about governance, not capability. Many countries, he wrote, lack “the protocols in place to manage the development, release, and deployment of advanced frontier AI models, heightening risks for the financial sector and beyond”. The route into the financial system is cyber: frontier models “may have the ability materially to alter the speed, scale and economics of cyber-risk”, with the damage magnified by the handful of suppliers most of the industry runs on.
Why supplier concentration is the British detail
That final point reads differently here than elsewhere. Britain already supervises critical third parties directly, giving the Bank and the Financial Conduct Authority oversight of cloud and technology providers that banks cannot realistically swap out. Bailey’s argument sharpens the rationale for it: a capability that rewrites attack economics does not arrive at one firm at a time, it arrives at everyone sharing a supplier simultaneously.
The letter also returns to market structure. Leverage is building in bond and equity markets while valuations sit high on investor optimism about AI, a combination that would amplify any correction. “I remain concerned therefore that a large shock or combination of shocks could concurrently trigger multiple vulnerabilities,” he wrote.
Bailey is not speaking into a vacuum. Last month 1,367 staff inside Google DeepMind, OpenAI and Anthropic signed their own letter, asking governments to help slow the frontier down deliberately, and this site has since covered the Hugging Face agent breakout and insurers redrafting cyber wording around agent-caused losses. The regulator is arriving at a conclusion the practitioners and the underwriters reached first.
Looking forward
Bailey ran the FCA and the Prudential Regulation Authority before taking the Bank, and has chaired the FSB since last year, so this functions as a signal about supervisory direction rather than a single intervention. For UK firms, the question worth preparing for is whether model governance starts appearing in operational resilience testing, where the scenario stops being a supplier outage and becomes an AI-enabled compromise reaching several institutions at once.