Six of the 136 Japanese financial institutions running generative artificial intelligence tell the Bank of Japan they red team it, and 67 of them are cleared to feed it confidential customer data
Six.
That is how many Japanese financial institutions, out of the 136 that use or are trialling generative artificial intelligence, told the Bank of Japan they carry out red teaming against those systems in customer-facing risk scenarios. Four of the six sit in the group the Bank defines as the heaviest users. The other two do not.
The figure comes from the Financial System Report annex the Bank published on Monday, its third annual survey of the subject. This item is two days late and runs anyway, because the numbers in it do not expire.
The adoption line has moved further than most forecasts of it
The Bank put the questionnaire to 150 institutions and every one of them answered. Ten major banks, 61 members of the Regional Banks Association, 34 members of the second association, 18 shinkin banks and 27 others, a list that runs from Mitsubishi UFJ to Japan Post, PayPay, Rakuten and the Shinkumi Federation.
Seventy nine point three percent are using generative artificial intelligence. Another 11.3 percent are trialling it. That leaves 9.3 percent doing neither, against 41.9 percent two years ago.
Set that beside the same survey's line on conventional artificial intelligence, meaning systems trained on task-specific data, which stood at 62.6 percent in use in fiscal 2024 and 72.7 percent now. The older technology gained ten points over two years. The newer one gained forty eight, and has passed it.
What it is actually doing
The Bank publishes a use-case table for the 136 institutions, splitting each application three ways: integrated into a business process, used as a support tool, or in trial.
Document creation and drafting is running at 132 of 136, of which 106 is the support-tool category. Meetings transcription is 122. Searching internal policies and related documents is 116.
Then the numbers fall away. Loan approval document preparation is 63. Customer-facing chatbots are 29, and so is credit assessment and credit risk management. Portfolio rebalancing recommendations sit at two, one of them a trial, with 134 institutions reporting no use and no plan to start.
So the technology is nearly universal for writing things down and nearly absent from telling anybody what to buy.
The split the Bank builds the rest of the report on
Asked what information they permit a model to process, 55.1 percent of the 136 answered confidential information, 37.5 percent internal but non-confidential material, and 7.4 percent publicly available material only.
The Bank then does something more useful than reporting that percentage. It takes the 75 institutions that allow confidential processing, intersects them with the 92 using or trialling the technology in customer service operations, and calls the resulting 67 the broad-use institutions. The remaining 69 are the comparison group, and every risk-management question in the report is reported against that division.
That is the sentence to carry away. Half of the institutions using the technology are cleared to run customer data through it while serving customers with it.
Where the controls are, and where they are not
On twenty measures the Bank asked whether each institution is conducting the measure, conducting it with room for improvement, considering it, or treating it as not applicable. Combining the first two categories gives a count for each group, and the shape is consistent: the broad-use institutions are ahead on all twenty, and both groups thin out at the same end.
Rules restricting what confidential material may be typed in: 66 of 67 and 50 of 69. Human involvement in decisions with critical outcomes: 64 and 35. Cybersecurity measures against threats such as prompt injection: 46 and 27. Securing people skilled enough to review the risks: 29 and 13.
At the bottom of the list, structured analysis of the risk in what users report back sits at 7 and 3, and red teaming at 4 and 2.
The Bank's own reading of this, on the page before, is that institutions remain cautious about putting generated output in front of a customer at all, which is consistent with the chatbot figure of 29.
The Bank says the hard part has not arrived
The conclusion names three things it wants senior management thinking about, and none of them is in the survey data, because none of them is happening at scale yet: putting generated output directly in front of customers, deploying agents that handle tasks on their own, and bringing in frontier models. Those, the report says, "demand carefully considered approaches to risk management and governance."
The Bank commits to nothing beyond continuing the conversation through examinations, monitoring and seminars. No rule follows from this document. It is a measurement, published in full, with the awkward columns left in.
