Secure Financial Data from AI Ingestion in Alignment with the New Code of Practice: A Guide for UK Banking Sector

The UK financial services sector finds itself at a critical intersection of innovation and security as artificial intelligence transforms banking operations. The UK Government’s new Code of Practice for AI cybersecurity arrives at a pivotal moment, providing essential guidance for financial institutions seeking to protect sensitive data while leveraging AI’s transformative capabilities.

Recent FCA data reveals the scale of this challenge: 78% of UK financial institutions now employ AI systems across their operations, from algorithmic trading to fraud detection and customer service. This widespread adoption brings unprecedented opportunities for improving financial services but also introduces new risks to sensitive financial data. The government’s new Code of Practice, announced in February 2025, establishes crucial requirements for protecting these AI systems and the sensitive data they process.

AI Risks in Financial Services

The integration of AI in financial services presents unique challenges that demand specific attention under the new Code of Practice. Financial institutions must understand these risks to implement effective protection measures while maintaining operational efficiency and market competitiveness.

Trading Systems and Market Data

The use of AI in trading operations represents one of the most sensitive areas requiring protection under the Code of Practice. Financial institutions must safeguard both proprietary trading algorithms and market-sensitive data while maintaining the speed and efficiency that modern markets demand. This delicate balance requires sophisticated security measures that protect against unauthorized AI access without introducing latency to trading operations.

Payment Processing Infrastructure

The protection of payment processing systems presents another critical challenge under the Code. As AI systems increasingly manage transaction processing and fraud detection, financial institutions must implement robust security measures that protect sensitive payment data while maintaining real-time processing capabilities.

Customer Financial Data Protection

The protection of customer financial information requires particular attention under the new Code. Financial institutions must implement comprehensive security measures that protect customer data from unauthorized AI access while enabling legitimate AI-powered services like personalized banking and automated customer support.

Aligning with the New Code of Practice

The Code mandates a sophisticated approach to risk assessment that goes beyond traditional security evaluations. Financial institutions must now consider not only direct security risks but also potential vulnerabilities introduced by AI systems’ interaction with sensitive financial data.

This assessment process requires institutions to evaluate:

The scope and nature of AI implementation across their operations, from customer-facing applications to back-office processes. Understanding these interactions helps institutions identify potential vulnerabilities and implement appropriate protection measures.

Existing security controls and their effectiveness in addressing AI-specific risks. Many institutions will find that traditional security measures must be enhanced to address the unique challenges presented by AI systems.

Potential impacts on operational efficiency and customer service. Security measures must be implemented in ways that support rather than hinder financial operations.

Technical Implementation Requirements

The Code provides specific guidance for implementing security measures in financial environments. Financial institutions must develop comprehensive security frameworks that protect sensitive data while maintaining operational efficiency. This includes:

Sophisticated access control systems that can manage AI system permissions while maintaining strict security standards. These systems must be capable of handling complex financial operations while preventing unauthorized access to sensitive data.

Advanced monitoring capabilities that can detect potential security incidents without impacting system performance. Financial institutions must be able to track AI system behavior while maintaining the speed and efficiency required for modern financial operations.

Training and Awareness Requirements

The Code of Practice places significant emphasis on specialized training for financial sector personnel. This requirement extends beyond traditional security awareness training, focusing specifically on AI-related risks and protective measures.

Specialized Staff Development

Financial institutions must develop comprehensive training programs that address the unique challenges of protecting AI systems and data. These programs should cover not only technical security measures but also operational considerations specific to financial services.

Operational Integration

Training programs must be integrated into daily operations, ensuring that security awareness becomes part of the organizational culture. This includes regular updates and refresher courses that address emerging threats and new protection requirements under the Code.

Incident Response and Recovery Planning

The Code mandates sophisticated incident response capabilities specifically designed for AI-related security events. Financial institutions must develop comprehensive plans that address both prevention and recovery.

Response Framework Development

Organizations must establish clear procedures for identifying and responding to AI-related security incidents. These procedures should include:

Immediate response protocols that can be activated without disrupting critical financial operations. The response framework must balance security requirements with the need to maintain essential services.

Escalation procedures that ensure appropriate stakeholders are involved in incident management. This includes coordination with regulatory authorities when required.

Business Continuity Integration

Incident response plans must be integrated with broader business continuity strategies. Financial institutions should regularly test these plans to ensure they can maintain critical operations while addressing security incidents.

Monitoring and Continuous Improvement

The Code emphasizes the importance of ongoing monitoring and system enhancement. Financial institutions must implement sophisticated monitoring systems that provide real-time visibility into AI operations while supporting continuous security improvement.

Performance Metrics

Organizations should establish clear metrics for measuring the effectiveness of their security measures. These metrics should address both technical security requirements and operational impacts, providing a comprehensive view of security program effectiveness.

Adaptation and Enhancement

Security measures should be regularly reviewed and updated to address emerging threats and changing operational requirements. This includes:

Regular assessment of security controls against evolving threat landscapes Updates to protection measures based on operational experience Integration of new security technologies as they become available.

Next Steps

The UK’s new Code of Practice represents a crucial development in protecting financial sector data from unauthorized AI access. Financial institutions must take decisive action to implement compliant security measures while maintaining operational efficiency. Essential steps include:

Immediate Actions

Financial institutions should begin by conducting thorough assessments of their current AI implementations and security measures. This evaluation should consider both technical requirements and operational impacts.

Strategic Planning

Organizations must develop comprehensive implementation strategies that address both immediate compliance requirements and long-term security objectives. These strategies should include clear timelines and resource allocation plans.

Ongoing Management

Successful implementation requires continuous monitoring and adjustment of security measures. Financial institutions should establish clear processes for ongoing management and improvement of their security programs.

Kiteworks Helps UK Financial Institutions Adhere to the Code of Practice

Financial institutions can accelerate their compliance with the Code of Practice by leveraging Kiteworks AI Data Gateway. This comprehensive solution addresses key requirements through:

Zero-Trust AI Data Access: The platform implements rigorous zero-trust principles specifically designed for AI interactions with financial data. This aligns directly with the Code’s requirements for strict access controls and continuous verification.

Compliant Data Retrieval: Through secure retrieval-augmented generation (RAG), financial institutions can safely enhance AI model performance while maintaining strict control over sensitive financial data access. This capability is particularly crucial for organizations balancing AI innovation with regulatory compliance.

Enhanced Governance and Compliance: The platform’s robust governance framework helps financial institutions:

• Enforce strict data governance policies across AI implementations
• Maintain detailed audit logs of all AI data interactions
• Ensure compliance with both the Code of Practice and broader regulatory requirements
• Monitor and report on AI data access patterns

Real-Time Protection: Comprehensive encryption and real-time access tracking provide the continuous monitoring and protection required by the Code, enabling financial institutions to:

• Protect sensitive financial data throughout its lifecycle
• Track and control AI system access to protected information
• Respond rapidly to potential security incidents
• Maintain detailed compliance documentation

Through these capabilities, Kiteworks helps financial institutions achieve the delicate balance between enabling AI innovation and maintaining the strict data protection standards required by the Code of Practice.

To learn more about Kiteworks and how its AI Data Gateway can protect your sensitive financial data from AI ingestion, schedule a custom demo today.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video How Kiteworks Helps Advance the NSA’s Zero Trust at the Data Layer Model
• Blog Post What It Means to Extend Zero Trust to the Content Layer
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video Kiteworks + Forcepoint: Demonstrating Compliance and Zero Trust at the Content Layer