Adrian Dunkley points to a trillion-dollar underlying risk from AI

AI is entering a financial-crime environment already measured in trillions of US dollars. My concern is how connected agents could amplify that exposure while organisations mistake faster decisions for better-controlled decisions. The trillion-dollar figure describes the wider environment; it is not an estimate of losses caused by AI.

I am Adrian Dunkley. For Caribbean boards, the practical question is how much authority an AI system has, how quickly an error could spread and whether anyone can stop it before customers or counterparties are affected. A chatbot response and an agent with payment permissions belong in different risk discussions.

The scale is established; AI's share is not

Nasdaq Verafin's 2026 Global Financial Crime Report announcement estimates US$4.4 trillion in illicit financial activity in 2025 and separately reports US$579.4 billion in scam and bank-fraud losses. Its work combines proprietary modelling, a survey of more than 500 financial-crime professionals and interviews. Illicit flows and losses are different measures and must not be added together.

The announcement also reports that 90% of surveyed professionals saw increased AI-driven attacks at their institution over the previous two years. That is a survey finding about perceived attack trends, not a calculation of what proportion of global crime AI caused. It cannot establish a Caribbean loss rate.

Those limits do not make the exposure trivial. They tell a risk team what to investigate. My argument is that AI should be assessed as a mechanism that can change the scale, speed and reach of existing harms, including harms caused by ordinary mistakes within legitimate organisations.

An agent can carry an error across several controls

Consider a hypothetical accounts agent that reads invoices, updates supplier details and prepares payments. If the same identity has authority across those steps, a misleading document could influence the record that later appears to justify the payment. Multiple screens do not provide independent controls when the same compromised process supplies the evidence for each.

OWASP describes indirect prompt injection as a risk when external material changes a model's behaviour. Restricting the agent's tools and checking consequential actions outside the model reduces what such a diversion can accomplish. A prompt telling it to ignore malicious instructions should not be the only protection.

“An AI agent should not be able to create the evidence, approve the exception and move the money,” is my recommendation. Separate those permissions and identify the person accountable for the business outcome. A supplier's model policy does not substitute for an organisation's operating controls.

Believing in the system can become an operational risk

A firm may believe its AI is improving performance while staff quietly repair its outputs. If management measures speed and ignores correction work, it can raise targets and remove the time needed for review. The dashboard then rewards a process whose risk is poorly understood.

This is where cognitive dissonance matters to my argument: decision-makers may struggle to reconcile a public commitment to an AI programme with evidence that it is failing. Automation bias, the tendency to favour an automated recommendation, is a related but different concern.

My proposed response is operational. Preserve failed cases, corrected drafts, overrides and complaints. Give the reviewer authority to pause the affected function. Ask whether rejected outputs are disappearing from the performance figures or whether a target encourages staff to approve recommendations they have not checked.

Shared suppliers can connect failures across firms

The Financial Stability Board's November 2024 analysis identifies third-party dependence and supplier concentration, market correlations, cyber risk and model risk among AI-related vulnerabilities. It also warns about financial fraud and disinformation. These are routes through which separate institutions can become exposed to a common problem.

For a Caribbean bank, insurer or public agency, a supplier register should therefore connect the AI model with its cloud service, identity provider, external data and subcontractors. Two products may share an underlying dependency. Buying both does not necessarily create a fallback.

Financial and reputational harm can reinforce each other. A wrong communication might generate customer complaints; a slow correction could weaken trust; an interrupted service could then increase recovery costs. These are plausible pathways to test, not measured loss multipliers. Model them separately before considering dependence between them.

Measure authority, containment and recovery

Start with the direct commitment the agent could make before containment. Under an explicitly chosen stress scenario, multiply consequential actions per minute by minutes until effective containment by the maximum direct commitment per action. The result is a currency amount describing the scenario's exposure envelope. It is not expected loss, because it contains no event probability and may omit indirect damage.

A board should challenge each input. Does containment include detection, acknowledgement and stopping queued work? Can a per-action limit be bypassed by several actions? Could the agent change the record used to authorise its next step? The answer may require a different architecture rather than a larger review team.

By 10 November, choose one connected workflow and document its read, write and execution permissions. Test a deliberately incorrect instruction with synthetic records, confirm that the prohibited action is blocked and record the time to revoke access. Then check whether an alternative process can complete the essential service without the same supplier.

That work fits my S4 AI Safety Framework: Specify the task and authority, Stress-test consequential failures, Safeguard the action and Scrutinise outcomes. Keep the failed test when you fix the process. A board needs evidence that a boundary holds, and a named owner who will restrict the system when it does not.