On June 18, 2026, China’s National Financial Regulatory Administration (NFRA) issued 32 Guiding Opinions on the deployment of artificial intelligence in banking and insurance, the most comprehensive AI governance framework yet produced for China’s financial sector. The rules, analyzed by The Asian Banker, establish four major governance requirements that will reshape how Chinese banks develop and deploy AI systems: a ban on personal data training, a high-risk AI classification framework, a mandate for shared computing infrastructure, and a full lifecycle management requirement.
The Personal Data Training Ban
The NFRA’s most immediate and consequential restriction is a prohibition on using personal customer data to train or fine-tune generative AI models. Names, identification numbers, mobile phone numbers, and bank account information are explicitly off-limits. The rule reflects a genuine concern: as Chinese banks have rushed to build internal AI capabilities, the temptation to use rich customer datasets as training data has been significant. The NFRA is drawing a clear line before that practice becomes entrenched.
The prohibition is more stringent than the approach taken in most Western jurisdictions, where anonymized or aggregated customer data is often used for AI training under existing data protection frameworks. By banning personal data use outright, rather than permitting it under anonymization conditions, the NFRA is prioritizing consumer trust over model performance. The practical implication is that Chinese banks will need to rely on synthetic data generation, federated learning, or publicly available financial data to train their AI systems, all of which are technically feasible but add complexity and cost.
High-Risk AI and Mandatory Human Oversight
The NFRA’s second major provision introduces mandatory human oversight for AI applications in high-stakes financial decisions. The guidelines specifically require human validation for AI systems involved in fund transfers, asset valuation, credit approval, underwriting, claims assessment, and overall risk management, all areas where an AI error carries direct financial and legal consequences for customers and institutions alike. These applications require explicit approval from banks’ risk committees before deployment, and ongoing human oversight throughout operations.
The human-in-the-loop requirement for credit approval is particularly significant. Chinese banks have been moving toward increasingly automated lending decisions, with AI systems making real-time credit assessments for consumer and small business loans. The NFRA’s rules require that these decisions be validated or overseen by qualified human personnel, a governance standard that China’s largest state banks, with their mature risk management frameworks, are better positioned to meet than smaller regional lenders.
The framework is structurally similar to the European Union’s AI Act, which also classifies credit scoring and related financial services as high-risk AI requiring strict governance. The US, by contrast, relies on existing model risk management principles without a dedicated AI-specific legal regime. China’s explicit classification framework gives regulators clearer enforcement tools and gives banks clearer compliance targets, a trade-off that favors stability over flexibility.
Shared Computing Infrastructure
The NFRA’s third major provision encourages large banks to share AI computing infrastructure with smaller institutions. The policy addresses a structural inequality in China’s banking sector: the largest banks, such as ICBC, China Construction Bank, and Agricultural Bank of China have the resources to build proprietary AI compute clouds, while smaller regional banks and rural credit cooperatives do not.
ICBC has already moved to fill this gap, deploying what it describes as the banking industry’s first domestically controlled AI compute cloud capable of training trillion-parameter models. The cloud is designed to serve not just ICBC’s internal needs but the broader banking sector, providing smaller institutions with access to frontier AI capabilities without requiring them to build their own infrastructure. This approach advances China’s broader goal of reducing reliance on foreign AI technology providers while democratizing access to AI capabilities within the domestic financial system.
Lifecycle Management and the Regulatory Architecture
The fourth major provision requires banks to manage AI systems through their full lifecycle, from initial business requirement analysis through deployment, ongoing monitoring, and eventual retirement. This governance requirement is less headline-grabbing than the personal data ban or the high-risk classification, but it is arguably more consequential for day-to-day operations: it means that every AI system deployed in a Chinese bank must be tracked, evaluated, and updated in accordance with a documented process that regulators can audit.
The NFRA rules fit into a broader regulatory architecture that EastFrontier has tracked closely. China’s three major AI regulations enacted earlier this year established the general framework for AI governance across sectors; the NFRA rules apply that framework specifically to the financial sector with the additional precision that banking supervision requires. Together, they represent a governance approach that is more prescriptive than the US model and more sector-specific than the EU’s horizontal AI Act.
For investors in Chinese fintech and AI, the rules create both constraints and opportunities. The personal data ban limits certain training approaches but creates demand for synthetic data and federated learning solutions. The shared infrastructure mandate creates a market for AI compute services within the banking sector. And the high-risk classification framework, by requiring human oversight of credit decisions, creates demand for AI systems designed from the ground up to support, rather than replace, human review, a different product category from fully automated lending systems, and one where Chinese AI companies have an opportunity to build genuine expertise.