Home › Library › Banking Ethics: Changing Dynamics
JAIIB Paper 2 • Ethics in Banks and Financial Institutions
Banking Ethics: Changing Dynamics
Every ethical principle covered so far in this module was written for an era before AI-driven credit scoring and API-shared financial data â this final topic asks what those same principles demand when technology moves faster than regulation. Covers ethics and technology, data security/privacy (DPDP Act), intellectual property rights, patents/proprietary rights, and the ethics of information security, with 50 exam-style MCQs with hidden answers.
đ Updated: September 2026 • 32 min read
đ At a Glance
Concept
Key Point
DPDP Act, 2023
India's Digital Personal Data Protection Act â consent-based data processing
Algorithmic Bias
AI credit models can perpetuate historical discrimination if trained on biased data
Proprietary Rights
A bank's internal risk models/software are protectable trade secrets/IP
1 Ethics and Technology
đ¤
Old Principles, New Applications
Technology doesn't create new ethical principles so much as it creates new, faster, higher-stakes applications of old ones â fairness now means auditing an AI credit-scoring model for algorithmic bias (does it systematically disadvantage certain demographics due to biased historical training data?); transparency now means explaining an AI-driven loan rejection in terms a customer can understand, not just a black-box score. Banks increasingly adopt "Responsible AI" principles â explainability, fairness testing, human oversight of automated decisions â precisely because unchecked algorithmic decision-making can scale an unnoticed bias to thousands of customers instantly.
2 Data Security and Privacy
đ
DPDP Act, 2023
India's Digital Personal Data Protection Act establishes a consent-based framework for processing personal data, defining rights for "Data Principals" (individuals) and obligations for "Data Fiduciaries" (entities processing data, including banks) â including purpose limitation, data minimisation, and breach notification requirements.
đ
Privacy by Design
Building data protection into a product/system's architecture from the outset, rather than retrofitting privacy controls after launch â an ethical (and increasingly legal) expectation for new banking products/apps.
đ¯
Purpose Limitation
Using customer data only for the specific purpose it was collected/consented for â e.g., not repurposing loan-application data for unrelated marketing without fresh consent.
đĸ
Breach Notification
An ethical (and DPDP Act-mandated) obligation to promptly inform affected individuals and the regulator (Data Protection Board) when a data breach occurs, rather than concealing it.
3 Intellectual Property Rights
Intellectual Property Rights (IPR) protect creations of the mind â software code, proprietary risk models, brand names, and process innovations. Ethically, this cuts two ways for a bank: (1) respecting others' IP (not copying a competitor's app design or a vendor's proprietary algorithm without licence), and (2) protecting the bank's own IP (an employee leaving to a competitor should not carry proprietary models/code with them â a recurring source of employment disputes and trade secret litigation in the FinTech era).
4 Patents and Proprietary Rights
đ
Patents
Legal protection for a genuinely novel invention/process (e.g., a specific fraud-detection algorithm meeting patentability criteria), granting exclusive rights to prevent others from using it without licence.
đ
Trade Secrets / Proprietary Rights
Confidential business information (a bank's internal credit-scoring formula, customer-segmentation logic) protected not by public patent registration but by maintaining secrecy â losing secrecy generally means losing the protection.
A patent requires public disclosure of the invention in exchange for exclusivity; a trade secret gets protection precisely by staying undisclosed â opposite mechanisms for the same underlying goal of protecting valuable IP.
5 Ethics of Information Security
Beyond compliance: The "ethics" of information security goes beyond simply meeting minimum legal/regulatory security requirements â it asks whether a bank is doing everything reasonably possible to protect customer data and system integrity, even where a specific regulation hasn't yet caught up with a new risk. This includes ethical questions like: should a bank disclose a security vulnerability discovered internally even before any actual breach occurs? Should customer data be retained indefinitely "just in case," or deleted once no longer needed (a core ethical/DPDP data-minimisation principle)? These questions require judgment beyond a compliance checklist.
â Key Takeaways
Ethics and technology: old principles (fairness, transparency) apply to new contexts like AI credit scoring â "Responsible AI" (explainability, bias testing, human oversight) is the emerging standard.
The DPDP Act, 2023 establishes India's consent-based data protection framework, with banks as Data Fiduciaries owing obligations to Data Principals.
Intellectual Property Rights cut both ways â respecting others' IP and protecting the bank's own proprietary models/code.
Patents require public disclosure for exclusivity; trade secrets get protection by staying confidential â opposite mechanisms, same protective goal.
The ethics of information security goes beyond minimum compliance, asking whether a bank does everything reasonably possible to protect data, including proactive vulnerability disclosure and data minimisation.
đ Top 50 JAIIB-Style MCQs on Banking Ethics: Changing Dynamics
Test your understanding with these 50 practice MCQs, closely modelled on the JAIIB (PPB) exam pattern. Each question has 5 options â the correct answer is hidden by default; tap "Show Answer" to reveal it along with a short explanation.
đ¤ Ethics and Technology
1 Algorithmic bias in an AI credit-scoring model refers to:
A. The model systematically disadvantaging certain demographics due to biased historical training data
B. A model that is always perfectly fair with no possibility of bias
C. A term unrelated to any AI or machine learning system
D. A feature that always benefits every applicant equally
E. A purely technical glitch with no ethical dimension
Answer: A. Algorithmic bias means systematic disadvantage from biased training data.
2 "Responsible AI" principles in banking include:
A. Explainability, fairness testing, and human oversight of automated decisions
B. No oversight of any kind over automated systems
C. Complete secrecy about how AI models work, with no explainability
D. Deliberately ignoring any fairness testing
E. Fully automated decisions with zero human review
Answer: A. Responsible AI includes explainability, fairness testing, human oversight.
đ Data Security & Privacy
3 The DPDP Act, 2023 is India's:
A. Digital Personal Data Protection Act
B. Domestic Payment and Deposit Protection Act
C. A law unrelated to data protection
D. A foreign statute with no application in India
E. A currency regulation
Answer: A. DPDP Act = Digital Personal Data Protection Act, 2023.
4 Under the DPDP Act, an individual whose personal data is processed is called a:
A. Data Principal
B. Data Fiduciary
C. Data Board
D. Data Regulator
E. No specific term is used
Answer: A. The individual is termed the Data Principal.
5 An entity like a bank processing personal data under DPDP is termed a:
A. Data Fiduciary
B. Data Principal
C. Data Consumer
D. No specific term applies
E. A Data Regulator exclusively
Answer: A. The processing entity is termed the Data Fiduciary.
6 "Purpose limitation" means:
A. Using customer data only for the specific purpose it was collected/consented for
B. Using customer data for any purpose without restriction
C. Never using customer data for any purpose at all
D. A concept unrelated to data protection
E. Allowing indefinite repurposing without consent
Answer: A. Purpose limitation restricts data use to its consented purpose.
7 "Privacy by design" means:
A. Building data protection into a system's architecture from the outset
B. Adding privacy controls only after a breach has already occurred
C. Ignoring privacy entirely during product design
D. A concept applicable only to physical branch design
E. Retrofitting privacy as an afterthought exclusively
Answer: A. Privacy by design builds protection in from the outset.
đ IP Rights, Patents & Trade Secrets
8 A patent requires:
A. Public disclosure of the invention in exchange for exclusivity
B. Complete, permanent secrecy with no disclosure
C. No protection mechanism of any kind
D. Automatic protection with no filing or disclosure
E. Disclosure only to competitors, never the public
Answer: A. Patents require public disclosure in exchange for exclusivity.
9 A trade secret gets protection by:
A. Staying confidential/undisclosed
B. Being publicly registered and disclosed
C. Having no protective mechanism at all
D. Being shared freely with competitors
E. Requiring a patent filing first
Answer: A. Trade secrets are protected by remaining confidential.
10 An employee leaving a bank for a competitor and carrying proprietary risk models with them raises concerns of:
A. Trade secret/IP violation
B. No ethical or legal concern of any kind
C. A fully encouraged, standard practice
D. A matter unrelated to intellectual property
E. A concern only for the new employer, never the former one
Answer: A. This raises trade secret/IP violation concerns.
đĄī¸ Ethics of Information Security
11 The "ethics" of information security goes beyond:
A. Simply meeting minimum legal/regulatory security requirements
B. Any legal requirement, addressing no ethical consideration
C. All practical security measures, addressing nothing further
D. Only technical, never ethical, considerations
E. Data protection entirely
Answer: A. Ethics of information security goes beyond minimum legal compliance.
12 Data minimisation, as an ethical/DPDP principle, means:
A. Deleting customer data once no longer needed, rather than retaining it indefinitely
B. Retaining all customer data forever, regardless of need
C. Collecting unlimited data with no restriction
D. A concept unrelated to data protection ethics
E. Sharing data freely with any third party
Answer: A. Data minimisation means deleting data once no longer needed.
𧊠Mixed / Comprehensive
13 Which of the following best explains why "explainability" matters for an AI-driven loan rejection?
A. A customer denied credit deserves an understandable reason, not just an opaque score, consistent with fairness and transparency principles
B. Explainability has no connection to fairness or transparency
C. Customers should never be told why their loan was rejected
D. Opaque scoring is always preferable to any explanation
E. Transparency principles have no application to AI-driven decisions
Answer: A. Explainability upholds fairness/transparency for a rejected customer.
14 Which of the following best explains why AI-driven bias is considered particularly dangerous compared to a single biased human decision-maker?
A. An unchecked algorithmic bias can scale to affect thousands of customers instantly, unlike an isolated human decision
B. AI systems always make fewer biased decisions than any human decision-maker
C. Scale has no bearing on the severity of algorithmic bias impact
D. A single human decision-maker's bias always affects more people than an algorithm
E. AI-driven decisions are inherently immune to any bias
Answer: A. Algorithmic bias can scale instantly to thousands, unlike isolated human bias.
15 Which of the following would be an appropriate reason a bank tests its AI credit-scoring model against historical training data for bias before deployment?
A. If historical data reflects past discriminatory lending patterns, an AI model trained on it could perpetuate that discrimination at scale
B. Historical training data always guarantees a perfectly unbiased model with no testing needed
C. Bias testing before deployment serves no practical purpose
D. Past discriminatory patterns have no bearing on how a trained AI model behaves
E. AI models trained on historical data are automatically free of any bias
Answer: A. Historical data reflecting past discrimination can be perpetuated by an untested AI model.
16 Which of the following would be an appropriate reason a bank's DPDP Act compliance requires obtaining fresh consent before using loan-application data for unrelated marketing?
A. The original consent was for the loan application purpose only, and purpose limitation requires new consent for a different, unrelated use
B. Original consent for any purpose automatically covers all future unrelated uses
C. Purpose limitation has no bearing on repurposing customer data
D. Marketing use of customer data requires no consent under any circumstance
E. Fresh consent is never required regardless of the new intended use
Answer: A. Purpose limitation requires fresh consent for an unrelated new use.
17 Which of the following would be an appropriate reason the DPDP Act mandates breach notification to both the affected individual and a regulator?
A. Prompt notification lets affected individuals take protective action (e.g., changing passwords) while enabling regulatory oversight of the incident
B. Breach notification serves no protective purpose for affected individuals
C. Concealing a breach is always the preferred, ethical response
D. Regulatory oversight of data breaches has no value or purpose
E. Affected individuals have no need to know about a breach affecting their data
Answer: A. Notification enables protective action and regulatory oversight.
18 Which of the following would be an appropriate example of a bank respecting a vendor's IP rights?
A. Licensing a FinTech partner's proprietary algorithm rather than reverse-engineering and copying it without permission
B. Copying a competitor's app design without any licence or permission
C. Using a vendor's proprietary code without disclosure or licensing
D. IP respect has no relevance to vendor relationships
E. Reverse-engineering a partner's algorithm is always ethically acceptable with no licence needed
Answer: A. Proper licensing rather than unauthorised copying respects vendor IP rights.
19 Which of the following would be an appropriate reason a bank's internal credit-scoring formula is typically protected as a trade secret rather than patented?
A. Patenting would require public disclosure of the formula, potentially letting competitors replicate it, whereas trade secret protection preserves competitive advantage through confidentiality
B. Trade secrets always require public disclosure, identical to patents
C. Patenting a formula has no disclosure requirement whatsoever
D. Confidentiality offers no competitive advantage over public patent disclosure
E. Credit-scoring formulas cannot be protected by any intellectual property mechanism
Answer: A. Trade secret protection preserves competitive advantage without the disclosure a patent requires.
20 Which of the following would be an appropriate ethical question a bank should ask regarding a security vulnerability discovered internally, even before any actual breach occurs?
A. Whether proactive disclosure/remediation is warranted even absent regulatory mandate, given the potential risk to customers if left unaddressed
B. Whether the vulnerability can be permanently concealed with no further action needed
C. Vulnerabilities discovered internally never warrant any consideration of disclosure
D. Proactive remediation serves no ethical purpose absent an actual breach
E. Customer risk has no bearing on how an undisclosed vulnerability should be handled
Answer: A. Proactive disclosure/remediation should be considered given potential customer risk.
21 Which of the following best explains why "human oversight of automated decisions" is a key Responsible AI principle for high-stakes banking decisions?
A. A human reviewer can catch edge cases or errors an algorithm might miss, adding a check especially important for decisions significantly affecting a customer's life
B. Human oversight has no value once an algorithm has been properly trained
C. Algorithms are always more reliable than any human reviewer for high-stakes decisions
D. Edge cases and errors never occur in automated decision-making
E. High-stakes decisions require no human check beyond the algorithm's own output
Answer: A. Human oversight catches edge cases/errors, important for high-stakes customer decisions.
22 Which of the following would be an appropriate description of the ethical tension between a bank retaining customer data "just in case" versus deleting it per data minimisation?
A. Retention might offer future business/analytical value, but it also increases privacy risk and breach exposure â data minimisation resolves this by favouring deletion once the original purpose is served
B. There is no tension at all; retention and minimisation are identical approaches
C. Retaining data indefinitely always eliminates any privacy risk
D. Data minimisation has no connection to reducing breach exposure
E. Future business value has no bearing on this ethical consideration
Answer: A. Minimisation resolves the retention-value-vs-privacy-risk tension by favouring deletion.
23 Which of the following would be an appropriate reason "Responsible AI" governance is increasingly formalised (e.g., dedicated committees/policies) rather than left to individual data scientists' judgment?
A. Formal governance ensures consistent, organisation-wide standards for fairness/explainability rather than relying on the varying judgment of individual practitioners
B. Individual judgment always produces more consistent outcomes than any formal governance structure
C. Formal AI governance serves no consistency-related purpose
D. Fairness/explainability standards require no organisation-wide consistency
E. Dedicated committees have no role in overseeing AI ethics
Answer: A. Formal governance ensures consistent standards across the organisation.
24 Which of the following would be an appropriate reason data protection regulation (like the DPDP Act) is described as "catching up" to technology rather than leading it?
A. New technologies (AI, data-sharing platforms) often emerge and scale before comprehensive regulation is drafted, creating periods where only ethical judgment, not law, governs certain practices
B. Regulation always precedes and anticipates every new technology before it emerges
C. Ethical judgment has no role to play when regulation lags behind technology
D. Technology and regulation always develop in perfect lockstep with no gaps
E. New data-sharing platforms have no bearing on regulatory development timelines
Answer: A. New technology often outpaces regulation, leaving gaps governed by ethical judgment alone.
25 Which of the following would be an appropriate reason a bank's ethics/compliance function collaborates closely with its data science/AI team, rather than operating in separate silos?
A. Fairness and bias considerations need to be built into model design from the start, requiring ongoing collaboration rather than a purely after-the-fact compliance review
B. Ethics and data science functions have no meaningful overlap requiring collaboration
C. After-the-fact compliance review alone is always sufficient without any design-stage collaboration
D. Model design considerations have no connection to fairness or bias outcomes
E. Siloed operation between these functions produces identical outcomes to close collaboration
Answer: A. Fairness needs to be built in from the start, requiring ongoing ethics-data science collaboration.
26 Which of the following would be an appropriate reason "consent fatigue" (customers reflexively accepting terms without reading) is an ethical challenge for consent-based data frameworks like DPDP?
A. If consent is given without genuine understanding, the ethical/legal purpose of requiring consent (informed choice) is undermined in practice
B. Consent fatigue has no bearing on whether consent is genuinely informed
C. Reflexive acceptance of terms always constitutes fully informed consent
D. Informed choice has no connection to the purpose of a consent-based framework
E. This phenomenon strengthens, rather than undermines, the framework's intended purpose
Answer: A. Uninformed consent undermines the framework's core purpose of genuine informed choice.
27 Which of the following would be an appropriate reason a bank's IP protection strategy for its proprietary fraud-detection algorithm might combine both patent filing (for a specific novel technique) and trade secret protection (for the broader implementation details)?
A. Different components of an innovation may be better suited to different protection mechanisms depending on whether disclosure or confidentiality better serves the bank's strategic interest for that component
B. Patent and trade secret protection are always mutually exclusive with no possibility of combined use
C. All components of any innovation should always use the identical protection mechanism
D. Strategic interest has no bearing on choosing between disclosure and confidentiality
E. Combining protection mechanisms serves no practical IP strategy purpose
Answer: A. Different components may suit different protection mechanisms based on strategic interest.
28 Which of the following would be an appropriate reason a bank might face reputational (not just legal) consequences for a data breach, even if it fully complies with DPDP notification requirements?
A. Customers may still lose trust in the bank's ability to safeguard their data, regardless of how compliantly the breach was subsequently handled
B. Compliant notification always fully restores any lost customer trust
C. Reputational consequences never follow a data breach regardless of circumstances
D. Customer trust has no connection to a bank's data-security track record
E. Legal compliance and reputational impact are always identical, with no distinction
Answer: A. A breach can damage trust regardless of subsequent compliant handling.
29 Which of the following would be an appropriate example of the "changing dynamics" this topic's title refers to, compared to traditional banking ethics concerns?
A. Fairness now extends to auditing algorithmic decision-making, a concern that didn't exist in traditional, manual, human-decision-based banking
B. No new ethical dynamics have emerged with banking's technological evolution
C. Algorithmic decision-making auditing was already a central concern in pre-digital banking
D. Traditional and technology-era banking ethics concerns are entirely identical
E. Fairness concerns have remained completely static despite technological change
Answer: A. Auditing algorithmic fairness is a new dynamic absent from traditional manual-decision banking.
30 Which of the following would be an appropriate reason banks are cautious about sharing customer data with FinTech partners even when the AA (Account Aggregator) framework technically permits consented sharing?
A. Beyond mere legal permissibility, banks must consider whether the partner's own data-handling practices meet the bank's own ethical/security standards
B. Legal permissibility alone always fully addresses every ethical consideration in data sharing
C. Partner data-handling practices have no bearing on a bank's own ethical responsibility
D. Banks have no responsibility once data sharing is technically consented and legally permitted
E. Security standards of a receiving partner are irrelevant to the sharing bank
Answer: A. Beyond legal permission, partner practices must meet the bank's own ethical/security bar.
31 Which of the following would be an appropriate reason a bank's ethics committee reviews new AI-based products before launch, rather than relying solely on the technical team's own assessment?
A. An independent, ethics-focused review can catch fairness/privacy concerns that a purely technical evaluation focused on functionality/performance might overlook
B. Technical teams always fully address every ethical consideration without any need for separate review
C. Independent ethics review serves no additional value beyond a technical assessment
D. Fairness and privacy concerns are always identical to functionality/performance concerns
E. Pre-launch ethics review has no practical benefit for new AI products
Answer: A. Independent ethics review can catch concerns a purely technical assessment might miss.
32 Which of the following would be an appropriate reason a customer's "right to be forgotten" (data erasure request) creates operational challenges for a bank, distinct from other industries?
A. Banks often have separate regulatory record-retention obligations (e.g., KYC/AML records) that may conflict with a full, immediate erasure request, requiring careful balancing
B. Banks have no record-retention obligations that could conflict with any erasure request
C. Erasure requests create no operational complexity for any industry, including banking
D. KYC/AML retention requirements have no bearing on data erasure rights
E. This challenge is unique to banking with no need for any balancing consideration
Answer: A. KYC/AML retention obligations can conflict with erasure requests, requiring careful balancing.
33 Which of the following would be an appropriate reason patents on genuinely novel fraud-detection techniques might raise an ethical tension around industry-wide fraud prevention?
A. Patent exclusivity could limit other banks' ability to use the same effective technique, potentially leaving customers at other institutions more vulnerable to the same fraud pattern
B. Patent protection always benefits every bank and customer identically with no exclusivity trade-off
C. Fraud prevention techniques have no connection to any patent-related ethical tension
D. Exclusivity has no bearing on how widely an effective fraud-prevention technique can be adopted
E. Other institutions' customers are never affected by one bank's patent decisions
Answer: A. Patent exclusivity could limit broader adoption, potentially leaving other customers vulnerable.
34 Which of the following would be an appropriate reason a bank documents its AI model's decision logic (even if proprietary/confidential internally) rather than treating it as a complete black box even to itself?
A. Internal documentation supports the bank's own ability to audit, explain, and correct the model if bias or errors are later discovered
B. A complete black-box approach, even internally, is always preferable for banks
C. Internal documentation serves no auditing or correction purpose
D. Bias or errors in a model can never be discovered or corrected regardless of documentation
E. This documentation practice has no connection to Responsible AI principles
Answer: A. Internal documentation supports the bank's own ability to audit and correct the model.
35 Which of the following would be an appropriate reason this final topic in JAIIB's Ethics module specifically addresses "changing dynamics" rather than static principles alone?
A. Technology continuously introduces new ethical scenarios (AI bias, data-sharing complexity) that a banker must learn to recognise and reason through, beyond memorising fixed historical case studies
B. Banking ethics has remained completely static since the era of Enron and Satyam, with no new dynamics to address
C. Technology has introduced no new ethical scenarios relevant to banking
D. Fixed historical case studies alone are always sufficient for understanding all future ethical challenges
E. This topic has no forward-looking relevance to a banker's actual future practice
Answer: A. Technology continuously introduces new scenarios requiring evolving ethical reasoning skills.
36 Which of the following would be an appropriate reason a bank's legal/compliance team monitors evolving DPDP Act rules and amendments closely, even after initial compliance is achieved?
A. Data protection regulation, especially in a fast-evolving digital economy, is likely to be refined/amended over time, requiring ongoing compliance monitoring
B. Once initial compliance is achieved, no further monitoring of regulatory change is ever needed
C. Data protection regulation, once enacted, never requires any amendment or refinement
D. Ongoing monitoring of regulatory evolution serves no practical compliance purpose
E. The digital economy's evolution has no bearing on data protection regulatory change
Answer: A. Fast-evolving digital regulation requires ongoing compliance monitoring beyond initial compliance.
37 Which of the following would be an appropriate reason a bank considers the ethical implications of using customer transaction data to train a general-purpose AI model shared across multiple bank products?
A. Data collected/consented for one specific product's purpose might not have covered use in an unrelated, broader model, raising purpose-limitation concerns
B. Purpose limitation has no relevance to how data is used in training AI models
C. Any data collected for any purpose can always be freely used for training any other model
D. Cross-product AI training raises no ethical or consent-related consideration
E. Original consent for one product automatically extends to every unrelated future use
Answer: A. Using data beyond its original consented purpose raises purpose-limitation concerns.
38 Which of the following would be an appropriate reason "algorithmic accountability" (a bank being answerable for its AI's decisions) is emphasised alongside technical accuracy metrics?
A. A technically "accurate" model overall could still produce systematically unfair outcomes for a specific subgroup, so accountability requires looking beyond aggregate accuracy alone
B. Technical accuracy alone always guarantees fair outcomes for every subgroup
C. Algorithmic accountability has no relevance once a model achieves high aggregate accuracy
D. Subgroup-level fairness is identical to overall aggregate accuracy in every case
E. Accountability considerations are irrelevant to AI-driven banking decisions
Answer: A. High aggregate accuracy can mask subgroup-level unfairness, requiring broader accountability focus.
39 Which of the following would be an appropriate reason a bank's data governance policy specifies who within the organisation can access sensitive customer data used in AI model training?
A. Restricting access limits the risk of misuse or unauthorised exposure of sensitive data even during the internal model-development process
B. Access restrictions have no relevance during internal model development, only during external sharing
C. All employees should have unrestricted access to any sensitive data used in AI training
D. Misuse risk during internal development is always negligible regardless of access controls
E. Data governance policies have no application to AI model training processes
Answer: A. Restricted access limits misuse/unauthorised exposure risk even during internal development.
40 Which of the following would be an appropriate summary of how "Ethics and Technology" (Section 1) sets up the remaining sections (data privacy, IP, information security) in this topic?
A. It establishes the general principle that technology reframes, rather than replaces, existing ethical obligations, which the subsequent sections then apply to specific domains (data, IP, security)
B. Section 1 has no connection to the subsequent sections in this topic
C. Technology entirely replaces, rather than reframes, prior ethical obligations
D. The subsequent sections address entirely unrelated subject matter to Section 1
E. This structural relationship serves no coherent pedagogical purpose
Answer: A. Section 1's general principle is applied to the specific domains in subsequent sections.
41 Which of the following would be an appropriate reason a bank might choose to exceed minimum DPDP Act requirements in its own internal privacy policy?
A. Going beyond minimum legal requirements can build stronger customer trust and pre-emptively address risks a baseline compliance approach might not fully cover
B. Exceeding minimum requirements always creates unnecessary business risk with no benefit
C. Minimum legal compliance always fully addresses every customer trust consideration
D. There is never any benefit to a bank exceeding baseline regulatory requirements
E. Customer trust has no connection to how a bank approaches data privacy
Answer: A. Exceeding minimums can build trust and pre-emptively address gaps in baseline compliance.
42 Which of the following would be an appropriate reason a bank's proprietary risk model is considered a valuable asset requiring protection similar to physical bank assets like cash or property?
A. The model represents significant investment and competitive advantage, and its theft/leakage could cause real financial/competitive harm, analogous to theft of a physical asset
B. Proprietary models have no value comparable to physical bank assets
C. Theft or leakage of a risk model causes no meaningful harm to a bank
D. Competitive advantage has no connection to protecting intangible assets like risk models
E. Intangible assets require no protection comparable to physical ones
Answer: A. A proprietary model's value and competitive advantage make it analogous to a protectable physical asset.
43 Which of the following would be an appropriate reason a bank considers the ethics of using third-party data brokers to supplement its own customer data for credit decisions?
A. The bank must consider whether the third-party data was ethically/legally sourced with proper consent, since using improperly sourced data could implicate the bank in a chain of consent violations
B. Third-party data sourcing practices have no bearing on the using bank's own ethical responsibility
C. Data brokers always ensure perfectly ethical, fully consented data sourcing with no need for verification
D. Using improperly sourced third-party data carries no implication for the purchasing bank
E. Consent chains have no relevance to third-party data purchase decisions
Answer: A. The bank must verify ethical/legal sourcing to avoid being implicated in consent-chain violations.
44 Which of the following would be an appropriate reason "explainable AI" (XAI) techniques are an active area of banking technology investment?
A. As AI models grow more complex, generating human-understandable explanations for their outputs becomes both an ethical necessity and, increasingly, a regulatory expectation
B. Explainable AI techniques have no connection to ethical or regulatory considerations
C. More complex AI models automatically become more explainable without any additional technique investment
D. Regulatory expectations have no bearing on AI explainability investment decisions
E. Human-understandable explanations serve no practical or ethical purpose
Answer: A. XAI addresses the growing ethical/regulatory need to explain complex AI outputs.
45 Which of the following would be an appropriate reason a bank's board is briefed periodically on emerging technology-ethics risks (AI bias, data privacy), similar to how it's briefed on credit/market risk?
A. Technology-ethics risks can have material financial, legal, and reputational consequences warranting the same senior governance attention as traditional financial risks
B. Technology-ethics risks carry no material consequences warranting board attention
C. Only traditional financial risks, never technology-ethics risks, deserve board-level briefing
D. Board governance has no role in overseeing emerging technology risks
E. Reputational consequences are unrelated to technology-ethics risk management
Answer: A. Technology-ethics risks carry material consequences warranting the same board attention as financial risks.
46 Which of the following would be an appropriate reason this topic (and the broader Ethics module) emphasises judgment-based reasoning over rote rule-memorisation for JAIIB candidates?
A. Real-world ethical scenarios, especially in fast-evolving technology contexts, rarely map perfectly onto a memorised rule, requiring bankers to reason through novel situations using underlying principles
B. Rule-memorisation alone always fully prepares a banker for every real-world ethical scenario
C. Novel technology situations never require any reasoning beyond existing memorised rules
D. Underlying principles have no practical application to real ethical decision-making
E. Judgment-based reasoning has no advantage over rote memorisation for exam or practical purposes
47 Which of the following would be an appropriate reason a bank views compliance with the DPDP Act as a floor, not a ceiling, for ethical data practice?
A. Legal minimums establish a baseline, but genuinely ethical practice may require going further where the law hasn't yet addressed a specific emerging concern
B. Legal minimums always represent the maximum possible ethical standard achievable
C. There is never any gap between legal compliance and genuinely ethical practice
D. Emerging concerns not yet addressed by law require no further ethical consideration
E. Viewing compliance as a floor rather than ceiling serves no practical purpose
Answer: A. Legal minimums are a baseline; genuine ethics may require going further where law hasn't caught up.
48 Which of the following would be an appropriate reason this final topic serves as a fitting conclusion to the entire JAIIB Ethics module (spanning organisational, individual, employee, workplace, and technology dimensions)?
A. It shows that the foundational ethical principles established throughout the module (trust, fairness, transparency, integrity) remain the constant thread even as their specific application evolves with new technology
B. This topic has no connection to the foundational principles covered in earlier module sections
C. Technology-era ethics requires an entirely new, unrelated set of principles with no continuity to earlier topics
D. Foundational principles like trust and fairness become irrelevant once technology is introduced
E. This topic's positioning as the module's conclusion serves no coherent purpose
Answer: A. This topic shows foundational principles persist as the constant thread even as application evolves.
49 Which of the following would be an appropriate reason a banking professional preparing for JAIIB should view this topic as directly relevant to their day-to-day work, not merely theoretical?
A. Modern banking roles increasingly involve AI-assisted decisions, digital data handling, and technology-driven products, making these ethical considerations part of routine practice, not abstract theory
B. AI and digital technology have no presence in modern banking roles
C. This topic is purely theoretical with no connection to any banker's actual daily responsibilities
D. Technology-driven products and data handling are irrelevant to routine banking practice
E. Ethical considerations around technology apply only to specialised IT staff, never general bankers
Answer: A. AI, digital data, and technology products are now routine parts of banking practice.
50 Overall, which statement best summarises this topic?
A. Banking ethics' changing dynamics apply enduring principles (fairness, transparency, trust) to new technology contexts â Responsible AI addressing algorithmic bias/explainability, the DPDP Act's consent-based data protection framework, intellectual property/patent versus trade-secret protection strategies, and an ethics of information security that goes beyond minimum compliance to genuine, judgment-driven protection of customer data and system integrity
B. Technology has eliminated the need for any traditional ethical principle in banking
C. The DPDP Act has no application to banks as data processors
D. Patents and trade secrets are identical, interchangeable protection mechanisms
E. Information security ethics is fully satisfied by minimum regulatory compliance alone
Answer: A. This correctly captures the full banking ethics changing dynamics framework.
Disclaimer: This article is prepared for educational and exam-preparation purposes only, summarising banking ethics and technology topics as of September 2026. Candidates should cross-check the latest official IIBF syllabus and the DPDP Act, 2023 before the exam.