TLDR: The financial services industry is rapidly adopting Artificial Intelligence (AI), including predictive, generative, and agentic AI, to enhance efficiency and customer experience. However, this innovation is met with significant regulatory challenges from both federal and state authorities, who are scrutinizing issues like algorithmic bias, data governance, model risk management, and explainability. Financial institutions must proactively update their compliance programs to address these evolving legal and ethical considerations, particularly concerning anti-discrimination laws and data usage rights.
The financial services industry is undergoing a profound transformation driven by the rapid adoption of Artificial Intelligence (AI) models. These include predictive AI, which analyzes historical consumer data to forecast outcomes; generative AI, exemplified by large language models (LLMs) capable of drafting, analyzing vast datasets, and summarizing complex information; and agentic AI, which powers interactive chatbots for direct consumer communication. Financial institutions are leveraging these technologies to improve accuracy, efficiency, and cost-effectiveness across various operations, from estimating default rates and identifying prepayment risk to combating fraud, assessing asset quality, and enhancing customer communications.
However, this technological advancement is unfolding against a backdrop of intense regulatory scrutiny and a complex, evolving legal landscape. Financial services companies are subject to constant oversight from multiple federal agencies, including the Consumer Financial Protection Bureau (CFPB), the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board (FRB), and the National Credit Union Administration (NCUA). State-level supervision also applies to various entities like brokers, lenders, and money transmitters, with state attorneys general holding broad authority to protect residents from harm.
Many existing federal laws, such as the Equal Credit Opportunity Act (ECOA) and the Fair Housing Act (FHA), which prohibit discrimination based on protected characteristics, were enacted decades before AI’s widespread adoption. Despite this, federal regulators have indicated their authority to enforce these laws to prevent algorithmic bias, including discriminatory outcomes from opaque ‘black box’ models. This stance was reinforced by interagency guidance from the CFPB, Department of Justice (DOJ), Equal Employment Opportunity Commission (EEOC), and Federal Trade Commission (FTC), emphasizing their commitment to ensuring automated systems comply with federal laws.
States are also taking a proactive role, often outpacing federal efforts. In 2025, 48 states and Puerto Rico introduced AI-related legislation, with 26 states adopting over 75 new measures. A notable example is the Colorado AI Act (CAIA), set to take effect on February 1, 2026. Modeled after European Union AI legislation, CAIA prohibits algorithmic discrimination, defined as unlawful differential treatment or impact disfavoring individuals or groups based on actual or perceived protected characteristics. This applies to ‘high-risk’ AI uses, including those in housing and financial services, potentially requiring risk assessments and consumer notices. Other states are expected to follow suit, despite a failed federal proposal for a 10-year moratorium on state AI legislation.
To navigate this intricate environment, financial institutions must develop robust AI-ready compliance programs. Key areas of focus include:
Data Considerations:
Understanding and assessing the data inputs for AI models is paramount. Institutions must ensure the quality and source of data, recognizing that models inherit characteristics, including biases, from their training data. Crucially, companies must have proper authority to collect and use data, as highlighted by pending cases concerning copyright and privacy, and FTC consent orders mandating ‘algorithmic disgorgement’ for unauthorized data use. The use of ‘alternative data’ (e.g., cash flow, employment type, online activity) can expand credit access but also poses risks if inputs are not intuitively related to financial capacity or act as proxies for protected classes, potentially violating anti-discrimination laws. Financial institutions should query data inputs for appropriate authority, consumer reporting agency origin, impact on disadvantaged consumers, ability to explain adverse actions, reputational harm, and credible relation to creditworthiness.
Managing Risk When Using AI Models:
AI models, with their complex, evolving algorithms, necessitate updated model risk management procedures. While no federal laws specifically govern AI model development, longstanding federal guidance on ‘models’ (defined broadly by the FRB as quantitative methods applying statistical, economic, financial, or mathematical theories) offers useful principles:
Identify Goals: Document the model’s purpose, intended use, underlying data sources, methodologies, and processing concepts. Test performance under various market conditions.
Test the AI Model: Conduct ongoing model validation and re-evaluation, especially with changes to the model or economic circumstances.
Implement Specific Policies and Controls: Provide detailed, understandable guidance on model use, maintenance, testing, assumptions, and limitations, tailored to the specific model and business case.
Ongoing Monitoring: Continuously monitor models for changes in products, activities, clients, market conditions, or laws that may require recalibration. Regular bias reviews, fairness guidelines, diverse datasets, retrieval augmented generation (‘grounding’ with external data), and reinforcement learning from human feedback can further mitigate regulatory risk.
Explainability:
Regulators are increasingly focused on the ‘why’ behind AI model outputs, particularly when they impact consumers. Although the CFPB withdrew circulars clarifying adverse action notice requirements for complex algorithms in 2025, the underlying ECOA requirements remain: specific, accurate reasons for adverse actions must be provided, regardless of the technology used. The National Institute of Standards and Technology (NIST), while not a financial regulator, offers four principles for explainable AI that are being adopted across industries:
Explanation: Identify the evidence, support, or reasoning behind an AI system’s outcome or process.
Meaningful: Provide explanations that are understandable to the intended consumer.
Explanation Accuracy: Ensure the explanation accurately describes how the AI model reached its conclusion.
Knowledge Limits: Identify and flag instances where the AI model is not equipped to handle scenarios or where its responses may be inaccurate.
Also Read:
- Global Financial Institutions Prioritize Responsible AI with Increased Investment and Dedicated Leadership
- AI Model Risk Management Market Poised for Significant Growth, Projected to Reach $15.03 Billion by 2033
As AI continues its rapid evolution, financial services companies and their advisors must adopt a multi-disciplinary approach. Proactive analysis of AI models and use cases, with a strong focus on data considerations, model risk management, and explainability, will be crucial for balancing innovation with compliance in this dynamic regulatory environment.
