How the regulatory map for AI in banking actually fits together

The federal banking regulators: safety and soundness lens

Three agencies supervise banks directly, and each treats AI primarily as a model risk issue, meaning the risk that a model is wrong, misused, or poorly understood, and that this error causes financial or reputational harm.

• OCC (Office of the Comptroller of the Currency): supervises nationally chartered banks. It applies model risk management expectations originally set out in SR 11-7, a joint Fed/OCC guidance document from 2011 that predates modern machine learning but is now the default framework examiners use for AI models, including validation, documentation, and ongoing monitoring requirements.
• Federal Reserve: supervises bank holding companies and state-chartered member banks. It co-authored SR 11-7 and increasingly asks boards whether they understand the AI models embedded in vendor software they did not build in-house.
• FDIC (Federal Deposit Insurance Corporation): supervises state-chartered non-member banks, applying similar model risk expectations, with particular attention to third-party AI tools used by smaller community banks that lack in-house data science teams.

None of these three has issued AI-specific binding rules. They apply the same lens they used for statistical credit scoring in the 1990s: can you explain it, validate it, and control it.

The consumer protection lens: CFPB and fair lending

The CFPB (Consumer Financial Protection Bureau) does not ask "is this model accurate." It asks "did this model treat a consumer unfairly or illegally."

Two laws do the heavy lifting:

• ECOA (Equal Credit Opportunity Act, 1974) and its implementing Regulation B, which prohibit discrimination in credit decisions and require creditors to give applicants specific, accurate reasons for denial, even when a machine learning model made the call. The CFPB has stated explicitly that "the computer says no" is not a legally sufficient adverse action reason, regardless of model complexity.
• FCRA (Fair Credit Reporting Act, 1970), governing how credit bureau data feeds into automated decisions and what disclosures consumers get.

This is where disparate impact becomes a central concept: a model can be facially neutral (it never uses race as an input) and still produce discriminatory outcomes if a correlated variable, like zip code or education history, acts as a proxy. This is a legal risk, not just a technical one, and it is the single most litigated AI issue in US consumer banking.

The FTC's overlapping claim

The FTC (Federal Trade Commission) regulates unfair or deceptive practices under Section 5 of the FTC Act, and it has authority over non-bank fintechs, data brokers, and AI vendors that banks rely on, entities the bank regulators cannot directly supervise.

The FTC has also warned companies against exaggerating AI capabilities. In 2023 it put companies on notice that overselling what an algorithm can do (say, marketing a credit model as "bias-free" without evidence) can itself be a deceptive practice, independent of whether the model actually discriminates.

This matters for banks because most AI credit models are not built entirely in-house. A bank partnering with a fintech underwriting vendor inherits FTC exposure through that vendor, even though the FTC cannot examine the bank itself the way the OCC can.

State regulators and the patchwork problem

State insurance commissioners, state banking departments, and state attorneys general add another layer. Colorado's AI insurance regulation and New York's Department of Financial Services AI guidance for insurers (2024) are early examples of states moving faster than federal agencies, particularly on algorithmic discrimination in underwriting.

California's CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) gives consumers rights around automated decision-making that can apply to banking-adjacent products.

The practical effect: a bank operating in 12 states may face 12 different disclosure or opt-out requirements for the same model, even though federal bank regulators only require one model risk framework.

Putting the mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → together: one model, four lenses

Go back to the small business loan model. Here is how the same deployment gets pulled in different directions:

| Regulator | Question it asks | Legal hook |

|---|---|---|

| OCC / Fed / FDIC | Is the model validated, documented, monitored? | SR 11-7 model risk guidance |

| CFPB | Did a denied applicant get a specific, accurate reason? | ECOA / Regulation B |

| FTC | Did anyone oversell the model's fairness or accuracy? | FTC Act Section 5 |

| State regulators | Does state law require extra disclosure or opt-out? | Varies by state |

A model can pass OCC's validation checklist and still violate ECOA if its adverse action notices are vague. It can be technically fair and still trigger an FTC action if the marketing overstated its capabilities. Compliance with one lens is not compliance with all of them.

Practical guardrails before deployment

Given this mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →, a defensible pre-deployment checklist for an AI credit or risk model looks like this:

1. Model documentation sufficient to satisfy SR 11-7 style validation: what data trained it, what its known limitations are, who owns ongoing monitoring.

2. Adverse action reasoning that can generate specific, individualized denial reasons, not just an overall score. This often requires explainability tooling (like SHAP values) layered on top of the model itself.

3. Disparate impact testing before launch, using standard fair lending statistical tests, and periodically after launch as the model or population drifts.

4. Vendor due diligence treating third-party AI tools as if they carry the bank's own regulatory exposure, since OCC guidance on third-party risk management explicitly says outsourcing the model does not outsource the liability.

5. Marketing and disclosure review to ensure no internal or external claim about the model's fairness or accuracy exceeds what has actually been validated.

A simplified fair lending check, run on model outputs before launch, might look like this:

# Simple disparate impact ratio check (illustrative only)
approval_rate_group_a = approvals_group_a / applications_group_a
approval_rate_group_b = approvals_group_b / applications_group_b

di_ratio = approval_rate_group_b / approval_rate_group_a
# Regulators often flag ratios below 0.80 (the "four-fifths rule")
# as warranting further investigation, though it is a rule of thumb,
# not a safe harbor under ECOA

The 80% "four-fifths rule" is a long-standing EEOC (Equal Employment Opportunity Commission) rule of thumb adapted informally to lending fairness testing. It is a screening tool, not a legal safe harbor: passing it does not guarantee ECOA compliance.

🎬 [VIDEO: "How AI Bias Happens in Lending" - https://www.youtube.com/results?search_query=AI+bias+lending+regulation - search for recent explainer content from CFPB, Brookings, or major law firms on algorithmic fair lending, useful as a visual companion to this lesson]

Key Takeaways

• No single US law governs AI in banking. Four separate lenses apply simultaneously: safety and soundness (OCC, Fed, FDIC via SR 11-7), consumer protection and fair lending (CFPB via ECOA/FCRA), unfair or deceptive practices (FTC via Section 5), and a growing patchwork of state rules.
• Passing one regulator's test does not clear the others. A well-validated model can still violate fair lending law if denial reasons are vague, or trigger FTC action if marketing overstates its fairness.
• Vendor-built AI does not reduce a bank's regulatory exposure. Third-party risk management guidance treats outsourced models as the bank's own liability.
• Disparate impact testing (like the four-fifths rule) is a useful screening tool but not a legal safe harbor; document it as one input into a broader fair lending review.
• Building deployment checklists around all four lenses, documentation, explainability, bias testing, vendor diligence, and marketing review, is more useful than waiting for a single unified "AI law" that does not yet exist.