# How AI regulation actually works across fintech markets
A single credit-scoring model, sold by the same vendor, deployed by three different banks, triggers three completely different regulatory regimes. In the EU, it's "high-risk" under the AI Act and needs a conformity assessment before it ever touches a customer. In the US, it falls under the Federal Reserve's SR 11-7 guidance and demands ongoing model validation. In Singapore, it gets evaluated against MAS FEAT principles, a set of soft-law expectations rather than hard rules. Same algorithm, three rulebooks, three different amounts of paperwork and liability. If you don't know which regime governs your deployment, you find out the expensive way: during an audit, a regulatory inquiry, or worse, a public failure.
This lesson maps the three major regimes so you can classify your own use case before you build.
Credit scoring (deciding who gets a loan, a credit card, or a mortgage, and at what price) sits at the center of nearly every AI regulatory framework. It directly affects financial inclusion, it has a long history of discrimination lawsuits, and it's easy to audit for bias (you can check approval rates by demographic group). That makes it a useful lens: if you understand how regulators treat credit scoring, you understand the logic of the whole regime.
The EU AI Act (formally in force since August 2024, with phased obligations rolling out through 2026-2027) classifies AI systems into four risk tiers: unacceptable, high-risk, limited-risk, and minimal-risk.
Credit scoring and creditworthiness assessment are explicitly named as high-risk use cases (Annex III). That triggers concrete obligations before deployment:
Penalties for non-compliance can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 7% of global annual turnover for the most serious violations (banned practices), with lower caps for other breaches, figures set in the regulation itself as of 2024.
The EU's logic is ex-ante and prescriptive: define the rules in law, force compliance before launch.
The US has no single federal AI law comparable to the EU AI Act. For banks, the operative document is still SR 11-7, a 2011 supervisory letter from the Federal Reserve (joined by the OCC, the Office of the Comptroller of the Currency) on "Model Risk Management."
SR 11-7 predates modern machine learning but has proven flexible enough that regulators now apply it to AI credit models. It requires:
Separately, credit models must also comply with the Equal Credit Opportunity Act (ECOA) and the Fair Housing Act, enforced by the CFPB (Consumer Financial Protection Bureau) and other agencies, which prohibit discrimination on protected characteristics regardless of whether AI is involved.
The US logic is principles-based and sector-specific: no dedicated AI statute, but existing supervisory frameworks and anti-discrimination law are stretched to cover AI. This means obligations depend heavily on *who* you are (a bank supervised by the Fed looks different from a fintech lender that isn't).
Singapore's Monetary Authority of Singapore (MAS) published FEAT principles (Fairness, Ethics, Accountability, Transparency) starting in 2018, alongside the Veritas initiative that helps banks operationalize them.
FEAT is not a binding law the way the EU AI Act is. It's supervisory guidance: MAS expects institutions to demonstrate FEAT alignment, and examiners will ask about it, but there's no fixed statutory penalty schedule attached to FEAT itself.
Core expectations for a credit-scoring deployment:
The Singapore logic is principles-based and collaborative: regulator and industry co-develop expectations (Veritas includes banks like DBS and industry consortiums), then supervision checks alignment during regular exams rather than through a one-time certification.
| Dimension | EU AI Act | US (SR 11-7 + ECOA) | Singapore (MAS FEAT) |
|---|---|---|---|
| Legal status | Binding statute | Supervisory guidance + statute | Supervisory guidance |
| Trigger | Use case classification (high-risk) | Institution type (regulated bank) | Institution type (MAS-regulated) |
| Pre-launch gate | Yes (conformity assessment) | No formal gate, but validation expected | No formal gate, exam-based |
| Enforcement | Fines up to % of turnover | Supervisory action, consent orders | Supervisory action, reputational |
| Core ask | Documented compliance | Independent validation | Demonstrated fairness process |
The practical takeaway: a fintech operating across all three jurisdictions can't build one compliance file and reuse it. The EU wants a certificate before you launch. The US wants an ongoing validation function. Singapore wants you to walk examiners through your fairness testing whenever asked.
Knowledge check
1. Why does the same credit-scoring algorithm face three different regulatory outcomes when deployed in the EU, US, and Singapore?
2. Why is credit scoring used as the central test case for comparing AI regulatory regimes?
3. Under the EU AI Act's risk-tier structure, what is the practical consequence of credit scoring being classified as 'high-risk' rather than 'limited-risk'?
4. Select ALL correct answers about the difference between the EU AI Act approach and Singapore's MAS FEAT principles.
Select all the correct answers.
5. Select ALL correct answers about why understanding your regulatory regime matters before building an AI system in fintech.
Select all the correct answers.
Even without knowing every local nuance, a few checks travel well across all three regimes:
1. Disparate impact testing. Compare approval rates and average interest rates across demographic groups (where legally permitted to collect that data; note the EU and US differ on this). A common threshold cited in US fair-lending practice is the "four-fifths rule" (a group's approval rate below 80% of the highest group's rate flags for review), an enforcement rule of thumb, not a guarantee of legality.
2. Explainability layer. Tools like SHAP (SHapley Additive exPlanations) let you generate a reason code for each decision, useful for EU Article 13 transparency duties, US adverse-action notice requirements under ECOA, and MAS transparency expectations simultaneously.
3. Human-in-the-loop checkpoint. Build a manual review step for edge cases and declines near the threshold, satisfying EU human oversight rules and giving your US validation team an audit point.
4. Drift monitoring. Track the model's population stability index (a common metric for how much the input data distribution has shifted) on a monthly cadence, aligned with SR 11-7's ongoing monitoring expectation.
A minimal drift check in practice:
# Simplified population stability index (PSI) check
import numpy as np
def psi(expected, actual, bins=10):
e_perc, _ = np.histogram(expected, bins=bins)
a_perc, _ = np.histogram(actual, bins=bins)
e_perc = e_perc / len(expected) + 1e-6
a_perc = a_perc / len(actual) + 1e-6
return np.sum((a_perc - e_perc) * np.log(a_perc / e_perc))
# PSI < 0.1: stable | 0.1-0.25: moderate shift | > 0.25: significant drift, retrain review🎬 [VIDEO: "The EU AI Act Explained" - youtube.com/@EUAIAct - a walkthrough of the risk tiers and how high-risk classification works, useful as a visual companion to this section]