How the regulatory map for AI in banking actually fits together

# How the regulatory mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → for AI in banking actually fits together

Picture a mid-size bank rolling out an AI model that scores small business loan applications. The model was built by a fintech vendor, trained on data licensed from a credit bureau, deployed through a cloud platform, and used by loan officers in twelve states. Before the model approves a single loan, it is already sitting inside the jurisdiction of at least four federal regulators and a patchwork of state laws. None of them wrote a rulebook specifically for "AI." Instead, each is stretching decades-old authority to cover it. Knowing which agency's lens applies, and when, is the actual skill here.

Why there is no single "AI law" for banks

Unlike the EU, the US has not passed a comprehensive federal AI statute for financial services. There is no equivalent of the EU AI Act (the EU's risk-tiered AI regulation, phased in 2024 to 2027) governing US banks.

Instead, US regulators apply existing banking, consumer protection, and fair lending law to AI systems. This means the "AI rulebook" for a US bank is really several overlapping rulebooks, each triggered by a different feature of the same model: what it does, who it touches, and where.

The federal banking regulators: safety and soundness lens

Three agencies supervise banks directly, and each treats AI primarily as a model risk issue, meaning the risk that a model is wrong, misused, or poorly understood, and that this error causes financial or reputational harm.

• OCC (Office of the Comptroller of the Currency): supervises nationally chartered banks. It applies model risk management expectations originally set out in SR 11-7, a joint Fed/OCC guidance document from 2011 that predates modern machine learning but is now the default framework examiners use for AI models, including validation, documentation, and ongoing monitoring requirements.
• Federal Reserve: supervises bank holding companies and state-chartered member banks. It co-authored SR 11-7 and increasingly asks boards whether they understand the AI models embedded in vendor software they did not build in-house.
• FDIC (Federal Deposit Insurance Corporation): supervises state-chartered non-member banks, applying similar model risk expectations, with particular attention to third-party AI tools used by smaller community banks that lack in-house data science teams.

None of these three has issued AI-specific binding rules. They apply the same lens they used for statistical credit scoring in the 1990s: can you explain it, validate it, and control it.

The consumer protection lens: CFPB and fair lending

The CFPB (Consumer Financial Protection Bureau) does not ask "is this model accurate." It asks "did this model treat a consumer unfairly or illegally."

Two laws do the heavy lifting:

• ECOA (Equal Credit Opportunity Act, 1974) and its implementing Regulation B, which prohibit discrimination in credit decisions and require creditors to give applicants specific, accurate reasons for denial, even when a machine learning model made the call. The CFPB has stated explicitly that "the computer says no" is not a legally sufficient adverse action reason, regardless of model complexity.
• FCRA (Fair Credit Reporting Act, 1970), governing how credit bureau data feeds into automated decisions and what disclosures consumers get.

This is where disparate impact becomes a central concept: a model can be facially neutral (it never uses race as an input) and still produce discriminatory outcomes if a correlated variable, like zip code or education history, acts as a proxy. This is a legal risk, not just a technical one, and it is the single most litigated AI issue in US consumer banking.

The FTC's overlapping claim

The FTC (Federal Trade Commission) regulates unfair or deceptive practices under Section 5 of the FTC Act, and it has authority over non-bank fintechs, data brokers, and AI vendors that banks rely on, entities the bank regulators cannot directly supervise.

The FTC has also warned companies against exaggerating AI capabilities. In 2023 it put companies on notice that overselling what an algorithm can do (say, marketing a credit model as "bias-free" without evidence) can itself be a deceptive practice, independent of whether the model actually discriminates.

This matters for banks because most AI credit models are not built entirely in-house. A bank partnering with a fintech underwriting vendor inherits FTC exposure through that vendor, even though the FTC cannot examine the bank itself the way the OCC can.

State regulators and the patchwork problem

State insurance commissioners, state banking departments, and state attorneys general add another layer. Colorado's AI insurance regulation and New York's Department of Financial Services AI guidance for insurers (2024) are early examples of states moving faster than federal agencies, particularly on algorithmic discrimination in underwriting.

California's CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) gives consumers rights around automated decision-making that can apply to banking-adjacent products.

The practical effect: a bank operating in 12 states may face 12 different disclosure or opt-out requirements for the same model, even though federal bank regulators only require one model risk framework.

Putting the mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → together: one model, four lenses

Go back to the small business loan model. Here is how the same deployment gets pulled in different directions:

| Regulator | Question it asks | Legal hook |

|---|---|---|

| OCC / Fed / FDIC | Is the model validated, documented, monitored? | SR 11-7 model risk guidance |

| CFPB | Did a denied applicant get a specific, accurate reason? | ECOA / Regulation B |

| FTC | Did anyone oversell the model's fairness or accuracy? | FTC Act Section 5 |

| State regulators | Does state law require extra disclosure or opt-out? | Varies by state |

A model can pass OCC's validation checklist and still violate ECOA if its adverse action notices are vague. It can be technically fair and still trigger an FTC action if the marketing overstated its capabilities. Compliance with one lens is not compliance with all of them.

Practical guardrails before deployment

Given this mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →, a defensible pre-deployment checklist for an AI credit or risk model looks like this:

1. Model documentation sufficient to satisfy SR 11-7 style validation: what data trained it, what its known limitations are, who owns ongoing monitoring.

2. Adverse action reasoning that can generate specific, individualized denial reasons, not just an overall score. This often requires explainability tooling (like SHAP values) layered on top of the model itself.

3. Disparate impact testing before launch, using standard fair lending statistical tests, and periodically after launch as the model or population drifts.

4. Vendor due diligence treating third-party AI tools as if they carry the bank's own regulatory exposure, since OCC guidance on third-party risk management explicitly says outsourcing the model does not outsource the liability.

5. Marketing and disclosure review to ensure no internal or external claim about the model's fairness or accuracy exceeds what has actually been validated.

A simplified fair lending check, run on model outputs before launch, might look like this: