Lending, fraud and onboarding were regulated long before machine learning. AI didn’t create new obligations so much as make the old ones harder to prove.
Fintech has always run on models: credit scores, fraud rules, KYC risk ratings. What’s new is how many models there are, how opaque some of them are, and how fast they change. Every one of those shifts lands on an existing obligation.
Explainability is no longer optional, even for complex models
Under the Equal Credit Opportunity Act, a lender that declines an applicant must give the specific principal reasons, either in the notice or when the applicant asks. The rule makes no exception for complex or third-party models: if you can’t say why the model declined someone, you can’t give the reasons the law requires.
That pushes explainability from a data-science nice-to-have into a launch requirement, and every model change has to keep the reasons accurate.
Fair lending risk now hides in features and prompts
Federal fair lending rules narrowed in 2026: the CFPB’s amendments to Regulation B say ECOA doesn’t support disparate-impact liability. The risk didn’t go away. Using a neutral-looking variable as a proxy for a protected trait is still disparate treatment, the Fair Housing Act still recognizes disparate impact for mortgage lending, and several states’ fair lending laws do too.
Alternative data, proxy variables and LLM-generated summaries of applicant files can all introduce bias that no one designed. The compliance math changed from “test the scorecard once” to “test every version, and know which version made each decision”.
Model risk management meets generative AI
Banks and their fintech partners manage models under interagency model risk guidance that expects inventory, validation, ongoing monitoring and oversight of vendor models. Its April 2026 rewrite, SR 26-2, replaced SR 11-7 and explicitly leaves generative and agentic AI out of scope, telling banks to govern those under their own risk practices.
That leaves the fastest-changing models with the least prescribed oversight: models from vendors you can’t fully inspect, outputs that vary run to run, and behavior that shifts when a prompt changes. Partner banks will still expect you to show how you control them.
| Use case | Obligations it touches | What changed with AI |
|---|---|---|
| Credit underwriting | ECOA/Reg B, FCRA, fair lending, EU AI Act high-risk | Reasons must stay accurate across model versions |
| Fraud and AML | BSA/AML, sanctions, model risk | More models, faster retraining, harder validation |
| Customer service bots | UDAAP, complaints, disclosures | Generated answers can misstate terms or fees |
| Insurance pricing | State insurance rules, EU AI Act high-risk | Proxy discrimination in external data |
Your vendors’ AI is your AI
Partner banks, card networks and EU regulators all expect you to know which third-party AI sits in your stack. In the EU, the Digital Operational Resilience Act adds ICT third-party risk requirements on top. A model update from a vendor is a change to your system, whether or not you were told.
The old math was one model, validated annually. The new math is dozens of models, changing weekly, each needing a defensible record.
What good looks like
- One inventory of every model and AI agent, internal and vendor, tied to the decisions it influences.
- Every model, prompt or tool change reviewed and approved before production, with the approval recorded.
- Adverse-action reasons and fairness tests re-run on each material change.
- Evidence a partner bank or examiner can review without a scramble.
Where AgentFlow fits
AgentFlow tracks every AI system and agent, routes changes through a review queue with deploy gates, maps each use case to the regulations that apply, and keeps signed approvals your partner bank and examiners can verify. Talk to us →