A regional bank denies a mortgage application. The decision came from a machine-learning model the bank licensed from a vendor, trained on data the bank never saw, producing a score nobody at the bank can fully explain. The applicant asks why. The bank's honest answer is: we are not sure. That scenario — not a hypothetical robot uprising — is what keeps US banking regulators occupied when they talk about artificial intelligence.

The supervision conversation has shifted over the past two years. Early regulatory interest in AI was largely observational: agencies hosted innovation hours, published requests for information and asked banks what they were doing. The posture now is more concrete. Examiners ask for model inventories. The Consumer Financial Protection Bureau has stated, in circulars and guidance, that adverse-action notices must give accurate, specific reasons even when a complex model made the decision. And interagency third-party risk guidance makes clear that outsourcing a model does not outsource the accountability.

This article explains which agencies are involved, which existing rules do the work, where the genuine gaps are, and what banks and their customers should expect. It is an explainer drawing on public guidance and statements, not legal advice and not a report of any specific examination.

Who regulates what

US banking supervision is divided by charter and function. The Office of the Comptroller of the Currency supervises national banks and federal savings associations. The Federal Reserve supervises bank holding companies and state member banks. The FDIC supervises state non-member banks and insures deposits across the system. The CFPB writes and enforces consumer financial protection rules across institutions above a size threshold. State regulators charter and supervise state banks alongside them.

None of these agencies has issued a comprehensive AI regulation. What they have done is more incremental and, for banks, more immediate: they have made clear that existing expectations apply to AI systems. The Treasury Department added a sector-level view with its March 2024 report on managing AI-specific cybersecurity risks in financial services, and the Financial Stability Oversight Council has flagged AI as a potential source of systemic vulnerability in its annual reporting.

The result is a patchwork that is older than it looks. A bank deploying a generative-AI customer-service agent in 2026 is governed by the same unfair-and-deceptive-practices law, the same fair-lending statutes and the same model-risk expectations as a bank deploying a logistic-regression scorecard in 2010. The technology changed; the accountability structure did not.

The framework doing the heavy lifting: model risk management

The single most important document in this space predates the current AI wave by more than a decade. The Fed's SR 11-7 letter and the OCC's companion bulletin, issued in 2011, define a model broadly — any quantitative method that processes inputs into estimates — and require banks to validate models before use, monitor them in production, document their limitations and maintain an inventory of everything in use.

Supervisors have consistently said these expectations cover machine learning. That has real teeth. Validation means an independent party challenges whether the model works as intended, on data the developer did not control. Monitoring means the bank watches for performance drift as the economy and customer behavior change. An inventory sounds bureaucratic until a regulator asks a bank to list every model affecting customers and the bank realizes it does not know — a finding that has surfaced in real examinations as AI features quietly ship inside vendor software.

Generative AI strains this framework in specific ways. A credit scorecard has stable inputs and outputs that can be back-tested. A large language model produces open-ended text, can behave differently after a vendor's silent update, and can be manipulated by the very customers it serves through prompt injection. SR 11-7's principles — validation, monitoring, documentation — still apply, but banks and vendors are working out what validation means for a system whose failure mode is a confident, plausible, wrong sentence.

Fair lending: the sharpest legal edge

The area where AI scrutiny is most legally concrete is credit discrimination. The Equal Credit Opportunity Act and Regulation B prohibit discrimination on protected characteristics and require creditors to give applicants specific reasons when they are denied. The Fair Housing Act does similar work in mortgage lending. These are not AI rules — but they bind AI systems completely.

The CFPB made this explicit in its 2022 circular on adverse-action notices: a creditor may not use a model so complex that it cannot state accurate reasons for denial, and it may not rely on a checklist of generic reasons that do not reflect what the model actually did. In 2023 the bureau, joined by other agencies, approved a rule requiring automated valuation models used in mortgage lending to meet quality-control standards, including testing for bias. The message to lenders is consistent: complexity is not a defense.

The harder technical problem is disparate impact — a model that never sees race can still produce systematically worse outcomes for a protected group through correlated variables like zip code, income volatility or thin credit files. Fair-lending testing for machine-learning models is an active, unsettled practice: regulators expect banks to search for less-discriminatory alternative models that perform comparably, but there is no universal standard for how hard that search must be. Expect this to be a continuing source of enforcement and litigation rather than a settled checklist.

Fraud, AML and the supervision of the supervisors' tools

Not all regulatory interest is defensive. Anti-money-laundering monitoring is one of the oldest large-scale machine-learning use cases in banking, and one of the worst-performing: rules-based transaction monitoring generates enormous volumes of false positives, and banks file millions of suspicious activity reports a year, most leading nowhere. FinCEN and the banking agencies have repeatedly encouraged responsible innovation here, including a 2018 joint statement supporting pilot approaches to AML compliance.

AI also cuts the other way. The FBI, Treasury and FinCEN have warned about criminals using generative AI for synthetic identity documents, deepfake voice authorization and phishing at scale. Regulators therefore ask banks two questions at once: whether their AI defenses work, and whether their controls account for AI-enabled attacks. A bank that authenticates customers by voice, for example, now faces a documented risk that voice can be cloned from seconds of audio.

This dual use explains why examiners' questions tend to be evidence questions rather than technology questions. Not 'do you use AI' but: what does your fraud model catch that the old system missed, measured how? What is the false-positive rate? Who reviewed the vendor's training data? What happens when the model is wrong about a customer, and how does that customer find out?

Third-party risk: the vendor problem

Most banks do not build their AI. They buy it — credit models from fintechs, fraud scoring from specialist vendors, chatbots built on foundation models from a small number of large AI providers, all of it increasingly delivered as cloud software the bank cannot inspect directly. The 2023 interagency guidance on third-party risk management states the governing principle plainly: using a third party does not diminish a bank's responsibility to operate safely and comply with the law.

Applied to AI, this creates a genuine tension. A bank's examiners expect documented validation and ongoing monitoring. A foundation-model vendor may consider its weights, training data and even evaluation results proprietary, and may update the model serving the bank's customers with little notice. Banks are responding with contractual audit rights, vendor due-diligence questionnaires, and in some cases running models on their own infrastructure — but the gap between what supervisors expect and what vendors disclose is one of the least resolved issues in the current landscape.

There is also a concentration question regulators have begun to voice: if hundreds of banks route fraud decisions, customer interactions or document processing through the same few model providers, a flaw or outage in one provider becomes a correlated risk across the system. That is a financial-stability argument, not a consumer-protection one, and it is the thread connecting bank supervision to the wider policy debate about AI infrastructure.

What is genuinely unsettled

Honesty about the gaps matters more than confidence about the frameworks. Several questions have no settled answer. How should a bank validate a generative model whose outputs are open-ended? What disclosure do customers deserve when they are talking to a machine, and when a machine influenced a decision about them? How should regulators coordinate when a single AI vendor serves banks supervised by four different agencies?

There is also a live jurisdictional debate. State legislatures have moved faster than Congress on AI generally — Colorado's AI Act, for example, imposes duties on deployers of high-risk AI systems including in lending, with an effective date that has already been pushed once amid industry pushback. The financial industry argues that banking is already regulated and that layering state AI statutes on top creates conflicting obligations; consumer advocates argue that existing banking law was not written with opaque, self-updating models in mind. Federal preemption of state AI laws has been proposed and contested in Congress without resolution.

Finally, the supervisory process itself is opaque. Examination findings are confidential, so the public learns about AI-related supervisory expectations slowly, through speeches, guidance and the occasional enforcement action. Outside observers should be cautious about claims — from vendors or critics — about what examiners are 'requiring,' since much of that is inferred rather than published.

What to watch next

Three developments will signal where this is going. First, whether the agencies update SR 11-7 or issue AI-specific model-risk guidance — several officials have acknowledged the 2011 framework needs interpretation for generative systems, and a formal update would be the most consequential single document in this space. Second, enforcement: a public action involving an AI underwriting or fraud model would set expectations faster than any speech. Third, the state-federal contest — whether Congress preempts state AI laws, and whether banking is carved out, will determine whether banks face one AI regime or fifty.

For customers, the practical takeaway is simpler. The rights you have against a bank's algorithm are the rights you have against the bank: a specific reason when you are denied credit, protection from discrimination, and a regulator to complain to when the answer does not make sense. The technology behind the decision does not change who is responsible for it. That principle — old law, new models, same accountability — is the through-line of everything US banking regulators have said about AI so far.