AI in Banking and Finance: Fraud, Lending, Customer Service and the Rules Banks Follow

Every time you tap your card, a model somewhere decides in a fraction of a second whether the purchase looks like you. Every time you apply for a loan online, software may help decide the answer. And every time you open your bank’s app with a question, there is a good chance an AI assistant answers first.

Banking was using machine learning long before chat assistants made AI a household word. What has changed is how far it now reaches, from the fraud desk to the call center to the loan file, and how quickly the rules around it are shifting. This guide covers the main use cases, the US rules banks follow and what community banks, credit unions and fintechs should do first.

Where banks use AI today

If the difference between machine learning and the newer generative tools is fuzzy, our explainer on machine learning vs deep learning is a quick primer.

Fraud detection and anti-money laundering

Fraud is where AI earns its keep most clearly. Rules like “flag any purchase over $2,000 abroad” catch some fraud but annoy honest customers. Machine learning models look at hundreds of signals at once, such as location, device, merchant type, time of day and spending history, and score how unusual each transaction is for that specific customer.

The public sector uses the same approach. In October 2024 the US Treasury said its expanded fraud detection work prevented and recovered more than $4 billion in fraud and improper payments in fiscal year 2024, including about $1 billion in check fraud recovery it attributed to machine learning.

The new threat: AI-powered fraud

Criminals use AI too. In November 2024 the Financial Crimes Enforcement Network (FinCEN) issued an alert on fraud schemes using deepfake media, noting an increase in suspicious activity reports describing fake identity documents, photos and videos created with generative AI to get past identity checks. The alert lists red flags, such as a customer photo flagged by deepfake detection software or device data that does not match the customer’s documents.

For banks, this means identity verification needs layered defenses: document checks, liveness detection, device signals and strong authentication. Our guide to zero trust security covers the account-protection side.

AI in lending and credit decisions

AI underwriting models can analyze more variables than a traditional scorecard, including cash-flow data from bank accounts. Supporters say this can help approve creditworthy borrowers with thin credit files. Critics worry about hidden bias and decisions no one can explain.

US law does not exempt AI from lending rules. This is not legal advice, and lenders should confirm current requirements with compliance counsel.

Adverse action notices. Under the Equal Credit Opportunity Act (ECOA) and Regulation B, a lender that denies credit or takes other adverse action must notify the applicant, generally within 30 days of a completed application, and provide the specific principal reasons or tell the applicant how to request them (12 CFR 1002.9). Regulation B’s official commentary says vague statements, such as that the applicant failed to achieve a qualifying score, are not enough. That requirement applies whether the decision came from a scorecard or a complex machine learning model, so lenders need models whose key drivers they can identify and explain.

Recent CFPB changes. The Consumer Financial Protection Bureau has changed its approach significantly:

• In May 2025 the CFPB withdrew dozens of guidance documents, including a 2022 circular on adverse action notices for decisions based on complex algorithms. The withdrawal removed the guidance, not the underlying adverse action rule in Regulation B.
• In April 2026 the CFPB published a final rule amending Regulation B, effective July 21, 2026. It removes the “effects test” (disparate impact) from Regulation B, narrows the discouragement provision and changes rules for special purpose credit programs.
• Fair lending groups sued to challenge that rule in federal court in May 2026. Check the current status of the case.

Other laws still apply. Intentional discrimination on a prohibited basis remains illegal under ECOA. The Fair Housing Act covers mortgage lending, many states have their own fair lending and AI laws and the Fair Credit Reporting Act governs how consumer report data is used. Some state AI laws also target automated decisions in lending.

Key takeaway: AI does not change a lender’s obligations. If a model helps deny credit, the lender still has to give specific, accurate reasons, and it remains responsible for discrimination, even if the model came from a vendor.

Model risk management: how regulators expect models to be governed

For 15 years, bank model governance followed SR 11-7, the 2011 supervisory guidance on model risk management. On April 17, 2026, the Federal Reserve, the OCC and the FDIC jointly issued revised model risk management guidance (Federal Reserve SR 26-2 and OCC Bulletin 2026-13) that supersedes SR 11-7.

Key points from the revised guidance:

• Risk-based approach. Expectations scale with a bank’s size, complexity and how much it relies on models. The Federal Reserve says it is expected to be most relevant to banking organizations with over $30 billion in total assets.
• Core lifecycle unchanged. Sound development, validation, ongoing monitoring, governance and attention to vendor models remain central.
• Generative and agentic AI are out of scope. The guidance states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope, while its principles do apply to traditional statistical models and non-generative AI. Banks are expected to use their broader risk management and governance practices to set controls for tools the guidance does not cover.

In practice, this means a traditional fraud or credit model falls under the model risk framework, while a generative AI chat assistant needs governance built from the bank’s general risk, compliance, third-party and information security programs.

AI in customer service

Chat and voice assistants now handle balance questions, card locks, payment dates, dispute intake and branch information. Newer generative assistants can answer in natural language and summarize account activity.

The risks are practical:

• Wrong answers. Generative assistants can state incorrect fees, policies or rates with confidence. Our guide to AI hallucinations explains why and how to reduce it.
• Dead ends. Customers who cannot reach a person when the bot fails get frustrated, and consumer protection rules still apply to what the assistant says and does.
• Security. Assistants connected to accounts must authenticate users properly and resist manipulation.

Strong designs ground answers in approved policy content, limit what the assistant can do without confirmation and provide a clear path to a staff member. As banks experiment with AI agents that take actions on accounts, these controls matter even more.

What smaller banks, credit unions and fintechs should know

Most community banks and credit unions get AI through vendors: their core processor, card network, fraud platform, loan origination system or digital banking provider. That does not shift responsibility. Regulators expect institutions to manage vendor risk, understand how vendor models work at an appropriate level and monitor performance.

Questions to ask any AI vendor:

Fintechs building embedded lending or payments should apply the same questions to their bank partners and their own models. Our guide to embedded finance and real-time payments covers how those partnerships work.

Where to start with AI in banking

1. Start with fraud and operations. These uses have clear metrics, such as losses, false positives and handling time, and they rarely involve credit decisions.
2. Inventory existing models. List every model and AI tool in use, including vendor tools, with an owner and a risk rating.
3. Map each use to its rules. Lending tools need adverse action and fair lending review; customer-facing tools need consumer protection review; all need data security review.
4. Set governance for generative AI separately. Write an approved-tools list, data rules and review requirements, since the new model risk guidance does not cover generative or agentic AI.
5. Pilot with human review. Keep staff approving AI output until accuracy is proven on your own data.
6. Monitor continuously. Track performance, complaints and outcomes by customer group, and retest models on a schedule.

The bottom line

AI is already central to banking, especially in fraud prevention, and it is moving fast into lending, service and operations. The rules have shifted in 2025 and 2026: the CFPB withdrew guidance and narrowed Regulation B, and bank regulators replaced SR 11-7 with new model risk guidance that leaves generative AI to each bank’s own governance. What has not changed is accountability. Banks must still explain credit decisions, avoid discrimination and stand behind what their models and chatbots do.

Sources

• Federal Reserve: SR 26-2, Revised Guidance on Model Risk Management — April 2026 interagency guidance superseding SR 11-7, including the generative and agentic AI scope exclusion
• CFPB: Regulation B, 12 CFR 1002.9 Notifications — adverse action notice timing and specific reasons requirement
• CFPB: Equal Credit Opportunity Act (Regulation B) final rule — April 2026 amendments on disparate impact, discouragement and special purpose credit programs, effective July 21, 2026
• FinCEN: Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions — November 2024 alert and red flags
• US Treasury: Enhanced Fraud Detection Processes, Including Machine Learning AI — fiscal year 2024 fraud prevention and recovery results