AI Compliance in Financial Services: Model Risk, Adverse Action, and Fair Lending

What replaced SR 11-7?

SR 26-2 at the Federal Reserve and OCC Bulletin 2026-13, issued jointly with the FDIC on April 17, 2026, replaced SR 11-7 and OCC Bulletin 2011-12 as the US guidance on bank model risk management.

For fifteen years, SR 11-7 and OCC Bulletin 2011-12 were the reference point. Examiners applied them to machine learning models the same way they applied them to logistic regressions. The new guidance also supersedes SR 21-8, the 2021 interagency statement on model risk management for BSA/AML systems, and rescinds the OCC’s Model Risk Management handbook booklet and its 1997 credit scoring model guidance.

Four points matter for AI:

• It is risk-based and tailored to a bank’s size, complexity, and model use. The agencies say it is expected to be most relevant to banking organizations with more than $30 billion in total assets.
• It still covers development and testing, validation and monitoring, governance and controls, and vendor and third-party models.
• The OCC states that generative and agentic AI models are not within its scope. The agencies plan a request for information on model risk management that addresses AI.
• The OCC states that non-compliance with the guidance will not by itself result in supervisory criticism. Violations of law and unsafe or unsound practices caused by poor model risk management still can.

Lighter supervisory expectations do not change the legal exposure. A credit model that produces unexplainable denials is still a fair lending problem, whatever the guidance says about validation.

How do adverse action notices work when a model makes the decision?

When a model makes the credit decision, the rule is the same as when a person does: Regulation B requires a creditor that takes adverse action to give the applicant a statement of specific reasons, or tell the applicant how to get one (12 CFR 1002.9).

In 2022 and 2023, the CFPB issued two circulars on AI. Circular 2022-03 said a creditor cannot skip specific reasons because its model is too complex to explain. Circular 2023-03 said a creditor cannot rely on the sample form checklist if the listed reasons do not reflect the actual reasons. Its example: if a complex algorithm denies an application because of the applicant’s chosen profession, a stated reason of “insufficient projected income” would likely not meet the requirement.

Both circulars were among 67 guidance documents the CFPB withdrew effective May 12, 2025.

The withdrawal removed the CFPB’s explanation. It did not change the regulation. A creditor that cannot say why its model denied an application still cannot produce the statement of specific reasons the rule requires.

• Map model features to reason codes that a consumer can act on
• Test that the top reasons stated match the features that actually drove the score
• Do not use a generic reason when a proxy variable did the work
• Keep the reason mapping under version control alongside the model

What changed in fair lending?

The CFPB’s April 2026 Regulation B rule removed disparate impact from the agency’s reading of ECOA, but the rule is under legal challenge and leaves other sources of disparate impact liability in place.

The CFPB issued the final rule on April 22, 2026. The final rule states that ECOA does not authorize disparate impact liability, deletes the “effects test” language from the regulation and commentary, narrows the discouragement prohibition, and restricts special purpose credit programs. It took effect July 21, 2026 (91 FR 21620).

The rule is being challenged under the Administrative Procedure Act in National Fair Housing Alliance v. CFPB, No. 1:26-cv-01820 (D.D.C.). The plaintiffs did not seek a preliminary injunction, so the rule is in effect. They moved for summary judgment on September 29, 2026; briefing is scheduled to run into January 2027, and there was no ruling as of this writing.

Three limits apply to the rule. Intentional discrimination is still prohibited. The CFPB’s rule does not change the Fair Housing Act, HMDA, or state laws that recognize disparate impact. And private plaintiffs and state attorneys general can still argue in court that ECOA itself supports disparate impact claims; courts decide what the statute means.

A lender operating in several states should keep running disparate impact testing on credit models. Colorado’s SB 26-189 covers financial and lending decisions from January 1, 2027, and state fair lending laws vary. See the state law guide.

What does FINRA expect from broker-dealers?

FINRA Regulatory Notice 24-09, issued June 27, 2024, says the securities rules apply to generative AI the same way they apply to any other technology. It creates no new requirements. It points to the rules most likely to be implicated, including Rule 3110 on supervision and Rule 2210 on communications with the public.

FINRA’s 2026 Annual Regulatory Oversight Report, released December 9, 2025, added a section on generative AI. Law firm summaries describe expectations on governance, testing, and monitoring, and the first discussion of risks from AI agents that act on a user’s behalf.

The practical points for a firm:

• Update written supervisory procedures for each approved AI use
• Treat AI-drafted customer communications as communications subject to Rule 2210
• Retain AI-assisted communications under the books and records rules
• Give staff approved enterprise tools so they do not use unsupervised ones
• Keep AI claims in marketing accurate and not overstated

Where does the SEC stand?

The SEC has no AI-specific rule, but it still charges false or overstated AI claims under its existing antifraud and adviser rules.

In July 2023, the SEC proposed a rule on conflicts of interest from predictive data analytics used by advisers and broker-dealers. On June 12, 2025, it withdrew that proposal along with other pending proposals, and said any future action would start with a new proposal. Enforcement against false AI claims never depended on that rule.

• March 18, 2024: Delphia (USA) Inc. and Global Predictions Inc. settled charges of false and misleading statements about their use of AI, paying $225,000 and $175,000.
• January 14, 2025: Presto Automation settled charges that it described third-party speech recognition technology as its own and overstated how much its product reduced human involvement. The SEC imposed no penalty, citing the company’s financial condition and cooperation.

These were ordinary cases: the adviser cases under the antifraud provisions, the Marketing Rule, and the Compliance Rule, and the Presto case under the antifraud and reporting provisions. The lesson is simple. If a filing, pitch deck, or website says a product uses AI, the company should be able to show what the AI does and how much of the work it actually performs.

What does NYDFS require?

NYDFS expects regulated entities to handle AI risk inside the existing Cybersecurity Regulation, 23 NYCRR Part 500, rather than under a separate AI rule. Its industry letter of October 16, 2024 adds no new requirements. It explains how the existing rule applies, with attention to:

• AI-enabled social engineering, including deepfakes
• AI-enhanced attacks
• Exposure of large volumes of nonpublic information used by AI systems
• Third-party and supply chain dependencies

The letter recommends covering AI threats in risk assessments, adding AI terms to vendor contracts, and moving away from authentication methods that deepfakes can imitate, such as SMS, voice, or video, toward options like digital certificates and physical security keys. A follow-up letter on May 21, 2026 addressed heightened risks from frontier AI models that find vulnerabilities faster.

For insurers, Circular Letter No. 7 (July 11, 2024) governs AI and external data in underwriting and pricing. See the insurance guide.

How do BSA/AML systems fit?

BSA/AML models now fall under SR 26-2, which superseded SR 21-8, and the Bank Secrecy Act duties behind them are unchanged.

Transaction monitoring, sanctions screening, and customer risk scoring often use machine learning. Until April 2026, SR 21-8 explained how model risk guidance applied to those systems. The statutory duties did not move: a bank must still maintain an effective AML program, monitor for suspicious activity, and file reports.

The detail that matters most here is documentation. When an examiner asks why an alert threshold changed or why a model suppressed a class of alerts, the bank needs a record that answers the question. A tuning decision with no record looks the same as a missed obligation.

Which rules apply to which firms?

Most of the AI-specific material is guidance. The binding pieces include Regulation B, the SEC’s antifraud provisions and Marketing Rule, FINRA’s own rules, NYDFS’s Part 500, and, from 2027, Colorado’s statute.

Source	Who it applies to	Binding?	Status as of October 2026
SR 26-2 / OCC Bulletin 2026-13	Banks, most relevant above $30 billion	Guidance	In effect since April 17, 2026; generative and agentic AI out of scope
ECOA / Regulation B adverse action (12 CFR 1002.9)	All creditors	Regulation	Unchanged; AI circulars withdrawn May 2025
Regulation B disparate impact amendments	All creditors	Regulation	Final April 2026; under legal challenge
FINRA Notice 24-09	Broker-dealers	Guidance on existing rules	In effect since June 27, 2024
SEC antifraud and Marketing Rule	Issuers, advisers, broker-dealers	Statute and rule	Enforced; PDA proposal withdrawn June 12, 2025
NYDFS AI cybersecurity letter	DFS-regulated entities	Guidance on Part 500	In effect since October 16, 2024
Colorado SB 26-189	Lenders using ADMT for Colorado consumers	Statute	Applies from January 1, 2027

What should a financial firm build its AI program on?

Build it on the duties that did not change: specific reasons for adverse action, no intentional discrimination, no false statements to investors, effective supervision, and sound risk management. Federal financial regulators spent 2025 and 2026 withdrawing or replacing guidance that applied to AI, and an agency can do that on its own. Those duties sit in statutes and regulations.

This guide is general information as of October 2026, not legal advice. Confirm current requirements with your primary regulator or counsel.