AI support agents stay compliant in financial services when the regulated steps run outside the model as code, every action lands in a record a supervisor can replay, and the agent is tested against the rules before it meets a customer. The exposure is already large: the CFPB found that more than 98 million people, about 37% of the US population, used a bank chatbot in 2022, and warned that institutions risk violating legal obligations when those systems fail. There is no AI-support-agent rule: FINRA, the CFPB, the SEC, the Federal Reserve, the FTC and NYDFS apply their existing rules to the agent as if it were an employee.
Key takeaways
Regulators are technology neutral. FINRA's Regulatory Notice 24-09 (June 27, 2024) says its rules apply to generative AI "just as they apply when member firms use any other technology or tool."
Decision rule: if a step has a statutory clock or a mandated disclosure, it runs as code, not generated text. Reg E gives you 10 business days to determine whether an error occurred. That deadline is computed, not generated.
Treat the agent as a model under SR 11-7. Document it, validate it independently, monitor it, and ask the vendor for a version history.
Know the penalty math. The CFPB's civil penalty tiers are $7,217, $36,083 and $1,443,275 for penalties assessed after January 15, 2025, and a chatbot answer that misstates a fee can be the violation.
Score 100% of conversations, not a sample. FINRA's 2026 oversight report expects firms to store prompt and output logs and track which model version was used and when.
Which US regulators govern an AI support agent at a bank, lender or broker-dealer?
Six US bodies reach a customer-facing AI agent today, and none of them does it through an AI-specific rule. The table maps each instrument to what it demands of the agent and to the date or penalty that makes it concrete.
Regulator | Instrument | What it demands of the support agent | Date or penalty |
|---|---|---|---|
CFPB | UDAAP under the Consumer Financial Protection Act; Regulation E (12 CFR 1005.11); Circular 2022-03 | Accurate answers on fees, rates and account status; dispute intake that starts the statutory clock; specific adverse action reasons even when an algorithm decided | Civil penalty tiers of $7,217, $36,083 and $1,443,275 (12 CFR 1083.1) |
FINRA | Regulatory Notice 24-09; 2026 Annual Regulatory Oversight Report | Rule 3110 supervision and Rule 2210 communications standards apply whether a human or a tool wrote the message; keep prompt and output logs; track model versions | Notice published June 27, 2024 |
SEC | Incident response programme; notify affected customers of unauthorised access to customer information within 30 days | Adopted May 16, 2024; 18 or 24 months to comply | |
Federal Reserve and OCC | Documentation, independent validation and effective challenge for any quantitative system that turns inputs into estimates or decisions | Issued April 4, 2011 | |
FTC | Notify the FTC no later than 30 days after discovering a breach involving at least 500 consumers' unencrypted information | Section 314.4(j) | |
NYDFS | Risk-informed cybersecurity programme for New York licensees; a May 21, 2026 industry letter flags frontier AI model risks | Promulgated March 1, 2017 |
Most of these obligations are about evidence: logs, documentation, notifications on a clock. The CFPB row turns a wrong answer into a violation, because a fee misstatement from a chatbot is judged the same way as one from a person. Our financial services page covers how these duties show up across banking, lending and fintech support.
Ask the vendor: Which of these instruments has a customer's compliance team assessed you against, and can you share the control mapping? Who can export conversation records for an examiner?
How does SR 11-7 model risk management apply to a support agent?
Under SR 11-7 a support agent that turns customer messages into decisions and actions is a model, and your model risk team will treat it as one. The guidance, issued April 4, 2011, defines a model as "a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates." A language model deciding whether a message is a dispute, and which workflow to trigger, fits that definition.
Three SR 11-7 duties map onto an AI agent deployment:
Documentation. What the agent may do, which models sit underneath it, what data it retrieves, and how each version differs from the last. The vendor should supply this.
Independent validation. SR 11-7's guiding principle is "effective challenge": critical analysis by objective, informed parties who can identify model limitations and force changes. Pre-launch simulation suites and third-party red teams deliver that challenge. Your team, not the vendor, should own the scenario library.
Ongoing monitoring. FINRA's 2026 oversight report spells this out: storing prompt and output logs, tracking which model version was used and when, and human review of outputs with regular checks for errors and bias.
The NIST AI Risk Management Framework, released January 26, 2023 and voluntary, gives examiners a shared vocabulary for the same work: Govern, Map, Measure, Manage.
Ask the vendor: Can you hand my model risk team a document describing the agent's architecture, underlying models and change history? When the underlying model changes, do I get notice and a regression run before it goes live?
What does the CFPB expect when a chatbot handles a dispute or a denial?
The CFPB expects the agent to recognise the dispute, start the clock, and never invent the deadline. Its chatbot report found that each of the ten largest US commercial banks had deployed chatbots, and singled out two failure modes: chatbots that fail to recognise a dispute is being raised, and "doom loops" that trap customers with no route to a human.
Regulation E makes the timing precise. Once a notice of error arrives, the institution must determine whether an error occurred within 10 business days, may take up to 45 days if it provisionally credits the account within 10 business days, and must report results within three business days of finishing. An agent that paraphrases those windows will eventually get one wrong. The intake step should write a timestamped record, and the deadlines are computed, not generated. Our Reg E dispute compliance guide covers the full flow.
Denials carry a second duty. Circular 2022-03 (May 26, 2022) states that ECOA and Regulation B "do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions." A support agent should never improvise why a customer was declined. It surfaces the reasons recorded in the decision system, verbatim, or hands off.
UDAAP exposure is the widest of the three. Any inaccurate statement about a fee, a rate or an account status can be an unfair or deceptive act, and the civil penalty schedule tops out at $1,443,275 at tier three. Grounding the agent in current policy content and blocking ungrounded numeric claims is therefore a compliance control.
Ask the vendor: Show me a dispute conversation and the record it creates, including the timestamp the clock starts from. Do Reg E deadlines come from the model or from code? What happens when a customer asks for a person?
How do deterministic boundaries keep the model away from regulated steps?
The most important design decision is choosing what the model is never allowed to improvise. Generative models are probabilistic. Identity verification, payment execution, dispute intake, mandated disclosures and hardship escalations are procedural, so they run as structured workflows that execute identically every time. Four rules define the boundary:
The agent triggers workflows; it does not perform them. A one-time-passcode or payment step runs as sealed code. The model sees the result ("verification passed"), never the internals, so conversational manipulation cannot alter the step.
Tool access is scoped to the workflow. The agent holds a tool only while the workflow that needs it is active. An agent answering a balance question has no refund tool to misuse.
Actions carry hard caps. Per-refund limits, rate limits and value ceilings are enforced in code. A fully manipulated conversation still cannot exceed them.
Sensitive actions are gated on authentication, server-side. A tool that changes account data fires only after verification passes; the model's view of whether the customer sounds legitimate does not count.
Around that core sit runtime guardrails on both sides of the exchange: inbound checks that classify messages for prompt injection and bad-actor behaviour, and outbound checks that inspect the draft before it reaches the customer and can block, rewrite or escalate it. Any language system can be manipulated; the useful question is what a manipulation can reach. The design goal is a blast radius of one conversation: no access to other customers' data, no persistent compromise, no action beyond the caps.
One caveat. Streamed responses complicate any claim that every response is checked before delivery, so ask how outbound checks interact with streaming. Our practitioner's guide to AI compliance and our guide to red-teaming a support agent cover how to test this layer.
Ask the vendor: Show me where the deterministic boundary sits in the product. Which steps can the model never execute directly? What are the per-action caps, and where are they enforced?
Do the EU AI Act, DORA and FCA Consumer Duty change the design?
They add documentation and outcome duties rather than a different architecture. The EU AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026 with some exceptions; obligations for high-risk systems, including credit scoring that can deny someone a loan, apply from 2 December 2027. Fines under Article 99 reach EUR 35,000,000 or 7% of worldwide annual turnover. A support agent that explains a credit decision is not itself the high-risk system, but one that influences the decision or its appeal may be, so keep the line between explaining and deciding explicit.
DORA has applied to EU financial entities since 17 January 2025 and treats your AI support vendor as an ICT third-party provider: contract terms, monitoring and exit planning are your obligations. In the UK, the FCA's Consumer Duty principle, "a firm must act to deliver good outcomes for retail customers," reaches every conversation an agent handles, including missed-repayment and vulnerability disclosures.
Ask the vendor: Can you support DORA-style contract terms, audit rights and exit assistance? Can I choose whether vulnerability signals steer, tag or hard-escalate?
What audit trail will a supervisor accept?
One that reconstructs a conversation months later, without an engineer: every message, retrieved document, tool call with its authorisation and outcome, guardrail event, and the model version in use at the time. Most transcripts miss that last item; FINRA's 2026 report names it. A chat log records what was said; a supervisory record explains why the agent acted and which controls fired.
Coverage matters as much as depth: score every ticket rather than a sample, and report guardrail-triggered escalations as an outcome so an examiner can see how often controls fire. Our quality assurance page describes 100% post-hoc review, and auditable AI support covers what to export.
Ask the vendor: Pick a closed conversation in your demo environment and replay it end to end, including guardrail checks and the model version. How long did that take, and who had to be involved?
What this looks like in practice: a worked example
Take the hardest common case in consumer credit: a customer writes in on chat saying a repayment was taken twice and they cannot cover this month's bill. Here is how the controls above combine on Lorikeet, one platform built this way.
The model does the part it is good at: it reads the message, recognises both a possible error and a financial-difficulty signal, and keeps the tone right. Identity verification runs as a structured workflow; the agent sees pass or fail, never the internals. The dispute intake step writes a timestamped record, and the Reg E windows are computed from that timestamp, not generated. The difficulty signal trips a guardrail that, depending on configuration, tags the ticket or hard-escalates to a human. A payment arrangement, if reached, executes as a capped, auth-gated workflow. Every step lands in the record, and Coach scores the ticket afterwards, as it does for every conversation. Before launch, this scenario ran hundreds of times in simulation, including adversarial variants where the simulated customer tries to get the debt waived.
This is the shape of the deployment at Carmoola, an FCA-regulated UK car finance provider, where 60% of inbound support resolves end to end and the agent works through missed-repayment and affordability conversations. Lorikeet charges per resolution, unresolved or unsatisfactory tickets cost nothing, which removes the incentive to keep a customer in a loop. Certifications and data handling (SOC 2, GDPR alignment, PII redaction, RBAC, US, AU and UK data residency) are on the trust page.
Two limits, stated plainly. Lorikeet never forms an opinion on whether a dispute is valid; it captures, routes and reports, and a human adjudicates. And on voice, outbound checks run as post-conversation review rather than live interception, so voice deployments lean harder on the deterministic layer and on simulation. To test the replay question against your own worst tickets, book a session and bring them.
What still needs a human
Several steps stay human by design:
Adjudication. Whether a dispute is valid, a claim is covered, or a fee is waived. The agent prepares the file; a person decides.
Adverse action reasons. A person owns the reason codes. The agent relays what the decision system recorded.
Vulnerability and hardship. Signals can be detected automatically; the arrangement offered should be reviewed by someone accountable for the outcome.
Effective challenge. SR 11-7 validation has to be independent of whoever built and configured the agent, including your vendor.
The exit. The CFPB's doom-loop finding sets the standard: a customer who asks for a person gets one. Lorikeet does not charge for those escalations, and any platform should treat the handoff as a measured outcome rather than a failure to hide.
The regulators have said what they want: technology-neutral supervision, deadlines met, reasons explained, records kept, and a human within reach. An agent that runs regulated steps as code, checks both sides of every exchange, and produces a record an examiner can replay meets that bar. Put the vendor questions to every shortlist, and insist on the replay.
