Compliance
19 articles in this category
The Interagency 36-Hour Computer-Security Incident Notification Rule Applied to Bank AI Systems
The OCC's Part 53, the FDIC's Part 304 Subpart C, and the Federal Reserve's Part 225 Subpart N gave banks a 36-hour clock on notification incidents. The architecture we run so an AI agent failure, a model-vendor outage, or a prompt-injection-driven exfiltration is detected, classified, and reported inside the window.
Colorado SB 26-189 for Banks and Lenders: The ADMT Framework Replacing the 2024 AI Act and What is Due by January 2027
Colorado repealed and reenacted its 2024 AI Act in May 2026. The replacement is SB 26-189, effective January 1, 2027, which drops the algorithmic-discrimination duty and the impact-assessment regime and instead lands pre-decision notice, a 30-day post-adverse-outcome explanation, and a meaningful human-review right on any 'covered ADMT' that materially influences a financial or lending decision. The version that actually maps to a bank or non-bank lender's operations.
CFPB 1071 Small Business Lending and AI Agents: A Subpart B Playbook for the Firewall, the Data, and the Filing
Section 1071 added 81 data points and a firewall between demographic collection and credit decisions. How to put AI agents inside the small-business application without breaching Regulation B Subpart B.
OFAC Sanctions Screening with AI Agents: The SDN List, Fuzzy Matching, and the 50 Percent Rule
Sanctions screening is strict-liability and the SDN list does not match cleanly. How we architect AI agents for name and identifier screening, beneficial-ownership traversal under the 50 percent rule, and hit disposition that survives an OFAC subpoena.
SCRA Compliance with AI Agents: DMDC Queries, the 6 Percent Cap, and the Verbal-Notice Trigger
SCRA carries a private right of action and an active DOJ enforcement docket. How we build AI agents that catch the verbal notice, query DMDC at the right moments, apply the rate cap correctly, and hold the foreclosure stay.
AI Chatbots in Consumer Finance: What the CFPB Spotlight Named and Who Enforces It in 2026
The CFPB's 2023 chatbot spotlight named real failure modes, and they did not disappear when the Bureau pulled back. The doom loop, missed federal rights, and UDAAP exposure, who enforces them now, and the controls that hold up.
Regulation E Error Resolution with AI Agents: A 1005.11 Playbook for Dispute Intake
Reg E error resolution has hard, statutory timing: 10 business days, provisional credit, 45 and 90 day windows. How to put an AI agent on dispute intake without missing a clock, and the verbal-claim trigger that keeps it compliant.
NYDFS Part 500 and the AI Cybersecurity Letter: What New York-Regulated Institutions Have to Build
New York's Part 500 is fully phased in and its October 2024 AI guidance tells covered entities how to apply it to AI risk. The controls that matter for an AI agent: phishing-resistant authentication, privileged access on the model store, AI vendor diligence, and data minimization.
FCRA Furnisher Accuracy for AI-Driven Decisioning and Servicing: A Section 623 Playbook
How AI agents affect FCRA Section 623 accuracy duties and dispute investigations. A playbook for meeting the reasonable-investigation standard in 2026.
TCPA Compliance for AI Voice Agents in Mortgage and Bank Outreach: A 2026 Field Guide
What the FCC's 2024 declaratory ruling, the one-to-one consent rule, and the Mortgage One class action mean for AI voice outreach — with the consent stack, suppression rules, and audit pack regulated lenders need.
AI Agents for BSA/AML: SAR Narratives, Transaction Monitoring Tuning, and the New Examiner Bar
How banks and credit unions can use AI agents inside BSA/AML programs — covering SAR narrative drafting, alert triage, transaction monitoring tuning, and the FinCEN and FFIEC controls examiners expect to see.
Fair Lending Testing for AI Agents: A Disparate Impact Playbook Under ECOA, HMDA, and the FHA
A working method for fair-lending testing of AI agents used in origination, marketing, and servicing — covering disparate impact, less-discriminatory-alternative search, marketing steering, and the exam-ready file.
BOOK A DEMO
- Deploy in weeks, not months
- Trained on FDCPA, TCPA, TILA, UDAAP, and RESPA
- SOC 2 Type II and PCI DSS L1 certified
- Integrates with your LOS, CRM, and telephony
