Financial Services AI Governance: What Fair Lending and Fiduciary Rules Can’t Audit
The governance gaps boards must close before AI agents act on customers’ money
By Dr. Freddie Seba · Wednesday, October 7, 2026
© 2026 Freddie Seba. All rights reserved.
Our miniseries on AI governance across highly regulated industries completes its first round. We examined higher education and healthcare; this week, financial services. I focus on healthcare, higher education, and financial services because I am a researcher-practitioner with hands-on experience in all three. The goal is not to prescribe. It is to surface lessons leaders can adapt to their own context and constraints.
Why Financial Services AI Governance Can’t Wait
In Issue 90, an AI agent “didn’t accept no for an answer” and reached an internal Australian government system. Financial services is where AI agents will soon act on customers’ money.
At Sibos on September 28, IMF First Deputy Managing Director Dan Katz said AI agents could route each payment to the most efficient provider and automate compliance checks. He also warned that AI accelerates the discovery and exploitation of vulnerabilities. Consumer AI agents such as Meta’s Muse are expanding into shopping, and in September, stocks of firms that depend on customers not switching providers fell as Muse topped the App Store.
The regulatory trail behind this moment is long:
- January 2024: The SEC, FINRA, and NASAA issued a joint investor alert on AI and investment fraud.
- March 2024: The SEC brought its first “AI-washing” cases against two investment advisers.
- July 2025: The Massachusetts attorney general settled with a student lender over its AI underwriting models.
- April 2026: The CFPB finalized a rule removing disparate-impact liability from Regulation B, effective July 21.
- May 2026: The CFPB issued Circular 2026-03, stating that lenders using machine-learning models remain fully responsible for giving specific, accurate reasons when they deny credit.
The board question is not whether your models are accurate. It is whether your institution can explain, substantiate, and stop what its AI does.
Question 1: What Were Financial Services Rules Designed to Govern?
Financial services oversight was built for models that people design, validate, and can explain.
- The Investment Advisers Act and the SEC Marketing Rule prohibit false or misleading statements, including about technology, and expect advisers to substantiate their claims.
- Fiduciary duty requires advisers to act in clients’ best interests.
- The Equal Credit Opportunity Act (ECOA) and Regulation B prohibit credit discrimination and require specific reasons when a lender takes adverse action.
- Model risk management guidance from bank regulators expects models to be validated, documented, and monitored.
- Broker-dealer supervision rules expect firms to supervise the tools their people use.
Each assumes the same thing: a person can explain how a model works, why it reached a result, and who approved its use.
Question 2: The Governance Gaps — What Falls Outside the Frame?
AI strains that assumption in four distinct ways.
1. Substantiation. Marketing can promise AI that does not exist, or does less than claimed. The first SEC AI-washing cases were about exactly that.
2. Explainability. Complex machine-learning credit models can produce accurate predictions without reasons a person can easily state. The law still requires specific, accurate reasons for each denial.
3. Drift and proxies. Models change as data and vendor versions change. Variables that seem neutral, such as the school an applicant attended, can stand in for protected characteristics.
4. AI agents and autonomy. Credit scoring models generally return the same output for the same input. AI assistants and AI agents do not: they can give two customers different answers to the same question, and they can take actions no one specifically approved.
Federal and state rules are diverging. The CFPB’s April 2026 rule states that ECOA does not provide for disparate-impact liability. But disparate impact remains available under the Fair Housing Act for mortgage lending and under several state laws. New York’s Department of Financial Services has reiterated that credit decisions with a disparate impact may be unlawful. Institutions operating across states face several standards at once.
Where It Breaks Down: Three Illustrative Examination Scenarios
These are some illustrative scenarios of how an examination could unfold. They are not findings from any actual examiner or regulator.
Scenario 1: The AI claim (Provenance)
Examiner: Your website and Form ADV describe AI-driven investment selection. Show us the system.
Firm: Our team uses data science tools to inform decisions.
Examiner: Which models, using which data, made which recommendations? Who reviewed the marketing language before it was published?
The board question: Can we substantiate every material claim we make about our AI, in filings, marketing, and social media?
Scenario 2: The credit denial (Provenance and Process)
Examiner: This applicant was denied. What were the specific reasons?
Lender: The model’s score fell below our threshold.
Examiner: A score is not a reason. Which factors drove the result? Have any of your variables been tested as proxies for protected characteristics? Under which states’ laws?
The board question: Can we explain each adverse decision in terms an applicant can understand, and show how we tested our variables?
Scenario 3: The customer-facing AI agent (Product Ownership and Preparedness)
Examiner: Your AI agent told two customers different things about the same fee waiver. One acted on it and was charged. Who is responsible?
Firm: The vendor provides the agent. Operations configured it. Marketing launched it.
Examiner: Which one person owns what it tells customers? And how quickly can you turn it off?
The board question: Who, by name, owns each AI agent that speaks or acts for our customers, and can they stop it today?
A Gap Only Governance Can Close
These rules assume an institution can substantiate, explain, and supervise its decisions. AI makes all three harder, and AI agents add a fourth demand: being able to stop a system that acts.
That is not a reason to avoid AI. It is a reason to build governance first.
Question 3: What Does Responsible AI Governance as Leadership Look Like in Financial Services?
The question is not “Is our model accurate?” It is “Have we built the minimum structures of accountability before AI decides or acts for our customers?”
That is the heart of AI Minimum Viable Governance (AI-MVG), the framework in my book, Ungoverned (May 2026), organized through the Seba 12 Ps of Responsible AI Oversight:
- Purpose: What is each AI system supposed to do, and what is it not authorized to do?
- Provenance: Can we trace why each decision was made, and substantiate every AI claim we publish?
- Process: How is each model verified, monitored for drift, and updated, including vendor updates?
- Protections: How do we bound what AI agents can do with customer accounts and money?
- Preparedness: Can we pause an AI agent, revoke its access, and roll back its actions?
- Privacy: What customer data does each system need, and who controls it?
- Policy: Which federal and state rules apply in every state where we lend or advise?
- People: Which customers are most exposed to proxy discrimination or unexplained denials?
- Product Ownership: One named person accountable for each AI system’s full life cycle. Not the vendor.
Download the Seba 12 Ps Reference Card (free): a one-page board tool for governing AI agents. [freddieseba.com/seba-12-ps-reference-card]
Want help applying the 12 Ps to your lending, advisory, or payments AI? I lead board briefings and executive workshops for financial institutions. Book a conversation at freddieseba.com
Financial Services AI Governance FAQ for Boards
Q: Federal disparate-impact rules were removed from Regulation B. Does fair lending testing still matter?
A: Yes. Disparate impact remains available under the Fair Housing Act for mortgage lending and under several state laws, and the Massachusetts Attorney General has already acted on AI underwriting. Testing is also how you produce the specific, accurate reasons the CFPB still requires.
Q: We buy our models from vendors. Who is accountable?
A: You are. Vendor models still operate under your name, your license, and your duty to customers. Product Ownership means one person at your institution owns each system, including vendor models.
Q: What is “AI-washing,” and why should boards care?
A: It is claiming AI capabilities you do not have, or overstating them. The SEC has treated such claims as false or misleading statements. If marketing says “AI-powered,” someone must be able to show it.
Next Steps for Boards and Executives
- Inventory every AI system that markets, decides, prices, advises, or acts for customers.
- Substantiate every AI claim in filings, marketing, and social media, or correct it.
- Test variables for proxy effects under every state law that applies, not only federal rules.
- Name an owner for each system, including vendor models and customer-facing AI agents.
- Rehearse the stop: pause, revoke, roll back, and notify.
Friday: AI Enforcement in Financial Services, and what states are deciding while Washington steps back.
Work With Dr. Freddie Seba: Keynotes, Board Briefings, and Advisory
Which AI agent at your institution speaks to customers without a named owner? Share your view in the comments.
- For boards, CEOs, and chief risk officers: AI governance keynotes, board briefings, and embedded advisory built on AI-MVG and the Seba 12 Ps. Visit freddieseba.com or send me a direct message on LinkedIn.
- For academia: I welcome collaboration on AI governance research and convenings in healthcare, higher education, and financial services.
- Subscribe: Ungoverned on LinkedIn and Substack. Read Issue 90: freddieseba.com/issue-90-ai-agent-governance-boards
References
- IMF. Dan Katz, “AI and the Future of Payments Policy,” Sibos 2026 (September 28, 2026)
- SEC, FINRA, and NASAA. “Artificial Intelligence (AI) and Investment Fraud” investor alert (January 2024)
- U.S. Securities and Exchange Commission. Settled charges against Delphia (USA) Inc. and Global Predictions Inc. (March 18, 2024)
- Massachusetts Attorney General. Settlement with Earnest Operations LLC (July 10, 2025)
- Consumer Financial Protection Bureau. Final rule amending Regulation B (April 22, 2026; effective July 21, 2026); summaries by Venable and Greenberg Traurig (2026)
- Consumer Financial Protection Bureau. Circular 2026-03 on adverse action notices and machine-learning underwriting (May 5, 2026)
- Bloomberg. “Meta’s Muse drags down stocks that depend on consumer inertia” (September 22, 2026)
- Seba, F. Ungoverned: A Practical Guide to AI Minimum Viable Governance (May 2026)
Disclosure and transparency. This analysis is written the way I argue AI should be used: critically, grounded in human judgment, for people, not in place of them. AI tools, including Anthropic’s Claude, OpenAI’s ChatGPT, and Google’s Gemini, support research synthesis, source verification, and drafting. This post, its visuals, and its downloadable tools may carry AI watermarks; a watermark confirms processing, not authorship. The frameworks, analysis, and editorial judgment are mine. Sources, articles, and reports are handpicked and curated manually, guided by my frameworks, and include government documents, academic research, policy analysis, and primary sources I read myself, analyzed with doctoral rigor and practical urgency.
Not legal advice. For information and education only. Consult your own legal counsel, compliance, and domain advisors.
#FinancialServices #AIGovernance #AIAgents #AgenticAI #FairLending #FinTech #BankBoards #RiskManagement #ChiefRiskOfficer #Compliance #ModelRisk #CIO #ITConsulting #AIMVG #Seba12Ps #Ungoverned
© 2026 Freddie Seba. All rights reserved.
Leave a Reply