UNGOVERNED AI | ENFORCEMENT: FINANCIAL SERVICES

When Regulators Draw Lines Without Formal Guidance

By Dr. Freddie Seba · Published October 9, 2026 · 8-minute read

My earlier post described the AI accountability gap in theory. This one shows it in practice. These three AI enforcement actions, along with this year’s shifts in federal policy, show that regulators act on governance failures whether or not AI-specific rules exist.

The consequences are real.

Key Takeaways

• March 2024: The SEC fined two advisers $400,000 combined for AI claims they could not prove.
• July 2025: Massachusetts settled with a student lender for $2.5 million over alleged bias in its AI underwriting.
• June 2022: The CFPB ended Upstart’s no-action letter and stated it had never endorsed the model.
• 2026: Federal disparate-impact liability narrowed, the duty to explain AI decisions did not, and states are stepping in.

Case 1: Delphia and Global Predictions — SEC “AI Washing” (March 18, 2024)

On March 18, 2024, the U.S. Securities and Exchange Commission announced settled charges against two investment advisers for false and misleading statements about their use of artificial intelligence. These were the SEC’s first enforcement actions of their kind.

Delphia (USA) Inc. told clients and the public that it used their data and machine learning to predict which companies and trends would outperform. The SEC found that Delphia did not have the AI and machine-learning capabilities it claimed.

Global Predictions Inc. called itself the “first regulated AI financial advisor” and advertised AI-driven forecasts. The SEC found these claims false or unsubstantiated. It also charged the firm with compliance failures, including having no process to review and approve marketing materials before they went out.

Result: Civil penalties of $225,000 (Delphia) and $175,000 (Global Predictions), $400,000 combined, plus cease-and-desist orders and lasting reputational damage.

Why it matters: AI claims get the same scrutiny as any other claim an adviser makes. Regulatory filings, websites, press releases, and social media are not separate channels. They all have to match what the firm can prove.

Governance gaps exposed:

• Provenance: No evidence that the claimed AI capabilities existed.
• Policy: No process to check that marketing claims matched actual capabilities.
• Product Ownership: No one accountable for keeping filings, marketing, and reality consistent.

Case 2: Earnest Operations — Massachusetts AG Fair Lending (July 10, 2025)

On July 10, 2025, Massachusetts Attorney General Andrea Joy Campbell announced a $2.5 million settlement with Earnest Operations LLC, a Delaware-based student loan company. The Attorney General alleged that Earnest’s AI underwriting models harmed Black, Hispanic, and non-citizen applicants.

According to the Attorney General, Earnest’s model used a “Cohort Default Rate” variable, the average loan default rate at the school a borrower attended. Because that rate tends to be higher at schools serving more Black and Hispanic students, the variable could penalize applicants for where they went to school rather than for their own credit history.

The Attorney General also alleged that Earnest:

• Used a “knockout rule” that automatically rejected applicants based on immigration status.
• Sent adverse-action notices that did not give accurate reasons for denials.
• Did not test its models for disparate outcomes.

Earnest denied the allegations and denied violating state or federal law.

Result: A $2.5 million payment, plus required changes: fair lending testing of its underwriting models, a written governance system with internal controls and risk assessments, a yearly model inventory, documented decisions, and compliance reporting to the Attorney General’s office.

Why it matters: This is one of the first state enforcement actions over discriminatory effects from an AI model. Massachusetts didn’t need a new AI law. It used existing consumer protection and fair lending law.

Governance gaps exposed:

• Provenance: Input variables were never assessed as possible proxies for race or national origin.
• Process: No fair lending testing, and no monitoring of outcomes across groups.
• Product Ownership: No one clearly accountable for the model’s fair lending performance.

Case 3: Upstart Network — The Safe Harbor That Was Never an Endorsement (2017–2022)

In September 2017, Upstart Network received the CFPB’s first-ever no-action letter for its AI-based underwriting model, and the CFPB renewed it in November 2020. While it was in force, the CFPB would not bring fair lending actions against Upstart over that model. In exchange, Upstart had to tell the CFPB about significant model changes before making them.

In April 2022, Upstart told the CFPB it planned to add many new variables to its model. CFPB staff asked for more time to review the changes. Upstart instead asked to end the letter, and in June 2022 the CFPB terminated it.

The CFPB’s termination order made one point especially clear: it never endorsed Upstart’s model and never concluded whether it complied with fair lending law.

Result: No penalty and no enforcement action. Upstart lost its safe harbor, and its own SEC filings now acknowledge that the CFPB could take supervisory or enforcement action in the future.

Why it matters: Regulatory comfort is not regulatory approval. Even the most favorable arrangement a regulator offered for AI underwriting left the burden of proving compliance with the company.

Governance lessons:

• Policy: A no-action letter, sandbox, or vendor assurance is not evidence that a model is fair.
• Protections: Independent testing has to continue whether or not a regulator is watching.
• Product Ownership: Someone must own the model’s compliance as it changes, not just on the day it’s approved.

What Changed in 2026

Federal rules moved in two directions this year, and boards need to understand both.

Federal disparate-impact liability narrowed (effective July 21, 2026). The CFPB’s final rule amending Regulation B removes disparate-impact liability under the federal Equal Credit Opportunity Act (ECOA). Federal ECOA claims now generally require intentional discrimination, including the deliberate use of neutral-looking variables as proxies for protected traits.

The duty to explain did not narrow (May 5, 2026). In Circular 2026-03, the CFPB said that lenders using complex or machine-learning models remain fully responsible for giving specific, accurate reasons when they deny credit. A model being proprietary or hard to interpret is no excuse.

States are filling the gap. The Earnest case was brought under Massachusetts law, and attorneys general in California, Oregon, and New Jersey have issued guidance on AI bias. As I wrote in my recent post on state AI governance, states are increasingly defining AI accountability.

For boards, the takeaway is simple: federal exposure has shifted but not disappeared, and state exposure is growing.

What These AI Enforcement Actions Have in Common

None of these cases was really about whether an algorithm was accurate. Each was about whether leadership could prove what its AI did, test what it produced, and name who was responsible.

• Delphia and Global Predictions couldn’t substantiate their AI claims.
• Earnest allegedly didn’t test its model for unfair outcomes.
• Upstart shows that even a regulator’s blessing doesn’t substitute for your own evidence.

Institutions that skip governance up front end up building it later, under a settlement order and at much higher cost.

Three Questions for Boards

1. What were existing rules designed to govern?

Securities and lending rules assume an institution can document its process, substantiate its claims, and explain each decision. They were written for systems that give the same answer to the same input, every time.

2. What falls outside that frame?

Machine-learning and generative AI systems can be difficult to explain and may not produce the same output twice. If an institution can’t explain a decision, it can’t meet a disclosure or adverse-action requirement, no matter how accurate the model is.

3. What does AI governance as leadership look like?

The question is not “Is our AI accurate?” It is “Can we prove what our AI does, and who answers for it?”

Board Checklist

• Provenance: Can you document and substantiate every material claim about your AI systems?
• Process: Do you test for unfair outcomes, monitor performance over time, and escalate problems?
• Protections: Can you override, pause, or audit an AI decision when something goes wrong?
• Product Ownership: Is one named person accountable for each AI system across its full life cycle?
• Policy: Have you mapped every applicable federal and state framework before deployment?
• Disclosure consistency: Do your AI claims match across regulatory filings, marketing, your website, and social media?
• Explainability: Can you give a specific, accurate reason for every credit or other consequential decision?

AI governance is board-level leadership work, not IT infrastructure and not a compliance checkbox.

Next Steps

1. Audit your AI claims. Check every statement in filings, marketing, and social media against what you can prove. Correct anything you can’t substantiate.
2. Test lending and pricing models for disparate outcomes. Federal ECOA no longer reaches disparate impact, but state laws like the one used against Earnest still can.
3. Name a Product Owner for each AI system—one person, accountable for substantiation, testing, monitoring, and remediation.
4. Document the governance chain. Who tested it? Who approved it? Who monitors it? Who escalates?
5. Track state activity. Watch your state attorney general’s guidance and enforcement, not just federal agencies.
6. Put AI on the board agenda. This is regulatory risk and fiduciary liability.

Governance is a board conversation, not an IT discussion.

---

Interested in AI governance advisory, speaking, or a leadership workshop? Contact me. Learn more about board-level oversight in The 12 Ps of Responsible AI Oversight.

For education only. Consult your legal, compliance, and domain advisors. AI tools assisted research, synthesis, and drafting.

References

• Consumer Financial Protection Bureau. (June 8, 2022). CFPB issues order to terminate Upstart no-action letter. consumerfinance.gov
• Consumer Financial Protection Bureau. (2026). Equal Credit Opportunity Act (Regulation B) [Final rule; effective July 21, 2026]. consumerfinance.gov
• Consumer Financial Protection Bureau. (May 5, 2026). Consumer Financial Protection Circular 2026-03.
• Massachusetts Office of the Attorney General. (July 10, 2025). Settlement with Earnest Operations LLC [Assurance of discontinuance].
• Seba, F. (2026). The 12 Ps of responsible AI oversight. freddieseba.com
• U.S. Securities and Exchange Commission. (March 18, 2024). SEC charges two investment advisers with making false and misleading statements about their use of artificial intelligence.