United States

How the financial industry uses artificial intelligence and the risks and benefits that your business should know

The financial sector’s use of artificial intelligence (AI) is not a new phenomenon. Indeed, financial institutions have long since adopted AI — or, as the Department of Treasury calls it, “traditional AI” — for credit underwriting, trading, investment advice, customer service, compliance, and process automation. But with the advancement of generative AI — and its ability to create new content based on training data — financial institutions have started using emerging technologies to reshape customer interactions, make quick credit/lending decisions, and detect illegal financial activity.

This Market Insight outlines key AI use cases in the financial sector, highlights risks and compliance standards derived from financial regulator guidance, and offers practical recommendations to help mitigate these risks.

Recently, several federal agencies have requested information from the financial sector to better understand how it uses AI; for example, the US Government Accountability Office (GAO) report Artificial Intelligence, Use and Oversight in Services, May 2025 (see www.gao.gov/assets/gao-25-107197.pdf) and the Department of the Treasury, Report on the Uses, Opportunities, and Risks of Artificial Intelligence (see home.treasury.gov/system/files/136/Artificial-Intelligence-in-Financial-Services.pdf). Seven major AI use cases emerged:

Each new use of AI, however, creates a new attack surface and can generate new risks or change old risks. For example, many financial regulators have raised concerns over biased credit and lending AI decisions for individuals in federally protected classes. Further, AI may introduce new biases or reframe old ones. Industry stakeholders also raised privacy risks related to AI models identifying individuals using de-identified data, and risks of AI models providing consumers with false or misleading data. Given these risks, regulators have released guidance, reports, and advisory alerts on how the financial sector can mitigate them.

The transition from the Biden Administration to the Trump Administration has certainly marked a sea change in the language used by regulators. Attacking “ideological bias or engineered social agendas,” President Trump’s Executive Order 14179 repealed the prior Biden Administration Executive Order 14110 — which, while pursuing United States AI leadership, had emphasized safety and security; promoted innovation, competition, and responsible development; and advanced equity and civil rights, consumer protection, privacy and civil liberties, and risk management.

The Trump approach eschewed secondary concerns to focus on its drive to solidify the United States’ role as the “global leader in AI.” Although this shift may lessen the risk of interference from Washington in the near term, it presents a possible quandary for financial institutions operating outside of the United States: compliance with international AI safety and nondiscrimination rules and guidance — echoed in international consensus — may incur US federal regulatory ire.

The complexity is only becoming more challenging in light of the Colorado AI Act and EU AI Act. Passed in May 2024, the Colorado Artificial Intelligence Act (CAIA) was set to become the first comprehensive state law to regulate AI use in employment, housing, credit, education, and healthcare decisions. More specifically, the CAIA requires developers of “high-risk” artificial intelligence systems to use “reasonable care” to protect consumers from any “known or reasonably foreseeable risks of algorithmic discrimination.” The CAIA also requires covered businesses to conduct impact assessments, provide disclosures, and maintain risk management policies when using high risk AI for consequential decisions. The law’s effective date, however, has been pushed to June 30, 2026, even as dozens of other states debate potential AI legislation.

Across the pond, the European Union (EU) is steadily adopting the EU AI Act, which applies to the development, deployment, and use of AI in the EU regardless of company location. The requirements for AI depend on the risk level of their intended purpose or use — these categories are unacceptable risk, high risk, limited risk, and minimal risk. Whether the EU’s potentially forthcoming Omnibus package (intended to reduce administrative burdens) weakens this approach remains to be seen.

Despite the shift in administrations, most federal regulators have yet to substantially revise their guidance, leaving financial institutions with the task of understanding prior guidance and discerning whether it will survive relatively intact and whether previous priorities will return in a few years. Indeed, some regulators have seen such material cuts to their funding and personnel that their guidance may only be valuable for its persuasive force.

In a December 2024 report, the Treasury Department summarized several categorical challenges related to the implementation of AI. These challenges — derived from industry responses to the department’s request for information — include:

To combat these risks, the report recommended several next steps that the Treasury Department, other government agencies, and financial sector should consider:

In a 2025 report, the SEC stated that it remains focused on registered businesses that use automated investment tools, AI, and trading algorithms or platforms, and the risks associated with these technologies. As a result, the SEC will closely examine businesses that use AI for “certain digital engagement practices, such as digital investment advisory services, recommendations, and related tools and methods.” The SEC also identified the following factors that it will consider during its assessment, such as whether a registered business:

These factors are in line with prior SEC guidance related to company disclosure of AI use in their annual reports. For example, the SEC’s Division of Corporate Finance has previously commented that “existing rules or regulations may require disclosure about how a company uses artificial intelligence” and that SEC staff will assess whether a company’s annual report:

Department Office of the Comptroller of the Currency (OCC)

The OCC similarly explained that adverse outcomes resulting from AI use in the financial sector can generally be caused by:

To mitigate the risk of these outcomes, the OCC expects financial institutions using AI to implement:

Further to these expectations, the OCC (along with other agencies) has taken direct action by implementing a final interagency rule requiring mortgage originators and secondary market mortgage issuers to implement “quality control standards” for their automated valuation models (AVM). The rule defines AVMs as “any computerized model used by mortgage originators and secondary market issuers to determine the value of a consumer’s principal dwelling collateralizing a mortgage.”

Regarding the “quality control standards,” covered entities must:

Consumer Financial Protection Bureau (CFPB)

According to the CFPB, the financial sector must look to existing laws when implementing AI. After seeking information from the industry on uses, opportunities, and risks of AI in the financial sector, the CFPB made its view clear — emerging technologies must still comply with existing laws such as the Equal Credit Opportunity Act (ECOA), Consumer Financial Protection Act (CFPA), and Fair Credit Reporting Act (FCRA). In particular, the CFPB highlighted several AI use cases and its expectations for companies adopting them:

Commodity Futures Trading Commission (CFTC)

In a recent advisory, the CFTC similarly reminded regulated entities that existing regulations and Commodity Exchange Act obligations still apply to AI. The advisory included a non-exhaustive list of AI use cases that, according to the CFTC, could trigger statutory and regulatory requirements:

Given this ever-changing executive branch landscape, financial institutions should approach the above agency reports, advisories, and guidance as reflecting financial regulator expectations regarding how the financial sector implements AI, as tempered by a more innovation-focused desire to win the global AI competition. When adopting AI internally and externally, businesses in the financial sector should consider: