Reuters reports the OCC and Fed are asking banks hard questions about AI. Attorneys say mortgage brokers should expect the same
Banking regulators are stepping up their scrutiny of artificial intelligence (AI) across the financial sector, pressing lenders on everything from data governance and vendor controls to whether they have kill switches in place to shut systems down if something goes wrong.
In an exclusive report released by Reuters on Friday, the Office of the Comptroller of the Currency (OCC) and the Federal Reserve have begun asking banks in routine examinations to map out how they use AI in higher-risk areas, including lending, know-your-customer checks, and sanctions screening, citing three sources familiar with the matter.
Supervisors are asking detailed questions about vendor relationships, how client data is protected, and what human oversight exists over automated systems.
Rather than writing new rules tailored to AI, regulators are working with what they already have, leaning on model risk management, third-party risk oversight, and consumer protection laws. Sources told Reuters the topic comes up in every bank examination now.
This report mirrors what attorneys have been advising mortgage brokers to monitor regarding AI usage. Mortgage brokers and lenders operate under a web of state and federal oversight, and when federal regulators flag a new area of concern, it tends to show up in broader examination priorities before long. Peter Idziak, a principal at Polunsky Beitel Green who works closely with mortgage companies on compliance, has been making this argument for months.
His first concern is that AI tools are generating records that brokers haven’t been asked to bring to examinations in the past. Now, examiners are starting to ask for them.
"If you're in a business where you are not necessarily required to save every communication you have, now you have transcripts of every call that you've ever made," Idziak told Mortgage Professional America earlier this year. "I would not be surprised if you have an exam and the regulator says, 'Well, give me all these transcripts and then I will run them through my AI and see if it thinks that you've engaged in any sort of prohibited conduct.' In the past, it just wasn't a source of information that's available."
On vendor risk, Idziak said brokers can't hand the compliance question off to whoever sold them the tool. If AI is involved in underwriting decisions, the broker is on the hook for what it does.
"Whenever you're engaging vendors, what's their training data?" Idziak said. "From a fair lending perspective, we have ECOA, so you can't discriminate based on sex, race, or national origin. But if you have a vendor from outside the space that's come in saying, 'Hey, I'm going to help you underwrite your loans,' one, what data do they train on? Two, how does it do its thinking, and how is it producing the result? Because for ECOA adverse action notices, you need to have a reason. You can't just say 'The AI said so.' Well, why did it say so? 'I don't know. It's a black box.'"
A central concern is whether AI tools are staying in their lane. Regulators are asking whether systems can access or pull in data they were never meant to see, a risk that gets serious fast when tools are designed to connect information across multiple platforms. Vendor chains are getting the same treatment, with supervisors pressing banks on whether third-party AI providers and their subcontractors are held to the same standards as the banks themselves.
Michelle Bowman, the Fed's vice chair for supervision, signaled in an April speech that the existing toolkit may not be enough.
"Today, banks are relying on existing risk-management frameworks to guide their use of AI," Bowman said. "While these supervisory tools are intended to support banks in applying sound governance and risk management, we should assess whether our supervisory guidance is fit for the future."
Experts are concerned that formal guidance, when it does arrive, risks being outdated before the ink is dry. The technology is moving faster than the regulatory process was built to handle.
For brokers running agentic AI tools, client-facing chatbots, or anything that acts on their behalf without a human in the loop, Idziak said the key is to hold it to the same standard you would hold a person.
"With agentic AI, the chatbots, what's your testing regime?" Idziak said. "How are you going to treat this? I've been of the view that you should treat it as a human employee. If you wouldn't tolerate something from a human employee, or if you would be held liable for what your human employee does, consider the agentic AI to be the same."
Stay updated with the freshest mortgage news. Get exclusive interviews, breaking news, and industry events in your inbox, and always be the first to know by subscribing to our FREE daily newsletter.
Leave a Reply