US retail bank compliance runs on testing: electronic transfer disputes, adverse action notices, fee practices and complaints, each examined by a federal regulator. AI agents can test files at full volume, draft exam responses and map complaints to rules. People keep findings, remediation and regulator contact. OCC, Federal Reserve, FDIC and CFPB oversight, SR 11-7, ECOA and GLBA apply.
What does retail banking compliance look like in the United States?
A US retail bank answers to more than one regulator. Its prudential supervisor depends on its charter: the OCC for national banks, the Federal Reserve or the FDIC for state banks. The CFPB examines larger banks for consumer financial protection. Each examination asks compliance to prove that the bank's practices matched the rules across thousands of accounts.
That makes testing the core of the job. Teams test error resolution on disputed card and transfer transactions against strict timelines, adverse action notices on declined credit, overdraft and fee practices for unfair or deceptive patterns, and privacy notices. Complaints arrive through the bank's own channels and through the CFPB, and each must be tracked to a resolution and a cause. Anti-money laundering work runs alongside: monitoring, currency reporting and suspicious activity reports.
Where can AI agents help?
- Dispute timeline testing (depth 1). The agent reads each disputed electronic transaction, the date the customer reported it, provisional credit, investigation notes and the final letter, and flags any case where a deadline was missed or the letter lacked required content. A tester confirms each flag.
- Adverse action review (depth 1). For declined credit applications, the agent compares the reasons in the notice with the factors recorded by the decision system. Under ECOA and Regulation B, the reasons must be specific and real, including when a model made or informed the decision. The agent flags notices whose reasons do not match the record.
- Fee practice analysis (depth 1). The agent looks for patterns that a regulator could call unfair or deceptive, such as repeated fees on the same item, or fees charged on transactions authorised against a positive balance. It reports the pattern and the accounts behind it.
- Exam request drafting (depth 2). The agent drafts responses to examiners' document requests, linking each answer to the source record. A compliance officer reviews and sends.
Every flag the agent raises must be traceable to the record it read. Examiners will ask how a finding was produced, and our guide on how to audit a compliance agent's recommendations explains the trail you need. The broader case for keeping compliance agents in a checking role is set out in AI compliance agents: second line, never the last word.
What stays with people?
Whether a pattern is a violation, how far back to remediate, which customers to refund and how much, and whether to self-report to a regulator are decisions for named officers and, often, counsel. These decisions carry legal exposure and set precedent for the whole portfolio.
Suspicious activity reports stay human. An agent can assemble the case and draft the narrative, but a trained investigator decides whether to file and owns what the report says.
Responses to examiners are also human, even when drafted by the agent. Examiners judge credibility as well as content, and the officer who sends the response must be able to defend every line.
Which rules apply in the United States?
There is no single federal AI law. Existing rules carry the weight:
| Area | Who supervises | What it means for an agent |
|---|---|---|
| Model risk | OCC, Federal Reserve, FDIC | SR 11-7 interagency guidance expects validation, ongoing monitoring and governance for models, which reaches an agent whose output informs decisions |
| Fair lending | CFPB and prudential regulators | ECOA and Regulation B require specific reasons for adverse action, including where a model is used |
| Consumer protection | CFPB | Unfair, deceptive or abusive practices are prohibited; agent-driven fees or communications are tested like any other |
| Financial privacy | Prudential regulators, CFPB | GLBA governs how customer financial information is used and shared |
| State law | State regulators such as NYDFS | State privacy laws such as California's CCPA as amended by the CPRA; Colorado's AI act targets high-risk systems making consequential decisions |
FATF Recommendations sit behind the federal anti-money laundering rules. If the bank also operates in the EU, its compliance agents may fall under the EU AI Act; see our guide to the EU AI Act and AI agents in compliance and AML teams. Our overview of how AI agents are regulated in the United States covers the rest. The NIST AI Risk Management Framework is voluntary but gives examiners and boards a shared vocabulary.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Weeks 1 to 4: choose dispute timeline testing, where the rules are precise and the answers checkable. Register the agent in the model inventory, assign a validator independent of the team using it, and write down the bank's procedures as the agent's sources.
Weeks 5 to 8: replay the agent on a quarter already tested by people. Your validator reviews the comparison, and the agent goes live at depth 1 only if it clears its floor on the bank's own files.
Weeks 9 to 13: add adverse action review. Fair lending exposure is high, so keep a person reviewing every flag and record the agreement rate for your next model review. The UK equivalent looks quite different; see compliance agents in UK retail banking.
Questions people ask
Is a compliance testing agent a model under SR 11-7?
If its output informs decisions about compliance or customers, treating it as one is the prudent course. That means inventory, validation, monitoring and documented limits.
Can an agent write the narrative in a suspicious activity report?
It can draft one from the case file. The investigator edits, decides whether to file and is accountable for the content.
Does CCPA apply to bank customer data?
Some financial data covered by GLBA is treated differently under California law, while other data the bank holds may fall under it. Map each data set before the agent reads it, with counsel.