The CFPB's position is simple: there is no technology exemption from federal consumer financial law. An AI agent serving consumers in credit, payments or deposit accounts must give accurate information, recognise and honour error and dispute rights, give specific reasons for credit denials, and never deceive or obstruct. The firm answers for the agent as it would for staff.
What does the CFPB expect, in plain words?
The CFPB enforces federal consumer financial law and supervises large banks and many nonbank providers. Its expectations for agents flow from existing law rather than from an AI rule. Four strands matter most.
No deception, unfairness or abuse. Federal law prohibits unfair, deceptive or abusive acts or practices. An agent that misstates a fee, implies a product is free when it is not, or makes it needlessly hard to cancel is a channel for exactly that.
Specific reasons for credit decisions. ECOA and Regulation B require specific reasons when credit is denied, including when a model is used. Complexity is not a defence.
Error and dispute rights. Federal law gives consumers rights to dispute payment errors, billing errors and inaccurate credit reporting, with obligations on the firm to investigate. Those rights are triggered by what the consumer says, not by which channel they say it in.
Privacy and data. GLBA governs how financial institutions handle consumers' nonpublic personal information, and state laws such as California's CCPA as amended by the CPRA add more.
Who does it apply to?
Banks, credit unions, lenders, card issuers, payment providers, servicers, debt collectors and other firms offering consumer financial products in the United States. Depending on size and charter, a firm may be supervised by the CFPB, a prudential regulator such as the OCC, Federal Reserve or FDIC, or a state regulator, but the substantive law applies to all.
Third-party agents do not move responsibility. If a vendor's agent speaks to your customers, the conduct is yours.
What does it mean when the agent acts, not just answers?
Most early guidance focused on chatbots that answer questions. Agents go further: they open disputes, change payment dates, cancel cards, offer hardship plans and draft collection messages. Each action carries legal weight.
Recognising a dispute is an action. A consumer who writes "I didn't make this charge" has likely raised an error. An agent that responds with general information and closes the chat may have failed to start an investigation the law requires. Agents must classify these messages and open the right case, with a person reviewing the outcome.
Collections agents carry the most risk. An agent that contacts consumers about debts must avoid harassment, false threats and misleading statements. Tone, frequency and timing all matter. Keep collection messages at depth 2: the agent drafts, a person or an approved template governs what is sent.
Offers can mislead by omission. An agent that suggests a balance transfer without mentioning the fee, or a payment deferral without mentioning interest, can deceive even if every sentence is true.
Account actions affect rights. Closing an account or reducing a limit may be adverse action needing specific reasons.
Our guide to AI compliance agents explains why agents that support compliance work prepare findings, while people make the calls.
How do you meet CFPB expectations with agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Accurate information | Agent answers only from approved, current product sources | Source list with versions; sampled answer reviews |
| No deception by omission | Brief requires material costs and conditions alongside any offer | Offer transcripts sampled against a checklist |
| Disputes recognised | Agent classifies error and dispute language and opens a case | Case records linked to the conversation |
| Dispute outcomes decided by people | Investigation outcomes held for a named person | Decision records with reviewer identity |
| Specific credit reasons | Reasons drawn from recorded decision factors | Notices linked to factor records |
| Fair collections | Collection messages drafted for approval or from approved templates | Template versions and approval logs |
| Access to a person | Consumers can reach a person when the agent cannot resolve their issue | Hand-over records and wait times |
| Outcomes monitored | Complaints, disputes and outcomes tracked for agent conversations | Monitoring reports to management |
Outcome monitoring is where UK firms are often ahead, because the FCA Consumer Duty demands it. Our piece on monitoring the outcomes of AI agents describes measures that transfer well to US expectations.
What will an examiner ask?
- Where do agents interact with consumers, and what can they do in each place?
- How does the agent recognise a billing error or payment dispute?
- Show us conversations where consumers raised disputes. What happened next?
- How do consumers reach a person, and how long does it take?
- What do agents say about fees and costs when making an offer?
- How do you monitor complaints that involve agents?
What does CFPB oversight not cover?
It does not cover model risk management, which prudential regulators address through SR 11-7. It does not cover state insurance or securities rules, and state regulators such as NYDFS may add their own expectations. It does not cover firms' operations outside the United States; compliance teams in other markets face their own regimes, as our briefs on consumer lending compliance in Canada and Nigeria show. For the service channel specifically, see CFPB and AI chatbots and agents in customer service.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the CFPB have a specific rule on AI agents?
Not a dedicated AI rule. It applies existing consumer financial law to agents, and has made clear that using complex technology does not excuse a firm from those obligations.
Can an agent offer a hardship plan to a consumer?
It can explain available options and gather information. Whether a consumer qualifies, and the terms offered, should come from an approved rule set or a person, and every offer should state its costs.
How quickly can a consumer finance firm deploy an agent safely?
It depends on the scope and the actions involved. Our answer to how long it takes to deploy an agent in finance sets out what drives the timeline.