CFPB and AI chatbots and agents in customer service

The CFPB expects automated customer service in consumer finance to give accurate answers, recognise when a consumer is raising a problem the law protects, and let the consumer reach a person when the automation cannot help. A chatbot or agent that loops, deflects or misinforms can put a firm in breach of federal consumer financial law, whatever it saves.

What does the CFPB expect of automated customer service?

The CFPB has looked closely at chatbots in consumer finance and set out the risks it sees. In substance:

• Inaccurate information. A bot that gives wrong answers about fees, balances or rights can mislead consumers, and the firm is responsible for what it says.
• Failure to recognise rights. Consumers raising a billing error, an unauthorised charge or a credit reporting problem trigger legal obligations. A bot that does not recognise these, or that treats them as general questions, can cause the firm to miss them.
• Doom loops. Bots that repeat the same scripted answers, or route consumers in circles, waste time and can block consumers from getting help they are entitled to.
• No way out. When automation cannot resolve an issue, consumers need a route to a person. Making that route hard to find or slow to reach is a problem in its own right.
• Privacy and security. Bots handle sensitive data and must protect it.

The legal hooks are the existing rules: the prohibition on unfair, deceptive or abusive practices, error and dispute rights in payments and credit, and privacy law.

Who does it apply to?

Any provider of consumer financial products and services in the United States using automated customer service: banks, credit unions, card issuers, lenders, servicers, payment apps and debt collectors. It applies to simple scripted bots and to AI agents alike. Our broader piece on the CFPB and AI agents in consumer finance covers credit, payments and accounts beyond service.

When must a consumer reach a person?

This is the question every service design must answer explicitly. Our position is that the agent should offer a person, without being asked twice, in these situations:

1. The consumer asks for one. Repeated attempts to keep them with the agent are a doom loop.
2. The agent cannot resolve the issue with its permitted actions and sources.
3. The consumer raises an error, dispute or unauthorised transaction. The agent may open the case and gather details, but a person owns the outcome.
4. The consumer signals distress or hardship, such as job loss, illness, bereavement or inability to pay.
5. The consumer disputes what the agent said, or the agent is unsure of its answer.
6. The issue concerns a complaint. Complaints deserve a human owner.

The hand-over must carry context, so the consumer does not repeat themselves, and the wait should be reasonable for the channel.

What changes when the bot is an agent that acts?

A scripted bot can only answer. An agent can freeze a card, change a payment date, issue a fee refund or reset access. That raises the stakes on two fronts.

First, identity. An agent that acts on an account must be sure who it is speaking to. Our playbook on how to connect an AI agent to your identity verification service covers how to step up verification before sensitive actions.

Second, the actions themselves. Some, such as freezing a lost card, are routine and protective and suit depth 3 once certified. Others, such as waiving fees outside policy or closing an account, carry consequences that need a person. Draw the line per action, not per agent.

How do you meet these expectations?

Our guide to AI compliance agents explains how a second-line agent can monitor these controls by sampling conversations, while a person reviews its findings.

What will an examiner ask?

• Show us how a consumer reaches a person from the agent, and how long it takes.
• How does the agent recognise a billing error or unauthorised transaction?
• Pick conversations where the consumer was frustrated. What happened?
• What actions can the agent take on accounts, and what identity checks apply?
• How do you know the agent's answers are accurate?
• How many complaints involve the agent, and what do they say?

What do these expectations not cover?

They do not set specific technical standards for bots. They do not cover non-US customers, who are protected by their own rules; the EU, for example, requires that people are told when they interact with an AI system, as our piece on the EU AI Act for agents in customer service explains. They do not replace state rules or prudential regulators' expectations on third-party and operational risk.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

In Pryme, hand-over is a verdict, not a failure. When a consumer raises a dispute or asks for a person, the agent's action is held for a named team, with the conversation and context attached. Escalation is one of the seven gates Attest scores, so an agent that fails to hand over when it should does not earn its certificate.