Pranay Shetty
CEO & Co-Founder
59 articles
UDAAP for AI Agents in Consumer Finance: What "Materially Interferes" Actually Looks Like in a Chat Transcript, and the Consumer-Experience Test the CFPB Applies
UDAAP is the rule every consumer-facing AI system in banking is ultimately measured against, and it is also the rule with the least specific text. The CFPB's Circular 2023-03 on chatbots, the 2022 exam manual update that was later rescinded, and the enforcement pattern under 12 USC 5531 and 5536 set the practical standard the agent has to clear. What we score against on every conversation, and why the consumer-experience test is the one that matters more than the internal QA test.
KYC Periodic Reviews and EDD Refresh at Commercial Banks: The Risk-Rated Cadence, the Adverse-Media Signal, and Where the AI Agent Actually Adds Time
The BSA/AML compliance program every commercial bank runs treats onboarding KYC as the ceremony and periodic KYC refresh as the graveyard shift. The FFIEC BSA/AML Exam Manual's expectations for ongoing customer due diligence, the risk-rated review cadence, and the enhanced due diligence obligations for higher-risk customers are the operational anchor for a periodic-refresh program that most banks run at a pace that lags the exam expectation. The AI agent's contribution to the refresh loop and where the human reviewer's judgment still has to be the answer.
Elder Financial Exploitation on the Voice Channel: What the Senior Safe Act, FinCEN FIN-2022-A002, and the State APS Handoff Actually Ask the AI Agent to Do
Elder financial exploitation is the fraud pattern retail bank compliance teams talk about the least and lose the most on. The Senior Safe Act, FinCEN's 2022 advisory, and the state Adult Protective Services reporting statutes set the response the bank is expected to run when the agent detects it, and the voice channel is where most of the signal lives. The detection cues we score, the temporary-hold decision the agent does not make alone, and the reporting flow the branch does not have to design from scratch.
The Annual Escrow Analysis Under Reg X 1024.17: Aggregate Accounting, the Two-Month Cushion, and the Explanation the AI Servicing Agent Owes the Borrower
Escrow analysis is where servicing math meets borrower incomprehension, and where a small computational error at the servicer produces a large volume of borrower calls the agent has to answer accurately. Reg X 1024.17 sets the aggregate-accounting method, the two-month cushion limit, and the shortage/surplus/deficiency rules the analysis has to produce. The intake the agent runs so a borrower gets the actual explanation the analysis warrants, and so the servicer does not create an error under its own rule.
RESPA Section 8 and AI-Driven Mortgage Referrals: The Anti-Kickback Architecture for Lead Routing, MSAs, and Co-Marketing
Lead-routing scores, AI co-marketing tools, and pay-per-application platforms have rebuilt the mortgage referral economy in vocabulary that maps very cleanly onto the RESPA Section 8 'thing of value' standard. The posture we put in front of marketing and partnerships so an AI workflow does not produce a 12 CFR 1024.14 finding the next exam catches.
The SAFE Act Line for AI Mortgage Assistants: When Quoting a Rate Becomes Loan Origination and What NMLS Cares About
The SAFE Act and Reg G/H were written for human MLOs and the definition of 'loan originator' bites on any person who takes an application or offers or negotiates loan terms. AI assistants on the mortgage intake desk straddle that line without realizing it, and the state regulators that examine NMLS are starting to ask. The boundaries we hold the agent to so the institution does not have to sponsor a license for software.
GLBA Safeguards for AI Vendors: 16 CFR 314, the Interagency Guidelines, and the 30-Day Notification Bank IT Cannot Push to Anyone Else
The FTC's 2023 Safeguards amendments added a 30-day breach-notification duty and a list of nine information-security elements every covered non-bank financial institution has to encode. Banks operate under parallel Interagency Guidelines with their own notification rule. AI vendors sit inside both perimeters and the institutions we serve are running diligence and contract terms that anticipate what the next regulator will ask for.
California's Final ADMT Regulations for Banks and Lenders: What the CPPA Lands on Significant Decisions and What Is Due in 2027
The California Privacy Protection Agency finalized its automated decisionmaking technology regulations in late 2025, with phased compliance through 2027 and 2028. The pre-use notice, the access and opt-out rights, the risk assessment attestation, and the cybersecurity audit, applied to a bank or non-bank lender's AI agent on a California consumer.
Regulation F for AI Voice Debt Collection: The 7-in-7 Ledger, the Limited-Content Message, and the Per-Debt Architecture
The CFPB's Regulation F call-frequency presumption, post-conversation wait, limited-content message, and channel opt-out rules are mechanical and per-debt. The agent design we run so an AI voice program does not inherit a 1006.14 harassment finding from a dialer it replaced.
Colorado SB 26-189 for Banks and Lenders: The ADMT Framework Replacing the 2024 AI Act and What is Due by January 2027
Colorado repealed and reenacted its 2024 AI Act in May 2026. The replacement is SB 26-189, effective January 1, 2027, which drops the algorithmic-discrimination duty and the impact-assessment regime and instead lands pre-decision notice, a 30-day post-adverse-outcome explanation, and a meaningful human-review right on any 'covered ADMT' that materially influences a financial or lending decision. The version that actually maps to a bank or non-bank lender's operations.
Force-Placed Insurance Under Regulation X 1024.37: What an AI Servicing Agent Has to Get Right Before the Charge Posts
Force-placed insurance is one of the most expensive servicing mistakes a mortgage program can make and the noticing rules at 12 CFR 1024.37 are mechanical. The agent design we run to keep the 45-and-30-day clocks, the reasonable-basis standard, the refund duty, and the credit-bureau correction synchronized across the systems that touch the loan.
CFPB 1071 Small Business Lending and AI Agents: A Subpart B Playbook for the Firewall, the Data, and the Filing
Section 1071 added 81 data points and a firewall between demographic collection and credit decisions. How to put AI agents inside the small-business application without breaching Regulation B Subpart B.
You Ain't Seen Nothin' Yet
- Any loan type, any agency guideline or custom investor overlays.
- Every finding cited to the guideline or document it came from