Compliance
37 articles in this category
Ability-to-Repay Under Reg Z 1026.43 in AI-Assisted Underwriting: The Eight Factors, the Revised General QM Price Test, and the Documentation Boundary the Agent Cannot Cross Alone
The ATR/QM rule at Reg Z 1026.43 has been through three rounds of major revision since 2013, and the current General QM definition anchors on an APR-to-APOR price threshold rather than the old 43-percent DTI cap. AI underwriting participates in ATR analysis by producing the eight-factor computation, but the documentation of the third-party verification the rule requires and the qualification decision the rule allocates to the creditor are places the agent's autonomy stops. Where AI actually sits in the ATR workflow and what the audit file has to contain.
RESPA Section 8 and AI-Driven Mortgage Referrals: The Anti-Kickback Architecture for Lead Routing, MSAs, and Co-Marketing
Lead-routing scores, AI co-marketing tools, and pay-per-application platforms have rebuilt the mortgage referral economy in vocabulary that maps very cleanly onto the RESPA Section 8 'thing of value' standard. The posture we put in front of marketing and partnerships so an AI workflow does not produce a 12 CFR 1024.14 finding the next exam catches.
HMDA Data Integrity for AI-Driven Loan Origination: The Reg C LAR Fields, the Resubmission Threshold, and the Audit File That Survives
AI agents on the mortgage intake desk now populate a meaningful share of the 110 HMDA LAR fields before a human ever looks at the file. The Reg C accuracy rules and the CFPB resubmission threshold catch the gaps before fair-lending analysis ever runs, and the architecture has to make field provenance and correction provable per loan.
The SAFE Act Line for AI Mortgage Assistants: When Quoting a Rate Becomes Loan Origination and What NMLS Cares About
The SAFE Act and Reg G/H were written for human MLOs and the definition of 'loan originator' bites on any person who takes an application or offers or negotiates loan terms. AI assistants on the mortgage intake desk straddle that line without realizing it, and the state regulators that examine NMLS are starting to ask. The boundaries we hold the agent to so the institution does not have to sponsor a license for software.
GLBA Safeguards for AI Vendors: 16 CFR 314, the Interagency Guidelines, and the 30-Day Notification Bank IT Cannot Push to Anyone Else
The FTC's 2023 Safeguards amendments added a 30-day breach-notification duty and a list of nine information-security elements every covered non-bank financial institution has to encode. Banks operate under parallel Interagency Guidelines with their own notification rule. AI vendors sit inside both perimeters and the institutions we serve are running diligence and contract terms that anticipate what the next regulator will ask for.
California's Final ADMT Regulations for Banks and Lenders: What the CPPA Lands on Significant Decisions and What Is Due in 2027
The California Privacy Protection Agency finalized its automated decisionmaking technology regulations in late 2025, with phased compliance through 2027 and 2028. The pre-use notice, the access and opt-out rights, the risk assessment attestation, and the cybersecurity audit, applied to a bank or non-bank lender's AI agent on a California consumer.
The Interagency 36-Hour Computer-Security Incident Notification Rule Applied to Bank AI Systems
The OCC's Part 53, the FDIC's Part 304 Subpart C, and the Federal Reserve's Part 225 Subpart N gave banks a 36-hour clock on notification incidents. The architecture we run so an AI agent failure, a model-vendor outage, or a prompt-injection-driven exfiltration is detected, classified, and reported inside the window.
Colorado SB 26-189 for Banks and Lenders: The ADMT Framework Replacing the 2024 AI Act and What is Due by January 2027
Colorado repealed and reenacted its 2024 AI Act in May 2026. The replacement is SB 26-189, effective January 1, 2027, which drops the algorithmic-discrimination duty and the impact-assessment regime and instead lands pre-decision notice, a 30-day post-adverse-outcome explanation, and a meaningful human-review right on any 'covered ADMT' that materially influences a financial or lending decision. The version that actually maps to a bank or non-bank lender's operations.
CFPB 1071 Small Business Lending and AI Agents: A Subpart B Playbook for the Firewall, the Data, and the Filing
Section 1071 added 81 data points and a firewall between demographic collection and credit decisions. How to put AI agents inside the small-business application without breaching Regulation B Subpart B.
OFAC Sanctions Screening with AI Agents: The SDN List, Fuzzy Matching, and the 50 Percent Rule
Sanctions screening is strict-liability and the SDN list does not match cleanly. How we architect AI agents for name and identifier screening, beneficial-ownership traversal under the 50 percent rule, and hit disposition that survives an OFAC subpoena.
SCRA Compliance with AI Agents: DMDC Queries, the 6 Percent Cap, and the Verbal-Notice Trigger
SCRA carries a private right of action and an active DOJ enforcement docket. How we build AI agents that catch the verbal notice, query DMDC at the right moments, apply the rate cap correctly, and hold the foreclosure stay.
AI Chatbots in Consumer Finance: What the CFPB Spotlight Named and Who Enforces It in 2026
The CFPB's 2023 chatbot spotlight named real failure modes, and they did not disappear when the Bureau pulled back. The doom loop, missed federal rights, and UDAAP exposure, who enforces them now, and the controls that hold up.
BOOK A DEMO
- Deploy in weeks, not months
- Trained on FDCPA, TCPA, TILA, UDAAP, and RESPA
- SOC 2 Type II and PCI DSS L1 certified
- Integrates with your LOS, CRM, and telephony
