A New Channel, Old Obligations
A lender that lets borrowers' agents check status, upload documents or request a quote has opened a channel. Every channel a regulated lender runs comes with the same set of questions from risk and compliance: who governs it, what can go wrong, how outcomes are monitored for fairness, how customers are protected from being misled, and what record is kept. None of those questions is new. What is new is that the other party is software, the lender's side of the conversation may be an agent too, and the evidence of what happened can be scattered across an identity provider, a gateway, a conversation log and the loan file.
This post walks through how frameworks lenders already work under apply to that channel. The personal agent readiness guide covers the technical stack; this is the governance that has to sit over it.
The GSEs Already Expect AI Governance
For sellers and servicers of agency loans, the starting point is no longer a principle. Freddie Mac's Bulletin 2025-16 amended its Seller/Servicer Guide to require a governance framework for artificial intelligence and machine learning used in origination and servicing, including AI embedded in vendor platforms the seller/servicer did not build; the requirements took effect on March 3, 2026. Fannie Mae has issued its own AI and machine learning governance framework for sellers and servicers.
Two consequences follow for agent traffic.
Your agent-facing systems are in scope. A lender-side agent that answers a borrower's agent, a classifier that detects agent callers, a model that decides which requests can be answered without a person — each is AI used in origination or servicing, and belongs in the inventory with an owner, a purpose and controls.
The borrower's agent is not yours to govern, but your response to it is. You cannot validate a consumer’s agent. You can govern what your systems accept from them, what they are allowed to do, and how their requests are verified. That is the boundary to document.
Model Risk: What Gets Validated
Banks will recognize the frame from SR 11-7, the Federal Reserve and OCC guidance on model risk management, and from the interagency third-party risk management guidance issued in June 2023. Our SR 11-7 post covers how those apply to agents generally. For agent traffic specifically, three things need validation evidence:
- The routing decision. Whatever decides that a request came from an agent, and whether it can be answered automatically, will be wrong sometimes. Test both directions: agents treated as people, and people treated as agents.
- The answers. A lender-side agent quoting rates, explaining conditions or describing loss mitigation options needs the same grounding and citation discipline as any customer-facing model, because a wrong answer to an agent is relayed to a borrower without a human in between.
- The boundary. The scopes and approvals that stop an agent from doing more than the borrower allowed are controls. They need testing like controls: try to exceed them.
Fair Lending: The Channel Is a Variable
The Equal Credit Opportunity Act and Regulation B prohibit discrimination on a prohibited basis in any aspect of a credit transaction, and disparate impact analysis looks at outcomes, not intent. A personal-agent channel introduces at least three ways outcomes can diverge that did not exist before.
- Different treatment by channel. If borrowers who arrive through agents get faster answers, different products or different pricing, and agent use correlates with a protected characteristic, the channel has become a fair lending variable.
- Different treatment by agent. Allowing some agents and blocking others is a reasonable security decision. It is also a decision about which borrowers get served through which path, and it should be monitored as one.
- Steering by the lender's agent. A lender-side agent that recommends products is doing what a loan officer does when they present options, and should be tested for the same steering patterns.
Our fair lending post covers the testing methods. The new step is to capture the channel and the agent identity on every application, so the analysis can include them.
UDAAP: Writing for a Machine Reader
The Dodd-Frank Act prohibits unfair, deceptive or abusive acts or practices in consumer financial services (12 U.S.C. 5531 and 5536). Two agent-specific risks deserve attention.
Saying one thing to agents and another to people. A lender that publishes cleaner terms in its agent-facing data than on its disclosures, or the reverse, has created a gap that a regulator could read as deceptive whichever version is better. One source of truth for products, prices and fees, rendered for both readers, closes it.
Burying the important part. The protocol draft asks businesses to make an approval's summary stand on its own and its terms match the request's fields, so the agent can compare what it is approving with what it asked for. A summary written to be technically accurate but practically opaque defeats that, and in an approval that commits a borrower, opacity is the kind of thing abusiveness analysis looks at. Our UDAAP post has the general framework.
Records: What to Keep, and Where
Existing retention rules apply to agent-originated activity the same as any other. Regulation B requires creditors to retain applications and related records for 25 months after notifying an applicant of action taken (12 CFR 1002.12(b)). Regulation Z requires evidence of compliance to be retained for at least three years, and the Closing Disclosure for five (12 CFR 1026.25(c)). We covered the general problem in AI agent recordkeeping and retention.
For agent traffic, the question is which record. We would keep one record per session that answers, without reconstruction:
- Which agent — its identifier and the domain it was verified against.
- Which borrower — and how they signed in to grant access.
- What was allowed — the scopes granted, and which were used.
- What was said — the lender's answers, including anything quoted from rates or disclosures.
- What was approved — each consequential action, the summary and terms shown, and when the borrower approved it.
- What happened next — the application created, the document received, the lock taken.
The Personal Agent Protocol draft gives this record a natural key — a session is named by the agent's client_id and the session's sid — and asks businesses to keep conversation records for at least 30 days. A regulated lender will want much longer, and will want the record joined to the loan file rather than left in a vendor's conversation store.
Who Owns It
The last governance question is ownership. Agent traffic touches marketing (who is on the shortlist), origination (intake and the TRID clock), servicing (authentication and loss mitigation), information security (identity and tokens) and compliance (everything above). Left to all of them, it belongs to none. The lenders that handle this well will name one owner for the agent channel, give it a policy, and put it in the AI inventory the GSEs now expect — before the traffic is large enough to make the decision for them.
Ramkumar Venkataraman
CTO & Co-Founder