Generative AI in Fintech: Use Cases, Model Risk and the Rules That Apply

Where generative AI fits in a fintech product

Fintech teams have two kinds of work: decisions (approve this loan, block this payment, file this report) and the paperwork, conversations and investigation around them. Generative models are good at the second kind and a poor fit for the first, because regulators expect decisions to be explainable, repeatable and tested, and a language model is none of those by default. The use cases that ship and survive an audit sit around the decision, with a person or a deterministic model making the call.

The pattern is the same across the table: the model reads and writes, a system of record keeps the facts, and the decision runs through logic you can explain. Our fintech app development work starts from that separation.

Model risk: SR 11-7 is gone, and generative AI is out of scope of its replacement

For fifteen years US banks managed model risk under the Federal Reserve's SR 11-7. On 17 April 2026 the Federal Reserve, OCC and FDIC replaced it with revised guidance, issued by the Fed as SR 26-2, which supersedes SR 11-7 and SR 21-8 and is aimed mainly at banking organisations with more than $30 billion in assets. The new guidance says plainly that generative AI and agentic AI models are "novel and rapidly evolving" and are not within its scope, while stating that a bank's general risk management and governance should still decide the controls for tools it does not cover.

For a fintech selling to banks this matters in practice. Your bank partner's model risk team will still ask how your generative feature was tested, how it is monitored and who can change it; they now do so under their own governance rather than a single supervisory template. Have the answers ready:

• Inventory: which features use which model, provider and version, and what decisions they feed.
• Evaluation: a test set of real cases with expected outputs, run on every prompt or model change, with results stored.
• Monitoring: accuracy samples reviewed by a person each month, drift alerts, cost per request.
• Change control: prompt and model changes go through the same review and release process as code.
• Fallback: what the product does when the model is down or returns something unusable.

Credit decisions: Regulation B and adverse-action notices

If any part of a credit decision uses AI, the US Equal Credit Opportunity Act and Regulation B still require a statement of specific reasons when you decline or offer worse terms. Section 1002.9(b)(2) says the reasons "must be specific and indicate the principal reason(s)", and that statements based on internal standards or a failure to achieve a qualifying score are insufficient. Notice is due within 30 days of a completed application.

The CFPB's Circular 2023-03 applied this directly to AI and complex models, saying creditors cannot pick the closest reasons from the sample forms if those do not reflect the actual reasons. The CFPB's page for that circular is now marked archived, and the CFPB withdrew dozens of other guidance documents in May 2025, so check its status with counsel. The requirement in the regulation itself has not changed, and it is the reason we do not put a language model in the credit decision. Use an interpretable scoring model that produces reason codes, and let generative AI draft the customer letter from those codes, inside approved templates.

EU AI Act: credit scoring is high-risk

Annex III, point 5(b) of the EU AI Act classifies as high-risk "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score", with an explicit exception for systems used to detect financial fraud. The Digital Omnibus on AI, published in July 2026, moved the start date for Annex III obligations from 2 August 2026 to 2 December 2027. High-risk obligations include a risk management system, data governance, technical documentation, logging, human oversight, and testing for accuracy, resilience to errors and cybersecurity.

Architecture that keeps auditors comfortable

1. The system of record owns facts. The model reads them through scoped queries and never writes balances, limits or decisions directly.
2. Every model call is logged with input references, output, model, prompt version and cost. Retain logs on the same schedule as the records they relate to.
3. Personally identifiable and card data stay out of prompts unless the task needs them. Card numbers never do: keep PANs in a tokenisation vault, as we did with Spreedly on Zeuss, and see our PCI DSS compliant development page.
4. Use a model hosted where your data residency rules require: Claude on AWS Bedrock or Gemini on Google Cloud in a chosen region, or the vendor API with a data processing agreement.
5. Human approval for anything customer-facing that is not a pre-approved template, and for every filed report.

A sensible first project

For most fintechs the first generative project with the best ratio of value to risk is agent assist in support or document intake with analyst review. Both produce measurable time savings within weeks, both keep a person on every decision, and both create the evaluation data you will need before letting AI near anything customer-facing. Fraud case narratives are a strong second project for teams with an investigations function, because investigators spend much of their time writing up what the evidence already shows.

What it costs

Model fees are small next to these figures; generative AI development cost has a per-request worked example. For the wider product budget read fintech app development cost.

Our relevant work

We have not built a credit model or a bank's AML system, and we say so. Our fintech-adjacent work is in payments and money movement inside other products: Stripe and PayPal billing reconciled by signature-verified webhooks on Chat Your History, idempotent payments and atomic order persistence on Paint Nite, and identity verification with Persona and PCI-compliant tokenisation on Zeuss. Our generative AI extraction work, such as GovDoc AI and Edge OCR, is the same engineering a document intake or analyst copilot needs.

For a regulated build, the fintech hub lists what we do, the generative AI development page covers the AI side, and generative AI in healthcare shows how the same human-review rules apply in another regulated sector. If support is your first use case, read generative AI for customer service.

Sources

• Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (17 April 2026): https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
• CFPB Regulation B, 12 CFR 1002.9 (notifications): https://www.consumerfinance.gov/rules-policy/regulations/1002/9/
• CFPB Circular 2023-03 (archived): https://www.consumerfinance.gov/compliance/circulars/circular-2023-03-adverse-action-notification-requirements-and-the-proper-use-of-the-cfpbs-sample-forms-provided-in-regulation-b/
• EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/