AI in banking: how a bank uses AI under the rules it answers to

In a survey published by the Bank of England and the Financial Conduct Authority (FCA) on 21 November 2024, 75% of the UK financial firms that answered said they already used artificial intelligence (AI), and 10% more planned to use it within three years [1]. Among international banks, which answered for their UK operations, the share using AI was 94% [1]. The survey received 118 responses, so these figures describe the firms that answered.

This guide is for a bank executive who has to decide how the bank uses AI and which rules apply to each use. Several of those rules changed in 2025 and 2026, and some well-known ones no longer apply. Every rule in this guide carries its status as of 26 October 2026. Some rules are law, which a bank must follow. Others are guidance, which tells a bank what its supervisors expect. The guide says which is which. A bank should still confirm with its own lawyers and its examiners which rules apply to it, because the answer depends on the type of banking licence it holds, its size, its country and the use.

How banks use AI today

The figures below come from surveys and regulators' questionnaires, and each one describes only the firms that answered.

Figure	Who reports it	Date
75% of responding UK financial firms use AI, and 10% more plan to within three years	Bank of England and FCA, 118 firms [1]	21 November 2024
94% of international banks in that survey use AI in their UK operations	Bank of England and FCA [1]	21 November 2024
The median number of AI use cases per firm is expected to rise from 9 to 21 in three years	Bank of England and FCA [1]	21 November 2024
Foundation models are 17% of all reported AI use cases	Bank of England and FCA [1]	21 November 2024
A third of all AI use cases are third-party implementations	Bank of England and FCA [1]	21 November 2024
46% of firms report only partial understanding of the AI they use	Bank of England and FCA [1]	21 November 2024
70% of federally regulated financial institutions in Canada expected to use AI by 2026	OSFI and FCAC [2]	24 September 2024

A foundation model is a large model trained on broad data, which other products are built on. A third-party implementation is AI that a vendor builds or supplies. The Canadian figure comes from the Office of the Superintendent of Financial Institutions (OSFI) and the Financial Consumer Agency of Canada (FCAC), from a voluntary questionnaire sent in December 2023 [2].

In the United States, the Office of the Comptroller of the Currency (OCC), which supervises national banks, wrote in its spring 2026 risk report that "Banks are taking a measured approach to the adoption of generative AI (genAI) and agentic AI" [3]. Generative AI is AI that writes text, images or code. Agentic AI is AI that takes actions on its own, such as calling other software, to reach a goal. The OCC says that "use cases are primarily productivity and customer experience enhancement tools" [3]. It also says it is reviewing its expectations, guidance and rules so that AI is open to all the banks it supervises, "rather than only a few" [3].

Most rules for bank AI are older rules

Most of the rules a bank answers to for AI were written before AI. The Financial Stability Institute of the Bank for International Settlements (BIS) wrote in December 2024 that "Most financial authorities have not issued AI regulations specific to financial institutions as existing frameworks already address most of these risks" [4]. The FCA says on its AI page, last updated 2 October 2026: "We do not plan to introduce extra regulations for AI" [13].

For a bank, then, the question is which existing rule covers each use. Model risk guidance covers models. Lending law covers credit decisions. Consumer protection law covers chatbots and other customer service tools. Privacy and information security rules cover customer data. Third-party guidance covers vendors. Anti-money laundering rules cover the monitoring of financial crime. The EU adds one law written for AI, the AI Act, which names credit scoring as a high-risk use.

What changed in 2025 and 2026

This table gives the status of the main rules as of 26 October 2026.

Rule	What it covers	Status as of 26 October 2026	Law or guidance
SR 11-7 and OCC Bulletin 2011-12	Model risk, 2011	Replaced on 17 April 2026 [17][6]	Was guidance
Revised interagency model risk guidance (SR 26-2, OCC Bulletin 2026-13, and Federal Deposit Insurance Corporation (FDIC) FIL-15-2026)	Model risk	In effect since 17 April 2026; does not bind; excludes generative and agentic AI [5]	Guidance
Consumer Financial Protection Bureau (CFPB) Circulars 2022-03 and 2023-03	AI and the reasons for credit denials	Withdrawn on 12 May 2025 [7]	Was guidance
Regulation B, 12 CFR 1002.9	Notices and reasons for credit denials	In force, unchanged [8]	Law
EU AI Act high-risk duties for credit scoring	Credit scoring of people in the EU	Apply from 2 December 2027, moved by Regulation (EU) 2026/1744 [9]	Law
Interagency Guidance on Third-Party Relationships (2023)	Vendors	In effect; replacement proposed on 15 September 2026, comments due 16 November 2026 [10]	Guidance
Financial Stability Board (FSB) sound practices for AI	All AI use in finance	Final report on 15 October 2026 [11]	Not binding [19]
OSFI Guideline E-23 (2027)	Models in Canada, including AI	Published 11 September 2025; takes effect 1 May 2027 [14]	Guideline
Prudential Regulation Authority (PRA) SS1/23	Models at UK banks, building societies and designated investment firms with internal model approval	In effect since 17 May 2024; current version April 2026 [15]	Supervisory statement

Model risk: new guidance, with generative AI outside it

The 2026 guidance defines model risk as "the potential for adverse financial consequences associated with models, which may result from decisions made based on model output" [5]. In plain words, it is the chance of losing money because of a decision made on a model's answer. On 17 April 2026 the Federal Reserve Board (the Fed), the OCC and the Federal Deposit Insurance Corporation (FDIC) issued revised guidance on model risk management, which replaces the 2011 guidance known as SR 11-7 (a Fed supervision and regulation letter) and OCC Bulletin 2011-12 [17][6]. The FDIC issued it as Financial Institution Letter FIL-15-2026.

On AI, the guidance says: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance" [5]. On its legal weight, it says it "does not set forth enforceable standards or prescriptive requirements" and that "non-compliance with this guidance will not result in supervisory criticism against a banking organization" [5]. On which banks it is for, the OCC says it "is expected to be most relevant to banking organizations with over $30 billion in total assets" [6].

For tools outside its scope, the guidance says a bank's own "risk management and governance practices should guide the determination of appropriate governance and controls" [5]. It also says that supervisory action "may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk" [5]. The OCC says the agencies "plan to issue in the near future a request for information" on model risk and on banks' use of AI, including generative and agentic AI [6]. This guide found no such request in the Federal Register as of 26 October 2026. The page model risk rules and AI covers the new guidance in detail.

Reveneau's view is that a bank using generative AI still needs written controls of its own: what each tool may be used for, who approves it, how its answers are tested before release, and what is checked after release. An eval is a written, repeatable test of an AI system's answers against cases the bank chooses. Eval results, kept with their dates, are evidence of whether those controls work. The guide on why AI evals matter explains evals for a buyer.

Credit decisions: two circulars withdrawn, the reasons rule unchanged

The Consumer Financial Protection Bureau (CFPB) withdrew 67 guidance documents on 12 May 2025 (this guide's count of the notice's list), including its two circulars on credit denials made with complex algorithms and AI [7]. The rule they interpreted is still in force. Regulation B, which carries out the Equal Credit Opportunity Act, says the reasons given for a credit denial "must be specific and indicate the principal reason(s) for the adverse action" [8]. Adverse action means a denial or another unfavourable decision on a credit application. The rule makes no exception for the type of model the lender uses. See AI in credit decisions and fair lending.

The EU moved its credit scoring date

The EU AI Act names AI used to evaluate the creditworthiness of people or to set their credit score as high-risk, except AI used to detect financial fraud [16]. Regulation (EU) 2026/1744 moved the start of the high-risk duties for those systems to "2 December 2027" [9]. It also rewrote the AI literacy duty, so that providers and deployers must now take measures "to support the development of AI literacy of their staff" [9]. See the EU AI Act for banks.

Vendor guidance has a proposed replacement

On 15 September 2026 the OCC, the Fed, the FDIC and the National Credit Union Administration (NCUA) proposed new guidance on third-party risk. They wrote that they "plan to rescind and replace existing guidance on third-party risk management" [10]. Comments are due 16 November 2026, and the 2023 guidance applies until a final version replaces it. See AI vendor risk for banks.

International standards

The Financial Stability Board (FSB), an international body of financial authorities, published its final report on 12 "Sound Practices for Responsible Adoption of Artificial Intelligence" on 15 October 2026 [11]. Under the FSB's charter, its decisions are not binding and create no legal rights or obligations [19]. In Canada, OSFI's Guideline E-23 defines a model to include AI and machine learning methods and takes effect on 1 May 2027 [14]. In the UK, the Prudential Regulation Authority (PRA) supervisory statement SS1/23 covers model risk at UK banks, building societies and PRA-designated investment firms that have approval to use internal models to calculate their capital requirements, and its current version is dated April 2026 [15]. The page what bank regulators have said about generative AI collects these statements.

Four uses and the rules for each

Credit. Regulation B's reasons rule applies to every model. In the EU, credit scoring of people is high-risk under the AI Act from 2 December 2027. See AI in credit decisions and fair lending.

Fraud and financial crime. The Bank of England and FCA survey found that firms see the largest current benefits of AI in "data and analytical insights, anti-money laundering (AML) and combating fraud, and cybersecurity" [1]. Anti-money laundering (AML) is the work of finding and reporting money from crime. See AI for fraud and financial crime.

Customer service. The CFPB wrote in June 2023 that chatbots must comply with all applicable federal consumer financial laws, like the processes they replace [18]. See AI in customer service for banks.

Customer data. Firms in the UK survey named data protection and privacy as "The largest perceived regulatory constraint to the use of AI" [1]. See customer data privacy and AI in banking.

Doing the work

The US Treasury wrote in December 2024 that it "recommends that financial firms prioritize their review of AI use cases for compliance with existing laws and regulations before deployment" [12]. That review is the first task. The second is the vendor. A third of AI use cases in the UK survey were third-party implementations, and 46% of firms said they had only partial understanding of the AI they use [1]. The page AI vendor risk for banks covers the vendor rules, and the printable AI vendor question list for banks turns them into 22 questions. The page running an AI pilot inside a bank covers the trial itself: what to test, who reviews it and what to record.

For the engineering controls every financial application needs, such as audit trails, access control and release controls, see the guide on financial software compliance.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code, and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. Reveneau says it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release.

For a bank, the questions in this guide are the ones to put to any development firm or AI vendor, Reveneau included: which rules the work falls under, what the tests show, and what the bank will be able to show its examiners. For how different kinds of firms suit regulated work, see an AI development partner for a regulated industry. To talk about a project, see Reveneau's services or contact Reveneau.