Treasury wants to understand how firms are using AI across a range of use cases, including providing products or services, risk management, capital markets, internal operations, customer service, regulatory compliance, and marketing. In each case, the RFIseeks information about the opportunities and risks presented by AI developments, including advancements in existing AI, as well as emerging technologies such as generative AI and large language models. The RFI seeks input from a broad set of stakeholders in the financial services ecosystem, including providers, facilitators, and consumers of financial products and services, as well as consumer and small business advocates, academics, nonprofits, and others. The RFI reflects the federal government’s aim to have a “whole of government” approach to AI while also recognizing that agencies are well positioned to address AI issues within their sector-specific ambit.

The Scope of AI Use in the Financial Services Sector

The RFI begins by asking for input on the evolving uses of AI in the financial services sector. Treasury asks if the RFI’s definition of AI (which is the same as found in President Biden’s October 2023 AI Executive Order) is appropriate for financial institutions or whether the various contexts in which financial institutions deploy AI require a broader or narrower definition.

The RFI asks about the AI models and tools financial institutions are using and exploring for future use, how they differ across and within institutions, and how they’re being used, such as for products and services, risk management, capital markets, internal operations, customer services, regulatory compliance, and marketing.

The RFI asks about the challenges, access barriers, and related risks small financial institutions face when using AI, as well as options to mitigate them. It also asks whether AI use exposes financial institutions to reputational risks.

Actual and Potential Opportunities and Risks Related to Use of AI in Financial Services

AI’s Opportunities

The RFI requests substantiated data about the actual and expected benefits of AI to financial institutions, financial regulators, consumers, researchers, advocacy groups, and others. It asks about specific benefits to low-to-moderate-income consumers and underserved individuals and communities. It also probes how AI has been used to improve fair lending and consumer protection.

Oversight Risks

The RFI notes several areas of concern related to AI oversight, including: (1) whether financial institutions fully understand the sources and content of the data underpinning the AI models they use and how the models work; (2) whether existing financial regulatory guidance on model risk management principles can be applied to certain AI models and tools, including emerging AI technologies; (3) the adequacy of existing human capital within financial institutions; and (4) explainability challenges.

The RFI asks about different approaches to AI development—in-house, third-party, or open-source code—and the benefits and risks of each. It also asks about the extent of interconnection between a particular financial institution’s AI models and tools and other financial institutions’ models and tools.

The RFI seeks input on commenters’ AI governance and risk management frameworks, policies, and practices. Treasury also seeks information about AI testing methodologies and efforts to improve explainability and mitigate bias risks. The RFI also asks about the adequacy of staffing to support the safe development and deployment of AI.

Fair Lending, Data Privacy, Fraud, Illicit Finance, and Insurance Risks

Treasury highlights several areas of interest related to consumer protection and data privacy, including: (1) a potential tension between personalization and targeting; (2) the effectiveness of tools to mitigate potential model bias; and (3) limitations of anonymization and de-identification. Issues raised include fairness, predatory practices, and illegality, and the potential liability associated with these risks.

The RFI asks how financial institutions are evaluating and tackling the risks emerging AI technologies pose for impacted entities such as low-income consumers or underserved individuals and communities. Treasury also seeks comment on governance strategies to ensure compliance with fair lending and other consumer protection requirements and whether existing laws should be strengthened or expanded to address other financial services beyond lending.

Treasury asks how financial institutions are assessing and managing increased data privacy risks associated with the use of AI models, as well as suggestions for strengthening existing privacy protections, such as Gramm-Leach-Bliley. The RFI asks how stakeholders are addressing and mitigating increased fraud risks caused by AI technologies, such as biometric impersonation, anti-money laundering, and countering the financing of terrorism.

Third-party Risks

The RFI notes that third-party risk has been an area of interest for financial regulators in recent years, including federal banking agencies’ 2023 interagency guidance on third-party risk management and the SEC’s 2022 proposed rule on third-party risk for investment advisors. The RFI seeks input on the challenges and concerns that arise from relying on third parties to develop, test, and deploy AI technologies.

Treasury also seeks comment on (1) how third-party risk management frameworks are being applied; (2) how the challenges of mitigating third-party risk vary according to size and complexity; and (3) whether emerging risks related to AI have exposed any gaps in existing operational risk management frameworks.

Treasury also requests information about how financial institutions are ensuring their operations are resilient to disruptions in the integrity, availability, and use of AI, as well as whether and how they are using AI to preserve continuity in these situations.

Further Actions

Treasury also seeks comment on what actions policymakers should take to promote responsible innovation and competition in the use of AI in financial services and to protect impacted entities, including consumers, from potential risks and harms. Finally, the RFI asks how different regulatory approaches in jurisdictions inside and outside the United States create challenges for financial institutions trying to manage AI-related risks on an enterprise basis, both as it relates to commercial matters and to consumer protection and access to services.

Next Steps

The RFI is another example of the Biden Administration’s interest in AI’s risks and benefits across the economy. It offers stakeholders an opportunity to contribute to U.S. policy efforts at the intersection of financial services and emerging AI technologies, emphasizing data, concrete examples, and specific policy suggestions. Comments are due August 12, 2024.