AI in action · Regulation

What State Examiners Will Ask Banks, Lenders and Fintechs About AI: Inside the CSBS Supervisory Framework

US state financial regulators now have a common playbook for examining how banks and nonbank lenders use AI. The Conference of State Bank Supervisors' framework, released on September 16, 2026, asks firms for an AI inventory, governance documents, risk assessments and vendor oversight. It creates no new legal obligations, but law firms expect most states to use it.

Oct 25, 2026

Most of the AI rules that touch American consumers' money are not federal. Mortgage lenders, money transmitters, consumer lenders and the majority of US banks are chartered or licensed by states, and the state examiners who visit them now have a shared method for looking at AI. The Conference of State Bank Supervisors, the association of state banking and financial regulators, released its Artificial Intelligence Supervisory Framework on September 16, 2026, after approval in August by its State Supervisory Processes Committee and Nondepository Supervisory Committee. In the weeks since, law firms including Venable, White & Case and Moore & Van Allen have published guides for clients on what it means.

The framework is built from documents an examiner can use in a visit. A core examiner guide sets out scoping questions, a document request list and procedures for governance and oversight, AI inventories and use cases, and generative and other emerging AI. An examiner work program explains how to apply it. Nonbank supplements cover third-party and vendor risk, model risk and consumer protection, and an optional worksheet lets an examiner tier each AI use case by risk to decide whether it needs a closer look. The approach borrows from existing references: NIST's AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework and the Treasury's AI Lexicon.

In practice an institution should expect to be asked for a list of every AI system it uses and for what, the policies and committees that govern them, the risk assessments behind them, documentation from the vendors that supply them, and evidence of how they are monitored. The attention to vendors matters most for nonbanks, which tend to use AI built into products they buy rather than models they build, so the examiner's question becomes how the firm evaluates and monitors a model it did not write. Uses that materially influence credit decisions or how consumers are treated, such as underwriting support, are the ones the framework treats as higher concern.

CSBS calls the framework a discretionary tool, and it creates no new legal obligations or supervisory expectations: each state decides whether and how to use it, and the examination is scaled to the institution's size, complexity and use of AI. The legal commentary reads it as a roadmap nonetheless. State regulators of nonbank mortgage lenders, through their association AARMR, are weighing whether to adopt it for that industry, after a survey with the Mortgage Bankers Association and Boston Consulting Group on how lenders use AI.

For a borrower the effect is invisible but useful. If a lender uses AI to decide who gets a loan or how a complaint is handled, a state examiner now has a standard way to ask how the model was chosen, who is accountable for it and how its decisions are checked. Federal supervisors are asking banks similar questions about autonomous agents, and the FCA, the Bank of Japan and the ECB have their own versions; the CSBS framework is the one that reaches the fintechs and nonbank lenders the federal agencies do not supervise.

Sources: Ballard Spahr Consumer Finance Monitor — CSBS releases Artificial Intelligence Supervisory Framework for state examiners (Sep 18, 2026); ABA Banking Journal — New tool released to help state bank examiners assess AI risks (Sep 2026); American Banker — State bank examiners get a playbook for inspecting AI (Sep 2026)