AI in finance: the regulator looked and stepped back

TL;DR. Finance is the control group for every other domain in this series, because it is the only one that had formal governance for statistical models before AI arrived. SR 11-7 dates from 2011 and was written for exactly this problem: models whose complexity exceeds a reviewer's ability to check them. The result is a field where explainability is a deployment gate rather than a preference, and where a model achieving 98% accuracy that cannot explain a specific decision is, from a compliance standpoint, not deployable. In April 2026 the successor guidance arrived and deliberately placed generative and agentic AI outside its formal scope. The most model-governed industry in the world looked at the current wave and declined to regulate it yet.

---

Every other article in this series describes a field discovering that its measurement apparatus was built for something else. Medicine's clearance pathway was designed for instruments. Education's instruments were designed for classroom research. Hiring's four-fifths rule dates from the 1970s.

Banking is the exception. It has had a framework designed for exactly this problem since 2011.

SR 11-7, the Federal Reserve's model risk management guidance, and the parallel OCC Bulletin 2011-12 require a formal model inventory, documented validation by someone independent of the developer, ongoing performance monitoring, and board-level oversight. Its central concept, effective challenge, means a model must be reviewed by a party with the standing, incentive and competence to disagree with it.

Which makes finance the most useful case in the series. It answers a different question from the others: not what happens when AI meets a field with no governance, but what happens when it meets a field that already had some.

Two things happened, and they point in opposite directions.

What the existing framework absorbed easily

Credit scoring, fraud detection and transaction monitoring moved to machine learning with far less disruption than in any other domain, for a reason that is structural rather than cultural.

These were already models. A credit scorecard is a statistical artifact with an inventory entry, a validation report, a monitoring schedule and an owner. Replacing logistic regression with gradient boosting changes what is inside the box without changing the box, the paperwork or the person accountable for it.

So the transition was a version upgrade, not a new category. SR 11-7's risk-based framing helped: it scales governance intensity with complexity, uncertainty, breadth of use and potential impact, and a machine learning model simply scores higher on all four and attracts more scrutiny accordingly. No new rule was required.

The measured results are solid rather than spectacular. Published benchmarking on standard fraud datasets reports an LSTM and gradient-boosting ensemble reaching a ROC-AUC of 0.9289, with an F1 of 0.636 and a benefit-cost ratio around 6 to 1. Those are good numbers for a problem where the positive class is rare and the cost of a false positive is a blocked customer.

And a detail from the same work is more instructive than the headline figure. Under temporal drift testing, the gradient-boosting model degraded by a delta-AUC of 0.0017 while the deep model degraded by 0.0626, roughly thirty-seven times more. The simpler architecture held its performance as the world moved; the more complex one did not.

That is a finding practitioners in this field already act on, and it explains something outsiders find puzzling: the reason banks keep using boosted trees is not conservatism. It is that the thing you buy with a deep architecture is frequently lost to drift within a year, and the thing you lose is explainability, which is not optional here.

The explainability gate

The sharpest difference between finance and every other domain in this series.

The regulatory position is that a system used for high-risk financial decisions must be transparent, auditable and thoroughly documented. The operational consequence has been stated bluntly in the literature: a model achieving 98% accuracy that cannot explain why a specific transaction was flagged is, from a compliance standpoint, not deployable.

Read that against medicine, where a device can be cleared on substantial equivalence without reporting patient outcomes, or hiring, where a tool need only be audited annually and the audit need not be acted on.

In finance, accuracy alone does not get you deployed. The reason is that a credit decision is adverse action, and adverse action requires a reason given to the person affected. That obligation predates machine learning by decades and does not bend for it.

This produces the field's characteristic trade. Practitioners choose architectures partly for interpretability, apply attribution methods to explain individual decisions, and accept accuracy they could exceed with a model they could not defend. An entire industry has been optimising a constrained objective while everyone else optimised the unconstrained one, and it is worth asking whether the constraint cost as much as it appears to, given the drift result above.

The 2026 decision, and why it is the most informative event

In April 2026 the OCC, Federal Reserve and FDIC jointly issued updated interagency model risk management guidance. SR 11-7 was superseded by SR 26-2.

The new framework deliberately places generative and agentic AI outside its formal scope.

That is not an oversight. The most heavily model-governed industry in the world, holding a framework built specifically for models too complex to check by inspection, looked at the current wave and declined to bring it inside.

The reasonable reading is that model risk management assumes properties generative systems do not have. A model in the SR 11-7 sense has a defined input space, a defined output, a measurable error, a validation dataset and a stable version. A general model answering arbitrary questions has none of those cleanly, and a validation framework built on them does not extend.

The consequence is a specific and unusual situation. Banks deploying assistants and copilots face a guidance gap rather than a regulatory vacuum. Supervisors continue to expect model-risk principles applied to consequential AI regardless of formal scope, so the obligation exists without a framework specifying how to meet it, and institutions are building controls against an expectation rather than a rule.

Every other domain in this series is waiting for regulation to arrive. Finance is the one where the regulator arrived, looked, and stepped back. That should be read as a statement about the difficulty of the problem rather than about regulatory capacity.

What the examiners actually find

Worth knowing, because it is the closest thing to a field-wide audit of AI governance anywhere.

Reported findings cluster around a small set of recurring gaps rather than novel violations, and the most common is incomplete model inventory. Banks regularly discover undocumented models during examinations.

That finding should be read carefully, because it is the same shape as the hiring result. A framework requiring you to inventory your models depends on you knowing what counts as a model, and spreadsheets, vendor tools and analytical scripts sit in a grey zone that expands every year. An undocumented model is not usually concealment. It is something nobody classified as a model until an examiner did.

The second recurring finding is staleness: models built in one economic environment and left unrevalidated through a change in conditions, with credit models built during a benign rate environment and carried unchanged through rate cycles as the standing example.

Neither of these is an AI problem. They are model governance problems that AI makes more common, because machine learning lowers the cost of building a model and therefore raises the number of models nobody wrote down.

The regulatory map, briefly

Finance carries more overlapping obligations than any other domain, and they are additive rather than alternative.

In the United States, the interagency model risk guidance sits alongside the CFPB's position that incorrect information given to a customer, including by an AI chatbot, can constitute an unfair or deceptive practice. Fraud and anti-money-laundering work carries its own reporting obligations.

In the European Union, retail credit scoring, small-business lending, probability-of-default and loss-given-default models, and insurance underwriting are named high-risk. Transaction monitoring, sanctions screening and behavioural anomaly detection are carved out of that specific clause, and still face data protection rules on automated decision-making, consumer protection law, and supervisor expectations on bias and explainability. High-risk obligations bind from August 2026.

And they stack. A bank operating in both jurisdictions meets the conformity assessment obligations of one on top of the validation regime of the other, with no reduction in rigour on either side.

The practical consequence is that finance has the highest compliance cost per deployed model of any sector, which shapes what gets built. The economics favour a small number of heavily governed models over many lightly governed ones, which is roughly the opposite of how AI is deployed everywhere else.

What this means for other domains

Three transferable findings, and the third is the one worth arguing about.

Governance designed for statistical models absorbs machine learning without much difficulty. The transition in credit and fraud was comparatively uneventful because the artifact being governed did not change category. Domains without an existing model concept had to invent the whole apparatus.

An explainability requirement is a real constraint and its cost is smaller than it looks. Finance gave up some accuracy for defensibility and got temporal stability as a side effect, since the simpler models drift less. Elsewhere that trade is usually presented as pure loss.

And a framework built for models does not extend to generative systems. The regulator with the most experience of governing complex models declined to bring them into scope. Any domain currently drafting AI rules by analogy to model validation should treat that as evidence, because finance tried the analogy first and stopped.

What is unresolved

How to validate a generative system at all. The formal exclusion in SR 26-2 does not mean nobody has to try, since supervisors still expect model-risk principles applied. What those principles mean for a system without a defined input space is truly unsettled, and the first bank to be examined on it will effectively write the standard.

Whether the explainability requirement holds under competitive pressure. If a jurisdiction permits less explainable models and they perform better, the constraint becomes a disadvantage. So far the drift evidence suggests the performance gap is smaller than assumed, and that is one study.

What counts as a model. The inventory finding will get worse before it gets better, because the cost of producing something model-shaped keeps falling. No workable definition currently separates a governed model from a spreadsheet with a regression in it.

And whether any of this reaches consumers. The framework protects institutions from model risk and requires reasons for adverse action. Whether a person declined for credit by a boosted tree receives an explanation they can act on, as opposed to a compliant one, is not something the regime measures.

The counter-argument

Finance's caution is not obviously wisdom. The same conservatism that produced careful model governance also produced a sector that took a decade longer than others to adopt techniques that worked. Reading regulatory restraint as insight risks mistaking slowness for judgement, and the deferral on generative AI may simply be a regulator without a view.

The explainability constraint may be costing more than the drift result suggests. One benchmark on public fraud datasets is thin evidence for a claim about an entire architectural trade-off. Domains where deep models substantially outperform may be paying a real price, and finance's comfort with the constraint could reflect that its problems happen to suit tabular methods.

The governance is also partly theatre. A formal inventory, a validation report and a board committee describe a process, not an outcome. The recurring finding that banks discover undocumented models during examinations suggests the inventory is frequently a compliance artifact rather than a live picture of what is running.

And the sector has a poor record of model risk producing safety. Risk models were extensively governed before 2008 and did not prevent what happened. A framework can be rigorous about validation and still be wrong about the thing that matters, which is a caution against reading SR 11-7 as a solved problem.

The short version

Finance is the control group for this series, because it is the only domain with formal governance for statistical models predating AI. SR 11-7, from 2011, requires a model inventory, independent validation, ongoing monitoring and board oversight, built around effective challenge: review by someone with the standing, incentive and competence to disagree.

Credit scoring and fraud detection moved to machine learning with unusually little disruption, because these were already models. Replacing logistic regression with gradient boosting changed what was inside the box, not the box, the paperwork or the accountable person. Published benchmarking reports an ensemble reaching ROC-AUC 0.9289 with a benefit-cost ratio around 6 to 1.

The more instructive figure is drift. Under temporal testing the gradient-boosting model degraded by 0.0017 while the deep model degraded by 0.0626, roughly thirty-seven times more. The reason banks keep using boosted trees is not conservatism: what a deep architecture buys is frequently lost to drift within a year, and what it costs is explainability, which here is a deployment gate. A model achieving 98% accuracy that cannot explain a specific decision is, from a compliance standpoint, not deployable.

Then in April 2026 the successor guidance arrived and deliberately placed generative and agentic AI outside its formal scope. The most model-governed industry in the world, holding a framework built for models too complex to inspect, looked at the current wave and declined to bring it in. The reasonable reading is that model risk management assumes a defined input space, a measurable error and a stable version, and general systems have none of those cleanly.

Banks therefore face a guidance gap rather than a regulatory vacuum: supervisors still expect model-risk principles applied, without a framework specifying how.

The transferable lesson is the last one. Any domain currently drafting AI rules by analogy to model validation should note that finance tried that analogy first, had the most experience with it, and stopped.

Common questions

Is AI new in finance? Mostly not. Credit scoring, fraud detection and transaction monitoring have used statistical models for decades, and the shift to machine learning replaced what was inside an existing governed artifact rather than creating a new category. What is truly new is generative AI in customer service and internal analytics, and that is precisely the part regulators have declined to bring into the existing framework.

What is SR 11-7? The Federal Reserve's model risk management guidance, issued in 2011 alongside OCC Bulletin 2011-12. It requires a formal model inventory, documented validation independent of the developer, ongoing performance monitoring and board-level oversight. Its central concept is effective challenge: review by a party with the standing, incentive and competence to disagree with the model. It was superseded by SR 26-2 in April 2026.

Why did the 2026 guidance exclude generative AI? Because model risk management assumes properties generative systems do not have. A model in the SR 11-7 sense has a defined input space, a defined output, a measurable error, a validation dataset and a stable version. A general system answering arbitrary questions has none of those cleanly, so a validation framework built on them does not extend. Supervisors still expect model-risk principles applied to consequential AI, which leaves banks with a guidance gap rather than a regulatory vacuum.

Why do banks still use gradient boosting instead of deep learning? Two reasons, and neither is conservatism. Explainability is a deployment gate in this sector, since adverse credit decisions require a reason given to the affected person. And under temporal drift testing, a gradient-boosting model degraded by a delta-AUC of 0.0017 while a deep model degraded by 0.0626, about thirty-seven times more. What the deeper architecture buys is frequently lost as the world moves, and what it costs is not optional.

What does explainability actually require in finance? That a specific decision can be accounted for, not merely that the model is understood in general. The practical statement in the literature is that a system achieving 98% accuracy which cannot explain why a particular transaction was flagged is not deployable from a compliance standpoint. This traces to adverse action requirements that predate machine learning by decades and do not bend for it.

What do bank examiners find wrong most often? Recurring gaps rather than novel violations, and the most common is incomplete model inventory: institutions regularly discover undocumented models during examinations. The second is staleness, with credit models built in one economic environment carried unrevalidated through a change in conditions. Neither is an AI problem, though machine learning makes both more common by lowering the cost of producing something model-shaped.

How does the EU AI Act apply to financial services? Retail credit scoring, small-business lending, probability-of-default and loss-given-default models, and insurance underwriting are named high-risk, with obligations binding from August 2026. Transaction monitoring, sanctions screening and behavioural anomaly detection are carved out of that particular clause and still face data protection rules on automated decision-making and supervisor expectations on bias. For a bank operating in both jurisdictions the obligations are additive with US model risk requirements rather than alternative.

What can other industries learn from financial AI governance? Three things. Governance designed for statistical models absorbs machine learning without much difficulty, which is why the transition was smoother here than anywhere. An explainability requirement costs less than it appears to, since the simpler models it favours also drift less. And a framework built for models does not extend to generative systems, which is worth knowing because finance tried that analogy first, with the most experience of it, and stopped.