On September 16, the Conference of State Bank Supervisors (CSBS) released a new supervisory resource designed to help state examiners assess the use and risks of artificial intelligence (AI) at state-chartered banks and state-licensed nonbank financial institutions. The publicly available framework also gives regulated institutions insight into examiners’ general approach, the types of questions they may ask, and the information they may request regarding an institution’s AI-based products, services, and tools.

Business email compromise (BEC) and other third-party fraud inducing funds transfers have generated a wave of litigation against banks: not just those where victims hold accounts, but also against the financial institutions where the funds were transferred, even when the victim is not a customer. A threshold question often arises as to whether the beneficiary bank receiving the funds via a wire transfer owes a noncustomer plaintiff any duty of care at all. Most courts uniformly hold that banks owe no duty of care to noncustomers. But in 2024, in Elkin Valley Baptist Church,the United States District Court for the Western District of Pennsylvania went against the weight of authority and answered that question in plaintiffs’ favor.

On September 2, the Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), Financial Crimes Enforcement Network (FinCEN), and National Credit Union Administration (NCUA) issued a joint statement clarifying the confidentiality requirements related to Suspicious Activity Reports (SARs), particularly when banks communicate with customers regarding potentially fraudulent transactions, other suspicious activity, or account closures. The statement applies to all banks, including community banks.

On August 26, New York State Senator Zellnor Myrie introduced Senate Bill S10688, legislation that would enact an express “opt out” from key provisions of the Depository Institutions Deregulation and Monetary Control Act of 1980 (DIDMCA), purporting to impose New York’s interest rate limitations on a broad range of consumer credit transactions. The bill was referred to the Senate Committee on Rules the same day. This proposed legislation marks the latest development in a continuing trend of state efforts to regulate state-chartered banks and fintech partnerships and impose restrictions on bank-model lending.

On August 25, seven federal agencies — the Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Consumer Financial Protection Bureau (CFPB or Bureau), National Credit Union Administration, Department of Housing and Urban Development (HUD), U.S. Department of Justice, and Federal Housing Finance Agency (the agencies) — jointly rescinded the February 2022 “Interagency Statement on Special Purpose Credit Programs Under the Equal Credit Opportunity Act and Regulation B,” effective immediately upon Federal Register publication. The agencies’ stated reason for the rescission was to clarify that creditors may not discriminate against borrowers based on prohibited characteristics, and that creditors should not rely on the Interagency Statement or related guidance going forward concerning special purpose credit programs (SPCPs). Curiously, the Federal Reserve Board, which joined in issuing the original Interagency Statement, was not a party to the notice of rescission, instead electing to separately withdraw its own version rather than join the other agencies in the joint rescission.

On July 31, the OCC and FDIC jointly issued a proposed rule to significantly amend their existing Community Reinvestment Act (CRA) regulations that have been in place since 1995.  While the proposal would retain key elements of the regulatory framework, it seeks to better align the regulations with CRA’s statutory mandate of encouraging banks to meet the credit needs of their communities by making “targeted” substantive, technical, and process-oriented changes and narrowing the scope of the rules.  Toward that end, the proposal focuses on the lending test, ensures that community development grants reach the communities they are intended to benefit, and narrows the range of retail banking services the agencies consider for CRA credit by excluding deposit services.  The proposed rule also seeks to provide greater clarity on how a bank receives CRA consideration and to reduce burden on banks (particularly community banks). Notably, the Federal Reserve Board (FRB) did not join the proposal.

In this solo episode of The Consumer Finance Podcast, Chris Willis, co-leader of Troutman Pepper Locke’s Consumer Financial Services Regulatory practice, walks through the recent wave of federal regulatory guidance addressing the role of immigration status in consumer lending and explains why the practical impact on lenders may be far more limited than the public discourse suggests. Chris breaks down what each piece of guidance says, including the Consumer Financial Protection Bureau’s reminder that Regulation B permits immigration status considerations in ability-to-repay analyses for mortgages and credit cards, and the banking regulators’ safety and soundness and concentration risk warnings. He also addresses the competing litigation risks that complicate a simple return to restrictive eligibility policies. He then turns to the critical practical question: what, if anything, should lenders actually do?

In this crossover episode of The Consumer Finance Podcast and Payments Pros, Taylor Gess is joined by colleagues James Stevens and Sarah Hanna from Troutman Pepper Locke’s Corporate and Consumer Financial Services practices to discuss the surge of interest among fintech and point-of-sale finance companies in obtaining bank charters, acquiring existing banks, and forming bank partnerships. With the current administration signaling an open-for-business posture at the federal banking agencies, and the Office of the Comptroller of the Currency (OCC) actively encouraging de novo applications, payment and fintech companies are weighing their options more seriously than they have in years. The conversation covers what is driving the spike in charter applications, including from companies in the crypto, lending, and payments spaces, and how specialty charters are factoring into that trend. James and Sarah also walk through the bank partnership landscape, where enforcement activity has cooled and focus has shifted, and explain how acquiring an existing bank charter compares to starting from scratch on timing, cost, and regulatory complexity. The episode closes with practical guidance for point-of-sale finance companies considering any of these three paths, including why building internal compliance infrastructure early, engaging regulators informally, and retaining regulatory counsel sooner rather than later can make or break a successful launch.

Yesterday, the federal banking regulators issued new interagency guidance directing supervised financial institutions to take a closer look at credit risk when lending to individuals who are not legally authorized to work in the U.S. The guidance, issued jointly by the Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), and National Credit Union Administration (NCUA), follows a May 2026 Executive Order (discussed here) aimed at addressing perceived risks to the financial system arising from the extension of credit to the non-work authorized population.

On June 25, the Federal Deposit Insurance Corporation (FDIC) issued a notice of proposed rulemaking that would significantly update and clarify its regulations governing the disclosure of confidential information, including confidential supervisory information. This is the first substantial revision to these rules in approximately 30 years. The proposal would amend 12 CFR Part 309 and add a new Part 306, with changes designed to reduce administrative burden, expand the ability of insured depository institutions (IDIs) to share confidential supervisory information without prior FDIC approval, and modernize and clarify the FDIC’s information disclosure framework. Comments on the proposed rule are due 60 days after publication in the Federal Register.