AI Transforming the Financial Landscape

On April 17, the OCC, Federal Reserve, and FDIC jointly issued OCC Bulletin 2026-13, replacing SR 11-7, the Federal Reserve’s 2011 supervisory guidance on model risk management, which has served as the banking industry’s primary model governance framework for 15 years. The new guidance takes a risk-based, principles-driven approach and applies only to banking organizations with more than $30 billion in total assets. Community banks below that threshold are no longer subject to this specific guidance.

The revised framework explicitly excludes generative and agentic AI, classifying those technologies as “novel and rapidly evolving.” Traditional statistical models and non-generative AI tools remain in scope. Fair lending expectations include disparity analysis across protected class segments, testing for proxy variables in model inputs, and ongoing monitoring for disparate impact throughout the model lifecycle.

The shift to a principles-based approach gives larger banks more flexibility in structuring model governance, but also increases responsibility for internal risk management teams. The exclusion of generative AI does not mean those systems are unregulated. Banking regulators have made clear that AI-specific guidance is forthcoming, and institutions should prepare accordingly.

The SEC’s Division of Examinations has begun sending information requests to financial firms focused on AI use, according to an August 7 analysis from FinTech Global citing Red Oak Compliance Solutions. Examinations target three areas: AI-driven portfolio management, algorithmic trading models, and marketing claims. The SEC is testing whether firms can substantiate public statements about their AI capabilities and avoid “AI washing”, the practice of overstating, misrepresenting, or exaggerating the role and sophistication of AI in products, services, or business operations.

Examiners are requesting written, audio, and video materials that reference AI, including ADV Part 2 filings, websites, pitch materials, and video content. Many firms report having AI governance committees, yet some discovered AI tools were being used by IT teams without compliance oversight. Third-party vendors add complexity, requiring firms to document and monitor AI embedded in external products and services.

Red Oak recommends three immediate actions. Review public AI claims for accuracy and consistency across all channels. Build a complete inventory of AI tools, including those obtained through third-party providers. Assign clear governance ownership and document it through committee structures, training records, and meeting minutes. Examiners are specifically requesting those records. While no dedicated ADV field for AI disclosures exists today, examinations are already driving detailed documentation expectations through direct information requests.

Providing one of the clearest examples yet of how agentic commerce could move from concept to real-world deployment, Synchrony announced an enterprise collaboration with OpenAI to help bring financing, rewards, and loyalty programs into AI-native shopping and checkout experiences.

A key element is a Synchrony ChatGPT plugin that will allow consumers to discover offers, promotional financing, and rewards within conversational shopping experiences. 

Synchrony also plans to deploy OpenAI models across its enterprise and expand AI training and tools for employees. The company views the collaboration as part of a broader strategy to support agentic commerce, where AI systems increasingly help consumers discover products, evaluate options, and complete transactions.

Synchrony emphasized maintaining consumer choice, merchant flexibility, and secure experiences as commerce becomes more AI-driven.

One of the largest U.S. consumer financial services companies, Synchrony operates at the intersection of shopping, payments, financing, and rewards. Its co-branded credit cards, installment lending, financing, and loyalty programs make it a significant indicator of how agentic commerce may evolve.

On August 12, NIST issued a Request for Information (RFI) seeking input on modernizing the National Vulnerability Database (NVD), the U.S. government’s primary repository for vulnerability management data. Comments are due October 13, 2026.

NIST says the vulnerability management ecosystem is being reshaped by artificial intelligence, increasing numbers of disclosed vulnerabilities, machine-readable security data, and the need for faster, more automated analysis. The agency is seeking recommendations on AI-enabled automation, vulnerability prioritization, data quality, interoperability, automated remediation, governance, and modernization of vulnerability standards.

The RFI also asks how the NVD should evolve over the next five years to better support analysts, developers, researchers, policymakers, and security tools while maintaining transparency, accuracy, trust, and accessibility. Responses will help guide future NVD strategy, architecture, standards development, and community collaboration efforts.

The RFI builds on NIST’s April 2026 update of NVD operations, which introduced risk-based prioritization and other measures to address record CVE growth. The latest request seeks input on how AI, automation, and machine-readable security data should shape the next generation of vulnerability management.