AI Security for Banks & Credit Unions
Use AI with the controls your examiners expect.
Banks & Credit Unions
AI You Can Explain to Your Examiner
Community banks and credit unions are adopting AI the same way everyone else is: a chatbot on the website, an assistant drafting member letters, a tool that summarizes loan files, a vendor's new "AI-powered" fraud or underwriting feature. Every one of those touches nonpublic personal information, and every one is something an examiner can ask about. We help you use AI with the documentation and controls that hold up when they do.
An AI inventory, vendor due diligence and a risk register mapped to the guidance examiners use.
For Banks & Credit Unions
Risks, Rules and How We Help
← All AI Security & Governance services
Where AI risk shows up in a bank or credit union
- Staff pasting member or customer data into chat tools that keep it, train on it, or store it outside your control.
- Vendor AI features switched on by default in core, digital banking, CRM or document systems, with nobody reviewing what data they use.
- Website and phone chatbots that can be tricked into revealing account information or giving answers your compliance team never approved.
- AI in credit and fraud decisions that nobody can explain to a member, an examiner, or a fair lending reviewer.
The rules your AI use touches
- Gramm-Leach-Bliley Act safeguards: the Interagency Guidelines Establishing Information Security Standards for banks, and NCUA Part 748 for credit unions. AI tools that handle customer information belong in your information security program and risk assessment.
- Third-party risk management: the federal banking agencies' 2023 interagency guidance on third-party relationships expects due diligence and ongoing monitoring of vendors, including their AI features.
- Model risk management: supervisory guidance on model risk (SR 11-7 and OCC Bulletin 2011-12) is increasingly applied to AI tools that inform decisions.
- Incident notification: banks must notify their primary federal regulator of a qualifying computer-security incident within 36 hours; federally insured credit unions must report a reportable cyber incident to the NCUA within 72 hours. An AI tool that leaks data can start that clock.
- Fair lending and adverse action: CFPB guidance makes clear that adverse action notices must give specific, accurate reasons even when a complex model made the decision.
- Examinations: the FFIEC IT Examination Handbook is the reference examiners use for information security, vendor management and governance.
How we help
- An AI Risk & Exposure Assessment that inventories every AI tool and vendor feature, maps where member and customer data goes, and produces a risk register in a format your board and examiners can read.
- An AI Governance Program: an AI acceptable use policy, AI added to your vendor due diligence, and a board briefing.
- AI Red Team Testing of website and phone chatbots before members find the gaps.
- Drift Monitoring for AI systems that need to keep behaving the way they were approved.
Get Started
Start With a Scoping Call
Thirty minutes, by video or on-site. We will talk through how your business uses AI today and where customer data goes, and you will leave with a written scope and quote. Nothing is tested and no data is shared until a written agreement is signed.
