Banks aren’t struggling to find artificial intelligence use cases—they’re struggling to govern them.
From fraud investigations to dispute resolution, AI is becoming part of the day-to-day work of financial institutions. At the same time, new governance laws in states like Colorado and Texas are introducing new expectations around transparency, documentation, and oversight.
In a recent PaymentsJournal webinar, David Chmielewski, Chief Product Officer and Co-Founder at Quavo and Hailey Windham, Community Lead for Banking at Sardine.ai, along with Jennifer Pitt, Senior Fraud Analyst at Javelin Strategy & Research, explored where these new requirements intersect with existing workflows, and what organizations can do now to build AI programs that are both effective and compliant.
The key is transparency—not just to satisfy regulators, but to maintain customer trust.
Implementing Continuous Governance
One of the main ways AI is currently being leveraged is to help institutions manage the high volume of cases, alerts, disputes, and documentation they are often inundated. These use cases play to AI’s strengths, such as its ability to summarize cases and detect anomalies across vast amounts of data.
In short, AI is helping organizations cut through the noise so they can spend more time on critical tasks. But it isn’t fully autonomous yet.
“We’re using AI today for some of the things that we thought were never possible to automate,” Chmielewski said. “Things like looking at representment documents with lots of evidence and summarizing them; things like customer communication and making sure we can quickly sort through what we’re receiving.”
“We’re also using it for the investigation process, but not without a human in the loop,” he said. “The dream where we’re just handing everything off to AI and it’s doing everything for us is not quite yet realized, but we’ll see if we can get there eventually.”
The challenge is no longer simply implementing AI—it’s governing it. As regulators begin formalizing expectations around AI oversight, organizations must ensure their processes can support transparency and accountability.
For example, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), which took effect this year, prohibits harmful and intentionally unlawful uses of AI while encouraging organizations to adopt established risk management practices. It also creates a regulatory sandbox where companies can test AI systems under state oversight.
Colorado has taken a similar approach. After enacting the nation’s first broad AI law, lawmakers replaced it with the Automated Decision-Making Technology Act, a more practical framework scheduled to take effect next year.
“I compare this to the recent Nacha explainability requirement,” Windham said. “Those rules weren’t saying don’t use machine learning, they were saying if you’re making a decision that affects customers or your institution’s risk, you need to be able to explain it. We already understand that concept in payments and fraud.”
“The difference with AI is that the model can change over time,” she said. “With Nacha, if I document why my fraud model flagged an ACH transaction today, I generally expect the same logic to produce the same outcome tomorrow. But AI introduces model drift—the data changes, customer behavior changes, fraud tactics evolve, and in some cases the model can evolve. That means governance isn’t this one-time exercise; it’s continuous.”
The Transparency Disconnect
These regulations are a response to AI’s growing influence on customer-impacting decisions, and are intended to establish requirements for ongoing monitoring, testing, documentation, and oversight.
Unfortunately, there are likely to be disconnects between financial institutions’ current workflows and those envisioned by the new legislation. One of the biggest disconnects is that many organizations view AI primarily as a productivity tool, while regulators are focused on governance.
“If the tool influences whether a dispute is denied, whether an account is frozen, whether funds are delayed, or whether a customer is treated differently, regulators may see that as part of the decisioning process,” Windham said. “The disconnect is documentation. Teams may know the tool works, but they cannot always explain what data is used, why it recommended a certain action, how often humans override it, or whether outcomes are being monitored across those customer groups.”
Meeting these explainability requirements can quickly become challenging particularly as they extend to banks’ third-party partners. This makes it critical for banks to institute guardrails for vendors rather than simply relying on risk scores, as institutions will likely need to provide robust documentation showing how AI-assisted decisions were made.
As complex as banks’ external relationships may be, internal infrastructure can also present some challenges.
“A lot of mid-sized and smaller-sized banks are still very siloed,” Pitt said. “Fraud teams, AML teams, KYC teams, data teams—every team is siloed using separate systems and separate data. In that case, if teams are already siloed, who is responsible for the risk? Who’s responsible for the decision?”
“That’s something that banks are going to need to deal with before implementing some of these tools,” she said.
The Front Lines of Technology
Beyond compliance, AI deployments could have a considerable impact on consumer trust. Over the past few years, consumers have become increasingly interested in how banks use and protect their personal data. Likewise, many customers want to understand how their financial institutions leverages AI.
“We survey around 5,000 U.S. adults every year for our fraud and scam survey, and we asked them about fraud and scam concerns,” Pitt said. “We also asked them about what tools that they’re comfortable with banks using to help them protect against fraud. What we found is that consumers who are being told what AI is being used for, why it’s being used, and what places it’s being used for, they are more willing to allow their bank to use that technology to help them protect against fraud.”
This means banks should be transparent about whether customer data is used to train models, whether at specific points in the process or on an ongoing basis. Consumers should also be informed about how their data could be used to detect fraud, identify suspicious activity, or flag transactions.
Along with this transparency, it is important to implement tools that reduce false positives and minimize unnecessary friction. This is especially important during the dispute process, where institutions should ensure AI supports a fair, reasonable, and well-documented review rather than replacing human judgement.
The goal is to assure consumers that their institution has taken every possible step to both streamline and secure their banking experience.
“We’re all consumers,” Chmielewski said. “We all have bank accounts and credit cards, and I want my bank out there protecting me and using the coolest newest technology to do it. I know that scams exist, and I know that fraudsters are out there trying to get at my accounts.”
“That transparency can feel a little strange for an FI, but if you step outside the business and put yourself in the shoes of a consumer, they want you to be forthright and transparent,” he said. “I think we’d all agree as consumers, we want our banks being out there on the front lines using this technology, because fraudsters definitely are.”
Striking the Right Balance
As difficult as it can be to balance automation, compliance, and the customer experience, this challenge is only likely to grow. Although Texas and Colorado have pioneered AI legislation, 48 other U.S. states could ultimately introduce their own approaches—not to mention evolving global regulations and industry standards that may further shape AI governance.
This means banks’ AI systems and processes should be designed with compliance in mind from the beginning. A compliance-by-design approach also creates flexibility, allowing institutions to improve efficiency through AI while ensuring human judgment is applied where customer impact is greatest.
“Use AI to gather your evidence, summarize case histories, detect patterns, prepare recommended next steps, and even reduce that repetitive work,” Windham said. “But when the outcome effects access to funds or dispute rights, fraud, liability, or even account status, there needs to be clear oversight and explainability.”
The next step for organizations is to map where AI is being used, classify the risks associated with each use case, document the controls in place, and review customer-facing documentation. From there, they can build a comprehensive audit trail that prepares the organization for evolving regulations while protecting both the institution and its customers.
“My biggest advice would be to think of yourself as the customer and what they would like to see and how they would like to be treated,” Chmielewski said. “Communication, transparency, all of those things start to fall into place. You will often be on the right side of regulation, and you’ll be doing the right things for your business if you’re thinking of yourself as a customer and how they would like to be treated.”