Regulatory oversight of artificial intelligence in the financial sector is tightening significantly. On September 16, 2026, the Conference of State Bank Supervisors (CSBS), which represents state banking regulators across the United States, released its official Artificial Intelligence Supervisory Framework. The framework provides state bank examiners with actionable tools to inspect and evaluate algorithmic risks at state-chartered banks and nonbank financial institutions.
This state-level initiative directly addresses a widening regulatory void. While established model risk management guidelines from federal agencies such as the Federal Reserve, the OCC, and the FDIC cover conventional statistical models, they have left generative and agentic systems largely unaddressed. The CSBS framework fills this void through three practical components: a Core Examiner Guide, a Risk-Tiering Worksheet for categorizing use cases, and a specialized Nonbank AI Supplement.
The Nonbank AI Supplement is particularly consequential for modern financial ecosystems. Many regional lenders and financial institutions rely heavily on fintech partners for credit scoring, underwriting, and payment processing, outsourcing critical analytical workflows. The new framework instructs examiners to scrutinize third-party model risks and governance at these nonbank partners. If an external vendor utilizes black-box models or fails to document data provenance, the regulated institution faces formal supervisory remediation.
The urgent need for updated supervisory mechanisms was reinforced on September 18, 2026, by the Bank for International Settlements (BIS). Speaking at a Cambridge University conference on digital regulation, Fernando Restoy, chairman of the Financial Stability Institute (FSI) at the BIS, warned against fundamental blind spots in current regulatory approaches. Restoy argued that authorities can no longer focus solely on internal enterprise use cases within single banks, but must prepare for systemic vulnerabilities across an entire financial system reshaped by autonomous algorithms.
Restoy emphasized that while foundational pillars such as capital and liquidity buffers remain essential, they cannot independently absorb the risks of real-time algorithmic contagion. Autonomous agents operating at millisecond speeds can trigger simultaneous asset liquidations and liquidity drains during volatile periods. To prevent cascading failures, the BIS leadership advocated for complementary real-time stress testing capable of capturing automated, network-wide shocks.
These coordinated signals from US state authorities and international standard-setters establish clear expectations for financial institutions. Banks and fintechs must now upgrade their model risk frameworks, document automated decision paths, and demonstrate strict oversight over partner models. The period of informal experimentation with advanced AI in financial services has officially come to a close.