June 2025 Summaries

This AI adoption checklist provides a comprehensive framework for banks and credit unions to integrate AI tools while ensuring compliance with relevant policies and regulations. It addresses the high usage of generative AI among knowledge workers, many of whom would resist discontinuing its use, even if banned, and highlights the prevalence of unapproved AI tool usage in the workplace. The checklist outlines steps for establishing a governance structure, including forming an AI governance committee and developing corporate AI policies. It emphasizes evaluating technology for compliance, security, privacy, cost, and deployment options. Risk management strategies involve auditing AI use, implementing data protection measures, and restricting access to authorized users. The checklist also stresses the importance of employee training, initial pilot deployments, monitoring and optimization of AI usage, and scaling adoption across the organization. Continuous evolution through regular policy reviews, monitoring regulatory changes, conducting ethics reviews, and fostering knowledge sharing is encouraged to maintain effective AI integration and enhance business impact.

Throughout 2022-23, the SEC and CFTC imposed $2 billion in fines on banks and investment managers for unauthorized use of WhatsApp, highlighting regulatory concerns about unsanctioned technology use. By 2025, similar risks arise with unsanctioned AI usage, prompting regulatory bodies such as the OCC, CFPB, and NCUA to issue notices on AI governance and compliance. The Trump administration's 2025 memo M-25-21 emphasizes AI governance for federal agencies, indicating AI regulation as a priority. The OCC and CFPB have expressed concerns about AI's "emerging risk," requiring banks to manage AI responsibly and avoid discriminatory practices. To mitigate AI compliance risks, financial institutions must navigate data privacy, unmonitored AI interactions, unsupervised AI decisions, and bias in AI outputs. Proactive measures include conducting AI usage audits, implementing approved AI channels, developing phased AI implementation plans, forming AI governance committees, and engaging regulators early. As regulators maintain that existing standards apply to AI, financial institutions are urged to adopt robust control frameworks to prevent costly enforcement actions, ensuring responsible AI innovation and compliance with existing regulations.