Recent OCC and FDIC Enforcement Trends: What they signal for AI, lending and compliance
Jan. 2026 · Authored by Cicrim Regulatory Insights Team
While every enforcement action has its own facts, recent OCC and FDIC cases share familiar themes: Weak governance over new products and technologies, inconsistent treatment of customers, and gaps in third-party and data controls. For AI-enabled banks, these themes are directly relevant to model deployment, vendor selection and day-to-day operations.
Relevant themes
Theme
Governance gaps
Boards and risk committees lack timely, clear reporting on emerging risks, including technology and third-party exposures, so problems often surface late as supervisory issues.
Theme
UDAAP & fair lending
Inconsistent practices across products, channels or partners lead to allegations of unfair, deceptive or discriminatory outcomes for consumers and small businesses.
Theme
Third-party risk
Oversight of fintech and vendor relationships used for marketing, onboarding, servicing or collections is often shallow, especially when partners control key customer interactions or algorithms.
Theme
Data & model controls
Controls around data quality, model validation and documentation remain weak, particularly where advanced analytics or AI models drive credit, pricing or servicing decisions.
What banks can do in the next 90 days
You don’t need a multi-year program to respond to these trends. Focused, incremental actions can materially reduce risk and demonstrate proactive governance to regulators.
Map recent OCC and FDIC themes directly to your products, channels and partners. Use a single view so executives and the board can see where enforcement risk is concentrated and which actions are already underway.
Focus testing on digitally originated and partner-enabled portfolios where AI or complex rules are used. Make sure methodologies and documentation connect clearly back to the themes from recent enforcement actions.
Reassess oversight of critical vendors and fintech partners, particularly those supporting marketing, onboarding, decisioning or collections. Confirm that monitoring, reporting and contract terms align with your risk appetite.
For high-impact AI and rules-based tools, verify that documentation, validation and monitoring align with your model-risk standards. Capture explainability, overrides and challenger results in a way examiners can easily follow.
Ensure that emerging technology, AI and third-party risks show up alongside traditional credit, liquidity and operational risk in board and committee packs, with explicit links to your risk appetite and enforcement themes.
Related insights
Regulatory compliance for mid-sized banks
How one institution modernized compliance workflows and reporting in response to evolving expectations around technology and third-party risk.
AI adoption & supervisory expectations
Research on how supervisors are approaching AI use and what that means for your governance roadmap.
Digital lending and UDAAP risk
Practical guardrails for marketing, underwriting and collections in digital channels, aligned with fair-lending and UDAAP expectations.
AI-Powered Decisioning
Modernize high-impact decisions with explainability, policy controls, and reviewable evidence.
Want help mapping enforcement trends to your risk program?
Cicrim can facilitate a focused session with your leadership team to translate public OCC and FDIC actions into a prioritized improvement roadmap for your institution, across governance, fair-lending, third-party risk and AI model oversight.