Unleashing AI Innovation in Financial Services Act

This Act may be cited as the Unleashing AI Innovation in Financial Services Act.
In this section:
The term AI test project means a financial product, service, or activity—
that falls under the jurisdiction of a financial regulatory agency;
that makes substantial use of artificial intelligence;
that is, or may be, subject to a Federal regulation or Federal statute; and
for which a regulated entity submits an application for the waiver or modification of an applicable regulation subject to an alternative compliance strategy.
The term appropriate financial regulatory agency means—
the appropriate Federal banking agency, as defined in section 3 of the Federal Deposit Insurance Act (12 U.S.C. 1813), with respect to an institution described in subsection (q) of that section;
the Securities and Exchange Commission, with respect to an institution not described in subparagraph (A) that is—
any broker or dealer that is registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any investment company that is registered with the Commission under the Investment Company Act of 1940 (15 U.S.C. 80a–1 et seq.);
any investment adviser that is registered with the Commission under the Investment Advisers Act of 1940 (15 U.S.C. 80b–1 et seq.);
any clearing agency registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any nationally recognized statistical rating organization registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any transfer agent registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any exchange registered as a national securities exchange with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any national securities association registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
any securities information processor registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
the Municipal Securities Rulemaking Board established under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
the Public Company Accounting Oversight Board established under the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7211 et seq.);
the Securities Investor Protection Corporation established under the Securities Investor Protection Act of 1970 (15 U.S.C. 78aaa et seq.); and
any security-based swap execution facility, security-based swap data repository, security-based swap dealer, or major security-based swap participant registered with the Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
the Bureau of Consumer Financial Protection, with respect to a covered person, as defined in section 1002 of the Consumer Financial Protection Act of 2010 (12 U.S.C. 5481), that does not have an appropriate financial regulatory agency under subparagraph (A), (B), (D), or (E) of this paragraph;
the National Credit Union Administration, with respect to an insured credit union, as defined in section 101 of the Federal Credit Union Act (12 U.S.C. 1752); and
the Federal Housing Finance Agency, with respect to—
a Federal Home Loan Bank;
the Federal Home Loan Bank System;
the Federal National Mortgage Association; and
the Federal Home Loan Mortgage Corporation.
The terms artificial intelligence and AI have the meaning given the term artificial intelligence in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).
The term Commission means the Securities and Exchange Commission.
The term Federal securities laws means—
the Securities Act of 1933 (15 U.S.C. 77a et seq.);
the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.);
the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7201 et seq.);
the Trust Indenture Act of 1939 (15 U.S.C. 77aaa et seq.);
the Investment Company Act of 1940 (15 U.S.C. 80a–1 et seq.);
the Investment Advisers Act of 1940 (15 U.S.C. 80b–1 et seq.);
the Jumpstart Our Business Startup Act (Public Law 112–106; 126 Stat. 306); and
the Dodd-Frank Wall Street Reform and Consumer Protection Act (Public Law 111–203; 124 Stat. 1376).
The term financial product, service, or activity—
includes—
a financial product or service, as defined in section 1002 of the Consumer Financial Protection Act of 2010 (12 U.S.C. 5481);
activities that are financial in nature, as defined in section 4(k)(4) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)(4));
any financial product or service provided by a person regulated by the Commission, as defined in section 1002 of the Consumer Financial Protection Act of 2010 (12 U.S.C. 5481); and
the offer or sale of any security subject to the Federal securities laws;
includes any internal activity of a regulated entity that is carried out in furtherance of the offering or sale of a product, service, or activity described in subparagraph (A); and
does not include the business of insurance, as defined in section 1002 of the Consumer Financial Protection Act of 2010 (12 U.S.C. 5481).
The term financial regulatory agency means—
the Board of Governors of the Federal Reserve System;
the Federal Deposit Insurance Corporation;
the Office of the Comptroller of the Currency;
the Securities and Exchange Commission;
the Bureau of Consumer Financial Protection;
the National Credit Union Administration; and
the Federal Housing Finance Agency.
The term regulated entity means an entity regulated, or insured in the case of a credit union, by any financial regulatory agency.
Each financial regulatory agency shall establish, or identify an office, division, or department of the agency that shall serve as, an AI Innovation Lab to enable regulated entities to experiment with AI test projects without unnecessary or unduly burdensome regulation or expectation of enforcement actions, including enforcement actions that disincentivize the substantial use of artificial intelligence to enhance regulatory compliance practices, pursuant to the approval of an application under section 4.
Beginning one year after the date of enactment of this Act, a regulated entity may submit to the appropriate financial regulatory agency an application, on a form determined by the appropriate financial regulatory agency, to engage in an AI test project through an AI Innovation Lab.
An application submitted under paragraph (1) shall include—
a description of the AI test project proposed to be carried out by the regulated entity, including—
the type and capabilities of the relevant AI technologies, systems, and applications; and
the purposes and goals of the AI test project;
an alternative compliance strategy that—
identifies a regulation issued by a financial regulatory agency that the regulated entity requests to be waived or modified;
proposes an alternative method for the regulated entity to comply with the Federal statute under which the regulation identified in clause (i) is promulgated and the purpose of such regulation, including an explanation as to why the alternative method is essential to the operation of the regulated entity and how the regulated entity would effectively manage risks, including cybersecurity risks, associated with the AI test project;
describes applicable plans and policies related to risk assessments, testing, controls, documentation, and monitoring and their role in managing risks described under clause (ii); and
contains policies for the regulated entity to maintain, consistent with applicable law, cybersecurity standards, and contractual limitations and obligations, records of the activities of the AI test project, so long as such policies do not require the regulated entity to maintain any records that the regulated entity is not permitted to maintain pursuant to another law or any contractual limitation or obligation;
an explanation of how under the strategy described in subparagraph (B), the AI test project—
would serve the public interest, improve consumer or investor access to a financial product, service, or activity, or promote consumer or investor protection;
would enhance efficiency or operations, foster innovation or competitiveness, improve risk management and security, including cybersecurity, or enhance regulatory compliance;
would not present—
a significant risk of loss to the Deposit Insurance Fund or the National Credit Union Share Insurance Fund where the regulated entity is an insured depository institution or insured credit union; or
a systemic risk to the financial system of the United States;
is consistent with the purposes of the anti-money laundering and countering the financing of terrorism obligations under subchapter II of chapter 53 of title 31, United States Code; and
would not present a national security risk to the United States;
a proposed date on which the AI test project would terminate and an explanation why such termination date would be appropriate;
proposed limitations on the size, scope, and growth of the AI test project;
a detailed business plan; and
an estimate of the economic, market, operational, and public interest impact of the AI test project if approved.
Two or more regulated entities may submit a joint application to the same financial regulatory agency under paragraph (2).
Notwithstanding paragraph (2), a regulated entity may submit an application under this subsection for an alternative compliance strategy for a regulation issued or enforced by a financial regulatory agency that is not the appropriate financial regulatory agency for the regulated entity.
An application described in subparagraph (A) shall be subject to the same requirements as an application described in paragraph (2), except that—
the regulated entity shall submit the application to—
the appropriate financial regulatory agency; and
any other financial regulatory agency that—
issued the regulation that is the subject of the alternative compliance strategy and has jurisdiction over the regulated entity with respect to such regulation; or
enforces the regulation that is the subject of the alternative compliance strategy with respect to the regulated entity; and
the AI test project may not take effect unless the application is jointly approved by—
the appropriate financial regulatory agency; and
each other financial regulatory agency described in clause (i)(II).
A regulated entity that is regulated by, or subject to regulations that are enforced by, more than 1 financial regulatory agency shall provide notice of any application submitted to the appropriate financial regulatory agency under this section to each such financial regulatory agency not later than 5 business days after the regulated entity submits the application to the appropriate financial regulatory agency.
A financial regulatory agency that receives a notice under paragraph (5) with respect to an application regarding a regulation that such agency issued or enforces may, within 30 days of receiving such notice, issue a notice of intervention to the regulated entity and the appropriate financial regulatory agency of such regulated entity.
If a financial regulatory agency issues a notice of intervention described in subparagraph (A), the applicable AI test project may not take effect unless such financial regulatory agency, jointly with the financial regulatory agencies described in paragraph (4)(B)(ii), approves the application.
Except as provided in subparagraph (D), not later than 120 days after the date on which a complete application is received by a financial regulatory agency under this subsection, the financial regulatory agency shall—
review the application and assess, to the extent reasonably practicable, the applicant’s ability to satisfy the standards described in subparagraphs (B) and (C) of paragraph (2); and
submit to the applicant in writing a determination of the agency.
If the applicant shows that it is more likely than not that the application meets the requirements for establishing an alternative compliance strategy and satisfies the standards described in subparagraphs (B) and (C) of paragraph (2), the financial regulatory agency shall approve the application and notify the applicant in writing of—
the regulation that is the subject of the alternative compliance strategy;
the terms of the alternative compliance strategy for the AI test project;
the date on which the AI test project will terminate;
any limitations on the size, scope, or growth of the AI test project; and
any additional limitations or conditions on the AI test project, as determined by the financial regulatory agency.
With respect to an AI test project, beginning on the date on which an application submitted under paragraph (1) is approved and ending on the date described in clause (i)(III)—
the appropriate financial regulatory agency may enforce a regulation described in clause (i)(I) only in the manner set out in the alternative compliance strategy described in clause (i)(II), subject to limitations or conditions described in subclauses (IV) and (V) of clause (i); and
except as provided in clause (iii), a financial regulatory agency that is not the appropriate financial regulatory agency may not enforce a regulation described in clause (i)(I).
With respect to an AI test project, a financial regulatory agency other than the appropriate financial regulatory agency may enforce a regulation described in clause (i)(I) if—
such other financial regulatory agency issued or enforces such regulation;
the approval of such other financial regulatory agency was required for the AI test project under paragraph (4)(B)(ii)(II) or (6)(B); and
the alternative compliance strategy described in subclause clause (i)(II) provides for enforcement by such other financial regulatory agency.
If a financial regulatory agency denies an application, the financial regulatory agency—
shall submit to the applicant a written notice explaining the reason for denial; and
may not take an enforcement action related to the proposed AI test project against the applicant earlier than the date that is 30 days after the date on which the financial regulatory agency submits such written notice.
Each time an application submitted under paragraph (1) is denied, the regulated entity—
may submit an amended application after receiving feedback from the financial regulatory agency making such denial; and
may not resubmit more than 2 applications that are substantially similar to the denied application.
Notwithstanding clause (i)(II), a financial regulatory agency, by and through its own attorneys, may file a civil action in an appropriate United States district court to enjoin an active AI test project if the financial regulatory agency determines that the AI test project—
presents an immediate danger to consumers or investors; or
presents a risk—
to financial markets;
in the case of an AI test project engaged in by an insured depository institution or an insured credit union, of loss to a Federal deposit or share insurance fund;
of a violation of anti-money laundering and countering the financing of terrorism obligations under subchapter II of chapter 53 of title 31, United States Code; or
to the national security of the United States.
Nothing in clause (iv) shall be construed to limit a financial regulatory agency’s authority to issue an administrative order to cease the activity of an active AI test project where the agency determines such activity is causing unmitigable or irreparable harm to consumers, investors, or financial stability.
If a financial regulatory agency determines additional time is needed to make a determination on a complete application received under this subsection, the financial regulatory agency may extend the 120-day deadline by one additional 120-day period. If the financial regulatory agency does not approve or deny the application by the end of the initial 120-day period (or the 240-day period, in the case of extension), the financial regulatory agency shall be deemed to have approved the application.
During the applicable 120-day determination period (or the 240-day period, in the case of extension), a financial regulatory agency may request additional information from the regulated entity.
Nothing in subparagraph (B) or (C) may be construed to limit the authority of a financial regulatory agency to take an enforcement action against a regulated entity with respect to fraud or market manipulation or for engaging in an unsafe or unsound practice.
All data supplied by sponsors of AI test projects to a financial regulatory agency submitted under this section shall be stored and maintained in a secure manner by the financial regulatory agency, consistent with applicable data security standards.
Not later than 180 days after the date of enactment of this Act, each financial regulatory agency shall promulgate regulations implementing this Act that—
shall be published in the Federal Register and provide a 60-day period for public notice and comment; and
include—
procedures for submitting applications for AI test projects and for modifying the AI test projects that are approved by the agency;
consequences for failure to comply with the terms of an alternative compliance strategy;
a requirement that an AI test project will include a specified termination date;
procedures to extend the termination date described in clause (iii) for a specified time period;
requirements for regulated entities to report the status and progress of AI test projects at a frequency reasonably necessary for carrying out this Act and the rules promulgated thereunder;
requirements for regulated entities to make disclosures reasonably appropriate to inform consumers or investors regarding any direct interaction with an AI test project, which shall be tailored to the scale, scope, and risks thereof and describe the nature of the AI test project and its applicable alternative compliance strategy;
procedures for maintaining, as appropriate and consistent with applicable law, the confidentiality, security, and privacy of information;
consideration of the type and capabilities of proposed AI test projects’ relevant AI technologies, systems, and applications in the development of applicable guidance and requirements;
procedures for assigning appropriate personnel to serve as liaisons and points of contact for regulated entities with approved AI test projects; and
procedures for coordinating decisions relating to applications submitted jointly by multiple regulated entities or applications submitted to more than one financial regulatory agency.
The financial regulatory agencies shall consult, share information, and coordinate, and may enter into a joint memorandum of understanding, in order to—
facilitate any joint approvals of applications;
understand and establish best practices with respect to—
AI innovation Labs;
promulgating and updating guidance and rules related to financial products, services, and activities that make substantial use of artificial intelligence based on the lessons learned from AI test projects; and
AI test project applications, approvals, alternative compliance methods, conditions, terms, reporting, disclosures, oversight, and guidance; and
avoid unnecessary, duplicative, or conflicting processes or efforts with respect to AI test project applications, approvals, reporting, and disclosures.
Not later than 2 years after the date of enactment of this Act, and each year for 7 years thereafter, each financial regulatory agency shall submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives an annual report on the outcomes of AI test projects. A report under this subsection shall include aggregated findings, trends, and lessons learned from the AI test projects.
A report under this section—
may not include the names of participating entities or any proprietary or confidential business information; and
where appropriate, may contain a classified annex.