Keeping up with changes in regulations and guidance can be a difficult task for a new compliance professional, especially in smaller institutions that don’t have a large compliance department. It can be difficult reading through new regulations and guidance to figure out how to respond. In this article we’ll walk the new compliance professional through a recent piece of guidance, and advise on what a good approach would be for that new compliance professional to respond.

On June 7, 2023 the CFPB published a Spotlight and blogged about financial institutions and their use of AI and chatbots. In this blog the CFPB touches upon the risk involved with using chatbots, especially from a UDAAP perspective. What the CFPB doesn’t do, however, is release or discuss any new laws or regulations. The new compliance professional may ask, “I’m not sure what to do with this… how do I respond? There isn’t anything in here that’s new.” That compliance professional would be correct, however, there is much to do, starting with what is known.
We know that the CFPB is discussing existing laws, regulations, and guidance on a newer (or at least focused) topic, which is the use of chatbots. To respond to this, the compliance professional should:

1. Gain an understanding of how and where the institution is using chatbots or chatbot-like technology. Include in this any project where chatbots or chatbot-like technology is even being considered.
2. For each item above, ensure that all risks are identified and discussed. If there are projects in flight that the compliance professional wasn’t aware of, that’s an issue right there. Risks need to be identified and discussed at the planning stage of projects, not toward the end. Remind the line of business leaders that the compliance professional needs to be involved.
3. For each item above, ensure that adequate testing is being performed. Ensure that testing isn’t designed just to spot failure and erroneous information being provided, but also to spot endless loops the consumer can’t exit, or the provision of choices for the consumer to click on that don’t reflect the consumer’s situation but force the consumer to select something they don’t wish to select. Frustration and stress in the process is viewed negatively by the CFPB.
4. Provide updated training on the compliance risks associated with using chatbots or chatbot-like technology.
5. Consider updating the Complaint intake form to have an identifier for whether the complaint involves the consumer’s interaction with a chatbot or chatbot-like technology.

So, while no new guidance was presented on June 7^th by the CFPB, there is plenty for the compliance professional to do to evidence the compliance function understood and responded to the Spotlight and blog.