July 14, 2026 · 10 min read

The AI security review for fintech AI startups: what bank and credit-union reviewers ask

You built an agent that runs KYC checks, drafts loan decisions, or works collections queues. A bank or credit union wants to buy it. Then their third-party risk team opens a review, and the deal goes quiet. If you have passed enterprise security reviews before, the bank version will still surprise you. It runs longer, it asks different questions, and the person reviewing you is not really evaluating your product. They are building a file they can defend to a federal examiner. Here is what they ask in 2026, what closes each question, and what to do about the controls you do not have yet.

Why bank vendor reviews are harder than enterprise reviews

Three things separate a bank's third-party risk review from the security review a tech company runs.

The reviewer has an examiner above them, and that changes what they can accept. The OCC, the Federal Reserve, or the FDIC examines banks. For credit unions it is the NCUA. The 2023 Interagency Guidance on Third-Party Relationships makes a bank responsible for managing the risk of your product as if it ran the product itself, and the NCUA sets similar expectations for credit-union vendor due diligence. Your missing control does not just worry the reviewer. It can become a finding in their next exam. So they document everything, re-review you annually, and will not accept "trust us" on anything they might one day show a regulator.

If your product influences credit decisions, you inherit model risk management. The Federal Reserve's SR 11-7 guidance (Guidance on Model Risk Management, 2011) defines how banks inventory, validate, and monitor models. An underwriting agent is a model under that definition whether you call it one or not. Expect questions about validation, performance monitoring, and change management that no enterprise buyer ever asked you.

The questionnaire grew an AI section.Risk teams have started copy-pasting the Cloud Security Alliance's AI-CAIQ, roughly 320 AI-specific questions with version 1.1 shipped in June 2026, into vendor packs on top of the banking questions. We wrote a separate guide on answering the AI-CAIQ. This article covers what is specific to banks and credit unions.

The practical result: founders report enterprise reviews taking weeks and bank reviews taking months, with annual re-review, right-to-audit clauses, exit-plan requirements, and a subprocessor list (banks call them fourth parties) you must keep current.

The five questions bank reviewers ask AI vendors

1. "Reconstruct this decline. Prove it was policy, not bias."

ECOA and Regulation B require creditors to give specific, accurate reasons for adverse action, and the CFPB has stated that the complexity of a model is not an excuse for failing to do so. Your buyer inherits that obligation for every decision your agent touches, and their fair-lending exam will test it after the fact.

So the reviewer asks a version of this: a year from now, an examiner picks one declined application. Can you produce the exact inputs the agent saw, the model and prompt version that ran, the policy rules it evaluated, the documents it retrieved, and the human who approved the outcome, and show that none of it was altered since?

A chat transcript in your own database does not answer this. You can edit your own database. What answers it is a decision record with integrity the bank can verify: hash-chained or otherwise tamper-evident, with the model version and policy snapshot captured at decision time.

2. "What credentials do your agents hold in production?"

Many agent products hold standing credentials: a database password, a core-banking API key that lives in an environment variable and never expires. Reviewers probe this hard, because an agent that reads untrusted input (emails, uploaded documents, web content) while holding a standing credential is a prompt-injection to data-exfiltration path.

Expect these follow-ups: What scope does each credential have? What is its lifetime? Can the model read the raw secret, or does something swap it in at the boundary? What happens when a credential is compromised, and how would you know? The answer they want: scoped, short-lived tokens issued per task, the raw secret never visible to the model, issuance and use logged.

3. "Trace this action back to a decision."

This is distinct from reconstructing a decline. Traceability means every consequential action, a data read, a payment initiated, a letter sent, a status change, is attributed to a named agent identity and tied to the request that triggered it and the human or policy that authorized it. When something goes wrong, the bank must rebuild the chain in hours instead of weeks. If your agents act through one shared service account, this question fails.

4. "How do you enforce FDCPA and fair-lending rules on what the agent does?"

If you sell collections automation, the FDCPA governs when your agent may contact a consumer, who it may speak to, and what it may say. If you sell underwriting or origination, fair-lending law governs what inputs the model may use and requires monitoring outcomes for disparate impact.

The question underneath is: where does the rule live? A line in the system prompt asking the model to comply is a hope, not a control. Reviewers ask whether an out-of-policy action gets blocked before it executes, whether the block is logged, and whether you can point to the enforcement layer in your architecture. They have started pushing back on prompt-level compliance by itself. An action layer that refuses and logs the refusal is the answer that holds up.

5. "Can it run inside our network?"

Many banks and credit unions will not send customer or member PII to a multi-tenant SaaS that forwards it to a third-party model API. So they ask: can you deploy in our VPC or on-prem? What leaves the network boundary, exactly? Which subprocessors see data? Can inference run locally?

If you are cloud-only today, say so and be precise about data flows. But know that "runs inside your network" collapses a large part of the review: no fourth-party data-sharing analysis, no cross-border questions, a much shorter data-flow section.

What evidence actually satisfies

One pattern covers almost every question: policy documents describe intent, runtime records prove behavior. Reviewers rank evidence accordingly.

The single highest-trust move is handing evidence over before anyone asks. A reviewer who receives a prepared pack reads you as a vendor who has done this before, and reviewers extend credit to vendors who make their exam file easy to build.

The honest-gap playbook

You will not have everything, and bank reviewers know small vendors never do. Gaps do not kill deals. Overstatements discovered later do, because the bank re-reviews you annually and often holds a contractual right to audit. A caught overstatement lands on the reviewer's desk when the examiner comes back, and they will not forgive you for that.

Write every gap in three lines: current state, compensating control, date.

Never write a remediation date you will not hit. The annual re-review checks it, and a missed date you never mentioned again reads like the overstatement it is.

Build a standing evidence pack

Answering each bank's questionnaire from scratch pulls engineers off the roadmap for weeks per deal. A standing pack, maintained like code and handed to every reviewer, gets that time back:

Update it quarterly and on any architecture change. The pack pays for itself on the second review and makes the annual re-review a quick diff. If you want a starting point, we published the 20 questions the AI section will ask you as a free reference.

FAQ

How does a bank or credit-union vendor review differ from a regular enterprise security review?

The reviewer answers to a federal examiner: the OCC, Federal Reserve, or FDIC for banks, the NCUA for credit unions. The 2023 interagency guidance on third-party relationships makes a bank responsible for a vendor's risk as if the risk were its own. That means longer reviews, annual re-review, right-to-audit clauses, subprocessor scrutiny, and documentation the institution can show a regulator years later.

What does 'prove the decline was policy, not bias' require in practice?

A reconstructable decision record: the exact inputs the agent saw, the model and prompt version that ran, the policy rules it evaluated, and the human or policy that authorized the outcome, stored in a form the bank can verify was not altered. US creditors must give specific, accurate reasons for adverse action under ECOA and Regulation B, and your buyer inherits that duty for every decision your agent touches.

Will a bank accept agents that hold standing production credentials?

Increasingly no, at least not without compensating controls and a remediation date. An agent that reads untrusted input while holding a long-lived credential is a prompt-injection to data-exfiltration path. Reviewers probe credential scope, lifetime, and whether the model can see the raw secret. Scoped, short-lived, per-task tokens are becoming the expected answer.

Does SOC 2 cover what bank reviewers ask about AI agents?

No. SOC 2 covers organizational security controls: access management, change control, incident response. It says nothing about model versioning, agent credentials, decision traceability, or fair-lending overlays on agent actions. Banks ask for SOC 2 and the AI-specific evidence on top.

What if we cannot run inside the bank's network yet?

Say so precisely. Describe exactly what data leaves the boundary, which subprocessors see it, and whether inference calls a third-party model API. Put self-hosted deployment on a dated roadmap if you plan it. Overstating deployment options is worse than the gap, because bank contracts often include audit rights and the claim will be checked.

How long does a bank AI-vendor review take?

Founders report months: due diligence, security review, contract negotiation with audit and exit clauses, and sometimes a separate model-risk workstream if the product influences credit decisions. Then it repeats annually. A prepared evidence pack shortens the first pass, and each re-review after that gets cheaper.

Want to know where you stand before a bank asks? Run the free 2-minute readiness checker. If a review is already blocking a deal, the AI Security Review Kit turns a 30-minute intake into the full answer pack, mapped to the AI-CAIQ, NIST AI RMF, and ISO 42001.

Written by Dmitrii Karataev. Twenty years in infrastructure and security. Corrections welcome: hello@daylite.ai.