The five banking AI chat tiers
Tier 0: Public website FAQ
Branch hours, ATM locations, product info. Lowest risk, easiest to ship.
Tier 1: Authenticated servicing
Balance, recent transactions, statement download. Behind SSO + step-up auth.
Tier 2: Transactional
Transfers, bill pay, card lock. Requires hard step-up + transaction signing.
Tier 3: Lending intake
Mortgage prequal, auto loan, personal loan. Bot collects ECOA-compliant data, hands to underwriter.
Tier 4: Agent assist
Bot embedded in CSR/banker UI surfaces policy answers + customer history during live calls.
Most banks should ship Tier 0 + Tier 4 first. They have the highest deflection and the lowest regulatory surface area.
The compliance baseline
- FFIEC IT Exam Handbook (2024 update): third-party AI vendors fall under Outsourcing Technology Services. Vendor due diligence is required.
- OCC Bulletin 2023-17: AI risk management, model risk, fair-lending impact, explainability.
- GLBA Safeguards Rule: NPI must be encrypted at rest + in transit; access logged.
- Reg E (Electronic Funds Transfer): dispute flows must meet 10/45-day windows. Bot can't obstruct dispute initiation.
- BSA/AML & OFAC: bot interactions are records; sanctions screening on any name/address collected.
- ADA Title III: chat must be accessible to screen readers (WCAG 2.1 AA).
- State privacy laws: CCPA/CPRA in California, plus 11+ other state laws by 2026.
Architecture diagram (in words)
User → SSO + step-up auth → Chat front-end → API gateway with rate-limit + DLP → Orchestrator (intent + tool routing) → RAG layer (carrier policy docs only, no internet) + Tool layer (core banking, card processor, statements) → LLM (model-data separation, no training) → Output filter (PII masking, regulated topic gates) → Audit log (7+ year retention, immutable).
Every hop is logged. Every answer cites the source doc.
Integration with banking systems
Core systems
- Fiserv DNA / Premier
- Jack Henry SilverLake
- FIS Horizon / IBS
- Temenos T24
Adjacent systems
- Salesforce Financial Services Cloud
- nCino (lending)
- Q2 / Alkami (digital banking)
- NICE / Verint (contact center)
The ROI math regulators will accept
What examiners look for
- A documented AI use-case registry with model cards.
- Quarterly fair-lending impact testing, does the bot disadvantage any protected class?
- An incident response plan for AI-specific failures (hallucination, prompt injection).
- A change management process when prompts or models change.
- SOC 2 Type II + ISO 27001 on the vendor.
- Evidence of red-team testing, at least annually.
The take
Banking AI chat is achievable and increasingly expected by customers, but it requires the discipline of a Model Risk Management program from day one. Pick a vendor that ships SOC 2, supports model-data separation, and has prior bank deployments. Start with Tier 0 + Tier 4. Expand on quarterly cadence with examiner-ready documentation. See also AI chatbots for fintech and security best practices.
Keep reading
What to read next
- E-commerceHoliday Return Policy 2026: Template and Examples 13 min
- Local servicesSmall Business Saturday 2026: A Local Shop Plan 13 min
- E-commerceHoliday Shopping 2026: The Numbers to Plan Around 12 min
Popular:Website AI chatbotFree AI chatbot for your websiteAI chatbot for small businessNo-code AI chatbotWhat is an AI chatbot?Best AI chatbot platforms
Bank-grade AI chat
Model-data separation and audit logging. EzyConn Enterprise.
Book a compliance review