Data-driven disruption

The Consumer Financial Protection Bureau’s open banking proposal doesn’t go far enough to protect sensitive consumer financial data, the Bank Policy Institute and The Clearing House said in a comment letter submitted in December.

The CFPB unveiled the long-awaited proposal in October. The consumer watchdog asserts the rule will give consumers greater control over their financial data by requiring banks to share such data with third parties like fintechs. 

To comply with the rule, banks would be required to make personal financial data available at no charge to consumers through “safe, secure, and reliable” digital interfaces, the CFPB said.

However, groups like the BPI and TCH, say the rule should apply not just to banks but to all third parties and data aggregators, and to all data.

“Our members welcome the competition brought about by innovative financial technology firms and are prepared to support the ability of bank customers to connect their bank accounts to the third-party apps of their choice, but such competition cannot come at the expense of data security,” the associations wrote in their letter. “It is critical that consumers’ personal and financial information remains secure when it is shared between financial institutions and third parties and when it is stored outside of the financial institution.”

The proposal seeks to move the market away from screen scraping, a practice the CFPB and some industry stakeholders have labeled a “risky data collection practice.” 

Screen scraping often requires consumers to share their usernames and passwords with third parties.

In the letter, the groups called on the CFPB to take a stronger stance against screen scraping by prohibiting the practice once a data provider has made a developer interface available.

The associations also asked the CFPB to impose direct requirements on authorized third parties and data aggregators and articulate its intent to supervise those entities for compliance.

The watchdog should also clearly define liability, the groups wrote.

“Aggregators and other data recipients should be liable for unauthorized transactions or failing to protect consumer data once data is within their possession,” they wrote. 

Data providers, or banks, should also be allowed to receive compensation from third parties to cover the cost of enabling data sharing, they said.

“By prohibiting only data providers from charging fees, the proposed rule arbitrarily distorts the marketplace and creates an unfair allocation of benefits to data aggregators and an unrecoupable cost to data providers,” the associations wrote. 

The CFPB has acknowledged the burden that complying with the rule would impose on some of the nation’s smallest banks. 

Smaller institutions may lack the tools and funds to build interfaces in compliance with the rule, the CFPB said.

As a result, the requirements of the rule would be implemented in phases, the bureau said.

The rule’s tiered compliance dates start at six months for the largest banks and fintechs, and extend to four years for the smallest firms, senior CFPB and administration officials said in October.

In its own comment letter, the Consumer Bankers Association highlighted its concerns with the costs and responsibilities that would be imposed on banks under the rule’s current form.

“[The] CBA is concerned by the general trend toward shifting many costs and responsibilities, including the monitoring of certain market participant behavior, onto data providers, including banks,” the trade group wrote. 

In addition to banning screen scraping, the group also called for third parties and data aggregators to certify they will accept liability in instances in which a consumer’s credentials are misused to initiate a fraudulent transaction.

“Mandate third parties and data aggregators be adequately capitalized and carry sufficient indemnity insurance to satisfy liability obligations, and also obligate third parties to certify as part of the certification statement that they are adequately capitalized, have accepted their liability obligations, and are carrying sufficient indemnity insurance,” the CBA wrote.

The American Bankers Association, meanwhile, called for the CFPB to remove the proposal’s prohibition of fees, and to “take a more active role in managing the data sharing ecosystem it is creating, while affording data providers flexibility to manage risk and prevent fraud.”

“ABA supports consumers’ right to access their financial information securely, transparently, and subject to their control,” the trade group wrote. “At the same time, it is essential that all participants in the data sharing ecosystem are held to the same high standards as banks in areas such as keeping consumers informed, resolving disputes, and so on. We appreciate the CFPB’s efforts to preserve the best parts of the market-led data sharing ecosystem while seeking to implement guardrails to protect consumers and market participants.”

Congress granted the CFPB the authority to establish the rule more than a decade ago under Section 1033 of the Dodd-Frank Act.

CFPB Director Rohit Chopra said the rule will help accelerate the U.S.’s shift to open banking, aligning the nation more closely with guidelines in place or under consideration in major jurisdictions around the world.

The CFPB said it plans to finalize the rule by the fall.

As use of Bank of America’s virtual assistant Erica balloons, the bank is continually fine-tuning and feeding the tool new information to better respond to customer inquiries.

That’s according to Nikki Katz, Bank of America’s head of digital, who oversees the team that supports the bank’s mobile app and website, as well as AI-powered Erica. 

Since Erica’s 2018 launch, the bank’s virtual assistant has been used more than 2 billion times, and it’s responded to 800 million inquiries from about 42 million clients, the bank said in a release in April. In light of its popularity with clients, Bank of America has sought to integrate the tool more deeply into the bank’s digital functions. 

Katz declined to comment on how much the Charlotte, North Carolina-based lender has invested in Erica to date. The bank plans to spend $3.8 billion on technology initiatives in 2024, CEO Brian Moynihan said in October. Bank of America aims to take a thoughtful, controlled approach to AI while searching for more areas where Erica can provide benefit, Katz said during an interview.

“Services like Erica — and, in general, all of our digital experience — are a big part of why people stay once they're here,” Katz said of client satisfaction. “It is definitely a big part of retention.”

Editor’s note: This interview has been edited for clarity and brevity.

BANKING DIVE: Why do you think Erica is resonating with the bank’s customer base?

NIKKI KATZ: Erica is really almost a gateway to client servicing, connecting clients to products and services, making it easier to access those products and services, simplifying and basically connecting life and financials for them. Erica can provide a weekly snapshot of your month-to-date spending, facilitate scheduling in-person meetings, flag a recurring charge and help clients understand what they need to pay attention to, to adjust their spending patterns.

There’s two ways that clients engage: inquiring of Erica — so, asking Erica questions — and getting insights from Erica, so Erica’s going to them.

We always anticipated, when we first launched, that people would ask Erica questions, but more and more, that has shifted, and now 50% of Erica interactions are people taking advantage of those insights. That’s things like monitoring recurring subscription fees, looking at the spend path, managing and monitoring deposits, refunds. Clients are asking for their account or routing number, instead of having to root around for it. Erica searches across your account, making it easy to look for a particular transaction. People also use Erica to assist with money transfers, bill pay.

How does Bank of America blend digital and human response to client needs?

Clients are doing more and more digitally, and we want to be there for that. But in the key moments that matter, when something's truly sensitive, or where you really need that human interaction, having branches and our high-touch strategy is a differentiator. It's about striking the right balance between technology and human channels.

We did 23.4 billion interactions with our customers via digital channels last year. Well north of 90% of all of our client interactions are now flowing through digital channels. Customers are using those channels more frequently; it’s becoming a habit.

For well over 90% of interactions, digital is perfect. If a client truly prefers to talk to a human, we definitely don’t want to be in the way of that. In that moment, Erica can essentially expedite that interaction, ensuring you get into the right queue, with the right specialist.

What kind of risks do AI-powered tools like this present? 

Our approach to AI is kind of controlled AI, because it has to be, in the space we’re in. There’s no room for an AI to hallucinate when dealing with personal finances. We are very thoughtful about where we apply AI. All the responses Erica produces, everything goes through really rigorous review to ensure she’s not ad-libbing. She’s not telling you something we wouldn’t stand behind.

This is an area where we have a ton of investment, we have a huge patent portfolio, we have a huge pipeline of AI-based projects we’re working on. This is an area we believe has a ton of value and opportunity for our industry, but we’re definitely going to come out on the more thoughtful side because of risk.

What else is in the bank’s pipeline of AI-based projects?

There’s a lot of applications we’re looking at, both in terms of internal efficiencies, internal tools as well as client facing. Nothing that we’re able to talk about beyond Erica right now, but it’s definitely an area of investment and investigation for us.

What’s next for Erica?

We are constantly evolving Erica, every single day. We’ve made 50,000 different tuning adjustments to Erica since it was launched, and we continue to do that.

We’re constantly looking at our natural language model, and ensuring it’s understanding what’s being said to it. During the COVID-19 pandemic, when the Paycheck Protection Program came out, all of a sudden Erica was getting all these questions around PPP. This was a new program, and there was nothing already in the system for it, so we had to really quickly adjust and improve the knowledge base so Erica knew what to do with those types of questions.

Erica was born on the consumer retail side, but once we started bringing in wealth customers and retirement, we had to train Erica on how to talk about retirement products, how to talk about wealth and what questions come with that, what clients need around those domains.

We're also expanding, so now that same data and technology is powering our CashPro Chat on the business side. You're going to see that kind of expansion of Erica and that technology across more of our businesses, capabilities. We’re looking at opportunities internally as well as client facing, to leverage that. Erica now powers the search at the top of the mobile app. 

As large global banks test quantum computing uses, it’s crucial that what’s learned is shared with the broader industry, particularly when it comes to defending against cyber risks.

That’s according to Jan Bellens, global banking and capital markets sector leader at accounting and consulting firm EY. Top banks are leading the charge on exploring applications for quantum computing technology, which uses quantum bits, or qubits, to handle data processing at much faster speeds than regular computing, which uses binary digits, or bits. 

Currently, “using quantum to fight quantum” is the most prominent banking application, since cyber risks are consistently top of mind for bank executives, said Bellens, who has worked with banking clients in 20 countries. 

For now, the technology — still in its infancy — is expensive and difficult to access. But it holds the potential to speed up a number of processes in the financial services world, including in capital markets and payments. “It’s effectively an algorithm that allows much more efficient and much, much, much faster computing, because it seeks more efficient routes to solve problems,” Bellens told Banking Dive in May.

BANKING DIVE: How are banks currently using quantum computing?

JAN BELLENS: The biggest one, at the moment, is actually more as a defensive tool. One of the reasons that banks were so quick to hire quantum computing talent is, effectively, because of the cyber risk that comes with quantum computing. One of the challenges is, if bad actors would have access to quantum computing capabilities, encryption tools that are currently being used in financial institutions pretty much around the world can quickly get decoded, because of the power and speed of quantum computing.

The first move by banks, when they hire quantum talent and when they want to understand the implications for their business, has to do with, how do I protect the bank against the cyber risk that comes from quantum computing? There are now emerging technologies — some are software-based, like rapidly changing passwords — that can effectively mitigate the risks that come from quantum.

What are other use cases for this?

With a lot of the use cases, there’s enough testing going on to make sure that error mitigation can be done. It’s very important for banks, especially, to make this error-free and to do sufficient testing to make sure that the use cases that are being run lead to the right outcomes. 

Where quantum computing is most powerful is for driving huge sets of unstructured data very fast toward an outcome. Most cases being tested are in the complex space of capital markets; think derivatives pricing. Quantum computers can run Monte Carlo simulations [a computational algorithm that determines the range of possible outcomes in a certain scenario] at much faster and efficient speeds. 

Another one would be portfolio optimization. Both for a bank's own trading book, and potentially for its clients — institutional investors or even high-net worth investors — if you look at the world of asset classes today, their historical returns, their future returns, their volatility in terms of standard deviations, etc., banks and capital markets providers are continuously running portfolio optimization models. Again, this is something a quantum computer can do much, much faster and with a much wider set of data, going back further in time, using more asset classes, and hopefully come to a better outcome.

Those two are the uses being tested the most. There’s others in payments, for risk optimization, that are certainly on the horizon, and being piloted and tested in months and years to come. 

Big banks such as JPMorgan Chase and Wells Fargo are exploring the use of quantum computing, but what about smaller banks? 

It’s really important to leverage all the efforts that have been made to protect the industry as a whole. Cyber is not a competitive issue. The industry getting together and more mature banks supporting the industry as a whole to ensure that it’s protected against this is absolutely critical. There’s a scarcity of great talent in this space; it’s not just about budgets or money. Certainly on protecting against the cyber risks, it’s really important to get that right. 

Looking ahead, how should the industry be thinking about quantum computing use?

Like artificial intelligence and generative AI, it’s important to start experimenting with this. There’s disagreement on the timelines of when this will be commercially available; some say 2030 to 2035, others say we’ll see that happen in two to three years. It’s a trend that’s almost inevitable. Getting in early, trying to test this out and preparing some use cases in certain spaces would be a good strategy, because it will help build the muscle and understand what’s possible. 

I would certainly encourage any industry roundtables, industry exchanges on cyber risk. It’s an industry challenge. Sharing what’s learned is important. 

But this is also going to be an interesting competitive challenge. The expectation certainly is that leading banks that get use cases on the positive side right — for example, portfolio optimization — will have a competitive advantage. They will have a faster, better, broader view than others. It may be too early, but that’s probably something for strategy folks and regulators to think about. How do you think about that from a competitive perspective? 

JPMorgan Chase launched a business in April that will help marketers target customers based on their spending habits.

Chase Media Solutions, billed as the only bank-led platform of its kind, connects Chase’s 80 million customers to retail deals tailored to their spending directly through their bank app.

Rich Muhlstock, president of Chase Media Solutions, said that its understanding of consumer spending has driven the firm to “reimagine what retail media networks can offer.”

“Like retailers, we have first-party data and a dedicated audience. But what sets us apart is the unrivaled scale and insights from our customers — having long served as a trusted guide for their financial decisions,” he said. “Chase reaches across brands, merchants and shopping verticals, providing a comprehensive view of purchase behavior; this strengthens the degree of personalization, helping brands deliver offers that stoke consumer interests.”

The bank is not sharing Chase customer data with retailers. Rather, it is working alongside brands and merchants to develop targeted offers for customers.

Brands have long wasted digital ad spend on dead ends. With Chase Media Solutions, brands share what their motivations are — acquiring new customers or building basket size, for instance — and then the bank targets customers with specialized deals through its app’s Chase Offers section.

When a customer activates the deal within the app and makes a subsequent purchase, in-store or online, a statement credit then appears for the customer.

Chase will only charge retailers when a customer follows through with a purchase. Therefore, the retailers will be able to trace back their sales directly to their Chase partnership,

“We will be part of larger campaigns, because there are other things that are obviously always going to be important to building brands and awareness and things like that,” Muhlstock told The Wall Street Journal. “But this fits in nicely with something that can truly drive sales.”

Chase Offers already presented customers with less targeted ads. Moving forward, it will be populated by offers developed within the bank’s new marketing arm.

During 30-day pilot launches for airline Air Canada, coffee chain Blue Bottle and fast-food restaurant Whataburger, participating brands saw sale and customer growth, the bank said.

“The Chase team succeeded in creating a thoughtful, targeted offer that exceeded our expectations. Two distinct offer constructs drove incremental revenue and awareness for Air Canada amongst Chase’s cardmember base,” said Scott O’Leary, vice president of loyalty and product for Air Canada, in a prepared statement. “These tests clearly demonstrated the potential of the Chase Media Solutions channel, and we look forward to working together more in the future.”

The launch follows the integration of Figg, a card-linked marketing platform acquired by the bank in 2022. The bank said it is part of its vision to bring dual value to business clients and banking customers.

Ally Financial said a proprietary large language model helped make its marketing operations more efficient in a monthlong test, according to details shared in November with Marketing Dive.

The Ally.ai chat solution, which launched in June 2023, delivered an average of 34% time savings on marketing tasks compared to when they were done without artificial intelligence. Ally estimates this level of productivity would save almost 3,000 working hours annually.  

A sample of 80 prompts inputted into the LLM during the pilot carried an 87% usefulness rate and delivered accurate responses 81% of the time.

Ally is the latest brand to offer evidence that the hype around generative AI is translating into concrete products that are impacting marketing functions. The company’s bets on the tech take the form of an LLM, a sophisticated chat interface in the vein of OpenAI’s ChatGPT that can toggle between sharing prompts to guide the creative process and answering user queries. 

Ally is focused on building out the feature in-house by leveraging its own data and cloud-computing infrastructure, an approach that executives said will help scale the tool across the enterprise while better monitoring for risk. Investing in proprietary tech could be of greater importance to categories like banking and finance that deal in sensitive personal information consumers wouldn’t want scraped by a third-party vendor.  

For now, Ally.ai appears most useful in the early stages of marketing initiatives. In one example of Ally.ai in action, a transcript of a podcast featuring an Ally executive was input into the LLM for the purpose of producing a short article that could be posted on the bank’s blog. The software was specifically asked to call out the most informative and entertaining bits of the discussion for consumers. A first draft materialized in 15 minutes but required a careful edit and human review. Ally said the work overall took an hour when it would usually take four without help from AI. 

“We look at Ally.ai as an assistant that will be able to help our teammates with faster and smarter project delivery, which leads to a better experience for our customers,” Andrea Brimmer, Ally’s marketing chief, said in a statement. “In several different instances, our content writers were able to use thoughtfully crafted prompts to either start up the creative process or help extend the distribution of content to new channels. Anytime we can reduce the time to publish while also letting our creatives do what they do best, that means a lot in our fast-moving, competitive environment.”

Other use cases called out by Ally include generating first drafts of ad copy, video scripts and social posts, along with improving search engine optimization, quality control and data analysis. Ally said it is evaluating potential applications of the solution in more than 100 areas but acknowledged not all of them may pan out. Ally.ai was previously piloted by the bank’s customer service department, helping summarize calls and ease workflows.

The bank views the LLM as a way to familiarize its marketers in a tech field that will likely be of growing importance in 2024. Ally has been hosting half-day sessions called AI Days to let employees explore the technology and share their findings. 

Eighty-seven percent of marketing and communications professionals are dipping their toes into the AI space, according to a recent benchmark survey from The Conference Board. Some of the most popular applications include summarizing content and aiding with creative ideation. 

Sacramento, California-based Golden 1 Credit Union has seen a 28% increase in approvals to protected classes of borrowers since it started using artificial intelligence for loan decisions, its CEO, Donna Bland, said in March at America’s Credit Unions’ Governmental Affairs Conference.

The credit union knew it was losing solid loans to other lenders due to faulty data, Bland said. So Golden 1 partnered with Zest AI to build its own customized credit scorecard.

Golden 1 is using data not only from the credit union’s membership in the algorithm but also from other Californians “who looked like our membership” to help grow the database, Bland said. 

Golden 1 launched the scorecard in December 2022 — first with credit cards and, then with unsecured and auto loans in 2023. 

The results have been more powerful than the credit union even envisioned, Bland said. The AI-driven scorecard led to higher loan approvals overall but especially among protected classes, including women, Latinx and Black people, and members older than 62, the executive said. 

“What that means for us is that we’re no longer denying tens of thousands of people,” Bland said. “We originate over $6 billion in loans a year … and that not only means Californians have more access to equitable credit, it's also good for the credit union and our financial position.”

Oak Ridge, Tennessee-based ORNL Federal Credit Union also partnered with Zest AI to help the institution make better lending decisions, CEO Jenny Vipperman said.

For the $3.6 billion-asset credit union, “one size does not fit all” when it comes to rating potential borrowers.

“A national score was the best that we had when it was the best that we had,” Vipperman said. “But today, I’m looking for a score that can look at my fellow Tennesseans and saying ‘what they’re using to make a decision in California cannot possible make the most accurate decision in Tennessee.’”

Bland said more relevant information is critical for scoring potential borrowers and making better loan decisions. She said Golden 1’s membership is composed completely of Californians, but that demographic is different from the nation as a whole. 

“California financial-wise can be very different from other parts of the nation,” she said. “So relying on national and traditional scoring models can paint the wrong picture when the credit union is making loan decisions.”

At $21.1 billion in assets, Golden 1 is the sixth-largest credit union in the country but the biggest using AI for lending.

Jennifer Golbeck, director of the social intelligence lab at the University of Maryland, said financial institutions must be careful when deploying AI for credit decisions. She pointed to a situation in 2008, where the algorithm being used by Wells Fargo to make mortgage decisions was found to have racial biases.

Race was not a part of the data, but the algorithm picked up on the fact that decisions made by Wells employees led to certain populations being pushed into subprime mortgages where whites with the same financial profile were not.

"If humans are racially biased in the way that they’re handing out mortgages, the algorithm is going to learn to do that, too,” Golbeck said. “AI has this veneer of objectivity, but because what it does is replicate our decision-making, it replicates our biases as well.”

Anti-money laundering fintech Refine Intelligence announced a $13 million seed round in November to fund its international expansion, led by Tel Aviv-based Glilot Capital Partners and San Francisco-based Fin Capital.

Refine uses proprietary artificial intelligence to detect legitimate customer activity that has triggered an AML alert, allowing it to be quickly resolved so as not to waste bank resources or punish good actors.

The fintech calls its process “greenflagging,” or in other words, “catching the good guys.”

“Banks used to have a superpower: knowing their customers' life stories so they could provide personalized financial service,” Refine Intelligence CEO Uri Rivner said in a prepared statement. “With banking increasingly done online and a significant drop in face-to-face interactions, banks' understanding of customer behavior is limited.”

“Refine Intelligence restores that critical context, empowering banks to ‘catch the good guys’ — identify false alarms triggered by perfectly legitimate customer transactions, and focus their energy on actual dubious activity,” he said.

Based on its work with its current banking partners, Refine found that 64% of all AML alerts can be attributed to five scenarios: buying or selling real estate, payment for cash-intensive jobs, giving or receiving gifts, buying or selling a car, or payment for construction expenses.

“Banks simply lack the context for these activities, and devote many resources to investigating false alarms,” the company said in its announcement.

Refine provides context in real time to explain customers' actions by tapping into AI trained on a proprietary data set of “genuine customer activity patterns that can automatically recognize specific customer life stories,” and through user-friendly inquiries in which customers are asked information about the source of their funds and the nature of their activity.

Wayne, New Jersey-based Valley Bank took a chance on Refine as its first customer. What it saw inspired an investment from Valley Ventures, the bank’s VC arm.

“After implementing Refine Intelligence's solution, our AML inquiry process was cut from 16 days to two minutes,” Chris Phillips, Valley Bank's director of AML, said in a prepared statement. “This has freed up our team to spend less time on investigations and more time serving our customers. Using Refine Intelligence has enhanced our efficiency by streamlining the process of investigating and resolving AML alerts, and improving our customers' satisfaction.”

Other banks have followed Valley Bank’s lead. Though Rivner did not reveal which banks are leaning into Refine, he said that the team is developing projects with banks with $8 billion to $10 billion in assets, all the way up to the top 10 U.S. banks and top five Canadian banks.

SYN Ventures, Ground Up Ventures and others also participated in the round.

Rivner said on his personal LinkedIn that he’s been “fighting financial crime for 20 years, working closely with the most amazing and talented fraud and financial crime teams this side of the galaxy.”

To Banking Dive, he said he “can’t remember doing anything else.”

Within fighting financial crime is the possibility of “stopping the most horrendous type[s] of crime [like] crimes against humanity or human trafficking,” he said.

“I’m also motivated by the challenge of coming up with new defenses all the time, coping with the ever-changing creativity and adaptability of criminals,” Rivner said.

And, of course, he wants to make legitimate transactions easier for the good guys.

He knows the inconvenience of being flagged on the basis of AML firsthand.

“[In one instance,] I had a very small amount of bitcoin that I was looking to deposit into my bank account. The transaction was denied, however, and I could not get any explanation from the bank — even after I submitted much paperwork to prove the transaction’s legitimate nature. It was very frustrating, and I knew that many others went through similar problems with banks,” Rivner said.

Banks, he noted, use up to 15% of their workforce on AML operations, and “the number of people being hired for this purpose grew by a factor of 10 in the last six or seven years,” he said. “It was an enormous problem that was only getting bigger, and I knew that something had to be done to solve it.”

Prior to starting Refine in 2021, Rivner founded BioCatch, a behavioral biometrics firm that now says it counts more than 25 of the world’s top 100 banks as customers.

While check use has plummeted over the last three decades, according to the Federal Reserve, check fraud has been on a different trajectory, increasing 385% nationwide since the COVID-19 pandemic, Treasury Department figures show.

Codat, a fintech based in London and New York, aims to remedy the issue.

The firm in April launched its Supplier Enablement API product, which seeks to help banks drive spending through virtual card products by allowing business customers to more easily share data from their accounting software with their bank.

By ousting static supplier payment files for secure, continuous API connnections, Supplier Enablement offers more robust data sets and analysis to banks.

JPMorgan Chase is one of the early users of the product.

“Thanks to our work with Codat, our clients can easily and digitally deliver critical supplier enablement data to our firm, helping to realize efficiency gains and cost savings sooner as well as across a greater share of their spend,” said Stephen Markwell, head of product strategy and fintech partnerships for commercial banking at JPMorgan, in a prepared statement.

When a business customer first engages a bank in search of a product — perhaps a loan or a commercial card — the first thing the bank asks of them is to provide data, Codat Chief Revenue Officer Joey Rault said in an interview with Banking Dive.

Getting the data to the bank, and in a format the bank can use, can be a timely process, he said, in particular for small- to medium-sized businesses.

“What we're hearing from the banks and what we're hearing from the relationship managers, the sales professionals, the bankers who are engaging with these small- and medium-sized businesses, is that it’s two, three, four weeks for them to actually get the file manually on average. With Codat, we’re talking about five minutes,” he said.

“That time savings makes it easier for the bank to build a deeper connection with the small business because they literally are connected directly to the source data,” Rault said. “And more importantly, from an actual customer relationship standpoint, now we're not going back and forth about the data — we're actually having a conversation about the service.”

Supplanting check use with virtual cards has two main benefits, said Ed Sherrington, Codat’s head of product for banking.

“In this high inflationary environment, there's a lot of pressure on cash flows, both for the customers who are paying their bills and for the vendors and suppliers themselves. Virtual cards are a win for both sides because they enable bank customers to pay their vendors on credit, and for the suppliers that on average, get paid much, much quicker when it's by virtual card [as opposed to check]. That has huge benefits to their cash flow,” Sherrington told Banking Dive.

The other benefit, he said, is “an increased sensitivity towards fraud and keenness” to prevent check fraud.

“Check payments are highly susceptible to fraud,” he said. “The more that we can get payments off of check and onto more secure payment methods like virtual card, the better for everyone involved.”

The rapid growth of generative artificial intelligence has created a looming cybersecurity risk for the banking sector, warned Michael Barr, the Federal Reserve’s vice chair for supervision.

As use cases for generative AI continue to evolve, “an arms race between those who are using generative AI to attack and those who are trying to use generative AI to block the attack” will ensue in the financial sector, Barr said in October during a live-streamed cyber risk conference held by the Federal Reserve Bank of Cleveland.

“Technology is always evolving, and so we have to keep up with the next threat. Generative AI could be a really important new concept for the economy, for finance, for really many aspects of economic life. And as with any new technology, it will have risks,” he said.

Barr said it is critical for financial institutions to make investments in generative AI to safeguard against cyberattacks. 

“There's a real risk that we have a cyber arms race using generative AI with defenders and attackers in a constant struggle,” Barr said. “So we do need to make sure that we are, and banks are, investing in the kind of technology that is useful, not only today, but in the near future.”

Barr also highlighted third-party relationships, emphasizing that banks of all sizes have a responsibility to ensure their vendors are properly managing cyber risk. 

“The banks need to treat the third-party risk management as if it were their own risk inside the institution, because legally it is, and from a supervisory perspective, it's required. It's just essential in terms of the safety and soundness of the financial system,” he said.

While it is mostly smaller institutions that rely heavily on third-party service providers, Barr noted that large institutions moving to cloud-based solutions also need to be vigilant. 

“It's absolutely essential that as they do that, banks are ensuring that their relationships with third parties, not only are not hurting them, but are actively helping them to manage their cyber risk,” he said. “We really need to have resiliency in critical service providers, and the banks have an absolutely central role in making sure that that's the case.”

Ripple effects

Due to the tightly interconnected nature of the U.S. financial system, a data breach at one firm can have devastating ripple effects across the financial services sector, even if that firm is a smaller bank, Barr said.

“If there's a problem at a small bank, it can then infect the rest of the financial system,” Barr said. “We're not any more safe if it's a small bank than a big bank, because that problem can then grow into the rest of the system. We have to worry about even the weakest link in the system.”

A cyberattack at a financial institution could disrupt a firm’s payment system and liquidity provision channels, Barr said. 

“If a bank has to cut itself off in order to protect the rest of the system from a cyberattack, that cutting off has ripple effects that could cause bank failures,” he said.

Barr emphasized the importance of having firms engage in internal and external testing, adding banks need to find creative ways to ensure they have the ability to recover and resume operations with the least amount of client disruption.

Barr’s comments come as Consumer Financial Protection Bureau Director Rohit Chopra has also warned of the risks of generative AI, albeit from a consumer perspective. 

Chopra, in April 2023, said the bureau is closely monitoring how generative AI and ChatGPT-like technologies, when used by banks, could undermine or create risks in customer care.

“We’re doing some work right now on how [generative AI] might undermine or create risks in customized customer care, to the extent that biases are introduced, or frankly, even the wrong information,” he said.

An interagency initiative launched by the Justice Department, Federal Trade Commission and Equal Employment Opportunity Commission in April 2023 aims to crack down on “unchecked AI” in lending, housing and employment.

British fintech Revolut is being sued in Illinois under the state’s biometric identification law for allegedly failing to provide customers with crucial information on how their data is stored, and for how long.

Tina Haralampopoulos filed a proposed class-action lawsuit against Revolut in December, alleging the fintech unlawfully collects and stores users’ biometric data without obtaining their written consent, as required by the Biometric Information Privacy Act.

Additionally, Haralampopoulos alleges that Revolut fails to disclose third-party participation in the biometric identity verification process; and does not provide a publicly available policy with information on how long it keeps biometric data, why it keeps biometric data, and how and when that data is eventually destroyed.

Revolut has been gaining traction in the U.S. market since crossing the pond in 2020. Worldwide, the neobank claims over 35 million personal customers, and U.S. CEO Sid Jajodia told American Banker it has over 840,000 stateside users as of October 2023. Jajodia was named to the position in 2022, cementing the neobank’s intention for U.S. growth.

Matthew Peterson of Consumer Law Advocate PLLC, who is representing plaintiffs in this case, told Banking Dive that given that Illinois is home to the country’s third-largest city, he “would not be surprised if IL accounts for at least 10K users.”

Should Revolut be found in violation of BIPA, plaintiffs are entitled to $5,000 in damages per reckless violation over the preceding five years, and $1,000 per negligent violation over the preceding five years.

The law was enacted in 2008, following the bankruptcy of Pay By Touch, a firm that provided retailers in Illinois with fingerprint scanners to facilitate consumer payments.

“That bankruptcy was alarming to the Illinois Legislature because suddenly there was a serious risk that millions of fingerprint records ... could now be sold, distributed, or otherwise shared through the bankruptcy proceedings without adequate protections for Illinois citizens,” Peterson wrote in Haralampopoulos’ case against Revolut.

“The bankruptcy also highlighted the fact that most consumers who had used that company’s biometric scanners were completely unaware that the scanners were not actually transmitting data to the retailer who deployed the scanner, but rather to the now-bankrupt company, and that their unique biometric identifiers could now be sold to unknown third parties,” he wrote.

A spokesperson for Revolut declined to comment on the lawsuit.

Crypto companies Coinbase and Binance.US were separately sued under BIPA in 2023. Spokespeople for both firms didn’t return requests for comment about their respective suit’s current standing.

Several tech giants have reached BIPA settlements in recent years. Meta agreed to pay out $68.5 million in 2023 in a class-action suit for alleged BIPA violations of Instagram users. Meta settled a separate suit in 2021 for $650 million for scanning the faces of Facebook users without their consent.

In 2022, Google’s parent company, Alphabet, settled allegations that the grouping function in Google Photos illegally collected users’ biometrics in violation of BIPA. The firm settled for $100 million.