Segments covered: deposit-taking institutions (community and regional banks, savings institutions, and credit unions) and the operations functions of larger banks, with brief notes on where nonbank lenders, payments firms, and asset managers differ. Insurance is outside this guide's lens. Linked workflows: support replies, document extraction, knowledge retrieval, meeting follow-up, incident triage. Linked roles: operations leaders, finance leaders, support leaders.
A bank borrows from depositors, lends and invests the money, and earns the spread, while examiners, consumer-protection law, and its board ask whether each decision can be explained and each vendor controlled. AI here is judged twice: on whether it saves money or earns revenue, and on whether the institution can show a supervisor how it is governed.
Sourced findings from regulators and statistical agencies are cited inline with their date, population, and limits. Proposed practices and editorial reasoning are labeled as such. Quillmere Savings Bank, in the economics and sequencing sections, is invented, as are its numbers. No bank was interviewed, no deployment observed, and nothing here is legal or compliance advice.
How the business makes money
A deposit-taking institution earns net interest income (interest on loans and securities minus interest paid on deposits and borrowings) and noninterest income such as service charges, card interchange, trust fees, and gains on loan sales. Its costs are credit losses and noninterest expense: salaries, occupancy, technology, and outside services. Four ratios do much of the work:
| Ratio | Definition | What moves it |
|---|---|---|
| Net interest margin | Net interest income as a share of average earning assets | Loan pricing, deposit costs, balance-sheet mix |
| Efficiency ratio | Noninterest expense (less amortization of intangibles) as a share of net interest income plus noninterest income; lower is better | Operating cost and revenue together |
| Net charge-offs to loans | Loans written off, net of recoveries, as a share of loans | Credit quality and collections |
| Return on assets | Net income as a share of average assets | All of the above, plus taxes and one-time items |
The FDIC's Quarterly Banking Profile for the second quarter of 2026 (data through June 30) reports 4,238 FDIC-insured commercial banks and savings institutions, with an industry net interest margin of 3.32% and an efficiency ratio of 55.38%, both annualized for the quarter. The 3,818 institutions the FDIC classifies as community banks reported a net interest margin of 3.81%, an efficiency ratio of 60.52%, and net interest income equal to 82.60% of net operating revenue. The same report counts 2,034,151 full-time-equivalent employees across all insured institutions, 347,003 of them at community banks. FDIC Quarterly Banking Profile, Second Quarter 2026 The efficiency ratio definition above is the FDIC's. These aggregates span very different institutions; by asset size, the efficiency ratio ranges from 76.47% for banks under $100 million to 53.74% for banks over $250 billion.
Credit unions are not in those figures. The National Credit Union Administration reports 4,214 federally insured credit unions with 146.1 million members and $2.50 trillion in assets as of June 30, 2026, and a net interest margin of 3.49% of average assets year to date. NCUA Quarterly Credit Union Data Summary, 2026 Q2 NCUA measures margin against average assets, the FDIC against average earning assets, so the two margins are not directly comparable.
For scale, the Bureau of Labor Statistics puts depository credit intermediation (NAICS 5221) at about 1.77 million employees and all finance and insurance (NAICS 52) at about 6.64 million in September 2026, seasonally adjusted and preliminary. BLS CES5552210001, CES5552000001 These payroll counts say nothing about AI.
This guide's lens is the deposit-taking institution, because its revenue model and supervision are well documented in public data, and because at community and regional institutions operations staff, not a large engineering group, will run any AI project. Other segments differ. Nonbank lenders depend on wholesale funding and credit losses rather than deposits, and are supervised differently. Payments firms earn on transaction volume, so fraud loss and processing cost matter more than margin. Asset managers earn fees on assets under management under securities-law duties this guide does not review. Insurance has its own guide in this series.
Where AI could touch the value chain
| Process | Capability | Canonical chapter | Benefit mechanism | Benefit location |
|---|---|---|---|---|
| Answer customer secure messages and contact-center questions | Retrieve, classify, generate | Support replies | Servicing capacity | Operating expense |
| Read loan applications, financial statements, and account-opening documents | Extract, classify | Document extraction | Operations capacity; faster cycle time | Operating expense; revenue only with evidence |
| Find the current policy or procedure for frontline and operations staff | Retrieve, summarize | Knowledge retrieval | Staff time; fewer procedure errors | Operating expense; risk |
| Record decisions and follow-ups from relationship-manager meetings | Transcribe, extract | Meeting follow-up | Banker capacity | Operating expense; revenue unproven |
| Triage operations and IT incidents | Retrieve, classify, summarize | Incident triage | Faster understanding of outages | Risk; operating expense |
| Credit decisioning and underwriting | Predict, classify | Not yet covered | Loss rates, approval speed | Credit losses; revenue |
| Fraud detection and anti-money-laundering monitoring | Predict, classify, summarize | Not yet covered | Lower losses; analyst capacity | Risk; operating expense |
| Collections and loss mitigation | Predict, generate | Not yet covered | Recoveries | Credit losses |
| Core processing, payments, reconciliations, regulatory reports | Rules and records | Ordinary software and data cleanup first | Accuracy, timeliness | Operating expense; risk |
The notes below on how each workflow transfers are editorial reasoning, not tested adaptations.
Servicing replies. The support replies chapter was written for software product questions, with an agent approving every draft. The approval design transfers; the requests differ. A bank message that looks like a balance question may be a dispute, a fraud report, a complaint, or a request from someone who is not the account holder, each with handling rules this guide has not reviewed. Proposed rule: the assistant routes those to existing procedures and drafts replies only for documented product and procedure questions.
Document extraction. The document extraction chapter separates capture, validation, and authorization and links each value to its source. That transfers to pay stubs, tax returns, and business financial statements. The consequence differs: a misread income figure can change a credit decision, so values stay proposals until a processor or analyst verifies them, and identity verification and credit judgment stay outside the step. The human review playbook covers staffing that check.
Procedure retrieval. The knowledge retrieval chapter was written for a consulting firm whose main risk is showing someone material they may not see. In a bank, the main risk is a confident answer from a superseded procedure. Index only current, approved procedures and cite procedure and version in every answer.
Relationship-manager follow-up. The meeting follow-up chapter covers consent, review, and retention. Banker meetings contain nonpublic customer information, so recording permission, retention, and any affiliate's separate recordkeeping duties go to compliance first.
Incident triage. The incident triage chapter keeps the assistant read-only and leaves security incidents to the security process. Whether a bank outage triggers notices to regulators is a question for compliance. The pattern transfers only where change history and service dependencies are already recorded.
Why credit, fraud, and AML are not yet covered. They carry the heaviest legal duties. Credit decisions fall under the Equal Credit Opportunity Act and Regulation B, which require specific reasons when credit is denied (see constraints); a model whose reasons cannot be stated accurately is a direct compliance problem. Credit and anti-money-laundering models at larger banks fall within the agencies' model risk guidance, which since April 2026 also replaces the earlier statement on models supporting Bank Secrecy Act compliance. AML monitoring also rests on Bank Secrecy Act obligations this guide has not reviewed. A missed alert or an unexplainable decline is a legal event, not a quality defect.
Constraints that shape every project
Vendors do not transfer responsibility. The Federal Reserve, FDIC, and OCC's June 2023 guidance on third-party relationships states that "a banking organization's use of third parties does not diminish its responsibility" to meet legal requirements "to the same extent as if its activities were performed by the banking organization in-house." It sets out a life cycle from planning and due diligence through monitoring and termination, and imposes no new requirements. Interagency guidance, SR 23-4 attachment The Federal Reserve's SR 23-4 letter showed no supersession on October 20, 2026. Credit unions answer to NCUA, whose guidance this guide has not reviewed. The vendor diligence playbook maps onto that life cycle.
Model risk guidance covers some AI, not generative AI. On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised model risk management guidance (SR 26-2), superseding SR 11-7 (2011) and SR 21-8 (2021). The letter expects it to matter chiefly for banking organizations with over $30 billion in assets, though it may apply to smaller ones with significant model risk. A footnote states that "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance," that an institution's own risk management should guide controls for tools not covered, and that the principles apply to "traditional statistical and quantitative models and non-generative, non-agentic AI models." SR 26-2, attachment Editorial reading: a statistical credit scoring model at a large bank is in scope; a generative drafting assistant is not, which leaves the bank to design its governance, not to skip it.
Credit decisions need stated reasons. Regulation B, implementing the Equal Credit Opportunity Act, requires notice of action taken within 30 days after a completed application and, for adverse action, reasons that are "specific and indicate the principal reason(s) for the adverse action"; citing internal standards or a failure "to achieve a qualifying score on the creditor's credit scoring system" is insufficient. 12 CFR 1002.9 CFPB Circular 2022-03 concluded that creditors may not use complex algorithms when that prevents specific and accurate reasons. Circular 2022-03 On May 12, 2025, the CFPB withdrew it and Circular 2023-03 among 67 guidance documents, saying the withdrawal "is not necessarily final." 90 FR 20084 The regulation itself stands; how it applies to a given model is a question for counsel.
New York cybersecurity rules. DFS's cybersecurity regulation, 23 NYCRR Part 500, applies to entities licensed under New York's Banking, Insurance, or Financial Services Laws. DFS cybersecurity resource center DFS's unofficial text of the second amendment requires a documented risk assessment, updated at least annually and on material change (500.9), written third-party service provider policies covering due diligence and contract protections (500.11), and an annual compliance filing by April 15 (500.17); small entities have a limited exemption (500.19). DFS, Second Amendment to 23 NYCRR 500 An October 16, 2024 DFS letter on AI-related cyber risks (deepfake social engineering, AI-enhanced attacks, data exposure, third-party dependencies) stated it "does not impose any new requirements." DFS letter, October 2024 A May 21, 2026 letter on frontier AI models urged faster vulnerability management and dependency mapping, also without new requirements. DFS letter, May 2026 For a DFS-regulated institution, an AI tool touching nonpublic information belongs in the Part 500 risk assessment and third-party policy; elsewhere, ask counsel which state rules apply.
Customer data and core contracts. Customer financial information is subject to privacy law and contract terms this guide has not reviewed: ask counsel what the vendor processes, where, whether it retains or trains on it, and how deletion is verified. Core-processor contracts can limit data access and integration, so whether a tool can read from or write to the core is a contract question before a technical one.
The sector's economics lens
For your finance lead
An efficiency-ratio improvement is real money, but small next to moves in deposit costs or credit losses, and it appears only if a paid cost stops. The example is invented.
Quillmere Savings Bank, a fictional community bank, has $1.5 billion of earning assets, $50 million of annual net interest income, $10 million of noninterest income, and $36 million of noninterest expense. Its efficiency ratio is 60%, near the community-bank aggregate of 60.52% reported above; its revenue mix (83% net interest income) is near the aggregate 82.60%. Pre-provision operating profit is revenue minus noninterest expense: $24 million. An AI project ends $400,000 a year of contractor and overtime spend in deposit and loan operations and adds $100,000 a year of tool and review cost.
| Case | Noninterest expense | Efficiency ratio | Pre-provision operating profit | Change |
|---|---|---|---|---|
| Baseline | $36,000,000 | 60.00% | $24,000,000 | — |
| Paid cost stops ($400,000) net of tool cost ($100,000) | $35,700,000 | 59.50% | $24,300,000 | +$300,000 (+1.25%) |
| Hours released but no paid cost stops; tool cost added | $36,100,000 | 60.17% | $23,900,000 | −$100,000 |
On $1.5 billion of earning assets, one basis point (0.01 percentage point) of net interest margin is $150,000 a year, so the $300,000 net saving equals two basis points of margin. And the saving sits before credit losses: one $300,000 loan charge-off would cancel a full year of it. These observations follow from the arithmetic, not from any measurement.
The capacity-only row deserves the attention. Faster salaried staff do not reduce noninterest expense unless attrition goes unreplaced, a contractor or outsourced service ends, overtime stops, or the same staff absorb growth that would otherwise need hiring. The finance leaders guide sets out how to test those mechanisms; the economics chapter explains why capacity is not cash.
Three cautions. Count released hours once: as avoided hiring or as a cost reduction, not both. Revenue claims (faster loan decisions winning business, better service keeping deposits) need their own evidence, and a retained deposit is worth its margin, not its balance. Governance has a cost: inventory entries, testing, vendor reviews, and examiner questions take staff time that belongs in the tool cost. This is a decision model, not accounting or capital guidance.
What is measured about adoption and outcomes
For your analyst
Adoption. The Census Bureau's Business Trends and Outlook Survey (BTOS) asks employer businesses every two weeks: "In the last two weeks, did this business use Artificial Intelligence (AI) in any of its business functions?" For the collection period September 21 to October 4, 2026 (reference period September 7–20; published October 8, 2026), an estimated 40.1% of businesses in finance and insurance (NAICS 52) answered yes, with a standard error of 1.86 percentage points, against 23.8% of all businesses nationally. The three preceding cycles, in date order, were 40.0%, 36.5%, and 41.0%. In the same cycle, 48.0% of NAICS 52 businesses expected to use AI in the next six months. BTOS sector data, national data
NAICS 52 combines banks and credit unions with insurers, securities firms, and funds, so it is not a measure of banking. The Census subsector file comes closer: in the same cycle, 23.9% of credit intermediation businesses (NAICS 522) answered yes (standard error 2.23 points), against 51.2% in securities and investments (NAICS 523) and 37.4% in insurance (NAICS 524); 37.1% of NAICS 522 businesses expected to use AI in the next six months, up from 28.9% a cycle earlier, a jump that one cycle cannot confirm. BTOS subsector data The 522 standard error is wide, and multi-unit companies operating in several states or sectors are reported separately, not under 522, so larger multi-state banks are outside that figure. All these estimates are weighted shares of responding employer businesses, not of employees or work, and "any business function" can mean one employee using a writing tool. BTOS methodology, version 5 The question was reworded in November 2025, so earlier figures are not directly comparable. Census Bureau, May 2026 BTOS is experimental, and cycle-to-cycle moves of a few points are within a few standard errors.
Share of businesses using AI, by sector
- This guide’s sector
- Other sectors in the guide
- All businesses
Show the data
| Group | Estimate | Standard error | 90% interval |
|---|---|---|---|
| Information | 50.2% | 1.43 pts | 47.8–52.6% |
| Finance and insurance | 40.1% | 1.86 pts | 37.0–43.2% |
| Credit intermediation and related activities (NAICS 522) | 23.9% | 2.23 pts | 20.2–27.6% |
| Professional, scientific, and technical services | 42.7% | 1.01 pts | 41.0–44.4% |
| Health care and social assistance | 24.8% | 1.01 pts | 23.1–26.5% |
| Wholesale trade | 21.6% | 1.46 pts | 19.2–24.0% |
| All employer businesses | 23.8% | 0.41 pts | 23.1–24.5% |
The 2025–26 BTOS AI supplement (reference period November 2025 to January 2026) adds sector-level detail. BTOS AI supplement table, reference period As shares of all NAICS 52 firms, AI use in the previous six months was reported in sales and marketing (20.6%), information technology (18.9%), customer service (16.2%), legal and compliance (11.8%), and finance and accounting (10.6%). Among AI-using firms, 54.9% used AI to supplement an employee's task, 13.7% to perform a task previously done by an employee, and 95.0% reported no change in employment from AI. These are firm self-reports, not measured outcomes.
Deployment maturity and outcomes. We found no attributable public measurement of how AI use changes efficiency ratios, servicing cost, loan cycle time, or error rates at banks or credit unions. Vendor case studies were not reviewed. The Neuronify AI hiring index measures job postings at New York AI companies and is not evidence of adoption or outcomes in banking.
Who is involved
The board sets risk appetite. The chief risk officer, and at larger banks a model risk function, decides whether a system is a model and how it is rated and tested. The compliance officer, with fair-lending and Bank Secrecy Act specialists, decides whether a use touches consumer-protection or anti-money-laundering duties. The chief information security officer owns cyber risk assessment and, at DFS-regulated institutions, the Part 500 program. Vendor management runs the third-party life cycle. Operations leaders own deposit and loan operations, where first projects are likely to sit; the contact-center head owns servicing, covered by the support leaders guide. The chief credit officer owns credit policy and any extraction feeding underwriting. Finance leaders confirm whether a saving is cash. The core provider is party to any integration that touches the core, and internal audit tests the controls. This guide does not yet include role guides for risk, compliance, or credit officers.
Expertise specific to this industry. A general AI builder lacks banking practice: taking a tool through the third-party risk life cycle, deciding with the model risk function whether a system falls under SR 26-2 or is a generative tool the bank must govern on its own terms, giving specific adverse-action reasons under Regulation B for anything feeding credit decisions, and, at DFS-regulated institutions, placing the tool in the Part 500 risk assessment. This guide places that expertise in-house, with risk, compliance, vendor management, and the CISO, with counsel as adviser and the core provider as a party to any core integration. See Staffing an AI pilot and Choosing and working with an AI partner.
Sequencing: a first move and what follows
The following is a fictional teaching example. Quillmere Savings Bank is the invented New York-chartered community bank from the economics section, with about 260 employees and $1.7 billion in total assets. Its numbers and decisions exist only for this example.
First, inventory and clean. Quillmere's operations head and compliance officer list where AI tools are already in use, including staff using public chat tools. Each deposit-operations procedure gets an owner and review date; superseded versions are retired. Vendor management adds AI questions to due diligence, and the security officer adds AI tools to the Part 500 risk assessment. SR 26-2 targets far larger banks and excludes generative tools, so Quillmere writes a short internal standard: inventory, owner, risk rating, testing before use, monitoring.
First move: procedure retrieval in deposit operations. Quillmere starts with an assistant that answers deposit-operations staff questions from approved procedures, citing procedure and version, following the knowledge retrieval chapter. The output is internal, read-only, and checkable against its source; no customer sees it and no decision rests on it alone. Success is time to a correct, traceable answer and errors found in quality review, not questions asked. The finance lead names the paid cost that must end: month-end overtime in the operations center.
Next, if that works: small-business loan packages. Quillmere extracts fields from business financial statements and tax returns into its spreading template, each value linked to its source page and verified by a credit analyst, as the document extraction chapter and human review playbook describe. The chief credit officer confirms the extraction makes no recommendation. Drafted replies to secure messages, excluding possible disputes, fraud reports, and complaints, come third.
Counterexample: consumer lending waits. The consumer lending team asks to go first with a vendor model that pre-screens personal-loan applications. Quillmere declines for now. The vendor cannot show how the model's outputs map to the specific reasons Regulation B requires in adverse action notices, there is no fair-lending testing plan, and the contract does not allow independent testing. The constraint is explainability and evidence, not capability. The simpler investments come first: a reason-code review of current declines, a testing plan, and contract terms that permit testing.
Questions for operators, investors, and vendors
- Which paid cost will stop, by how much, and on what date, net of tool and governance cost?
- Does any output feed a credit, account-opening, fraud, or anti-money-laundering decision, directly or as an input someone relies on?
- Are procedures and policies current, owned, and versioned well enough to index?
- What customer data will the vendor process, store, or use for training, and what does the contract say?
- Is it in our model inventory? If generative and outside SR 26-2, what governance replaces model validation?
- For DFS-regulated institutions: is the tool in the Part 500 risk assessment and third-party policy?
- For vendors: what are the error rates on our own documents and messages, and who measured them?
- For investors: does a claimed AI advantage show up in the efficiency ratio, cost per account, or loss rates, or only in pilot anecdotes?
When to wait
Wait when procedures are out of date or unowned, when the vendor will not say how customer data is handled, or when no paid cost can be named that will stop. Wait on any use that feeds credit, fraud, or anti-money-laundering decisions until compliance, risk, and counsel have reviewed it and a testing plan exists. Wait when the core contract does not allow the needed integration. The simpler investments pay off on their own: owned and current procedures, a loan-package document checklist, a reason-code review for declines, AI questions in vendor due diligence, and an inventory of AI tools staff already use.
Evidence still needed and related reading
Obtain attributable operator accounts from community banks and credit unions of servicing volumes by request type, document exception rates, procedure-lookup time, and which costs actually stopped after a pilot. Review NCUA guidance on third-party and AI risk, the Bank Secrecy Act and its examination procedures, consumer dispute and complaint rules, and privacy law before extending this guide to credit, fraud, or AML. Confirm Part 500 citations against the official regulation text. Track the NAICS 522 BTOS estimate across cycles before reading a trend into it. No bank was interviewed and no deployment observed for this chapter.
Continue with knowledge retrieval, document extraction, support replies, vendor diligence, operations leaders, and finance leaders.
Hiring in New York: open roles at NYC AI companies building for finance and insurance, read daily from the companies' own job boards. These companies sell AI into the industry; they show which skills vendors are hiring for, not what firms in the industry are hiring.