The CFPB's June 6, 2023 issue spotlight found that all of the top 10 US commercial banks had deployed chatbots and that roughly 37% of the US population — over 98 million people — interacted with a bank chatbot in 2022. It warned that chatbots that give inaccurate information, fail to recognize disputes, or block access to a human can violate federal consumer law, and that institutions remain responsible for timely, straightforward answers 'regardless of the processes or technologies used'.
| Document | CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance |
| Issued by | Consumer Financial Protection Bureau |
| Type | Report |
| Status | Final |
| Published | Jun 6, 2023 |
| Applies to | Banks, card issuers, servicers and fintechs deploying chatbots or generative-AI assistants for customer service |
| Official source | consumerfinance.gov ↗ |
| Use cases | Customer-facing chatbots · Generative & agentic AI |
What are the key points of CFPB Chatbots in Consumer Finance (issue spotlight, 2023)?
- Adoption data: every top-10 commercial bank uses a chatbot; Bank of America's Erica had nearly 32 million users and over 1 billion interactions by October 2022.
- Risks: inaccurate or unreliable answers, 'doom loops' that prevent reaching a human, failure to recognize a dispute or error notice, and privacy/security exposure of customer data.
- Legal hooks: statutory dispute and error-resolution duties (e.g. Regulation E and Regulation Z), UDAAP, and FCRA; a chatbot that impedes these can be a violation.
- Flags the shift from relationship banking to algorithmic banking and the growing use of large language models.
- States the CFPB is monitoring the market and expects institutions to ensure chatbots comply with law.
What did CFPB Chatbots in Consumer Finance (issue spotlight, 2023) change for banks?
It put customer-service AI, not just underwriting, inside the CFPB's supervisory lens, and gave banks a concrete standard: chatbots must give accurate information, recognize legally significant customer communications (disputes, error notices) and provide a path to a human.
Can a bank's chatbot violate consumer protection law?
Yes. The CFPB's 2023 report says a chatbot that gives inaccurate information, fails to act on a dispute, or prevents access to a human can breach dispute-resolution rules and UDAAP, and the bank is liable regardless of the technology.
Does the CFPB require a human escalation path from chatbots?
There is no specific rule, but the report identifies inability to reach a live agent as a source of law violations and consumer harm; most banks treat human escalation as a control expectation.
| Date | Document | Status |
|---|---|---|
| Apr 22, 2026 | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions | In force |
| May 12, 2025 | CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal | In force |
| Aug 12, 2024 | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector | Final |
| Sep 19, 2023 | CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B | Withdrawn |
| Apr 25, 2023 | Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Final |
| May 26, 2022 | CFPB Circular 2022-03 — Adverse action notification requirements in connection with credit decisions based on complex algorithms | Withdrawn |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →