What does Insurance Circular Letter No. 7 (2024) say about AI in banking?

What are the key points of Insurance Circular Letter No. 7 (2024)?

• Defines AIS as a machine-based system designed to perform functions normally associated with human intelligence, used to supplement or proxy traditional underwriting, and ECDIS as external data used the same way — excluding MIB reports, motor-vehicle reports, prescription data, and criminal-history searches.
• Unfair discrimination: insurers must demonstrate that ECDIS and AIS do not rely on protected class status and comply with Insurance Law anti-discrimination provisions (including §§2303, 3221, 4224, and Articles 24, 26, 43, 45).
• Three-step disparate-impact test: (1) quantitatively assess disproportionate adverse effect on protected classes, (2) establish a legitimate, lawful, non-pretextual rationale, (3) search for a less discriminatory alternative — repeated at least annually and documented.
• Proxy assessment: insurers must show ECDIS do not correlate with protected status using data available or reasonably imputed, without collecting new sensitive data from consumers.
• Governance: board oversight, senior management ownership, cross-functional committees, written policies reviewed annually, staff training, full AIS documentation, and complaint procedures under 11 NYCRR 243.
• Third parties: the insurer retains full responsibility for vendor ECDIS and AIS; contracts should give audit rights and require cooperation with DFS.
• Transparency: adverse-action notices must disclose that AIS or external data were used and the consumer's right to review the data; within 15 days of a declination the insurer must give the specific reasons and cannot hide behind a vendor's proprietary claims.
• Finalized after a January 17, 2024 proposed circular letter and a comment period ending March 17, 2024.

What did Insurance Circular Letter No. 7 (2024) change for banks?

This is the most prescriptive US state guidance on algorithmic fairness in financial services and it set the pattern later followed by Colorado's insurance AI rules. For banking groups the practical impact is on insurance subsidiaries and bank-affiliated agencies, which must now maintain model inventories, disparate-impact testing, and vendor audit rights that many had not previously documented. Bank lenders are outside its scope, but its three-step analysis closely mirrors what the CFPB and federal fair-lending examiners expect under ECOA and Regulation B, so many banks reuse it as a template.