How does Flagstar govern its use of AI?
Flagstar's AI controls are built into the platform rather than written into its filings. StarIQ, which the bank says was 'built specifically for regulated financial services environments', puts every use case through one auditable workflow from business case through compliance review to multi-level approval, screens prompts with Palo Alto Networks Prisma AI firewalls for prompt injection, sensitive data and policy violations, and answers document and policy questions through a retrieval pipeline with citation tracking and access-controlled knowledge bases. It runs in an AWS tenant. Oversight sits with an AI strategy committee chaired by chief information and operations officer Chris Higgins and attended by CEO Joseph Otting, a former Comptroller of the Currency; Robert Martin, Head of AI and Engineering since March 2026, set up AI risk governance frameworks at MUFG. At board level the 2026 proxy places technology risk with the Risk Committee and a Technology and Operations Committee. The disclosure is thin: the 2025 10-K has no AI risk factor, its technology-change risk names stablecoins, and the 2026 10-Qs do not mention AI. Otting said in May 2026 the bank has built 'a solid risk governance structure'.[1][2][3][4][5][6][7]
Data as of Oct 16, 2026 · Flagstar profile updated Oct 13, 2026 · 11 sources cited on this page · 140 banks profiled on this site · Markdown
Which AI controls has Flagstar described?
| Control | What it does | Source | Date |
|---|---|---|---|
| Single governance workflow | Business case, compliance review and multi-level approvals in one auditable system | Flagstar release | June 15, 2026[1] |
| AI firewall | Palo Alto Networks Prisma AI firewalls detect prompt injection, sensitive data and policy violations in real time | Flagstar release | June 15, 2026[1] |
| Cited retrieval | RAG over documents and policies with citation tracking and access-controlled knowledge bases | Flagstar release | June 15, 2026[1] |
| Contained hosting and cost tiers | Runs in an AWS tenant; three model tiers so simple questions do not use the most expensive model | American Banker Leaders | July 30, 2026[2] |
| AI strategy committee | Chaired by the CIOO with the CEO attending; prioritises a revenue and expense-reduction backlog | American Banker Leaders | July 30, 2026[2] |
| AI governance expertise | Head of AI and Engineering Robert Martin established AI risk governance frameworks at MUFG; Justin Zimmerman led AI-driven compliance work in cloud at U.S. Bank | Flagstar release | March 16, 2026[3] |
| Board oversight | Technology risk with the Risk Committee and a Technology and Operations Committee; CIOO and CISO jointly lead the cyber program | 2026 proxy | April 30, 2026[4] |
What supervisory and disclosure context surrounds Flagstar's AI?
Flagstar is supervised directly by the OCC as a national bank. The OCC approved, on October 3, 2025, the reorganisation that eliminated Flagstar Financial, Inc. and left Flagstar Bank, N.A. held directly by its shareholders, so the bank now files its 10-K and 10-Qs itself.[8][5]
AI is largely absent from those filings. The 2025 10-K's technology-change risk factor names digital assets such as stablecoins and does not mention artificial intelligence; the first- and second-quarter 2026 10-Qs contain no AI language; the April 2026 proxy has one sentence on AI and automation capabilities.[5][6][9][4]
Data security has a history at the bank. In November 2025 Flagstar agreed a $31.5 million settlement of class actions over two 2021 cyberattacks affecting about 2.19 million people, in one of which it paid a $1 million ransom; a separate 2023 breach at vendor Fiserv affected 837,390 of its customers.[10]
Not published: AI principles, an AI risk policy, model inventory figures or any description of how StarIQ outputs are validated beyond the controls above.[1][2]
What does the Flagstar profile record on this topic?
The rows below are the entries of the Flagstar AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 29 dated moves, 14 use cases and 30 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI-aware security layer | Palo Alto Networks Prisma AI firewalls detect sensitive data, prompt injection and policy violations in real time. | In production | [1] |
| Integrated AI governance workflow | Business case, compliance review and multi-level approvals in one auditable system. | In production | [1] |
| StarIQ for underwriting data discovery | Credit underwriting uses StarIQ to find the data most relevant to faster decisions; risk management and marketing are the heaviest users. | Pilot | [2] |
| AI strategy committee and tiered model routing | The CIOO chairs an AI strategy committee attended by the CEO that prioritises a revenue and expense-reduction backlog; StarIQ routes work to three model tiers by complexity to manage cost. | In production | [2] |
| Machine learning in security engineering | Eric Gunn, hired as Distinguished Engineer for Information Security, applies machine learning to cybersecurity problems; Flagstar has not described specific deployed tools beyond the StarIQ firewall layer. | Announced | [3] |
| Head of AI with AI risk governance background | Robert Martin, who established AI risk governance frameworks at MUFG, now strengthens governance frameworks and least-privilege access as Head of AI and Engineering; the board Risk Committee hears from the CRO, CCO and CISO. | In production | [3][4] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Aug 21, 2026 | Pope ties the real-time core to fraud and AI | CTO Jason Pope said a real-time system of record improves fraud decisions and AI capabilities and gives near-real-time liquidity and risk reporting; Higgins said the effort is 'a business transformation' rather than a technology one. | [11] |
| Aug 6, 2026 | Q2 2026 10-Q: software expense $49 million; Figure stake sold; still no AI language | Software expense rose to $49 million for the quarter and $96 million for the half, attributed to infrastructure development and system enhancements. The bank sold its whole stake in Figure Technology Solutions for $46 million. The filing does not mention artificial intelligence. | [9] |
| Jul 30, 2026 | Inside StarIQ: who uses it and how it is governed | Higgins on American Banker's Leaders: one of 12 S2 components, trained on compliance and branch and call-centre procedures, three model tiers to control cost, runs in an AWS tenant, built for auditability; heaviest users are risk management and marketing; customers should notice in six to nine months. | [2] |
| May 7, 2026 | Q1 2026 10-Q: no AI language; software expense up 12% | Software expense was $47 million, up 12% on a year earlier. The filing does not mention artificial intelligence. | [6] |
| Apr 30, 2026 | Proxy statement: internal AI capabilities 'progressed' | The 2026 proxy says S2 rolled out to teammates in mid-2025 on five principles including 'Data Enabled' and 'Risk and Control Managed', and that internal AI and automation capabilities progressed with the enterprise platform scheduled for early-2026 launch. It also discloses that director Lux sits on the board of Mphasis, which supplies data migration and management services. | [4] |
| Mar 16, 2026 | Robert Martin appointed Head of AI and Engineering | One of the five March hires; he came from MUFG, where he built AI risk governance frameworks, and leads incubation in the Chief Technology Office plus identity, cloud, SRE and platform work. Eric Gunn (security, machine learning) and Justin Zimmerman (AI-driven compliance in cloud) joined the same day. | [3] |
| Feb 27, 2026 | 2025 10-K carries no AI risk factor | The first annual report filed by the bank itself after the holding company was dissolved; its technology-change risk factor names digital assets such as stablecoins, and the filing does not mention artificial intelligence. | [5] |
How does Flagstar control generative AI risk?
Through StarIQ's design: an auditable workflow that takes each use case from business case through compliance review to multi-level approval, Palo Alto Networks AI firewalls that screen prompts for injection and sensitive data, cited retrieval over access-controlled documents, and hosting in an AWS tenant. An AI strategy committee chaired by the CIOO prioritises use cases.
Does Flagstar's 10-K mention AI?
No. The 2025 10-K, filed in February 2026, has no AI risk factor, and its technology-change risk factor names stablecoins instead. The 2026 10-Qs also contain no AI language; the April 2026 proxy statement has a single sentence on internal AI and automation capabilities.
Who oversees AI at Flagstar?
Chief information and operations officer Chris Higgins chairs the AI strategy committee, which CEO Joseph Otting attends. Robert Martin, Head of AI and Engineering, brings AI risk governance experience from MUFG. The board's Risk Committee and Technology and Operations Committee oversee technology risk.
Which regulator supervises Flagstar's AI?
The OCC. Flagstar Bank, N.A. is a national bank, and since the OCC-approved reorganisation of October 2025 there is no holding company, so OCC model-risk and third-party guidance apply directly to StarIQ and its vendors.
- Flagstar Bank Announces Proprietary Technology Transformation
- The AI-Enabled Bank: Reimagining Retail Banking from Branch to Mobile (Leaders, with Chris Higgins)
- Flagstar Bank, N.A. Expands Technology Leadership Team Accelerating the Bank's Technology Architecture
- Flagstar Bank, N.A. Proxy Statement for the 2026 Annual Meeting (Form DEF 14A)
- Flagstar Bank, N.A. Annual Report on Form 10-K for the fiscal year ended December 31, 2025
- Flagstar Bank, N.A. Quarterly Report on Form 10-Q for the quarter ended March 31, 2026
- Flagstar Bank Touts Turnaround Progress, Eyes Capital Returns as CRE Exposure Falls
- Corporate Decision #1347: Flagstar Bank, N.A. and Flagstar Financial, Inc. reorganization
- Flagstar Bank, N.A. Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Flagstar agrees to $31.5 million data breach settlement
- Flagstar picks cloud-native core to replace legacy patchwork
When Flagstar moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning