SEC filings · computed from SEC EDGAR filings dataset; nothing on this page is written by a model. All ranked answers: /banks/leaders
On the public record as of Oct 31, 2026, 56 of the 141 large banks profiled have a verbatim filing statement about third-party or vendor AI risk. Ranked by quotes (filings), the top 5 are State Street (5 filing quotes), Valley (5 filing quotes), Busey Bank (4 filing quotes), BofA (4 filing quotes) and First Hawaiian (4 filing quotes). State Street's strongest evidence: State Street warns that developing new products incorporating artificial intelligence may impose costs, third-party dependencies and increased risks on the company. (Form 8-K, 8-K exhibit, filed Jan 17, 2025).
141 banks profiled (120 US, 21 non-US) · 56 with matching evidence · top 40 shown · ranked answer, not a comparison
Which of the large banks flag third-party and vendor AI risk in their SEC filings?
| # | Bank | Quotes (filings) | Latest statement (extractor's one-line claim) | Status | Date | On this site | Sources |
|---|---|---|---|---|---|---|---|
| 1 | State Street | 5 | State Street warns that developing new products incorporating artificial intelligence may impose costs, third-party dependencies and increased risks on the company. (Form 8-K, 8-K exhibit, filed Jan 17, 2025) | 5 filings | Jan 17, 2025 | State Street · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 2 | Valley | 5 | Valley says Bluevine's data science and AI talent will accelerate its long-term technology strategy and reduce reliance on third-party software. (Form 8-K, 8-K exhibit, filed Sep 28, 2026) | 3 filings | Sep 28, 2026 | Valley · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 3 | Busey Bank | 4 | Busey cites technological changes, including AI tools from it and its third-party vendors, as a factor that could cause unforeseen consequences for the company and its… (Form 8-K, 8-K exhibit, filed Apr 28, 2026) | 4 filings | Apr 28, 2026 | Busey Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 4 | BofA | 4 | Bank of America says it uses AI across operations, business processes, services and products and expects increasing use of it. (Form 10-K, risk factors, filed Feb 25, 2026) | 4 filings | Feb 25, 2026 | BofA · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 5 | First Hawaiian | 4 | First Hawaiian says it and its vendors or counterparties have developed or incorporated AI into business processes, services or products, creating risks and challenges. (Form 10-K, risk factors, filed Feb 27, 2026) | 3 filings | Feb 27, 2026 | First Hawaiian · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 6 | Citizens Business Bank | 4 | The bank has adopted a Policy Framework applying to all AI initiatives by the bank and its vendors. (Form DEF 14A, proxy, filed Apr 7, 2026) | 2 filings | Apr 7, 2026 | Citizens Business Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 7 | Stifel Bank | 4 | Stifel says it seeks contractual protections from third-party AI vendors, including data handling, IP, explainability and incident notification terms. (Form 10-K, risk factors, filed Feb 24, 2026) | 2 filings | Feb 24, 2026 | Stifel Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 8 | Axos Bank | 4 | Axos says it or its vendors, clients or counterparties may develop or incorporate AI into business processes, services or products. (Form 10-K, risk factors, filed Aug 21, 2025) | 2 filings | Aug 21, 2025 | Axos Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 9 | Fifth Third | 3 | Fifth Third says AI models, including those from vendors, may be flawed in ways that are hard to identify. (Form 10-K, risk factors, filed Feb 24, 2026) | 3 filings | Feb 24, 2026 | Fifth Third · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 10 | Citi | 3 | Citi says faulty Generative AI development or deployment, including weak testing and oversight, could cause adverse consequences despite its existing policies. (Form 10-K, risk factors, filed Feb 20, 2026) | 3 filings | Feb 20, 2026 | Citi · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 11 | SouthState | 3 | SouthState flags increased risk from its own and third-party vendors' use of AI tools, including errors, unfair treatment, and fraud. (Form 10-Q, MD&A, filed May 2, 2025) | 3 filings | May 2, 2025 | SouthState · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 12 | Regions | 3 | Regions' Risk Committee monitors model performance, including generative AI, among other key risks. (Form DEF 14A, proxy, filed Mar 23, 2026) | 2 filings | Mar 23, 2026 | Regions · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 13 | Banc of California | 3 | Banc of California says its use of AI and emerging technologies could cause service disruptions, processing errors, compliance failures, or operational risk if poorly… (Form 10-K, risk factors, filed Feb 27, 2026) | 2 filings | Feb 27, 2026 | Banc of California · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 14 | NBT | 3 | NBT says it uses AI across platforms, including third-party systems, and evaluates AI tools through its SDLC with model validation and risk controls. (Form 10-K, business, filed Feb 27, 2026) | 2 filings | Feb 27, 2026 | NBT · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 15 | Prosperity | 3 | Prosperity says it and its vendors may use AI and machine learning to improve customer service, products, and automate business and risk decisions. (Form 10-K, risk factors, filed Feb 26, 2026) | 2 filings | Feb 26, 2026 | Prosperity · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 16 | Hilltop | 3 | Hilltop believes larger competitors can develop new technologies in-house, potentially leaving Hilltop at a competitive disadvantage. (Form 10-K, risk factors, filed Feb 13, 2026) | 2 filings | Feb 13, 2026 | Hilltop · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 17 | Simmons Bank | 2 | Simmons says third-party AI models carry risks in how they are developed, trained and deployed, including unauthorized training data and limited visibility into… (Form 10-Q, risk factors, filed Aug 5, 2026) | 2 filings | Aug 5, 2026 | Simmons Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 18 | Huntington | 2 | Huntington has a dedicated Artificial Intelligence Risk Committee among its management committees overseeing risk. (Form 10-Q, MD&A, filed Jul 28, 2026) | 2 filings | Jul 28, 2026 | Huntington · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 19 | KeyBank | 2 | KeyCorp's Technology Committee oversees management's AI and technology investment activities and major vendor relationships. (Form DEF 14A, proxy, filed Mar 27, 2026) | 2 filings | Mar 27, 2026 | KeyBank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 20 | Texas Capital | 2 | Texas Capital engaged external firms to conduct AI defense assessments as part of strengthening its cybersecurity defenses. (Form DEF 14A, proxy, filed Mar 12, 2026) | 2 filings | Mar 12, 2026 | Texas Capital · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 21 | First Financial Bank | 2 | First Financial says customers, competitors and vendors are using AI, generative AI, LLMs and AI agents at rapidly increasing rates, raising risks to its business. (Form 10-K, risk factors, filed Feb 19, 2026) | 2 filings | Feb 19, 2026 | First Financial Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 22 | M&T | 2 | M&T says the development and use of AI, including by third parties, presents risks and challenges that may adversely affect the company. (Form 10-K, risk factors, filed Feb 18, 2026) | 2 filings | Feb 18, 2026 | M&T · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 23 | Beacon Bank | 2 | Beacon previously originated loans via Upstart's AI underwriting partnership, suspended in mid-2022, with a $7 million remaining portfolio at year-end 2024. (Form 10-K, business, filed Mar 3, 2025) | 2 filings | Mar 3, 2025 | Beacon Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 24 | Seacoast Bank | 2 | Seacoast flags that developments in generative AI may exacerbate cybersecurity risks, including those involving third parties. (Form 10-K, other, filed Feb 25, 2025) | 2 filings | Feb 25, 2025 | Seacoast Bank · in their words → | SEC EDGAR ↗ · SEC EDGAR ↗ |
| 25 | Mechanics Bank | 2 | Mechanics Bank says inaccurate or biased AI analyses could cause competitive harm, legal liability, and reputational damage. (Form 10-K, risk factors, filed Mar 17, 2026) | 1 filing | Mar 17, 2026 | Mechanics Bank · in their words → | SEC EDGAR ↗ |
| 26 | Pinnacle | 2 | Pinnacle says AI development and use by it, its vendors, clients or counterparties presents a number of risks and challenges to its business. (Form 8-K, 8-K exhibit, filed Mar 2, 2026) | 1 filing | Mar 2, 2026 | Pinnacle · in their words → | SEC EDGAR ↗ |
| 27 | Renasant | 2 | Renasant says it and its vendors, clients and counterparties have begun incorporating AI into certain business processes, services and products. (Form 10-K, risk factors, filed Mar 2, 2026) | 1 filing | Mar 2, 2026 | Renasant · in their words → | SEC EDGAR ↗ |
| 28 | FirstBank | 2 | FB Financial says AI can enable more sophisticated fraud and cyber threats and may raise data breach and privacy risks, especially with third-party systems. (Form 10-K, risk factors, filed Feb 26, 2026) | 1 filing | Feb 26, 2026 | FirstBank · in their words → | SEC EDGAR ↗ |
| 29 | First Merchants | 2 | First Merchants says it and its vendors, clients and counterparties use and develop machine-learning and generative AI tools and models. (Form 10-K, risk factors, filed Feb 25, 2026) | 1 filing | Feb 25, 2026 | First Merchants · in their words → | SEC EDGAR ↗ |
| 30 | Bank of Hawaii | 2 | Bank of Hawaii says it is exposed to risks from AI used by third-party vendors, clients, counterparties and intermediaries. (Form 10-K, risk factors, filed Feb 24, 2026) | 1 filing | Feb 24, 2026 | Bank of Hawaii · in their words → | SEC EDGAR ↗ |
| 31 | Ameris | 2 | Ameris expects its vendors to embed AI into products faster than Ameris can build AI capabilities independently. (Form 10-K, risk factors, filed Feb 28, 2025) | 1 filing | Feb 28, 2025 | Ameris · in their words → | SEC EDGAR ↗ |
| 32 | BNY | 2 | BNY says its own and third-party AI use, including generative AI, may expose it to risks and potential liabilities. (Form 10-K, risk factors, filed Feb 27, 2025) | 1 filing | Feb 27, 2025 | BNY · in their words → | SEC EDGAR ↗ |
| 33 | Morgan Stanley | 2 | Morgan Stanley says cyber attackers may become more effective at fraudulently obtaining sensitive information by using artificial intelligence. (Form 10-K, risk factors, filed Feb 22, 2024) | 1 filing | Feb 22, 2024 | Morgan Stanley · in their words → | SEC EDGAR ↗ |
| 34 | WaFd Bank | 1 | WaFd identifies its reliance on third-party technology and developments related to artificial intelligence as a risk to its forward-looking results. (Form 8-K, 8-K exhibit, filed Oct 16, 2026) | 1 filing | Oct 16, 2026 | WaFd Bank · in their words → | SEC EDGAR ↗ |
| 35 | Santander US | 1 | Santander says it uses AI and explores more uses, while warning third-party AI could cause false information, inefficiencies, liability and reputational harm. (Form 10-K, risk factors, filed Mar 2, 2026) | 1 filing | Mar 2, 2026 | Santander US · in their words → | SEC EDGAR ↗ |
| 36 | Eastern Bank | 1 | Eastern expects vendors to embed more AI and worries its third-party risk framework may not fully mitigate the resulting risks. (Form 10-K, risk factors, filed Mar 2, 2026) | 1 filing | Mar 2, 2026 | Eastern Bank · in their words → | SEC EDGAR ↗ |
| 37 | Live Oak | 1 | Live Oak says it may lack control over how third-party AI models are developed, trained and updated. (Form 10-K, risk factors, filed Feb 27, 2026) | 1 filing | Feb 27, 2026 | Live Oak · in their words → | SEC EDGAR ↗ |
| 38 | UMB | 1 | UMB has a TOPS committee overseeing risks from emerging technology including artificial intelligence, reporting up to its board risk committee. (Form 10-K, other, filed Feb 26, 2026) | 1 filing | Feb 26, 2026 | UMB · in their words → | SEC EDGAR ↗ |
| 39 | Atlantic Union | 1 | Atlantic Union says third-party AI models carry risks from opaque development, training data, and deployment practices. (Form 10-K, risk factors, filed Feb 26, 2026) | 1 filing | Feb 26, 2026 | Atlantic Union · in their words → | SEC EDGAR ↗ |
| 40 | First Citizens | 1 | First Citizens says AI presents unique risks, including third-party model development risks such as unauthorized training data and limited visibility into mitigation. (Form 10-K, risk factors, filed Feb 24, 2026) | 1 filing | Feb 24, 2026 | First Citizens · in their words → | SEC EDGAR ↗ |
Each row quotes one record from SEC EDGAR filings dataset; the “On this site” link opens the bank's own page or sub-page with every source. Banks absent from the table have nothing matching on the record this site holds.
How is this ranked?
Data: the SEC filings dataset (data/sec/quotes.jsonl): verbatim AI statements from 10-K, 10-Q, 8-K and DEF 14A filings of the banks' holding companies, each with its EDGAR link, filing date, section and topic.
Rule: Quotes whose verbatim text names third parties, vendors, suppliers or service providers. Score = such quotes; ties by distinct filings, then the newest filing.
Counts: 56 of 141 profiled banks qualify; the table shows the top 40; 64 distinct sources cited in the table. Data checked 2026-10-31; ranking template updated 2026-10-30.
What are the caveats?
The dataset holds the AI passages the extractor found in filings since January 2024; a bank with few quotes may say more in passages not captured. Quotes are verbatim; the one-line claim is the extractor's summary and links the EDGAR text.
Banks without a US SEC filer (most non-US groups, private and mutual banks) have no quotes and are absent.
Banks absent from the table have nothing matching on the record this site holds, which is not evidence that they do nothing. Each row links the bank's own page, where every entry carries its sources.
Which bank ranks first?
State Street leads with 5 filing quotes: State Street warns that developing new products incorporating artificial intelligence may impose costs, third-party dependencies and increased risks on the company. (Form 8-K, 8-K exhibit, filed Jan 17, 2025). Valley is second with 5.
How many large banks flag third-party AI risk in SEC filings?
56 of the 141 profiled banks (120 US, 21 non-US groups); the table shows the top 40. Among those listed, 40 are US banks and 0 non-US groups.
What counts, and what does not?
Quotes whose verbatim text names third parties, vendors, suppliers or service providers. Score = such quotes; ties by distinct filings, then the newest filing. Source: the SEC filings dataset (data/sec/quotes.jsonl): verbatim AI statements from 10-K, 10-Q, 8-K and DEF 14A filings of the banks' holding companies, each with its EDGAR link, filing date, section and topic.
Is this a measure of capability?
No. Every row is a sourced fact on the public record: what the bank, a regulator, a filing or an independent outlet has put on the record. The page does not rate how well anything works.
When was this checked, and how often does it update?
The data behind the table was last checked on 2026-10-31 (SEC EDGAR filings dataset). The page recomputes whenever that dataset changes and is republished with the site; it is never edited by hand.
When any of these banks moves on AI, you'll read it the next morning.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning