How does UMB govern AI risk, and how has its disclosure changed?
UMB governs AI through its existing risk structure rather than a dedicated AI body. The 10-K for 2025, filed February 26, 2026, places third-party and emerging-technology risk, 'including emerging technology (e.g., artificial intelligence)', under a Technology, Operations, Privacy and Security (TOPS) Committee co-chaired by CISO and chief privacy officer Justin Rainey and by Uma Wilson, chief information, bank product and operations officer; Rainey reports to Shannon Johnson, chief administrative officer and, since February 2026, chief risk officer. The 2026 proxy, filed March 12, 2026, gives the board Risk Committee, chaired by Kris Robbins, oversight of emerging-technology risk including AI. Both are new. The 10-Ks for 2023 and 2024 mentioned AI only once, as added risk when technology initiatives implicate AI or automation; the 2025 proxy and the third-quarter 2025 10-Q did not mention it. The 2025 10-K extends AI to privacy law, service providers' AI, controls over outside platforms and the warning that UMB's framework may not manage AI usage effectively. UMB publishes no AI principles, model inventory or bias-testing results, and its 2026 10-Qs add nothing on AI.[1][2][3][4][5][6][7][8]
Data as of Oct 16, 2026 · UMB profile updated Oct 13, 2026 · 12 sources cited on this page · 140 banks profiled on this site · Markdown
Which committees and officers oversee AI risk at UMB?
| Body or officer | Role in AI risk | Source date |
|---|---|---|
| Technology, Operations, Privacy and Security (TOPS) Committee | Management committee overseeing third-party and emerging-technology risk, including AI; co-chaired by the CISO/CPO and the chief information, bank product and operations officer | February 26, 2026[1] |
| Board Risk Committee | Ten independent directors chaired by Kris Robbins oversee the risk framework, including information security and emerging technology (including AI) | March 12, 2026[2] |
| Justin Rainey, CISO and chief privacy officer | Leads cybersecurity, business continuity, physical security, privacy and third-party risk; reports to the chief administrative and risk officer | 2025-2026[9][1] |
| Shannon Johnson, chief administrative officer and chief risk officer | Chief risk officer since February 2026; the CISO/CPO reports into this role | February 26, 2026[1] |
| Leroy Williams Jr., director | Risk Committee member; former global CIO of Ball Corporation and founder of CyberTekIQ | March 12, 2026[2] |
How has AI appeared in UMB's SEC filings?
| Filing | What it says about AI | Filed |
|---|---|---|
| 10-K for 2023 | One reference: technology initiatives that 'may implicate new technologies or solutions such as those related to artificial intelligence or automation' carry additional risk | February 22, 2024[3] |
| 10-K for 2024 | The same single technology-initiatives reference | February 27, 2025[4] |
| 2025 proxy | No reference to artificial intelligence | March 14, 2025[5] |
| 10-Q for Q3 2025 | No reference to artificial intelligence | October 30, 2025[6] |
| 10-K for 2025 | AI named under the TOPS committee remit and in risk factors on privacy and data-use law, service providers using AI, controls over outside platforms and technology initiatives | February 26, 2026[1] |
| 2026 proxy | Board Risk Committee oversight of emerging technology including AI | March 12, 2026[2] |
| 10-Qs for Q1 and Q2 2026 | No reference to artificial intelligence | April 30 and July 30, 2026[7][8] |
What does UMB do in practice, and what is not published?
The 2025 10-K warns that solutions using AI carry uncertain legal, data and privacy risk, that AI controls must adapt to reliance on outside platforms, and that the bank's risk framework 'may not' manage AI usage effectively.[1]
For customers, UMB's guidance covers AI-enabled fraud: romance scammers can generate realistic photos with AI, and social engineers can use AI to manipulate voice recordings or images.[10][11]
UMB has not published AI principles, a model inventory, validation or bias-testing results, or how the payment-fraud AI its fraud unit tested is governed.[1][12]
What does the UMB profile record on this topic?
The rows below are the entries of the UMB AI strategy profile that bear on this page, as of Oct 13, 2026; the profile holds the full record of 25 dated moves, 10 use cases and 23 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI oversight through the TOPS committee | Third-party and emerging-technology risk, including AI, overseen by a committee co-chaired by the CISO/CPO and the chief information, bank product and operations officer; AI named in privacy and operational risk factors. | In production | [1] |
| Information security and privacy programme under a named CISO/CPO | Justin Rainey leads an integrated programme covering cybersecurity, business continuity, physical security, privacy and third-party risk; he reports to the chief administrative and risk officer and co-chairs the TOPS committee. | In production | [9][1] |
| Controls on AI used by service providers | The 10-K says solutions using AI carry uncertain law, data and privacy risk, and that AI controls must be adapted to reliance on outside platforms; the bank flags its own risk framework may not manage AI usage effectively. | In production | [1] |
| Privacy-law exposure from AI integration | Risk factor on privacy, data-use and security obligations, including those for integration with AI; named for the first time in the 2025 10-K. | In production | [1][4] |
| Board Risk Committee oversight of AI | Ten independent directors, chaired by Kris Robbins, oversee the risk framework including emerging-technology (including AI) risk; the CAO/CRO sits on the management TOPS committee. | In production | [2][1] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Jul 30, 2026 | Q2 2026 10-Q has no AI language | The quarterly report contains no reference to artificial intelligence, as in the Q1 filing. | [8] |
| Apr 30, 2026 | Q1 2026 10-Q has no AI language | The quarterly report filed the day after the call contains no reference to artificial intelligence. | [7] |
| Mar 12, 2026 | 2026 proxy: Risk Committee oversees AI risk | The board Risk Committee, chaired by Kris Robbins, oversees the risk framework including information security and emerging technology (including AI). | [2] |
| Feb 26, 2026 | 2025 10-K: AI named seven times | Up from one mention a year earlier; AI now appears in risk factors on privacy law, third-party service providers, internal controls, technology initiatives and the TOPS committee remit. Shannon Johnson is listed as chief administrative officer and, since February 2026, chief risk officer. | [1][4] |
| Feb 26, 2026 | 2025 10-K: AI under the TOPS committee | Emerging technology such as AI is overseen by the Technology, Operations, Privacy and Security Committee within enterprise risk; AI or automation in technology initiatives is flagged as added risk. | [1] |
| Apr 28, 2025 | UMB profiles its CISO and chief privacy officer | Justin Rainey, with more than two decades in information security and privacy, holds the dual CISO/CPO role. | [9] |
| Feb 27, 2025 | 2024 10-K carries one AI reference | Artificial intelligence appears once, in the risk factor on technology initiatives that may implicate AI or automation. | [4] |
Who oversees AI risk at UMB?
Management oversight sits with the Technology, Operations, Privacy and Security Committee, co-chaired by CISO and chief privacy officer Justin Rainey and chief information officer Uma Wilson. At board level, the Risk Committee chaired by Kris Robbins oversees emerging-technology risk including AI, per the 2026 proxy statement.
When did UMB start disclosing AI risk?
UMB's 10-Ks for 2023 and 2024 mentioned AI only once, as an added risk in technology initiatives. Its 2025 proxy and third-quarter 2025 10-Q did not mention AI. The 10-K filed February 26, 2026 and the proxy filed March 12, 2026 added AI to committee remits and to several risk factors.
Does UMB have AI principles?
No published AI principles, responsible-AI policy or model inventory were found. UMB governs AI through its enterprise risk framework, the TOPS committee and the board Risk Committee, and its 10-K warns that the framework may not manage AI usage effectively.
What does UMB tell customers about AI fraud?
Its consumer guidance warns that romance scammers can use AI to generate realistic profile photos and that social engineers can use AI to manipulate voice recordings or images. UMB has not described AI in its own fraud monitoring beyond the proof of concept its fraud unit reported in 2025.
- UMB Financial Corporation Annual Report on Form 10-K for the fiscal year ended December 31, 2025
- UMB Financial Corporation 2026 Proxy Statement (DEF 14A)
- UMB Financial Corporation Annual Report on Form 10-K for the fiscal year ended December 31, 2023
- UMB Financial Corporation Annual Report on Form 10-K for the fiscal year ended December 31, 2024
- UMB Financial Corporation 2025 Proxy Statement (DEF 14A)
- UMB Financial Corporation Quarterly Report on Form 10-Q for the quarter ended September 30, 2025
- UMB Financial Corporation Quarterly Report on Form 10-Q for the quarter ended March 31, 2026
- UMB Financial Corporation Quarterly Report on Form 10-Q for the quarter ended June 30, 2026
- Take the road less traveled: Justin Rainey's career journey to UMB
- How to identify an online romance scam and stay safe in 2026
- How to protect yourself from social media scams
- The Most Powerful Women to Watch, No. 15, Uma Wilson, UMB Bank
When UMB moves on AI, you'll read it here first.
when one of the banks we cover moves on AI, it is in the next morning's brief · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning