Banks and Credit Unions Utilizing Ineffective Chatbots May Risk Violating Federal Law

In an October 2023 advisory opinion, the Consumer Financial Protection Bureau (CFPB) put large banks and credit unions on notice that the use of chatbots and other technologies could increase the risk of violating federal law if those services are ineffective. As we have previously written about, the CFPB’s advisory opinion interprets Section 1034(c) of the Consumer Financial Protection Act (CFPA), which generally requires certain financial institutions to respond to a consumer’s request for information concerning a consumer financial product or service in a timely manner. The statute applies to “insured depository institutions and credit unions that offer or provide consumer financial products or services and that have total assets of more than $10 billion.”

While the focus of the advisory opinion is the CFPB’s view that charging fees in connection with information requests unreasonably impedes consumers’ ability to request and receive account information, there are numerous other aspects of the advisory opinion that are notable and worth addressing. While it did not take up much space in the actual opinion, one important piece is how the use of emerging technologies, particularly chatbots, could pose risk to large banks and credit unions when it comes to compliance with Section 1034(c).

Keeping with the rationale that unreasonably impeding a consumer’s ability to request and receive account information would be a violation of Section 1034(c), the CFPB explains that “[l]arge banks and credit unions may violate section 1034(c) if they employ technologies that do not properly recognize consumer information requests or that provide inaccurate or incomplete information in response to those requests.” The CFPB cautions that “the absence of appropriate checks and quality assurance processes” can result in requests that are inadvertently misdirected or responses that are inadequate.

That is not to suggest that large banks or credit unions should necessarily steer clear of new technologies or shy away from the use of chatbots. The CFPB acknowledges that “[c]hatbots or other automated responses may serve to expedite responses in some cases.” However, understanding that those technologies can introduce risk when they aren’t operating properly is important and should result in large banks and credit unions focusing more on these services in the short and long term. To ensure that the potential risk of violating Section 1034(c) is mitigated, covered entities must ensure that interactive technologies are properly structured and are monitored over time so that they facilitate consumer requests for information and do not inhibit them.

Even though Section 1034(c) has been operative since the CFPA was signed into law by President Barack Obama in July 2010, this advisory opinion is the CFPB’s first guidance regarding the law and, to date, no supervisory findings or enforcement actions have been issued or pursued related to Section 1043(c). However, the CFPB noted in its advisory opinion that “[a]s a matter of prosecutorial discretion, the CFPB does not intend to seek monetary relief for potential violations of section 1034(c) that occur prior to February 1, 2024.” Therefore, large banks and credit unions should take the time now to validate how existing technologies are performing and recognize that consumer requests for information submitted through a chatbot or other form of interactive technology are likely to implicate federal law.