November 10, 2026

AI / FINTECH / CRYPTO / TECH

Evan Kessler

Evan covers AI models, agents, and the software around them. His articles examine permissions, operating costs, and the gap between a product announcement and a usable workflow.

Latest

Four questions for insurance AI governance: ownership, consumer harm, testing and examination records

AI · Oct 31

NAIC AI Model Bulletin: What Insurers Should Document

What the NAIC AI model bulletin says about governance, vendors and records, and why state rules matter.

Diagram of personal data feeding a pricing algorithm, with a product page showing the required notice that the price was set by an algorithm using personal data

Algorithmic pricing · Oct 29

New York's Algorithmic Pricing Disclosure Law, Explained

What GBL § 349-a requires when an algorithm uses personal data to set a price, who is exempt and how it is enforced.

Three steps under NYC Local Law 144, bias audit, public summary and notice, beside a grid of ten business days of notice before an automated hiring tool is used

NYC Local Law 144 · Oct 28

NYC Local Law 144: Bias Audits for AI Hiring Tools

What NYC's AI hiring tool law requires: a yearly independent bias audit, a public summary and advance notice.

NIST · Oct 27

NIST AI RMF Generative AI Profile: A Practical Guide

How to use NIST's four AI RMF functions and Generative AI Profile without treating them as a checklist.

Diagram of an AI supply chain in financial services: a financial firm that stays responsible, an AI vendor as the third party and a foundation model provider as subcontractor, above the five stages of the vendor relationship life cycle from planning to an exit plan.

AI governance · Oct 25

Third-Party AI Risk in Financial Services: What Regulators Say

Most financial firms buy their AI. Treasury's 2024 report and a 2026 proposal show what that means for vendor oversight.

Illustration of a bank support chat in which a customer says they did not make a charge, with two outcomes: the message is recognized as a notice of error and a case opens with the Regulation E investigation clock, or the bot misses it and the customer is stuck in a loop with no human

chatbots · Oct 24

CFPB on Chatbots in Consumer Finance: What It Means for AI Support

What the CFPB's chatbot report found and how its dispute and human-help concerns apply to AI support.

Flow diagram of controls that protect customer data in an LLM app: the signed-in customer, an access layer that runs with the user's permissions, masking of account and card numbers before the prompt and logs, and the model vendor, with logging, encryption and provider assessment underneath

LLM security · Oct 23

LLM Sensitive Information Disclosure in Fintech AI Apps

Why a system prompt cannot hide customer data, and the controls outside the model that can.

FINRA · Oct 22

FINRA Generative AI Guidance: Chatbots, Supervision and Rule 2210

How FINRA's supervision and communications rules apply to chatbots, AI-drafted content and AI review tools.

Diagram of an invoice passed through a JSON Schema to produce two schema-valid responses, one that matches the source and one with a wrong total and an invented rate

Structured outputs · Oct 20

LLM Structured Outputs: JSON Schema Validity Is Not Accuracy

How OpenAI and Anthropic enforce a JSON Schema, and the checks financial data extraction still needs.

Diagram: a supplier invoice with hidden instructions flows into a language model, followed by three controls that still hold (least privilege, human approval, deterministic output checks) and weaker filters that can be bypassed

Prompt injection · Oct 19

Prompt Injection in Financial LLM Apps: The Defenses That Hold Up

OWASP and NIST say prompt injection cannot be reliably filtered. These controls still protect financial data.

Diagram of the NYDFS Circular Letter 7 three-step fairness test, with a retest loop, and the three disclosures an applicant notice should include

NYDFS · Oct 18

NYDFS Circular Letter 7: What New York Expects From AI Underwriting

What New York expects when AI or outside data shapes insurance underwriting: fairness tests, governance and notices.

NYDFS · Oct 18

When a Fintech Needs a New York Money Transmitter License

A guide to New York money transmitter licensing, NMLS applications, funds-flow analysis, and DFS supervision.

Diagram: an application passes through a credit model to adverse action and a notice; specific reasons such as delinquent credit obligations qualify, while internal standards or a failed qualifying score do not.

Adverse action notice · Oct 16

AI Credit Denials and Adverse Action Notices: What ECOA Requires

A model-driven credit denial still needs specific, accurate reasons, even after the CFPB withdrew its AI circular.

Diagram of SR 26-2 scope: statistical models, non-generative AI and vendor models in scope; generative and agentic AI out of scope; lifecycle from development to monitoring

SR 26-2 · Oct 15

SR 26-2 Model Risk Management and Where AI Models Fit

The 2026 interagency guidance replaced SR 11-7 and left generative and agentic AI out of scope.

NIST AI RMF · Oct 14

How to Use the NIST Generative AI Risk Profile

A practical guide to turning NIST AI 600-1 into owners, release tests, monitoring and incident rules.

Diagram of a four-step retrieval pipeline over financial documents (parse, retrieve, generate, cite), the failure at each step, and three checks: filter by period, recompute figures, match each citation.

RAG · Oct 12

RAG for Financial Documents: Where Retrieval Breaks

What FinanceBench, DocFinQA and other studies found about retrieval over filings, and the checks that catch it.

Diagram of the New York RAISE Act: frontier developers that trained a model above 10^26 operations publish transparency reports and report incidents; large frontier developers with revenue above $500 million also publish a framework and file disclosures; deadlines of 72 hours, 24 hours, three months, 30 days and two years.

RAISE Act · Oct 11

New York's RAISE Act: What Frontier AI Developers Must Do

What the amended New York RAISE Act asks of frontier AI developers from January 1, 2027.

Diagram: three NYDFS documents from October 2024, October 2025 and May 2026 point into an existing Part 500 program of risk assessment, access controls, training and monitoring, marked no new requirements.

NYDFS · Oct 10

NYDFS AI Cybersecurity Guidance: What Three Letters Ask of Regulated Firms

How New York's financial regulator applies Part 500 to deepfakes, AI vendors and frontier models.

A hand holds a blank request card above a metal slot beside a green glass gate and a separate cabled device.

AI · Oct 8

LLM Function Calling Explained: Schemas and Permissions

A model requests a function call; your application executes it.

A hand above a payment approval switch, connected through a green gate beside an invoice.

AI agents · Sep 26

Before an AI Agent Makes a Payment: Permissions, Limits and Approval

An agent can prepare a payment. Separate controls must decide whether it is allowed to send it.