A UDAAP compliance program with agents: what none of them may decide

A UDAAP compliance program is the part of a bank's compliance management system that prevents, finds and corrects unfair, deceptive or abusive acts or practices: written policies, training, monitoring and audit, a complaint process that looks for UDAAP signals, and board and management oversight of all four. Examiners rate it by the evidence it leaves, which is why so much of the work is evidence work: capturing what customers see, listing every claim and fee, checking each against the documents, and noticing when something changes. That part can now be done by AI agents. The part that cannot is judgment, and it is where the line in a program run with agents has to be drawn. Botminds' UDAAP Risk Assessment uses eight agents to walk, read, compare, rate and draft; none of them may decide whether a practice crosses a line, sign a launch or send anything to a partner. A compliance officer decides every note, and a different person signs.

What is a UDAAP compliance program?

It is the set of controls by which a bank keeps UDAAP risk within what its board accepts. The OCC's examiners look for a consumer compliance program that "adequately identifies, measures, monitors, and controls the bank's UDAP and UDAAP risks through components including policies and procedures, training, monitoring and audit, and customer complaint response processes", scaled to the bank's "size, complexity, and risk profile" (OCC Comptroller's Handbook, UDAP and UDAAP). The FFIEC rating system adds board and management oversight, change management and self-identification of issues (FFIEC rating system).

The CFPB's examiners test the same structure from the other side. Their procedures ask whether "The entity's internal control processes are documented" and whether "Computer programs are tested and documented to ensure accurate and timely disclosures to consumers" (CFPB Supervision and Examination Manual, UDAAP). Neither manual asks how the evidence was gathered. Both ask whether it exists, and whether someone accountable acted on it.

What should a UDAAP policy include?

A UDAAP policy should name who owns UDAAP risk, which products and activities it covers, how new and changed products are reviewed, how complaints are analysed, and who may accept a risk. The OCC lists the policies that typically carry UDAAP controls: lending, deposit products and account management, deposit-related credit including overdraft, third-party risk management, marketing including promotional offers, incentive compensation, complaint resolution and whistleblowing.

What does a UDAAP review cover?

Everything a customer meets, and everything that tells the customer something. Beyond advertising and new products, the CFPB's procedures ask whether the entity "evaluates initial and subsequent disclosures, including customer agreements and changes in terms", "has a thorough process for receiving and responding to consumer complaints", and "evaluates servicing and collections for UDAAP concerns." The OCC's monitoring list adds "sales scripts, and call recordings" and "Product or service delivery in conformance with stated objectives and customer disclosures."

The last item is the one most programs struggle with. The OCC suggests the audit or compliance function "compare applicable disclosures with marketing materials, sales calls, and operations for consistency between disclosed information and how a product or service is marketed or what occurs through operational processing." That is a comparison across many documents and many screens, done for every new or changed product, which is precisely the kind of work that is slow by hand.

Can AI review marketing for UDAAP?

AI can gather and compare the evidence; it should not be the reviewer. The case for caution is measured. A peer-reviewed study of AI legal research tools, built on retrieval to reduce invented answers, found that each leading product gave a hallucinated answer to between a sixth and a third of the questions (Magesh et al., Journal of Empirical Legal Studies, 2025; the study is quoted inChatGPT for AML compliance). A UDAAP judgment that rests on a misread clause is worse than none. The answer is not to avoid AI but to require that every statement an agent makes cite the passage it rests on, and to keep the decision with a person.

Supervisory guidance leaves the design to banks. The agencies' revised model risk guidance of April 2026 describes itself as setting no enforceable standards, says it generally does not reach banks of $30 billion or less unless their model risk is significant, and leaves generative and agentic AI outside its scope (FDIC FIL-15-2026; the guidance's own words are inthe customer risk rating model guide). The GAO notes that "Federal financial regulators have also begun using AI tools to oversee regulated entities and financial markets" (GAO-25-107197). Examiners will ask what the agents did and who decided; a program should be able to show both on any note.

What each agent in UDAAP Risk Assessment does, and what it may not do

The limits are written per agent, not as a general disclaimer, because each agent's failure mode is different. A walker that cannot load a screen must not guess what was on it; a document reader must not infer a term the agreement does not state; a standards agent must not turn a proposal into a decision.

Every step of the agents' walk, with what each read, how sure it was and whom it handed to

Who decides if a practice is unfair?

A person with authority, on the evidence, with legal advice where the question is close. The regulators keep that line for themselves: both the OCC and the FDIC decide UDAP and UDAAP questions on the particular facts, with their lawyers involved, rather than by formula (FDIC manual, VII-1). A bank's program should mirror that: agents propose, the compliance officer decides each note with a reason code, and a different person signs the launch decision and any accepted risk.

How do you monitor UDAAP risk, and how do complaints feed reviews?

Monitor the products already launched through complaints, refunds and changes, and route each signal back to the screen or the term that caused it. The OCC's handbook expects banks to analyse complaint data with "trend and pattern analyses" across products, lines of business, third parties and channels, and to use "key word searches or text analytics (such as 'unfair,' 'misleading,' 'deceptive,' 'abusive,' or 'cheat')." It also expects "appropriate root cause analysis ... for substantive complaints, even if there are only a small number of substantive complaints." The CFPB's manual puts the same point plainly: "even a single substantive complaint may raise serious concerns that would warrant further review."

In the solution, the Change watch agent reads complaint management each night and maps each theme to the journey and the screen. In the sample bank's settings five complaints on one theme within 30 days reopen a launched journey, and a reviewer may reopen earlier with a reason. Complaints carrying a BSA flag are never shown in the review. How the program's risks are scored is set out in the UDAAP risk assessment matrix.

Agents can read every screen, every clause and every complaint. What they cannot carry is accountability, so the program has to put a name on every decision they inform.

What records does a UDAAP program keep?

Enough to answer, for any product, what customers saw, what the bank concluded, on what evidence, and who signed. The CFPB's document request for a UDAAP examination includes training materials, product lists with fee structures and disclosures, policies, board and committee minutes, compensation arrangements, marketing in every medium, agreements with third parties that deal with consumers, complaint files, and "Documentation related to software development and testing, as applicable."

In the solution every agent step, decision and signature is kept with who, what, when, why and the evidence, for five years after a product is retired in the sample settings. Dismissed notes stay visible, struck through, so a reviewer of the agents can see what people overruled. The examiner pack exports a journey's screens by version, notes and sources, decisions and signers, change requests and agent versions, with personal data masked and confidential flags left out.

A decision with its reason code and the exact wording the partner must use

Where UDAAP Risk Assessment fits in your program, and where it does not

The solution covers the evidence-heavy parts of a UDAAP program for products customers meet on a screen: pre-launch review of new and changed journeys, version comparison, complaint mapping after launch, partner change requests and the examiner pack. It runs the bank's own rating model, confidence floor, review clock and reason codes, all of which are settings the administrator proposes and the chief compliance officer approves before they are in force.

It does not write the policy, train the staff, set the board's risk appetite or run the audit, though it gives the auditor a read-only trail to test. It does not decide anything. What the board should learn about the decisions that remain human is the subject of UDAAP training for the board of directors; to see the agents and their limits on one of your own journeys, start from UDAAP Risk Assessment.

Questions people ask

Can an AI agent approve a product launch?

It should not, and in the solution it cannot. The regulators apply UDAAP standards case by case with legal review, and the FFIEC rating system looks for accountable board and management oversight. Agents propose; a named compliance officer decides each risk and a different person signs.

What happens when the agents are unsure?

In the sample settings, the Standards agent makes no call below 0.80 confidence or when the customer's and the partner's readings disagree; the note goes to the compliance officer with the evidence and no proposal. The threshold is a setting the chief compliance officer approves.

How are AI agents in a UDAAP program audited?

By recording, on every note, which agent versions produced it, what each read, and how confident it was, and by keeping dismissed notes visible. An auditor can then filter the trail by agent and compare its proposals with the decisions people made.

Does model risk guidance apply to UDAAP review agents?

The agencies' revised guidance of April 2026 is not enforceable as such and generally does not apply to banks of $30 billion or less without significant model risk. Larger banks should expect their model risk function to ask how the agents are validated and monitored.

How many people does a UDAAP review need?

At least two for any launch: one to decide the risks and propose the decision, another to sign it. The sample bank adds a program manager as the only channel to partners, and an internal auditor with read-only access.