What changed between these versions
A substantive expansion and clarification. v2 broadens the scope of the study to include scams, adds the FCC and other agencies to consultations, and introduces new elements for evaluating technology differences and ensuring access to AI/ML tools. It also modifies the pilot program by adding an asset size eligibility requirement and a sunset clause with a follow-up report.
Overview
There are numerous changes, including several new subsections and significant modifications to existing provisions. · v2 expands the scope of the study, clarifies definitions, adds new requirements for the pilot program, and introduces additional reporting mechanisms.
The most significant changes in v2 include broadening the study's focus to encompass "scams" in addition to fraud, expanding the list of consulting agencies to include the FCC and other state/federal bodies, and adding a new requirement to evaluate how different fraud detection technologies compare. The pilot program for community financial institutions is now explicitly limited to those with less than $10 billion in assets and includes a new sunset provision with a mandatory post-pilot report. Several definitions and reporting requirements were also clarified or expanded to include considerations for privacy, error rates, and national security.
Major additions
This new element requires the study to specifically evaluate how various advanced fraud detection technologies differ in their use, effectiveness, costs, benefits, and other considerations outlined in subparagraphs (A) through (C).
This addition ensures a more granular and comparative analysis of the different technologies, providing a deeper understanding of their practical implications and suitability for various institutions. It will likely lead to more comprehensive recommendations regarding technology adoption.
This provision allows the Federal banking agencies to include a classified annex with the study report, to be provided to the relevant Congressional committees, if applicable.
This enables the inclusion of sensitive information that cannot be made publicly available, potentially providing a more complete picture to Congress without compromising security or proprietary data.
This new subsection establishes a sunset clause for any pilot program created under Section 4, mandating its expiration not later than 3 years after the submission of the Section 3(c) report. It also requires a follow-up report from the Federal banking agencies to Congress within 6 months after the pilot program's expiration, detailing findings, determinations, and recommendations, which may include a classified annex.
This addition introduces a clear timeframe for the pilot program, ensuring its temporary nature and requiring a formal evaluation of its outcomes. The post-pilot report will provide crucial data for future legislative or regulatory actions regarding fraud technology adoption by community financial institutions.
Deletions
In v1, the report was to be made publicly available "except for classified or supervisory information."
The explicit exception for classified or supervisory information from the public report was removed. However, a new Section 3(c)(2) was added to allow for a classified annex to be provided to committees, suggesting a shift in how sensitive information is handled rather than a complete removal of its consideration. The public report itself is now fully public.
This provision in v1 required the study to evaluate "interactions between fraud detection models and consumer protection laws."
This specific evaluation element was removed. It was replaced by a new, broader requirement in v2's Section 3(b)(3)(C) focusing on steps agencies can take to ensure access to AI/ML tools, shifting the focus from specific interactions with consumer protection laws to broader access considerations.
Modifications
The explicit inclusion of "scams" broadens the scope of the technologies to be studied and potentially the types of fraud they address. The removal of "other emerging technologies" might slightly limit the future-proofing aspect of the definition, focusing more on the listed categories.
Before
Defined "advanced fraud detection technology" to include a list of specific technologies "and other emerging technologies used to detect, prevent, or mitigate financial fraud."
After
Defined "advanced fraud detection technology" to mean "emerging technologies used to detect, prevent, or mitigate financial fraud and scams, including" a list of specific technologies. It removed "and other emerging technologies" and explicitly added "scams."
This change ensures that the study and pilot program apply only to credit unions that are federally insured, potentially excluding a very small number of non-insured credit unions from the scope of the Act.
Before
Defined "credit union" as a "State credit union or Federal credit union, as such terms are defined, respectively, in section 101 of the Federal Credit Union Act (12 U.S.C. 1752)."
After
Defined "credit union" as "has the meaning given the term 'insured credit union' in section 101 of the Federal Credit Union Act (12 U.S.C. 1752)."
This modification formally broadens the scope of the study to explicitly cover "scams" in addition to "fraud," aligning with the change in Section 2(1) and ensuring the study addresses a wider range of illicit financial activities.
Before
The title of the section was "STUDY ON ADVANCED TECHNOLOGIES IN FRAUD DETECTION AND PREVENTION."
After
The title of the section was changed to "STUDY ON ADVANCED TECHNOLOGIES IN FRAUD AND SCAM DETECTION AND PREVENTION."
The addition of the FCC and other Federal and State government agencies brings a broader range of expertise and perspectives to the study, particularly relevant for scams that often originate through communication channels. This could lead to a more comprehensive and inter-agency approach to fraud and scam detection.
Before
Required Federal banking agencies to consult with Treasury, FinCEN, FTC, BCFP, and appropriate law enforcement agencies.
After
Required Federal banking agencies to consult with Treasury, FinCEN, FTC, BCFP, the Federal Communications Commission, and other appropriate Federal and State government agencies, including appropriate law enforcement agencies.
This modification broadens the criteria for evaluating technology effectiveness to include "detection," "prevention," and "privacy," emphasizing a more holistic view of the technology's impact beyond just reducing losses. This highlights the importance of data privacy in fraud detection efforts.
Before
Required evaluation of "measurable outcomes relating to fraud reduction, loss mitigation, and consumer protection."
After
Required evaluation of "measurable outcomes relating to fraud detection, prevention, loss reduction, loss mitigation, privacy, and consumer protection."
The explicit inclusion of "error rates" as a barrier highlights a critical technical challenge in advanced fraud detection, particularly with AI/ML systems. Changing "regulatory uncertainty" to "regulation" suggests a focus on the impact of existing regulations rather than just the uncertainty surrounding them.
Before
Listed barriers including "cost, interoperability constraints, regulatory uncertainty, data access limitations, and liability concerns."
After
Listed barriers including "interoperability, data access, liability, error rates, and regulation." (Removed "cost", "constraints", "limitations", "concerns", changed "regulatory uncertainty" to "regulation", added "error rates").
This modification ensures the study considers the diverse nature of community financial institutions, recognizing that challenges and disadvantages may vary significantly between different types (e.g., small banks vs. small credit unions, or those with different business models), leading to more nuanced recommendations.
Before
(A) "challenges faced by community financial institutions in accessing or deploying advanced fraud detection tools"; (B) "whether economies of scale disadvantage smaller community financial institutions relative to large community financial institutions."
After
(A) "challenges faced by community financial institutions in accessing or deploying advanced fraud detection tools, including unique challenges faced by various types of community financial institutions"; (B) "whether economies of scale disadvantage smaller community financial institutions in general, or certain types of smaller financial institutions."
This modification explicitly ties the AI/ML study element back to the primary institutions covered by the Act, ensuring the focus remains on their specific applications and challenges.
Before
Required evaluation of "the use of artificial intelligence and machine learning models, applications, and tools in detecting fraud patterns, anomalies, synthetic identity fraud, and real-time payment fraud."
After
Required evaluation of "the use by insured depository institutions and credit unions of artificial intelligence and machine learning models, applications, and tools in detecting fraud patterns, anomalies, synthetic identity fraud, and real-time payment fraud."
This represents a significant shift in focus. Instead of analyzing potential conflicts or compliance issues with consumer protection laws, v2 directs the agencies to proactively identify strategies for facilitating access to these advanced technologies, particularly for smaller institutions and their vendors.
Before
Required evaluation of "interactions between fraud detection models and consumer protection laws."
After
Required evaluation of "steps Federal banking agencies can take in coordination with other relevant government agencies and the private sector to ensure access by insured depository institutions and credit unions, including community financial institutions and their third-party vendors, to such models, applications, and tools."
This modification requires a more balanced and comprehensive assessment of regulatory impacts, considering both the positive and negative effects of supervisory expectations on innovation, while also ensuring that necessary safeguards are maintained.
Before
Required evaluation of "whether existing supervisory expectations create barriers to innovation."
After
Required evaluation of "what benefits and risks arise from existing supervisory expectations with respect to innovations in fraud detection and prevention, including whether existing supervisory expectations create barriers to innovation while maintaining relevant safeguards."
This ensures that any regulatory support for technology adoption is not pursued in isolation but is explicitly aligned with broader policy goals of consumer protection, privacy, financial stability (safety and soundness), and national security, potentially adding more constraints or considerations to future guidance.
Before
Required evaluation of "the need for interagency guidance, regulatory clarity, or safe harbors to support technology adoption."
After
Required evaluation of "the need for interagency guidance, regulatory clarity, or safe harbors to support technology adoption in a manner that promotes fraud detection and prevention consistent with consumer protection, privacy, safety and soundness, and national security."
This means the main report will be fully public, increasing transparency. Sensitive information can still be conveyed to Congress via the new classified annex.
Before
Required the report to be publicly available, "except for classified or supervisory information."
After
Required the report to be publicly available, without the exception. (The exception was effectively moved to a new classified annex provision).
Similar to Sec. 3(b)(6)(B), this ensures that all recommendations stemming from the study are framed within the context of promoting fraud detection and prevention while upholding consumer protection, safety and soundness, and national security, potentially influencing the nature and scope of future policy proposals.
Before
Stated recommendations "which may include" a list of proposals.
After
Stated recommendations "that promote fraud detection and prevention consistent with consumer protection, safety and soundness, and national security, which may include" a list of proposals.
While subtle, removing "responsible" might slightly broaden the scope of AI use encouraged, or at least remove an explicit qualifier that could have been interpreted as a limitation. It could imply a greater emphasis on adoption, with the consistency requirements in 3(c)(3) providing the necessary guardrails.
Before
Recommended "guidance or safe harbors to encourage responsible artificial intelligence use in fraud prevention."
After
Recommended "guidance or safe harbors to encourage artificial intelligence use in fraud prevention."
This aligns the title with the broader scope of "community financial institutions" which includes credit unions, ensuring consistency with the definitions and the overall intent to support both types of institutions.
Before
The title of the section was "COMMUNITY BANK FRAUD TECHNOLOGY PILOT PROGRAM."
After
The title of the section was changed to "COMMUNITY FINANCIAL INSTITUTION FRAUD TECHNOLOGY PILOT PROGRAM."
The change in trigger ensures the pilot program starts after the formal report is submitted, not just the study. The asset size limitation significantly narrows the eligibility for the pilot program, focusing resources specifically on smaller community financial institutions, which are likely to face more significant challenges in adopting advanced technologies.
Before
Stated the pilot program could be established "Not later than 1 year after submission of the study under section 3".
After
Stated the pilot program could be established "Not later than 1 year after submission of the report required under section 3(c)". It also added "for insured depository institutions and credit unions with less than $10,000,000,000 in total consolidated assets".
Scope
Meaningful expansion or narrowing — Changes are scattered throughout the bill, affecting definitions, the scope and elements of the study, the reporting requirements, and the pilot program. — v2 represents a refinement and expansion within the same policy direction. It broadens the scope of the study to include scams and a wider range of consulting agencies, and it refines the pilot program's eligibility and adds a sunset clause, but the core purpose of studying and facilitating advanced fraud detection technology remains consistent. — The changes to definitions (Sec. 2) and the study's scope (Sec. 3) directly interact with and inform the subsequent sections, particularly the pilot program (Sec. 4), by clarifying which institutions and types of illicit activities are covered. The addition of consistency requirements for recommendations also influences how future policy will be shaped.
Impact analysis
Insured depository institutions and credit unions (general)
Procedural change and expanded scope.
The study's scope is broadened to explicitly include "scams" and to consider "privacy" as a measurable outcome, requiring a more comprehensive analysis of their technology use.
Community financial institutions (general)
Procedural change and increased specificity in analysis.
The study will now specifically consider "unique challenges faced by various types of community financial institutions" and "certain types of smaller financial institutions" regarding access to technology.
Community financial institutions with less than $10,000,000,000 in total consolidated assets
Gain (focused support) and narrowing of eligibility for larger community financial institutions.
These institutions are now explicitly designated as the sole eligible participants for the voluntary pilot program.
Federal banking agencies
Increased responsibilities and procedural changes.
Required to consult with additional agencies (FCC, other state/federal agencies) for the study. New requirements for the study elements (e.g., comparing technologies, ensuring access to AI/ML tools). New reporting requirements for a classified annex and a post-pilot program report.
Public and Congressional committees
Gain (increased transparency and information).
The main study report will be fully public, without exceptions for classified/supervisory information (which can now be provided via a classified annex to committees). A new post-pilot program report will also be publicly available.