Financial regulators may turn to exams over rulemaking due to changes in technology and the law. According to the report, policymakers may find “policymaking by examination” more attractive as they face challenges in governing new technologies.
The traditional division of labor in financial regulation has generally been between Congress, expert agencies, and regulators. However, two developments are unsettling this framework: technology becoming harder to govern through rules, and the legal environment making formal rules less durable as a rule.
Challenges in Governing New Technologies
Artificial intelligence systems are probabilistic rather than deterministic, making it difficult for developers to predict how they will respond to a prompt or perform in new contexts. Financial institutions also increasingly rely on combinations of services assembled from other companies’ application programming interfaces (APIs), which can leave them dependent on third, fourth, and fifth parties over which they may have limited visibility or practical leverage.
These new technologies do not merely move quickly, but their risks can be difficult to identify with precision ex ante. Policymakers are beginning to learn that managing them requires continuous governance, including monitoring, operating boundaries, escalation procedures, and mechanisms for responding when outcomes deviate from expectations.
The U.S. Supreme Court has reinforced presidential control over financial regulators, making regulatory policy more responsive to changes in administration. Other decisions have weakened the finality of agency rules in court, including the Seila Law v. Consumer Finance Protection Bureau and Loper Bright Enterprises v. Raimondo cases.
Shaping Market Norms
Instead of relying on formal rules, policymakers will increasingly look to shape market norms by turning to supervision – essentially, creating policy via examination. Through examinations, regulators and supervised institutions can observe how technologies perform, determine which risks are material, and adjust as evidence accumulates.
Institution-specific judgments can also be repeated across examinations until they function as market-wide expectations, despite never being publicly articulated or meaningfully reviewed by the general public. This approach can provide a more adaptive and responsive way of regulating financial institutions, but it also raises concerns about legitimacy and accountability.
As supervision acquires greater policy influence, financial regulators need guardrails to ensure that the process is transparent, technologically capable, and risk-focused. The Consumer Financial Protection Bureau has published its Bayesian Improved Surname Geocoding methodology for fair-lending testing, which illustrates the potential for more structured and ongoing information flows.
Modern supervision also requires different expertise, including software engineers, AI specialists, cybersecurity experts, economists, and behavioral scientists alongside traditional examiners. The timing may be unusually favorable, with recent college graduates in technical fields facing higher unemployment rates than the broader population.
The supervision process must become more technologically capable and more transparent, with a system designed for continuously evolving technologies that cannot depend principally on static reviews and disclosure via periodic batches of PDFs. Regulators should move toward structured, ongoing information flows and machine-readable data, and publish clearer supervisory frameworks and tools.
Supervisory Perimeter Risks
Furthermore, policymakers need a supervisory perimeter that follows risk, asking not only who is subject to financial regulation but also who regulators can actually examine. Existing law provides some tools, such as the Bank Service Company Act, but Congress and regulators should ask where existing supervisory authority remains inadequate.
Greater supervisory influence requires greater accountability, with informal or opaque examination findings potentially delaying business activity and shaping institutional conduct without rulemaking’s safeguards. Congress and regulators should clarify when supervisory determinations become sufficiently final to permit review by federal courts.
Agencies should strengthen internal appeals processes so that institutions can challenge contested judgments before they harden into enforcement actions, ratings, or broader expectations. Accountability need not destroy the candid dialogue that makes supervision useful, and properly designed review mechanisms can preserve examiner discretion while preventing supervisory judgment from becoming shadow law.
The Corner Post v. Board of Governors of the Federal Reserve System case held that the statute of limitations period for challenging an agency rule begins when the challenger was first injured by that rule, not necessarily when the rule was issued. This means that even longstanding regulations may face fresh legal challenges years after agencies and market participants had treated them as settled.
Adapting to New Technologies
As regulators adapt to the changing environment, they will need to develop new skills and expertise to effectively supervise financial institutions. This includes recruiting specialists in areas such as cybersecurity and artificial intelligence, as well as developing new tools and methodologies for examining complex technologies.
The use of machine-readable data and structured information flows can help regulators to better understand the risks and performance of financial institutions, and to identify areas where additional guidance or oversight is needed. By publishing clearer supervisory frameworks and tools, regulators can also help to promote transparency and accountability in the supervision process.
Implementing Effective Supervision
One key challenge in implementing effective supervision is ensuring that the supervisory perimeter follows risk. This means that regulators need to have the authority and ability to examine not just financial institutions, but also other companies and service providers that may pose a risk to the financial system.