America’s new banking risk regulation overlooks AI and shifts the burden of defence

In April 2026, U.S. banking regulators issued SR 26-2, replacing a 15-year-old model-risk standard with a more proportional approach while explicitly excluding generative and agentic AI pending separate guidance. The author argues the change transfers the burden to banks to defend their governance choices, even as examiners continue to scrutinize AI systems; a 2025 Massachusetts settlement with Earnest Operations LLC totaled $2.5 million over alleged harms tied to AI underwriting. A survey of 230 banking professionals found nearly three in four could not confirm they could shut down a malfunctioning AI model or report an AI failure to regulators.

Analysis

The market mechanism is not an immediate sector-wide compliance shock: a principles-based standard can reduce process burden where banks can justify lighter controls. The asymmetry is in deployment-heavy lenders: if examiners treat the AI exclusion as no shelter from existing supervisory authority, weak audit trails could turn into remediation costs, slower product rollouts, or consumer-redress exposure before formal AI rules arrive. That creates a potential valuation discount for banks whose consumer-credit economics depend on automated underwriting, but the article does not identify exposed institutions or establish that supervisory findings are already broad-based.

Near term, the author’s account of supervisory questions is a watch signal, not proof of an industry-wide enforcement cycle. Over 1–3 months, disclosed exam findings, control spending, or guidance on AI deployment would be the catalysts. Over 6–18 months, continuous monitoring and decision-traceability requirements could benefit governance and data-observability vendors, but the article supplies no evidence of contract winners or material revenue contribution.

Contrarian point: the omission of AI-specific rules may delay standardized compliance spend, while proportionality may ease requirements for simpler models. A broad bank short is therefore poorly supported. The thesis weakens if banks report no incremental remediation or deployment constraints across upcoming results and regulatory communications.

Key Decisions for Investors

• Do not make a broad directional short in banks on this article alone. The regulatory burden is conditional and may be offset by proportionality.
• Use KBE as a relative-value hedge only if bank disclosures or supervisory communications confirm AI-related remediation or deployment delays: short KBE against XLF rather than taking an outright sector position. Exit the hedge if the next two reporting cycles show no material findings or cost increases; the main risk is that the catalyst never broadens beyond isolated cases.
• Track consumer lenders’ disclosures for underwriting-model governance, adverse-action notice remediation, and changes to automated decisioning. Treat those as exposure indicators, not assumed liabilities; avoid selecting a company-specific short without that evidence.
• Keep governance/observability software on a watch list, but require named bank wins or measurable revenue contribution before buying the theme. The article’s compliance-spending thesis is plausible but does not identify beneficiaries.