AI supervision in financial services: what CSBS and NFRA say, and the FINRA gap

Scope: two regulators documented, one not

The question asks about three regulators: the Conference of State Bank Supervisors (CSBS), China's National Financial Regulatory Administration (NFRA) and FINRA. The documents supplied for this guide cover only two of them. They are a framework page and a press release from the CSBS, and a notice from the NFRA. None of them concerns FINRA.

This guide therefore states no FINRA expectation. Anything said about broker-dealers would have to come from FINRA's own materials, which were not part of the source set. The rest of this guide reports only what the CSBS and NFRA documents say, and attributes each point to them.

CSBS: a discretionary examiner tool

The CSBS published its AI Supervisory Framework on September 16, 2026.

The framework page describes it as a tool for state examiners, and the wording is about examiner discretion. It says the framework is a "discretionary tool for state examiners to identify and understand AI at financial institutions, assess associated risks, and determine when a deeper review may be appropriate."

The CSBS press release states who the framework is aimed at. It says the resource supports state examiners in assessing AI use and risks at state-chartered banks and state-licensed nonbank financial institutions.

The framework page says it is scaled to the firm being examined. It states that the framework is designed to consider each institution's size, complexity, risk profile and use of AI.

The page also says adoption is not uniform. According to the CSBS, each state financial regulatory agency decides how far the framework is built into its own supervisory programs.

The documents do not call the framework a rule, and they set no deadlines or penalties. A firm's actual exposure depends on what its own state agency does with the framework.

CSBS: what the framework draws on and contains

The CSBS says the framework rests on existing AI risk management material. Its page names the National Institute of Standards and Technology's AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework and the U.S. Department of the Treasury's AI Lexicon.

The framework page lists several components. The first is a Core Examiner Guide. The page says it provides the core examination approach, with initial scoping questions, a document request list, and procedures covering governance and oversight, AI inventory and use cases, and generative AI and emerging use.

The page also lists an Examiner Work Program, which it describes as additional detail for applying the Core Examiner Guide. It lists a Source Support Document that identifies the materials used to develop the framework.

For nonbanks, the page lists separate supplements. It says they give additional guidance for reviewing third-party and vendor risk, model risk, and consumer protection at nonbank financial services companies.

The page further lists an AI Use Case Risk Tiering Worksheet. It describes the worksheet as an optional industry tool that supports a risk-based assessment of individual AI use cases.

The CSBS press release says the framework also tells firms what to expect. It states that the public release gives regulated institutions clarity on the general approach, the types of questions, and the information a state examiner may request about AI-based products, services and tools.

The CSBS also says firms can use the framework themselves. The page says institutions can use it to assess their own AI programs, establish sound AI governance and risk management, and prepare for examinations.

NFRA: the Guiding Opinions

The NFRA's notice is dated June 18, 2026. It announces the Guiding Opinions on the Safe Development and Application of Artificial Intelligence in the Banking and Insurance Industries.

The form differs from the CSBS item. The NFRA says the Guiding Opinions require banking and insurance institutions involved in AI development and application to promote compliant, transparent and trustworthy AI and to strengthen classified and tiered management.

The NFRA states the structure of the document. It says the Guiding Opinions set out 32 guiding measures across seven areas: governance framework, AI development and application, data governance, computing infrastructure, risk management, capability building, and safeguards and supervision.

The NFRA also names four principles that institutions shall follow. They are user accountability, independent and controllable development, pragmatism and efficiency, and safe development.

On development practice, the NFRA says institutions are required to improve their development, testing and evaluation systems. The notice says this includes whole-process management across the model development and deployment lifecycle.

NFRA: risk, security and supervision

The risk requirements are the most direct on security governance. The NFRA says institutions must bring AI-related risks into their comprehensive risk management systems.

The notice adds controls for high-risk uses and for third parties. It says institutions must set up human oversight and intervention mechanisms at critical stages of high-risk applications, and strengthen the management of outsourcing and supply chain risks.

Security and resilience appear in the sixth area. The NFRA says institutions are required to strengthen cybersecurity, data security and personal information protection, and to improve operational resilience and business continuity management.

The seventh area covers the regulator's own role. The NFRA says it and its local offices shall strengthen guidance and supervision and urge institutions to fully implement the AI risk governance requirements.

The notice also covers data governance and computing infrastructure. It treats the infrastructure items as encouragement rather than requirements for institutions. The page lists attachments, but their text is not reproduced in the material supplied, so the 32 individual measures are not available here beyond this summary.

What the documents leave open

Taken together, the two sources show different kinds of expectation. The CSBS material gives examiners an approach, a document request list and an optional worksheet, and leaves adoption to each state agency. The NFRA notice sets out requirements for institutions across seven areas. Both name governance, risk management and third-party or outsourcing risk as subjects of supervision.

Several things cannot be answered from these documents:

• The CSBS pages do not list specific security controls or technical standards beyond the frameworks they name as sources.
• Neither source gives enforcement dates, penalties or examination schedules in the text supplied.
• The NFRA summary does not say how "high-risk" AI applications are defined.
• Nothing in the source set describes FINRA's expectations for broker-dealers.

A security leader who needs the full detail should read the CSBS Core Examiner Guide and Examiner Work Program, the NFRA Guiding Opinions attachment, and FINRA's own published materials.