# AI for Fintech and Payments: Where It Pays and Where the Rules Bite

*In fintech and payments, AI pays first in support. The same questions come in each day, about transfers, fees, holds and payouts. It also pays in winning back failed payments. Then comes reading onboarding papers. The closer it gets to moving money or deciding credit, the more rules apply. So climb one rung at a time.*

By Cameron Sullivan, Founder & CEO, Techify AI · October 15, 2026 · 11 min read

> **Key takeaways**
>
> - An estimated 37% of people in the US used a bank's chatbot in 2022. The CFPB, the US watchdog for consumer finance, names the main risks. Bots miss disputes. They give wrong answers. And they trap people in "doom loops" with no way to a human.
> - Regulation E is the US rule for electronic money transfers. Under it, a spoken notice of an error counts. The firm then has 10 business days to look into it. It can take up to 45 if it puts the money back for now. Say an agent hears "I didn't make this charge." It must treat that as a notice.
> - The FTC's Safeguards Rule covers finance firms that aren't banks. They must encrypt customer data. They must use multi-factor login, a second check past the password. They must also keep watch over the vendors they use. That includes an AI vendor and the model firm behind it.
> - Take a fintech of 5 to 50 people. Give it a support agent that works across its chat channels. We estimate that agent is worth $100,000 to $400,000 or more in year one. It takes 40 to 60% of the repeat questions off founders and staff.
> - Credit decisions carry the strictest rule. Regulation B covers adverse actions, such as turning down an applicant. The lender must give the specific main reasons. A missed score on the lender's system is not one of them.

Start where the answer already exists. In a fintech or payments firm, that means three places.

First, the support queue. When will my payout land? Why is this transfer on hold? What does this fee mean? Second, the failed card payment that needs a reminder at the right hour. Third, the onboarding form someone has to read.

AI does those well. And the rules that apply are ones a good support team follows now.

Each step toward acting on an account pays less. It also costs more to run safely. The same goes for moving money or deciding who gets credit. So build from the bottom. First the AI answers. Then it reads the user's own account. Then it acts, with a yes from the user. Leave moving money and credit decisions with people. Wait until the lower rungs have earned their keep.

## The Autonomy Ladder: what AI should do in fintech, rung by rung

We sort each fintech use onto four rungs, drawn at the top of this page. Each rung adds a skill, and each one adds rules.

| Rung | What the AI does | Rules that apply | Who approves |
|---|---|---|---|
| 1. Answer | Answers from your help docs, with a citation (a link to its source) | The CFPB's chatbot findings: right answers, and a route to a human | The agent, inside approved topics |
| 2. Read | Looks up the user's own account: payout date, transfer status | Identity checks, the FTC Safeguards Rule, PCI DSS if card data is near | The agent, once it has checked who the user is |
| 3. Act | Updates a card, retries a payment, opens a dispute case | Regulation E's error clock, and an audit trail for each action | The user, who confirms each action |
| 4. Move or decide | Refunds, credits, approvals, credit decisions | Regulation B's specific reasons, and anti-money-laundering (AML) controls | A person, each time |

The ladder is the plan as well as the map. Start on rung one and a team learns three things. It learns where its help docs are wrong. It learns how users really phrase things. And it learns which questions a machine should never answer. All three are needed before rung three is safe.

A team that starts on rung four learns them too. It just learns them in front of a regulator.

## Where AI pays in fintech, ranked

This ranking is for a fintech or payments firm of 5 to 50 people. It goes by value. It also goes by how soon each use pays back.

1. **Support on the repeat questions (rung one).** The same questions come in through Slack, WhatsApp, email and the app. The founder answers them. No one else knows how. A support agent takes 40 to 60% of those questions off founders and staff. For a team that size, we estimate it is worth $100,000 to $400,000 or more in year one.
2. **Answers that use the account (rung two).** "Where is my payout?" needs the user's own record. That means identity checks and access rules. It means the Safeguards Rule in full. It's worth it once rung one is stable.
3. **Billing and failed-payment recovery (rung three).** Trials that turn into paid plans. A reminder at the right time after a card fails. A self-serve portal, so the user fixes it with no ticket. The card number never touches the AI. We estimate a billing layer like this is worth $100,000 to $1 million or more. That is per year, and it depends on scale. Much of that comes from three things. Billing runs itself. A newsletter writer is built to cut content time by 60 to 80%. And a web app keeps subscriptions out of the app stores. That keeps them out of the stores' 15 to 30% cut. On one fintech product, we built that layer. It has self-serve signup. Trials run 7, 14, 15 or 30 days. Staff can override the length for any one user. It has Stripe subscriptions. Its reminders step up after each failed payment. There is a web app that works on phones. And there is an admin dashboard where staff can review each answer.
4. **Dispute intake (rung three).** The agent spots the dispute and logs it with the time. It opens the case and hands it to a person. The value is the fine you never pay.
5. **Onboarding and document checks (rung three).** It reads the ID and the business papers. It pulls out the fields and flags what doesn't match. A person approves.
6. **Fraud scoring and credit decisions (rung four).** These are the biggest prizes in the field. They carry the heaviest rules. Most teams this size buy fraud scoring. They get it from their processor or an outside expert. Credit decisions stay with an underwriter, the person who judges credit risk. The model they use is one they can explain.

## How a fintech support agent should be built

The pattern that holds up starts with a knowledge base. That is the set of written answers the agent draws on. Your team wrote it, across chats and docs. It is cleaned, then indexed so it can be searched. The agent answers only with a citation. And it hands off when it isn't sure.

- **One source of truth.** Pull the answers out of where they live, into one index. That means Slack threads, chat groups, help docs and policy PDFs. Note where each one came from.
- **Clean it first.** Before indexing, run a step that finds personal data in the history. That way, an account number from a 2024 thread stays out. It never ends up in someone else's answer.
- **Answer with the source.** Each answer carries the snippet it came from. That is how staff catch an old fee table. The design is in [RAG with citations](/insights/rag-with-citations).
- **A confidence line, not a guess.** The agent scores how sure it is. On an approved topic, that score may fall below a set line. Then it says so and hands off. On our build, the line was set at 95%.
- **Watch the dashboard.** It shows the top questions. It shows the deflection rate and the spread of scores. Deflection rate is the share of questions the agent closes with no person. The three tell you which docs to fix next.

At one payments firm, the founders kept answering the same questions. The questions came in on Slack, WhatsApp and Telegram. We built one knowledge base. It drew on those channels and on the docs the team uploaded. It has a dashboard of what is asked and what is deflected. It has a path to a person. It was built to cut repeat questions by 40 to 60%. And it was built to send a first reply in under 10 seconds.

Most of the value is kept or lost at the handoff. Hand a person the whole thread and the agent's draft. They can close it in a minute. The longer case for that is in [how to reduce churn with AI customer support](/insights/reduce-churn-with-ai-customer-support).

## The sentence your agent must not miss

The CFPB looked at chatbots in consumer finance. Its report came out in June 2023. It is plain about where they fail. Scripted bots may miss a dispute. They log it only if the user says certain words. And they may not notice a user claiming their rights under US law.

A large language model, or LLM, is the AI behind today's chat tools. It is better at hearing "that wasn't me," however it's said. It still has to act on it.

Reg E sets the clock. A notice of error can be spoken or written. It counts if it reaches the firm in time. That means no later than 60 days after the firm sent the statement that shows the error. Then the firm has 10 business days. In that time it looks into it and decides. It has 3 more to report the result. And it has 1 to fix an error it finds.

It can take up to 45 days instead. But it must give provisional credit within those 10 business days. That means it puts the money back for now, while it looks.

So the design rule is short. Say a message reads as a dispute of an electronic transfer. The agent stops answering and opens a case. The case holds the time, account, amount and date. It also holds the user's own words. Then it goes to the team that owns disputes.

The agent doesn't argue. It doesn't troubleshoot. It doesn't ask the user to come back later. Card disputes and credit card billing errors have their own rules. The same reflex applies.

## The rules that apply to AI in fintech

The FTC is the US trade watchdog. PCI DSS is the card brands' rule book for keeping card data safe. SOC 2 is an outside report on how well a vendor guards data.

| Rule | Who it covers | What it means for an AI system |
|---|---|---|
| Regulation E (12 CFR 1005.11) | Firms that handle consumer electronic money transfers | A spoken notice of error starts the clock. Spot it, log it, route it |
| Regulation B (12 CFR 1002.9) | Lenders | An adverse action, such as a denial, needs the specific main reasons. "Internal standards" or a missed score is not enough, so a credit model has to be explainable |
| FTC Safeguards Rule | Finance firms that aren't banks and fall under the FTC, from lenders and brokers to account servicers and wire transfer firms | A written risk assessment. Encryption at rest and in transit. Multi-factor login. Oversight of each service provider. And notice to the FTC no later than 30 days after a breach of 500 or more consumers' unencrypted data |
| PCI DSS | Anyone who stores, handles or sends card data | Keep card numbers out of prompts, transcripts and logs. Hand card entry to the processor's hosted page |
| The CFPB's chatbot findings | Consumer finance | Right answers, a route to a human, and noticing when a customer claims their rights |
| SOC 2 | Not a law, but a question buyers ask | A report from an independent CPA firm. Type I is a point in time. Type II covers a period |

This is not legal advice. It is the list your lawyer will start from. The design should answer each line of it. Do that before the first user types a question.

## What it costs to run

We scoped the support agent above at $50 to $500 a month in tools and model costs. Clients at 1,000+ daily AI interactions typically see all-in model costs of $200 to $1,200 a month. Those bills sit on their own accounts. So no one marks up the tokens.

Most fintech questions need only a small, cheap model reading the right doc. The costly model is for the few that need reasoning. And a handoff costs a person's time, not tokens. The full breakdown is in [what it costs to run an AI system](/insights/cost-to-run-an-ai-system).

The model isn't what takes the time. The time goes into the links to your ledger, your processor and your support desk. It goes into the access rules for rung two. And it goes into the test set. That is a few dozen real questions. Each has the right answer and source. You run it again after each change.

## What goes wrong with AI in fintech

| What goes wrong | What it looks like | The fix |
|---|---|---|
| A stale document becomes a confident answer | The fee changed in March and the help article didn't | A citation on each answer, and an owner for each document |
| A card number ends up in a log | A user pastes a card into the chat. Now it sits in your transcripts and in the model provider's request logs | Mask card numbers on the way in |
| A dispute is treated as a question | The agent explains how pending charges work to a user who just said the charge isn't theirs | Dispute spotting that stops the answer and opens a case |
| The doom loop | "Talk to a person," asked twice, still answered by the bot | One ask reaches a person |
| An action without a yes | The wrong plan cancelled, because the user had two | Read it back, ask, then act |
| Rung four on day one | Refunds, credits or approvals on the model's own say, before anyone knows how it fails | Climb the ladder one rung at a time |

## What to ask an AI vendor

- Which of our systems will the agent read? Which will it write to? What does it need a person to approve? Put the three lists in the contract.
- How does it spot a dispute or a notice of error? What exactly happens next? Show us a test.
- How is personal data found and masked before indexing? How are card numbers kept out of transcripts and logs?
- Who are your subprocessors, the model provider among them? How do you meet our Safeguards Rule duty to watch over them?
- Is each answer cited to a source doc we can open?
- What is the confidence line for a handoff? Can we see the spread on our own questions?
- How many asks does it take a user to reach a person?
- Whose accounts do the model, hosting and logs run on? If we leave, what do we keep?

A vendor who answers the first two with a test, not a slide, has built this before.

## When not to use AI in a fintech

**Light volume.** Fewer than 30 to 50 questions a week? A well-kept FAQ page does the job.

**Nothing written down.** The agent answers from your docs. Does the know-how live only in the founder's head? Write it down first.

**You want it to move money on its own.** An agent that answers and routes is a support system. One that issues refunds, credits or approvals with no person is another kind of system. It needs other controls. It belongs at the top of the ladder. It comes after each rung below it has run clean.

## FAQ

### Can AI handle payment disputes?

AI can spot a dispute, record it and route it. And it should. Under Regulation E, a spoken notice of error counts. The 10-business-day clock starts when the firm gets it. The inquiry and the decision belong to the dispute team. Build the agent to stop at once. The moment a message reads as a dispute, it opens a case.

### Does the FTC Safeguards Rule apply to a fintech's AI chatbot?

Yes, if the fintech is a finance firm that isn't a bank. It must also fall under the FTC. Then the rule covers the customer data the chatbot touches. That means a written risk assessment. It means encryption at rest and in transit. Data is locked when it is stored and when it moves. It means multi-factor login for anyone who reaches that data. And it means oversight of each service provider. The AI vendor and its model provider are two of them.

### How much does AI customer support cost to run for a fintech?

We scoped a support agent for a payments firm. It ran $50 to $500 a month in tools and model costs. Now take systems in production at 1,000+ daily AI interactions. Their all-in model costs typically run $200 to $1,200 a month. That is on the client's own accounts. The links to other systems cost more than the model. So does the test set.

### Can AI make credit decisions?

It can inform them. But Regulation B makes a lender give the specific main reasons for an adverse action. "You missed our score" is not enough. Nor is "you fell short of our internal standards." So a credit model has to give reasons a person can state and stand behind. That is why most teams keep the decision with an underwriter.

### Where should a fintech start with AI?

On the bottom rung. That means answering the repeat questions from docs the team has already written. Each answer has a citation, and a person is one ask away. It pays back soonest and carries the lightest rules. It also shows where the docs are wrong. You learn that before the system may read accounts or act on them.

## Sources

- Consumer Financial Protection Bureau, "Chatbots in consumer finance" (June 6, 2023): [consumerfinance.gov](https://www.consumerfinance.gov/data-research/research-reports/chatbots-in-consumer-finance/chatbots-in-consumer-finance/)
- Regulation E, 12 CFR 1005.11, procedures for resolving errors: [law.cornell.edu](https://www.law.cornell.edu/cfr/text/12/1005.11)
- Regulation B, 12 CFR 1002.9, notifications and the statement of specific reasons: [law.cornell.edu](https://www.law.cornell.edu/cfr/text/12/1002.9)
- Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know": [ftc.gov](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know)
- General facts: PCI DSS governs card data; SOC 2 is an attestation report issued by an independent CPA firm against the AICPA Trust Services Criteria, Type I at a point in time and Type II over a period.
- Build figures (anonymised) and modelled estimates are from Techify's build library. The $200 to $1,200 monthly model cost at 1,000+ daily AI interactions is a company figure.

## Related

- [How to reduce churn with AI customer support](/insights/reduce-churn-with-ai-customer-support)
- [How to make a RAG system cite its sources](/insights/rag-with-citations)
- [What it costs to run an AI system](/insights/cost-to-run-an-ai-system)