One auto lender reports agentic AI cut its approval cycle 88 percent. In April, federal regulators replaced the 15-year-old model-risk guidance and left generative and agentic AI out of its scope.

_{Sources
1 Auto Finance News | Auto Lenders Look to Agentic AI, 'Vibe Coding' in Underwriting, Compliance, Collections
2 Auto Finance News | Exclusive: Ken Garff Automotive Group Taps Arivo Acceptance as Captive
3 Automation Anywhere | AI in Lending: The Enterprise Playbook for Financial Institutions
4 FinTech Global | Agentic AI Targets the Friction Automation Can't Fix
5 OCC | Bulletin 2026-13, Model Risk Management: Revised Guidance
6 Federal Reserve | SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026)
7 FDIC | Agencies Issue Revised Model Risk Guidance
8 Davis Polk | Visual Memo: Key Changes Under the Federal Banking Agencies' Revised Model Risk Management Guidance
9 American Banker | Regulatory Silence on Generative AI Isn't a License for Inaction
10 CFPB | Circular 2022-03, Adverse Action Notification Requirements in Connection With Credit Decisions Based on Complex Algorithms
11 CFPB | CFPB Issues Guidance on Credit Denials by Lenders Using Artificial Intelligence
12 Multimodal | Explainable AI in Lending: What Regulators Expect in 2026
13 Bloomberg Law | Serta Ruling Offers Damages Road Map in Lender-on-Lender Disputes
14 Law360 | Lenders Left Out of Serta Uptier Deal Win $400M in Ch. 11 Suit
15 The Baltimore Banner | Ex-Maryland Bank CEO Sued in NFL Player Lending, Identity Theft Scam
16 ESPN | Report: Penix, Njoku, McKinney Used by Ex-Bama DE for Fraud
17 Brewbound | Uncle Nearest's Receiver Turns Fraud Narrative Back on Lender, Alleges Farm Credit Mid-America Ignored Red Flags
18 The Spirits Business | Uncle Nearest Receiver Claims Lender 'Ignored Red Flags'
19 OCC | OCC Issues Updated Model Risk Management Guidance (News Release 2026-29)
20 CFPB | Regulation B, 12 CFR 1002.9, Notifications
21 CFPB | Regulation B, 12 CFR 1002.2, Definitions
22 Taktile | Introducing Taktile AI Agents: The Future of SMB Credit Underwriting
23 Taktile | AI Agents in Commercial Credit Underwriting: A Responsible Deployment Guide}

The Arivo detail that traveled is the "vibe coding": a five-person Beta Team, mostly interns, building internal tools by describing them in plain language to Claude or Microsoft Copilot rather than writing the code by hand.¹ It is a good headline, but it is the smaller story. The larger one is where these tools are pointed. Auto lenders described using agentic AI across underwriting, compliance, and collections, the three functions that decide who gets financed, whether the file is defensible, and how a missed payment gets worked.¹

Agentic differs from the automation lenders already run. An automated rule fires when a condition is met. An agent is given a goal and left to plan and execute the steps to reach it: retrieve the documents, query the data sources, run the models, resolve the exceptions, and draft the underwriting memo, without a person signing off at each step.⁴ The demand is real because the manual load is real. IDC's 2026 lender study found roughly half of US underwriting is still done by hand, and named outdated credit-risk models, document collection, and compliance and KYC as the top three friction points lenders want to remove.⁴ That is the pressure pushing agents from the mailroom into the decision.

The performance claims are the reason this is a lead and not a footnote. Automation Anywhere reports its agentic underwriting workflows cut processing time by about 60 percent, with one automotive lender reducing approval cycles by 88 percent, and it describes collections deployments that match a human collector's recovery rate while logging far more consistent compliance, with resolution rates climbing into the 80-to-90 percent range in mature setups.³ Take those as the ceiling, not the floor. Every figure in that paragraph comes from a company that sells the software, measured on deployments it chose to describe, with the lender unnamed. None of it has been independently validated, and a buyer cannot pull the underlying files.

That gap is not a reason to dismiss the tools. It is the reason to govern them. An 88 percent faster approval cycle is a genuine operating gain if the declines it produces are lawful and the collections calls it places are compliant. It is a liability if they are not, and the speed only means the mistake scales faster. The discipline an operator needs here is the same one that separates a good forward-flow buyer from a burned one: trust the tape you can audit, discount the number you cannot.

For fifteen years, when an examiner wanted to know whether a bank's lending model was sound, the reference was SR 11-7, the 2011 interagency guidance on model risk management. On April 17, 2026, the OCC, Federal Reserve, and FDIC issued revised guidance, published as OCC Bulletin 2026-13 and Federal Reserve SR 26-2, that supersedes and replaces SR 11-7.^{5 6 7} The new document says plainly that generative and agentic AI models "are novel and rapidly evolving" and "are not within the scope of this guidance," and it directs firms to govern those tools through their own risk-management practices until the agencies issue a promised request for information on AI model risk.^{6 8}

Read that carefully, because it cuts against the intuition. The agencies did not ban agentic AI in lending, and they did not write rules for it. They replaced the old guidance and left this class of model out of scope, and the OCC noted the revised version is most relevant to banking organizations with more than $30 billion in assets.¹⁹ This is not a lawless zone: existing credit, fair-lending, contract, privacy, security, and state-law duties all still apply. What is missing is model-risk guidance built for agentic tools. For a bank, that means no interagency standard to point to during a model validation. For a non-bank alt-lender, which SR 11-7 never bound directly anyway, the practical effect is starker: the market's default reference for "is this model governed properly" now explicitly says these tools are someone else's problem to define. As one American Banker analysis put it, regulatory silence on generative AI is not a license for inaction; it is an instruction to build the controls yourself.⁹

There is a floor, and it is the part of the law that reaches the borrower rather than the examiner. Under the Equal Credit Opportunity Act and Regulation B, when a statement of reasons is required, those reasons must accurately reflect the factors that actually drove the decision.²⁰ The notification duty scales with the borrower: a business applicant with gross revenue of $1 million or less is generally owed a fuller adverse-action notice, while larger applicants and certain trade-credit and factoring arrangements are generally owed written reasons on a timely written request.^{20 21} The CFPB has said twice, in Circular 2022-03 and again in its 2023 guidance, that whatever the trigger, a creditor cannot escape the specificity requirement by claiming its model is too complex, too opaque, or too new to explain.^{10 11} "The black box decided" is not a lawful basis for an adverse action.

Put the two regulatory facts next to each other and the operator's position is clear. The model-risk guidance that told you how to validate a model stepped back from agentic AI, but the requirement to explain a covered decline in plain, specific language did not. An agentic underwriting stack that cannot say, for a given applicant, which factors drove the decision is not merely an unvalidated model. It is an adverse-action violation waiting for a complaint. Explainability stops being a data-science nicety and becomes the compliance artifact that keeps the lender out of an ECOA action.¹²

Inventory where an agent already touches a financing or collections decision. Most shops adopted these tools function by function, so no single person can name every place an AI now declines an applicant, prices a deal, or works a delinquency. Build that list first. You cannot govern a decision you have not located, and the examiner or plaintiff's lawyer will assemble the list whether you did or not.

Make every automated decline produce its specific reasons before it goes out. For each agentic step that can result in an adverse action, confirm the system emits the principal reasons in plain language that maps to the actual drivers, not a generic bucket. If your vendor cannot show you the reason codes for a sample of real declines, you have bought a speed gain and an ECOA exposure in the same contract.

Write the model-governance standard the agencies did not. With agentic AI outside the revised guidance, your own policy is now the reference document. Decide who validates the agent, how often, what it is allowed to decide unsupervised, and what triggers a human review, and put it in writing before you scale the deployment, not after an incident forces it.

Treat vendor performance numbers as claims to be tested on your book. A 60 or 88 percent improvement measured on someone else's portfolio is a reason to run a controlled pilot, not to sign an enterprise rollout. Score the agent against your last quarter of manual decisions and measure the declines it would have flipped, then decide.

It validates a submitted business name and EIN against IRS records and returns an IRS code your system routes, a point check you own.

Comparing a narrow name and EIN validation endpoint to a broader KYB workflow on a checklist hides the one question that matters: which job are you buying for.

Read more: Cobalt EIN Verify vs Middesk Identity: Lender Comparison

Reply "Yes" to this newsletter, and our Marketing Manager will contact you for instructions. Also, you may access it directly here and use the API Key from your account.

See Cobalt Business Verification Agent in action

Schedule a FREE demo call

Judge Christopher Lopez of the US Bankruptcy Court for the Southern District of Texas awarded lenders excluded from Serta Simmons Bedding's 2020 uptier exchange about $261.13 million in damages, plus 9 percent annual interest running from June 2020, which pushes the recovery above $400 million.^{13 14} The court found the $1.2 billion "uptier" that demoted the excluded lenders, and that participating funds including BlackRock and Oaktree took part in before later settling, triggered the credit agreement's ratable-sharing provision. It is the clearest damages road map yet for creditor-on-creditor liability-management disputes.¹³ If you buy syndicated or participated paper, the ruling puts a number on what an "open market purchase" fight can cost the winners, and the discipline for your desk is the covenant language, not the headline yield.

According to a petition filed by lender All Pro Capital, James Plack of Crownsville-based South River Capital arranged a roughly $3.3 million contract-advance loan in July 2024 for a man he believed was Falcons quarterback Michael Penix Jr., collecting a $66,000 origination fee, before the borrower vanished with the funds and left the lender alleging $3.6 million in damages.¹⁵ Prosecutors separately allege the impersonator was Luther Davis, a former Alabama player who they say posed as Penix and two other NFL players to obtain loans from multiple lenders between 2023 and 2024; those criminal allegations are unproven.¹⁶ The lending lesson survives whatever the courts decide: a rushed advance against an unverified identity is a synthetic-fraud loss whether the borrower is a fake athlete or a fake business, and the file that skips identity verification is the file that funds the scam.

In a July 7 counterclaim, court-appointed receiver Phillip G. Young Jr. turned Farm Credit Mid-America's $100 million case back on the lender, alleging it breached its duty of care by approving 28 drawdown requests between July 2022 and August 2023, totaling nearly $67 million, that were each signed only by the company's former CFO, without confirming them with founder Fawn Weaver.^{17 18} The filing alleges Farm Credit kept processing the requests even after its own inspection found the borrowing base overstated by about $21 million, and earned roughly $400,000 in fees as the facility grew, an incentive the receiver says explains the lapses; the CFO separately admitted to investigators that he falsified reports, per the counterclaim.¹⁷ These are allegations a court has yet to test, but the operational warning is concrete: single-signatory drawdowns and unreconciled borrowing-base certificates are the exact controls an agentic underwriting stack should be built to flag, not to speed past.