United States requirements

Financial data safeguards, credit decisions, state privacy, and sensitive-data requirements.

For a United States deployment, determine the requirements by legal entity, regulator, state, activity, and information involved.

Financial information safeguards

The Gramm-Leach-Bliley Act and the applicable regulator’s rules govern relevant financial information. The FTC Safeguards Rule applies to financial institutions within the FTC’s jurisdiction; other regulated institutions may have different implementing requirements. Covered institutions must address service-provider safeguards and oversight. See the FTC guidance.

Review the security program, risk assessment, access protection, encryption, monitoring, testing, incident procedures, and contractual safeguards applicable to the service. Agree evidence and responsibilities for the deployment.

Lending decisions and explanations

The Equal Credit Opportunity Act and Regulation B govern relevant credit decisions and notices. Where a statement of adverse-action reasons is required, it must identify the specific principal reasons. A score or generic reference to an algorithm does not replace the actual reasons. See Regulation B, section 1002.9.

Establish approved criteria, assess discrimination risk, verify explanations against the actual decision process, and maintain appropriate records. AMLOK outputs must be used within that approved scope. See AI and model governance.

Consumer reporting

If a workflow obtains, supplies, or uses consumer reports, assess the Fair Credit Reporting Act and each party’s role. Permissible purpose, accuracy and dispute duties, and relevant adverse-action or risk-based-pricing notices depend on the activity. See the FTC FCRA overview and notice guidance.

Do not assume alternative data or a business-lending label removes consumer-reporting obligations. Assess information and actual use, including personal guarantees.

State privacy and breach obligations

Map privacy, security, and notification laws applicable to the people, data, and entities involved. Where the CCPA applies, address rights, notices, service-provider terms, and sensitive information. Assess exemptions at the appropriate scope rather than assuming every record of a financial business is exempt. See the California Attorney General’s guidance.

State-specific automated-decision, consumer-credit, biometric, and other requirements may need additional analysis. A national statement does not replace a state-by-state deployment assessment.

Health and biometric information

HIPAA applies to covered entities and business associates within its scope. Processing protected health information for a covered entity may require a business associate agreement and applicable safeguards. See HHS guidance.

Do not send protected health information, biometric templates, or verification media through an ordinary financial-data workflow without first agreeing purpose, legal requirements, supported scope, safeguards, and retention. An external verification provider’s test results or assurance reports do not apply to AMLOK’s own service.