Treasury AI Cyber Report (Fin. Services)
Treasury Report — Managing AI-Specific Cybersecurity Risks in the Financial Services Sector
United States · Treasury Report (March 2024)
- Status
- In effect
- Took effect
- March 27, 2024
- Applies to
- Banks, credit unions, broker-dealers, and other financial-services firms regulated by Treasury bureaus and partner agencies
- Enforced by
- U.S. Department of the Treasury (with OCC, FRB, FDIC, NCUA, FinCEN, SEC, CFTC)
Treasury released a sector-wide report outlining AI-specific cybersecurity risks facing banks and financial institutions, the gap between large and small firms in AI-fraud defense, and supervisory expectations for AI-driven fraud, deepfakes, and prompt-injection attacks.
Who is protected: Consumers and businesses banking with U.S. financial institutions
Legal detail
U.S. Treasury Department, 'Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector' (March 2024). Directs financial firms to extend existing third-party risk management (FFIEC, NIST), incident response, and model risk management programs to AI use cases including LLM agents, AI-enabled fraud, and synthetic identity.
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Strength | Limited |
| Enacted | March 27, 2024 |
| Citation | Treasury Report (March 2024) |
| Private right of action | No, agency enforcement only |
| Penalties | No direct penalties; supervisory expectations enforced via existing examination authority |
| Topics | consumer protection · consumer data privacy · automated decision-making |
| Agency page | Treasury Report — Managing AI-Specific Cybersecurity Risks in the Financial Services Sector |
More AI rules in United States
- Trump AI Innovation & Security EO (June 2026) · In effect
- FERC order directing PJM and other grid operators to reform tariffs on… · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- NAIC AI Evaluation Tool Pilot (12 states, 2026) · Proposed / pending
- FTC Proposed Policy Statement — AI Accuracy (July 2026) · Proposed / pending
Related consumer protection rules elsewhere
- Missouri AI Therapy Chatbot Ban (SB 1019) · In effect
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Arkansas Frank Broyles Act AI amendment — voice and likeness protection (2025) · In effect
- PA v. Character.AI (Fake Psychiatrist Chatbot) · Blocked / in litigation
- NAACP v. xAI (Colossus 2 Air Pollution) · Blocked / in litigation
- RI Therapy Chatbot Ban (2026) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.