Zotta Lending Brief 02 · AI compliance
AI in lending: what applies in the UK, Kenya and US?
Before putting AI into a lending workflow, separate obligations already in force from regulatory examples and legislation still under debate. Three jurisdictions show why the status and scope of a source matter as much as its headline.
AI-generated narration with original Zotta graphics. The comparison distinguishes rules, guidance and proposals.
Reported facts
Read the legal status before the headline
The current news anchor is the FCA’s October publication. Kenya’s latest tracker reviewed here is dated 16 October. Older US and Kenyan rules are included as dated legal context, not presented as new announcements.
Reported facts
United Kingdom: existing duties, practical FCA examples
The FCA’s 19 October publication, updated 20 October, illustrates AI practices under the existing regulatory framework. The examples are non-exhaustive and create no new requirements. Relevant areas include Consumer Duty, governance, senior-management accountability, resilience and complaints.
For lending teams, the useful emphasis is evidence: test consumer outcomes, including relevant vulnerable-customer scenarios; assign responsibility; and make oversight effective in practice. An approval step with a person’s name on it is not, by itself, evidence that the control works.
Reported facts
Kenya: distinguish the Bill from the law already in force
The Senate tracker dated 16 October lists the Artificial Intelligence Bill, Senate Bills No.4 of 2026, at second reading and records the committee report as tabled on 7 October. In paragraph 1210 of that report, the committee recommends that the Senate should not proceed with the Bill. A committee recommendation is not a final parliamentary outcome. This evidence does not establish an enacted AI Act or a commencement date.
Separately, section 35 of the Data Protection Act 2019 already addresses solely automated decisions with legal or similarly significant effects. Its protections have exceptions for contractual necessity, authorisation by law and consent, with safeguards including notification and reconsideration. Do not read this as a blanket ban on all automation—or as unconditional permission where an exception is invoked.
Regulation 22 adds operational detail on transparency, meaningful information about the logic, fairness and human intervention. Apply the actual conditions to the proposed processing, rather than waiting for a future AI statute.
Reported facts
United States: current credit rules and carefully scoped guidance
Regulation B §1002.9 sets adverse-action notice requirements. Under the applicable notice route, creditors provide specific principal reasons or notify applicants of their right to request them; reasons must reflect the factors actually considered. Timing, transaction type and exceptions matter.
The CFPB’s withdrawal register lists AI-related Circulars 2022-03 and 2023-03 as withdrawn on 12 May 2025. Those circulars should not be presented as current guidance. Their withdrawal does not remove the requirements in the current regulation.
On 17 April 2026, SR 26-2 replaced SR 11-7 and SR 21-8. The revised model-risk guidance promotes a proportionate approach and is principally relevant to banking organizations above $30 billion in assets, with some smaller-bank exceptions. It is guidance, not an enforceable rulebook. Footnote 3 explicitly excludes generative and agentic AI; that scope exclusion is not an exemption from other applicable law or risk controls.
This section covers selected federal credit rules and banking guidance. State requirements and other sector-specific obligations need a separate applicability review.
Zotta’s interpretation
Three implementation questions to take into a project
Map the use case
Describe exactly what the system does, whose data it uses and what consequence its output can have. Record the jurisdiction, entity, product, legal source, effective date and accountable owner.
Question Which obligations apply to this workflow, and which documents are only proposals or examples?
Demonstrate the controls
Use fictional cases to test explanations, escalation and human review. Ask what evidence shows that reviewers can identify an error and change an outcome. Treat a supplier’s assurance as something to examine.
Question What can the team demonstrate today, and what remains unverified?
Keep monitoring
Set review dates, incident routes and change controls. Track rule changes separately from model or vendor changes so that a dated assessment is not mistaken for permanent approval.
Question What event would trigger re-testing or a fresh legal review?
Video
Full transcript
Planning to use AI in lending? Start by separating current rules, regulatory guidance, and proposals.
This is the Zotta Lending Brief: the United Kingdom, Kenya, and the United States.
In the UK, the FCA's October nineteenth publication gives practical examples under the existing framework. It creates no new requirements. The message: test consumer outcomes, assign accountability, and make human oversight effective.
Kenya needs a careful distinction. The Senate's October sixteenth tracker lists the AI Bill at second reading. Its committee recommends that the Senate should not proceed with the Bill. That recommendation is not a final parliamentary outcome.
Meanwhile, Kenya's Data Protection Act already protects people from solely automated decisions with significant effects, subject to exceptions and safeguards.
In the United States, existing credit law still matters. Regulation B sets adverse-action notification rules and requires specific principal reasons when reasons are provided. Two often-cited AI credit circulars were withdrawn in May twenty twenty-five.
The April twenty twenty-six banking model-risk guidance replaces S R eleven seven. It excludes generative and agentic AI from its scope. That is not an exemption from other law.
Zotta's practical takeaway: map each use case to the rules that actually apply. Keep evidence of testing, explanations, human review, and ongoing monitoring.
This is a starting point, not a compliance certificate. Read the dated sources and implementation questions at zotta.ai.
Evaluating software
Turn a software discussion into an evidence review
Bring a fictional workflow and an agreed set of requirements to any supplier evaluation. Record what is demonstrated, what needs configuration and what has not been verified. The Zotta loan management system buyer guide can help structure that discussion. This article does not claim that Zotta supplies every control described.
Explore the Zotta loan management system.
Reported facts
Primary sources and dates
- UK: FCA examples
- Official source. Published 19 October 2026; updated 20 October. Sections 1.1–1.2, 2 and 3. Existing framework; examples do not create new requirements.
- Kenya: Senate tracker
- Official source. Tracker dated 16 October 2026, PDF page 52, row 157: second reading; committee report tabled 7 October.
- Kenya: committee report
- Official source. Main report, printed page 168 (PDF page 169), paragraph 1210. Committee recommendation; not a final Senate decision. Library catalogue date differs from tabling date; this brief uses the tracker’s tabling date.
- Kenya: Data Protection Act
- Official source. Act No.24 of 2019, section 35, printed pages 923–924. Existing law, including exceptions and safeguards.
- Kenya: General Regulations
- Official source. Data Protection (General) Regulations 2021, regulation 22. Existing automated-decision transparency and safeguard provisions.
- US: Regulation B
- Official source. Current CFPB regulation page, §1002.9(a)–(b) and official interpretations. Applicable notice routes, time limits and exceptions must be checked.
- US: withdrawn guidance
- Official source. Official register: Circulars 2022-03 and 2023-03 withdrawn on 12 May 2025. Historical context, not new October guidance.
- US: revised model-risk guidance
- Official source. SR 26-2, 17 April 2026, replaces SR 11-7 and SR 21-8. Dated background, not this week’s news.
- US: guidance scope
- Official source. Attachment, pages 2–3 and footnote 3: nonbinding guidance, principally larger banking organizations; generative and agentic AI excluded.