Payments Pros – The Payments Law Podcast

AI in Payments: Practical Applications and Legal Insights

Episode Summary

Carlin McCrory and Jason Cover discuss the role of artificial intelligence in the payments industry.

Episode Notes

In the latest episode of Payments Pros, host Carlin McCrory is joined by Jason Cover to discuss the role of artificial intelligence (AI) in the payments industry. They define AI and generative AI, highlighting its capabilities in generating text, images, and other data. Jason outlines four key considerations for using AI: ensuring data quality, adhering to applicable laws, understanding AI operations, and maintaining human oversight.

Carlin and Jason explore practical applications of AI in the payments sector, such as customer service chatbots and automated dispute resolution. Jason emphasizes the importance of supervised AI use to avoid potential liabilities, citing recent Consumer Financial Protection Bureau guidance.

The episode also covers the evolving regulatory landscape, including state-level initiatives like Colorado's statute on high-risk AI. Jason underscores the complexity of navigating these regulations and the need for companies to stay informed about state law changes.

Episode Transcription

Payments Pros – The Payments Law Podcast
AI in Payments: Practical Applications and Legal Insights
Hosts: Carlin McCrory
Guest: Jason Cover
Date Aired: October 30, 2024

Carlin McCrory:

Welcome to another episode of Payments Pros, a Troutman Pepper podcast focusing on the highly regulated and ever-evolving payment processing industry. This podcast features insights from members of our fintech and payments practice, as well as guest commentary from business leaders and regulatory experts in the payments industry. I'm Carlin McCrory, one of the hosts of the podcast.

Before we jump into today's episode, let me remind you to visit and subscribe to our blog, TroutmanPepperFinancialServices.com, and don't forget to check out our other podcasts on Troutman.com/Podcasts. We have episodes that focus on trends that drive enforcement activity, digital assets, consumer financial services, and more. Make sure to subscribe to hear the latest episodes.

Today, I'm joined by my colleague, Jason Cover, to discuss artificial intelligence in the payments industry. We will explore what AI is, the key considerations for its use, and the regulatory landscape that companies need to navigate. Jason, thanks so much for joining me today.

Jason Cover:

Thanks, Carlin.

Carlin McCrory:

Let's just go ahead and kick off the podcast by discussing a little bit about what is AI, and tell me a little bit about generative AI.

Jason Cover:

Yes. Carlin, I think this is one of those terms that if you ask 100 people what it means, they'll give you 100 different definitions. I think it's useful to sort of think about this in a couple different ways. One definition that I found is the White House Science and Technology Council's definition. They've loosely defined it as a computerized system that exhibits behavior that is commonly thought of as requiring intelligence.

I mean, to me, this sort of conjures visions of Lieutenant Data from Star Trek. I think that doesn't really exist yet, and it isn't super helpful and I think isn't really important to us as regulatory attorneys. I think the major use case that is coming up these days is derived from some terms that we've been seeing kicking around maybe for the last 10 or more years, and that's big data and machine learning.

Big data is this concept of that we just have reams of data everywhere in the world available now, whether it's through the Internet or other devices. But we're not in the library anymore with written paper anymore. We have tons of digital data that machines can use, and that corollary concept of machine learning is sort of plugging that data into a machine, teaching it. Then often these machines can now teach themselves.

I think in a lot of ways, that's sort of what folks are talking about when they talk about AI these days that we kind of have some sort of computerized system that's using or being trained on big data and then may or may not be teaching itself. But for regulatory purposes, I'm not sure it really matters. I mean, the important concept is that there's like an automated system that's performing jobs that might otherwise be performed in different ways. That, to me, is sort of the key concept that a lot of these things hinge on.

In terms of generative AI, I mean this is the hot topic du jour these days. I think a fairly decent definition of generative AI is something that's capable of generating text, images, videos, or other data using a generative model. It's often responsive to prompts from a user. The use case here is ChatGPT. I mean, that's the thing on the top of everyone's mind, I think.

Carlin McCrory:

What types of considerations are there when using AI? I mean, we can think about all the risks that are involved and that are presented by using AI.

Jason Cover:

Yes. I've kind of distilled this down to four golden rules for AI. I think sometimes people get so enmeshed in the concept of the AI and all the things that it can do that they lose sight of the bigger picture. I've kind of distilled these rules down just to sort of hone in on this. The first one I have is garbage in, garbage out. This is basically the concept that AI is only as good as information that's used to train it. If you're plugging “big data” that is just garbage, that's what the AI is going to give you.

Or if you have the entire Internet is training it and that includes like hate sites and terrible things of that nature, then your AI is going to have problems and butterfly ramification effects down the line. As an initial matter, you really need to know what kind of information you're putting in the AI because that's ultimately the type of information that it's going to put out.

The second rule I have is there's no such thing as an AI-free pass. Whether it's AI or any other kind of disruptive technology, we can't ignore or use that as an excuse for applicable laws and regulations. If you're a payment processor or you’re a financial institution, you're ultimately responsible for your AI’s actions and that you can't just sort of say, “Well, the AI did it. It's not our fault.” We've seen folks that kind of use this as an excuse, and it's unhelpful. I don't think any regulator in the country is going to acknowledge that.

Somewhat closely intertwined is know thy AI. We need to understand what our AI is doing and being able to explain that so that it's really important to document all of the factors that are going in and have some sort of observable ability to understand what it's doing. Some of our clients have even gone so far as to have a system or an AI that sits on top of the AI that's running. That helps them interpret what's going on. But at the end of the day, it can't just be a black box. Or it's risky to have it be a black box that no one could understand.

Then finally, I think that the AI governance or supervision of it is very key. Unsupervised use of AI, I think, poses substantial risk. If you just sort of set it and let it run amok without anyone, any human control or governance over it, and directly interacting with consumers, you're sort of setting yourself up for failure.

Carlin McCrory:

Jason, can you talk a little bit about the use cases and what you're seeing companies do with AI? Is it replacing staff? Or is staff just using AI to assist with their current functions? Then what regulatory concerns are you seeing as well in employing AI with payment-related services?

Jason Cover:

Carlin, we're seeing clients get very creative on the whole of anywhere they can think of to fill these functions in the consumer life cycle generally. There's a use case, and folks are trying to find creative ways to use them. I think for payments in particular, the two main use cases I've seen to date are customer service-type things, chatbots, things of that nature. Then I think a lot of companies have considered using AI or other automated systems to help process disputes or unauthorized use, things of that nature.

Carlin McCrory:

Then what are the regulatory concerns that you're seeing come from the use of these types of services?

Jason Cover:

For those types of uses, Carlin, I think there's concern anytime again you let the AI run unsupervised. I think a fully generative AI chatbot that runs on its own could be quite problematic, right? Recently, Air Canada had a chatbot that promised to discount on a bunch of flights, and they were forced to have to pay those discounted rates. If you have an AI that isn't working properly and makes a bunch of promises to the consumer, you could ultimately be held liable for those.

CFPB has actually provided guidance on this. They have a bulletin on AI and the use of chatbots. They say like the processes they replace, chatbots must comply with all applicable federal consumer financial laws. Entities may be liable for violating those laws when they fail to do so. That kind of gets back to our golden rules again. You're responsible for the chatbots.

I think because of this, a lot of folks have been somewhat hesitant to fully allow chatbots to work directly with their consumers. The chatbot might help or an AI might help select pathways forward, but it might not actually answer. Or it might help a CSR help pull that information about the consumer or help provide potential responses that the CSR might provide to customers. But it's not directly interacting. There's some sort of direct control by an actual human over the AI in both of those context.

The other use I think that folks have tried to use in the payment sphere automating sort of decisions or processing issues around disputes and error resolution and unauthorized use, there's several consent orders actually about this in the context of automated systems; all from the CFPB, two in the sphere of Reg E and the FTA, and one in the FCBA credit card dispute process.

Again, it's all well and good to use AI or other automated systems to sift through all this data and make decisions, but you really need to ensure the accuracy of what it's doing. If it makes incorrect decisions or doesn't do so in a reasonable way, you're going to be on the hook for whatever a regulator may believe it did wrong.

Carlin McCrory:

Yes. That makes sense. I guess, generally speaking, it would obviously be a best practice to have a CSR or someone else monitoring what the AI is saying. Is that the broadly speaking recommendation?

Jason Cover:

Yes. At least for the time being, maybe before things get better in terms of how capable the AI is, having some sort of human control over it, I think, is absolutely helpful. Again, in that sort of direct CSR interaction with the consumer, maybe the AI is helping or prompting the CSR to provide a response. Or maybe in that dispute process, it's providing some potential options or pulling information about the consumer up that some other process actually makes the decision.

I think particularly with generative AI, the ChatGPT type of process, I think most of our clients have been of the opinion is just not quite game time ready to have direct consumer interaction.

Carlin McCrory:

That makes sense. Then the last thing I wanted to ask you about was you just mentioned the CFPB, but what about the states? Have they become involved in AI regulation?

Jason Cover:

Yes. I think everyone has, Carlin. I mean, the CFPB has something just from like May 2022 by my list. They have 10 bulletins or other publications that either directly relate to AI or have some context that AI is touched on in each of those. We've recently seen at the state level increasing regulation or attempts through legislation at adopting it. There's an array of statutes out there that may govern AI in some specific context. Maybe there is an AI statute that's directly related to fair lending issues or something like that on a state level.

This year, Colorado enacted a comprehensive statute that governs the use of what they call high-risk AI, and it's quite intensive and problematic. I mean, it requires a host of things. One of which is providing disclosures to consumers that a high-risk AI was used in whatever kind of process the consumer was involved in. I think it's going to be, A, very interesting to see whether that Colorado legislation holds up, if there's any amendments to it, how it's implemented and enforced and, B, whether other states continue to follow through with that in the absence of any sort of comprehensive national legislation or regulation of it.

In some ways, I think it's similar to the privacy world where there's no real comprehensive federal regulation, at least at a legislative level necessarily. But states increasingly are enacting these privacy-related statutes. I'm very curious to see whether that's going to be an increasing area of scrutiny at whether it's a state legislature or state AGs or regulators, but certainly something that's increasingly on their minds.

Carlin McCrory:

Yes, Jason. That's really interesting in the piecemeal aspect of it. Companies needing to keep abreast of any state law changes will certainly be a factor I'm sure.

Jason Cover:

Yes. It's going to get complicated and I think intrusive, unfortunately.

Carlin McCrory:

Well, Jason, thanks so much for joining us today, and thanks to our audience for listening to today's episode. Don't forget to visit our blog, TroutmanPepperFinancialServices.com, and subscribe, so you can get the latest update. Please make sure to also subscribe to this podcast via Apple Podcast, Google Play, Stitcher, or whatever platform you may use. We look forward to next time.

Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.