Large language models belong in credit risk as readers of unstructured material, drafters of credit narratives and interfaces to formal models. They do not belong as unsupervised decision makers. The strongest evidence points to a division of labor: conventional, validated models produce the scores and attributions, and the LLM extracts, summarizes and explains, with a human approving anything that touches a borrower. For credit unions, community banks and lenders, the question is less whether to use LLMs than how to bound them so that examiners, auditors and borrowers can follow every step.
This article covers what an LLM actually does in a credit workflow, how it differs from the scorecards and regression models you already run, what recent research says about reliability, which U.S. regulatory expectations apply, and how to test and monitor a deployment.
TL;DR
Automate Regulatory Model Risk Governance
Examine models against 32 qualitative criteria and resolve risk Tiers with pre-deployment checklists per OCC 2011-12 guidelines.
- LLMs add the most value on unstructured inputs such as financial statements, news, analyst reports and credit memos, where traditional models that rely on ratios and payment history have little to work with.
- Reliability is uneven: a 2026 Citi-affiliated study found LLMs reproduced supplied feature-importance rankings well but explained risk drivers poorly when left on their own.
- Existing U.S. law applies whether or not AI is involved, so fair lending, adverse action notices, model risk management and third-party risk all carry over to LLM workflows.
- Treat each LLM use as a risk-tiered model: define its purpose, validate it before launch, log everything, keep a human approval boundary and monitor continuously.
Table of Contents
- What an LLM is, and where it fits in credit risk
- How LLMs differ from conventional credit models
- Where LLMs are being used today
- What the evidence says about reliability
- Limits and risks to plan for
- U.S. regulatory and fair-lending expectations
- A deployment and monitoring checklist
- Our perspective
- Putting this into practice with RiskInMind
- FAQ
- Sources
What an LLM is, and where it fits in credit risk
An LLM is an AI model trained to understand and generate human-like text. In finance, LLMs can analyze financial reports and support tasks such as credit scoring, although adoption is held back by privacy concerns, regulatory compliance and the need for finance-specific accuracy. That last constraint matters more in lending than in most industries, because the vocabulary of credit is technical and context-dependent: "covenant," "delinquency" and "reserve" mean something precise, and a fluent but wrong paraphrase is worse than no paraphrase.
In practice, the LLM sits at four points in the credit lifecycle:
- Intake: pulling figures and facts out of tax returns, bank statements, financial statements and loan packages.
- Analysis: summarizing borrower narratives, management commentary and industry news into risk-relevant observations.
- Documentation: drafting credit memos, exception write-ups and regulatory reports from structured results.
- Interaction: letting analysts query portfolio data, policies and model documentation in plain language.
Notice what is absent from the list: the core probability-of-default or loss estimate. That remains the job of models whose behavior you can validate statistically. For a broader view of how those models work, see our overview of credit risk modeling and modern approaches to lending.
How LLMs differ from conventional credit models
Traditional credit-risk methods rely on structured data such as financial ratios and past payment information. A systematic review of interpretable LLM research notes that LLM approaches can extract context from unstructured executive comments, economic news and analyst reports, material that a scorecard cannot ingest directly.
The differences show up in five places:
| Dimension | Conventional models | LLM-based approaches |
|---|---|---|
| Primary input | Structured fields: ratios, payment history, utilization | Text and documents, often combined with structured fields |
| Output | Score, probability or classification | Text: summaries, extracted fields, narratives, rationales |
| Explainability | Established attribution methods | Fluent explanations that may not match the model's true drivers |
| Validation | Mature back-testing and benchmarking practice | Evolving practice; outputs vary with prompts and model versions |
| Typical failure | Drift, mis-specification | Plausible but incorrect statements |
The fourth and fifth rows are where model risk teams spend their effort. A logistic regression gives the same answer on the same input every time. An LLM may not, and its mistakes read as confident prose rather than as an obvious outlier. If you want the machine learning side of this comparison, our piece on how machine learning transforms credit assessment for banks covers the structured-data end.
Where LLMs are being used today
The Financial Stability Board's October 2026 report on responsible AI adoption describes several patterns. On scoring, it says AI credit scoring can analyze large volumes of financial and behavioral data and, paired with alternative data, may improve risk assessment where traditional methods are less effective and broaden access. On underwriting, the same report describes GenAI deployments that automate extraction from financial documents and generate structured narratives supporting credit decisions, improving processing time, consistency and operational efficiency.
That second use is the most mature and the easiest to defend. Extraction and narrative drafting are tasks where an analyst can check the output against the source document in seconds. The credit decision itself stays with a person or a validated model.
Monitoring is the other proven area. A peer-reviewed industry paper from EMNLP 2024 reports that its production News Risk Alerting System had run for nearly three years and alerted credit officers to more than 2,700 credit-relevant events with estimated precision of 77%. Two lessons follow. First, the value is in surfacing events a human might miss across a large portfolio. Second, a 77% precision figure means roughly one alert in four is noise, so the workflow has to be designed for credit officers to triage, not to act automatically.
For lenders working in small business credit, where documents are messy and volumes are high, the same logic applies; our look at SMB lending AI that works for banks and credit unions goes deeper on that segment.
What the evidence says about reliability
The most useful recent finding concerns explanation. A 2026 Citi-affiliated preprint found that LLMs reproduced formal feature-importance rankings reliably when those rankings were supplied, but that autonomous explanations showed limited alignment with model-grounded references. The authors therefore position LLMs as narrative interfaces, not substitutes for formal attribution methods. Their perspective is that an LLM should verbalize auditable attribution results, never invent or replace the underlying explanation method.
This maps directly onto how you should design the workflow. If a gradient-boosted model or scorecard produces reason codes through a validated method, an LLM can turn them into clear language for an analyst or a notice draft. If you ask an LLM to say why a borrower is risky with no grounding, you get an answer that sounds right and may not reflect what drove the outcome.
The research base is also still maturing. The 2026 systematic review examined 60 papers published from 2020 through 2025, classifying them by architecture, data type, explainability mechanism and application area. Sixty papers across six years is a young literature, and most of it is not drawn from a community bank's loan book. Benchmark results should be treated as hypotheses to test on your own portfolio, not as performance guarantees.
Limits and risks to plan for
The CFA Institute's practical guide states plainly that LLMs can produce plausible-sounding but incorrect outputs, and that finance's technical, context-dependent language creates accuracy and hallucination challenges. Privacy, regulatory compliance, the need for financial specialization and the maintenance expertise required can also limit adoption.
In a credit setting those general risks become specific ones:
- Hallucinated facts in memos. A drafted credit memo that invents a covenant or misstates a debt service ratio can propagate into committee decisions. Every figure should trace to a source field or document.
- Data exposure. Sending borrower documents to an outside model endpoint raises privacy and third-party questions. Where the data goes, who can retain it and whether it trains anyone's model are due diligence items, not footnotes.
- Inconsistency. Identical inputs can yield different outputs, which complicates audit and complicates fair treatment of similar applicants.
- Bias. The GAO notes that U.S. institutions' use of AI brings risks including biased lending, poor data quality, privacy problems and cybersecurity threats alongside efficiency and lower costs.
- Vendor change. A hosted model updated without notice can shift behavior overnight. Version pinning and change notification belong in the contract.
U.S. regulatory and fair-lending expectations
There is no separate rulebook for LLMs in U.S. lending. The GAO's May 2025 report says existing federal financial laws and regulations generally apply whether or not AI is used, and that regulators oversee AI primarily through existing laws, guidance and risk-based examinations. FDIC, Federal Reserve and OCC officials pointed to model-risk and third-party-risk guidance as relevant depending on circumstances, and the GAO recommended broader model-risk guidance from the NCUA, which matters directly to credit unions.
Two fair-lending concepts deserve attention. FinRegLab's 2023 research summarizes that federal fair-lending law generally prohibits disparate treatment based on protected characteristics and disparate impact from facially neutral criteria unless justified by a legitimate business need that cannot reasonably be met with less-impactful means. An LLM that reads free-text narratives can pick up proxies for protected characteristics in ways a ratio-based model would not, so subgroup testing applies to text-driven workflows as much as to numeric ones.
The second concept is adverse action. FinRegLab's 2026 framework explains that ECOA requires individualized disclosure of the principal reasons for credit denials, line termination or certain other adverse actions, and that FCRA requires key factors negatively affecting credit scores when a score influenced an adverse action or higher pricing. This is where the explanation finding above becomes operational: reasons given to a borrower must be accurate and specific, which is a poor fit for free-form LLM rationales. FinRegLab's perspective is that explainability supports fair-lending compliance, adverse-action notices and model-risk management, beyond any transparency preference.
The FSB takes a proportionate view: AI can improve efficiency, risk monitoring and decision-making, while institutions should apply proportionate controls for explainability, data governance, performance, human oversight, cybersecurity and third-party AI risks. Our own summary of recent developments is in CFPB 2026: consumer credit AI rules for U.S. lenders and borrowers, and the compliance angle is covered in the role of AI in regulatory compliance for banks. Your compliance officer and counsel should confirm how current rules apply to your specific products.
A deployment and monitoring checklist
FinRegLab's April 2026 framework gives a clear sequence for testing, deploying and monitoring machine learning models, and it applies cleanly to LLMs. Condensed into steps:
- Inventory and risk-tier every LLM use. A memo drafting assistant and a model that influences approval are not the same tier.
- Define the purpose and the human-approval boundary. Write down what the model may produce and what a person must sign off.
- Validate before launch. Cover data, conceptual soundness, performance, stability, fairness, explanations, security and privacy, with independent challenge for material models.
- Test explanations early. The same framework recommends selecting explainability methods during development and reviewing sample notices for accuracy and specificity with compliance or legal staff, then adjusting the model or process before implementation.
- Deploy with controls. Use access controls, audit logs, versioned prompts and model documentation, fallback procedures and human review.
- Monitor continuously or at risk-based intervals. Track accuracy, drift, overrides, subgroup outcomes, adverse-action reason quality, incidents and vendor changes.
- Keep the lines of defense distinct. The framework describes clear division among business, risk and compliance, and internal audit, with independent validation and monitoring and stability assessment under changing data conditions.
Overrides deserve special mention. A rising override rate tells you the model and your analysts disagree, and the cause is worth knowing whichever side is right. For a wider governance view, see our AI risk management best practices for financial institutions.
Our perspective
We build for credit unions and community banks, and the pattern we see is consistent: institutions get into trouble when they ask a language model to do the one thing it does least reliably, which is justify a decision it did not make. The research points the same way. Our design principle is that the model reads, drafts and summarizes, while validated methods score and explain, and every output carries an audit trail an examiner can follow.
That is why we keep our AI processing in-house, with no third-party data exposure, and why we organize the platform around specialized agents for regulatory compliance, credit risk assessment and market analysis, coordinated by a central AI director named Ava. Narrow agents are easier to scope, test and tier than one general assistant. They also make the human-approval boundary easier to draw, because each agent's output has a defined consumer: an underwriter, a compliance officer or a portfolio manager.
Our advice to a CRO evaluating any LLM tool, ours included, is to ask three questions. Where does borrower data go? Can every figure in a memo be traced to a source? What happens to behavior when the underlying model changes? If the answers are vague, the tool is not ready for credit.
— Raj
Putting this into practice with RiskInMind
If you are moving from pilots to production, the bottleneck is usually documents: extracting borrower data, drafting memos and keeping an audit-ready record. Our platform covers automated loan underwriting, credit memo generation, fraud detection for documents, CECL reserve modeling, portfolio monitoring and regulatory reporting, with SOC 2® certification and real-time processing. You can explore the Loan Application product to see how intake and underwriting work together, or review plans on our pricing page and request a demo against your own workflow. Portfolio and lending leaders can also start from our solutions for portfolio managers.
FAQ
What is an LLM in finance?
An LLM is an AI model trained to understand and generate human-like text. In finance, it is used to analyze reports, summarize documents and support tasks such as credit scoring, within limits set by privacy, compliance and accuracy needs, as the CFA Institute's guide explains. In credit, it most often handles text-heavy work rather than producing the final risk estimate.
Can an LLM make a credit decision on its own?
It can technically produce a recommendation, but the evidence and the rules argue against relying on it alone. Existing federal laws apply to AI-assisted decisions, adverse action reasons must be individualized and accurate, and the FSB stresses human oversight. A safer design uses the LLM for extraction and drafting, with validated models and a human making the decision.
Will AI replace risk professionals such as FRM holders?
The research points to changed work, not absent people. Model validation, fair-lending review, explanation testing and vendor oversight all require judgment and accountability that regulators expect an institution's staff to hold. Professionals who can challenge and monitor AI outputs are more necessary as adoption grows.
What risk models do banks use?
Banks commonly use scorecards, regression-based probability-of-default and loss models, machine learning classifiers and portfolio-level stress and reserve models such as CECL. LLMs generally complement these rather than replace them. Our guide to loan risk modeling strategies walks through how they fit together.
Sources
- Practical Guide: LLMs in the Financial Industry, CFA Institute RPC
- Sound Practices for Responsible Adoption of Artificial Intelligence, Financial Stability Board
- News Risk Alerting System (NRAS), EMNLP Industry 2024
- Review: Interpretable LLMs for credit risk, a systematic review
- Could Large Language Models work as Post-hoc Explainability tools? (2026 preprint)
- GAO-25-107197, Artificial Intelligence: Use and Oversight in Financial Services
- FinRegLab, Explainability and Fairness in Machine Learning for Credit Underwriting (2023)
- FinRegLab, Framework for Managing Machine Learning Models (April 2026, explainability and adverse action)
- FinRegLab, Framework for Managing Machine Learning Models (April 2026, model-risk management)