Changes in technology and the law will make “policymaking by examination” more attractive to regulators.
In Federalist No. 62, James Madison warned that frequent changes in law could undermine public confidence and make it harder for people to order their affairs. Durable institutions, he argued, required durable rules.
For much of the modern administrative state’s history, financial regulation followed a familiar division of labor. The U.S. Congress delegated authority to “apolitical” expert agencies. Agencies generally set policy through rules adopted after public input. Regulators then used supervision—periodic examinations in which specially trained examiners review policies, sample transactions and complaints, and interview executives—to ensure compliance. Enforcement punished violations of law.
Two developments are unsettling that framework.
First, technology is becoming harder to govern through rules written in advance. Artificial intelligence (AI) is the clearest example. Modern AI systems are probabilistic rather than deterministic: Even developers cannot always predict precisely how a model will respond to a prompt or perform in new contexts. Financial institutions also increasingly rely on combinations of services assembled from other companies’ application programming interfaces (APIs). This means that banks’ systems are digitally connected, in real time, with outside companies to provide key bank products and services. For instance, a bank may rely on a cloud computing company’s APIs to store and process consumer information in the “cloud,” use another company’s APIs to send and receive bill payments, use another company’s APIs for cybersecurity checks, and so forth. APIs enable banks to develop rapidly and have access to best-in-class technologies; but they also leave institutions dependent on third, fourth, and fifth parties over which they may have limited visibility or practical leverage.
These new technologies do not merely move quickly. Their risks can be difficult to identify with precision ex ante. Policymakers are beginning to learn that managing them requires continuous governance—monitoring, operating boundaries, escalation procedures, “circuit breakers” that pause or override an AI system when it acts unexpectedly, and mechanisms for responding when outcomes deviate from expectations.
Second, the legal environment has made formal rules less durable. In Seila Law v. Consumer Finance Protection Bureau and similar decisions, the U.S. Supreme Court has reinforced presidential control over financial regulators, making regulatory policy more responsive to changes in administration.
Other decisions have weakened the finality of agency rules in court. In Loper Bright Enterprises v. Raimondo, the Court eliminated the deference that courts previously gave agency interpretations of ambiguous statutes.
More importantly for regulatory durability, the Court held in Corner Post v. Board of Governors of the Federal Reserve System that the statute of limitations period for challenging an agency rule begins when challenger was first injured by that rule—not necessarily when the rule was issued. That means even longstanding regulations may face fresh legal challenges years after agencies and market participants had treated them as settled.
Taken together, these developments will make it harder for agencies to assume that a finalized rule will remain stable across administrations or over time.
Instead, policymakers will increasingly look to shape market norms by turning to another tool: supervision – essentially, creating policy via examination. Through examinations, for instance, regulators and supervised institutions can observe how technologies perform, determine which risks are material, and adjust as evidence accumulates. Institution-specific judgments can also be repeated across examinations until they function as market-wide expectations, despite never being publicly articulated or meaningfully reviewed by the general public.
That is an empirical prediction, not a normative endorsement. Speed and adaptability are not the same as legitimacy. Further, examiners also face asymmetric incentives. They may bear significant reputational costs for missing a risk that later causes harm, while receiving little credit for permitting socially beneficial risk-taking. Individually rational supervisory decisions can therefore become more risk-averse than the socially optimal result.
If supervision is going to acquire greater policy influence, financial regulators need guardrails.
First, the supervision process must become more technologically capable and more transparent. A system designed for continuously evolving technologies cannot depend principally on static reviews and disclosure via periodic batches of PDFs. Regulators should move toward structured, ongoing information flows and machine-readable data. They should also publish clearer supervisory frameworks and, where possible, the tools that they use.
The Consumer Financial Protection Bureau’s publication of its Bayesian Improved Surname Geocoding methodology for fair-lending testing illustrates the potential. The agency published the statistical model that it was using to identify indications of unintended discrimination in lending. That allowed supervised institutions to understand what regulators were testing for and address potential problems before an examination—improving compliance even if doing so produced fewer examination “findings.”
Modern supervision also requires different expertise. Agencies should recruit software engineers, AI specialists, cybersecurity experts, economists, and behavioral scientists alongside traditional examiners. The timing may be unusually favorable: Recent college graduates, particularly those entering technical fields, currently face higher unemployment rates than the broader population.
Second, policymakers need a supervisory perimeter that follows risk. Traditionally, policymakers have asked who is subject to financial regulation—the “regulatory perimeter.” Increasingly, they must also ask who regulators can actually examine—the “supervisory perimeter.” Cloud providers, AI developers, payment platforms, and fintech firms increasingly supply technology on which regulated institutions depend, yet supervisory expectations often reach them only indirectly through their bank customers.
Existing law already provides some tools. The Bank Service Company Act, for example, permits federal banking regulators to examine certain services performed for banks by third parties. But as software becomes more complex and critical functions migrate outside traditional financial institutions, Congress and regulators should ask where existing supervisory authority remains inadequate.
Finally, greater supervisory influence requires greater accountability. Informal or opaque examination findings can delay business activity, shape institutional conduct, and create de facto expectations without rulemaking’s safeguards. Congress and regulators should clarify when supervisory determinations become sufficiently final to permit review by federal courts, while agencies should strengthen internal appeals processes so that institutions can challenge contested judgments before they harden into enforcement actions, ratings, or broader expectations.
Accountability need not destroy the candid dialogue that makes supervision useful. Properly designed review mechanisms can preserve examiner discretion while preventing supervisory judgment from becoming shadow law.
Technology is becoming more complex and uncertain. Formal rules are becoming less durable. Neither trend is likely to reverse. If supervision consequently assumes greater influence over market behavior, policymakers should not allow that shift to develop by accident. The supervisory system we inherited was built for a different era. The next one needs to be more transparent, technologically capable, risk-focused, and accountable.
The views expressed in this essay are those of the author and do not necessarily reflect those of any organization with which he is currently or previously affiliated.
