Happy Monday, Fintech Takers!

Quick question before we get started: How early is too early to start decorating for Christmas?

My family’s position has always been post-Thanksgiving. We usually go up into the mountains and cut down a Christmas tree the day after Thanksgiving, and that officially kicks off the holiday season. However, I’ve seen a lot of evidence this year — online and around town — that folks are increasingly treating anytime after Halloween as an acceptable window to begin decorating for Christmas?

Please weigh in with your opinions on this question. My wife and I are feeling miffed about the erasure of the post-Halloween pre-Thanksgiving fall season (and we LOVE Christmas, BTW) and we need some outside opinions.

- Alex

Stablecoins in 2026: What We Know, What We Don’t

Most stablecoin recaps will tell you what happened this year. Ours will too, but we won't stop there.

Simon Taylor (Brainfood), Rob Hadick (Dragonfly), John Timoney-Gomez (Rain) and I will be digging into the open questions, like who ends up owning the customer, and what it takes for everyday folks to use stablecoins without knowing it.

Join us live on Dec. 15 for Stablecoins in 2026: A Year in Review.

Bring your best predictions, and we’ll hold you to it next December.

3 FINTECH NEWS STORIESCopy anchor linkCopied

#1: Banks Could Use Some Guidance on AI as Well Copy anchor linkCopied

What happened?Copy anchor linkCopied

The OCC published a supervisory framework to help bank examiners assess the risks of AI:

This document provides bank examiners with a supervisory framework for evaluating banks’ use of Super Intelligence (SI) in normal-course business activities, including, but not limited to, credit decisioning, payments, fraud detection, customer service, operations, risk management and market activities. SI and agentic SI can facilitate banks serving customers faster and more consistently, defend against cyber threats, improve the detection of fraud and financial crimes, and automate manual operations allowing skilled staff to focus on higher value tasks. Used with adequate controls, SI and agentic SI can strengthen risk management, lower costs, and expand access to financial services.

So what?Copy anchor linkCopied

Let’s start by acknowledging that the term “Super Intelligence” is super dumb, and the introduction of yet another acronym (SI) is super confusing. Apparently, the President made the change because he thinks the term “artificial intelligence” sounds fake. This is ironic because the term “superintelligence” (no space, not capitalized) actually already has a very specific technical definition (a hypothetical future system that surpasses human intellect across all domains) that is very different from the capabilities of current AI systems and that was decided on by people who actually know what they’re talking about.

Regardless, here at Fintech Takes, we will continue to use the term artificial intelligence (AI), and I will endeavor to be as specific and technically accurate as I can be when I’m talking about particular models and systems.

On the topic of the OCC’s supervisory framework, I actually think it’s pretty good.

It focuses on how AI, as a technology, is used by banks (and the consequences of failure or misuse for those use cases), rather than on the sophistication of the technology itself. This is a smart approach, as it allows bank supervisors to focus their work on the use cases that pose the most risk for the banks and their customers, rather than inherently treating anything AI-related as higher risk, simply because it’s novel. For example, in the document, the OCC explains that a simple rules-based system for initiating transactions might be riskier than a sophisticated AI model that is used for drafting internal documents.

The framework is organized around six pillars — Purpose, Risk, Control, Oversight, Resilience, and Assurance — and the components that make up those pillars demonstrate an impressively nuanced understanding of how LLMs and agentic systems work and their vulnerabilities and failure modes. For example, in the first pillar (purpose), the document states that “Effective [AI] risk management begins with a clearly defined and documented purpose. A purpose statement may establish the authorized scope of an [AI] system or agent and provide a basis for identifying scope drift, unauthorized use, and control failures.” It then goes on to clarify that scope drift — AI agent activity outside of its approved purpose — may be treated by examiners as a control failure, even if the resulting output or action appears reasonable.

Yes! This is exactly the kind of well-measured, technology-aware approach that bank examiners should be taking! A+¹  

But here’s the thing. This is a framework for supervisors. It tells examiners what to look for when they walk into a bank. It doesn’t tell banks what good looks like.

That’s not an accident. When the OCC and the Fed replaced their model risk management guidance back in April, they explicitly carved generative and agentic AI out of scope. The rationale was that these models are too novel and are evolving too quickly to fit the guidance.

And look, I get it. The old model risk guidance was built for a world of logistic regressions and scorecards. You validate the model, document the assumptions, monitor for drift, and revalidate on a schedule. That playbook doesn’t map cleanly onto a system that gives different answers to the same question, whose underlying model gets swapped out by a vendor every few months, and that can call tools and take actions on its own.

It’s fine to say the old guidance doesn’t fit LLMs.

What’s not fine is stopping there.²

The usual defense is that writing rules now would freeze progress, and that it’s better to let the technology mature before we lock anything in. But that argument assumes that nothing gets locked in while regulators wait. That’s not how this works.

Banks aren’t waiting. Every bank deploying an LLM today is deciding for itself how to validate it, how to document it, how much human review it needs, and what counts as an acceptable explanation for its outputs. And every exam team that reviews those deployments is either blessing or challenging those decisions, one bank at a time. Added up, those thousands of individual calls become the standard. Nobody chose it; it’s just what exists. It’s wet cement. You can shape it now, or you can live with whatever shape it’s in when it dries.

Explainability under ECOA is the clearest example. Reg B requires lenders to give declined applicants the specific principal reasons for the decision, but what does “specific principal reasons” mean when an LLM is part of the credit decision? As I wrote here, it’s not at all clear. LLMs reason very differently from traditional machine learning models. Their approach to understanding the interrelationships within a dataset is much less intuitive to humans, which means that it’s extremely difficult to say how Reg B’s explanation obligation applies to them.

We only get one chance to answer that question. Once a handful of large lenders have built their adverse action processes around one answer, and their examiners have accepted it, that’s the answer. Changing it later means telling an entire industry that its compliance infrastructure is wrong, and that almost never happens.

The agencies don’t need to write the final rulebook for AI in banking. But they do need to put a stake in the ground, even a provisional one that they revise later, before the industry pours the concrete for them.

#2: FICO is Done With Transparency Copy anchor linkCopied

What happened?Copy anchor linkCopied

FICO’s latest earnings call was … interesting:

Fair Isaac said it would not share expectations for its financial performance in the new fiscal year as it navigates changes in its pricing structure and slow mortgage demand.

The credit-score provider said it is transitioning its mortgage originations pricing structure to be tailored to the individual needs of customers, rather than a single flat fee.

The change comes as the company faces more competition from competitor VantageScore, which was recently approved to be used by government-backed mortgage lenders.

Given the pricing transition, FICO said it wouldn’t share fiscal-year 2027 guidance at this time.

So what?Copy anchor linkCopied

Will Lansing, FICO’s CEO, was quite candid about why FICO³ is moving to less transparent pricing:

I think you all know, it's no secret that transparency and detail on our programs and pricing have not been particularly helpful for FICO. We were of a view for many years that because the FICO Score at $10 or $4.95 or whatever we were charging was such a tiny fraction of overall closing costs, we really didn't think that the price was a very big deal. We thought that the value so far exceeded the price that why not share details around the pricing just so that everyone understands how little it is in the scheme of things.

As you all know from watching events over the last several years, we've really been attacked for what we consider to be not very good reasons. We're attacked because we're transparent and clear about our score price. As you all know, the credit files cost a lot more, credit evaluation costs are much more. In fact, every other element of the closing is a lot more than what FICO charges, and yet somehow FICO has become the poster child for affordability in housing, which is just a crazy thing. So internally, we've had a lot of conversations about, has this transparency been helpful? The conclusion is no, it has not been helpful.

I want to push back on a couple of things here, but first, let’s talk about what the numbers are actually saying.

On the surface, FICO’s mortgage business looks strong. Mortgage origination revenue was up 72% in the quarter. But volumes were down by high single digits. All of that growth came from pricing increases, and such increases are unlikely moving forward thanks to competition with VantageScore.⁴

Look at what’s happening with FICO’s biggest customers. Rocket has said it will make VantageScore 4.0 its default credit model for eligible loans, including conforming loans sold to Fannie and Freddie. UWM now pulls both scores on every application and uses whichever one qualifies the borrower better. Meanwhile, the bureaus are pricing VantageScore around $1 per score, and FICO’s primary response — the Preferred Program — is to hold its $10 price flat for 2027.

So maybe this quarter’s mortgage revenue growth isn’t sustainable. Growth is already decelerating: From 97% in Q3 to 72% in Q4. Maybe it’s a sugar high, the last few quarters of pricing that was set before the competition became real. And maybe that’s the simplest explanation for why FICO didn’t issue guidance for 2027. If management were confident mortgage revenue would keep climbing, I suspect they’d have told us.

Now, about Lansing’s explanation. I don’t think it holds up.

The framing is that the FICO Score was always a tiny, reasonably priced piece of closing costs. In his version of the story, the bureaus’ credit files were the real expense, and FICO got scapegoated for being transparent. But lenders didn’t buy FICO Scores à la carte. They bought them from the bureaus, bundled with the credit files.⁵ And because of the FHFA’s tri-merge requirement, they bought three of those bundles per borrower. Every time FICO raised its royalty, the bureaus marked it up (sometimes by up to 100%) and passed it on. FICO and the bureaus weren’t on opposite sides of the affordability problem. They were all getting paid from the same increases.

The timing matters too. FICO’s mortgage score price barely moved for 30 years. It made its first adjustment in 2018, the same year Congress passed the Credit Score Competition Act. Then, starting in 2023, as regulators worked through approving alternative scores, the increases got big: From roughly 60 cents to $10 in about four years. It’s like the concession stand that jacks up beer prices once it hears the stadium is going to let fans bring in their own drinks next season. You can do it. Just don’t act surprised when people get mad.

FICO wasn’t attacked for being transparent. It was attacked because the increases were huge, they came all at once, and they arrived right as its monopoly was ending.

#3: Give Customers a Reason to Use the Front DoorCopy anchor linkCopied

What happened?Copy anchor linkCopied

Mercury launched Agent Controls:

Today, Mercury is launching Agent Controls: see every agent connected to your account, what it can do, its activity, and cut it off in seconds.

Big banks are locking AI agents out. It’s bad security, and an admission they don’t understand the future.

Blocking agents is the opposite of a good security policy.

Founders are already using agents, so trying to block them only pushes people to share a login with their agent or let it drive their browser with few guardrails and no record of what it did.

We're building for agents with clear safeguards, visibility, and permission.

Agent Controls shows every agent connected to your Mercury account, who connected it, and what it's permitted to do. You can disconnect any agent in seconds.

So what?Copy anchor linkCopied

Mercury is correct in saying that blocking third-party AI agents is bad security policy. Customers will just attempt to go around the blocks, in less secure and monitored ways.

I’d argue that big banks blocking third-party AI agents is about managing liability risk, not security risk. It’s an understandable instinct, but I think it’s incredibly shortsighted given the rapidly improving capabilities of AI agents. Banks may be somewhat able to block AI agents today, but that will not always be the case, as phone-use agents become more capable and more commonplace. Banks will, at some point, be operating in a world in which the use of their approved channels for third-party AI agents — their MCP servers and APIs — will be optional for customers, not mandatory.

In that world — where customers can either choose to go through your well-regulated front door or sneak in with their credentials through a side door — you will need to be able to give them compelling reasons to pick the front door. What will those reasons be?

One of them will be control and data security. That’s what Mercury has built with Agent Controls. A way for its customers to feel more comfortable connecting their AI agents. A way for them to feel in control. And it only works with Mercury’s MCP server. You have to go through its front door to get access to it.

This is, to put it mildly, not what the big banks are doing. They’re not making it easy for customers to safely connect their third-party AI agents and to easily manage those connections. Instead, in the case of Wells Fargo, they are actually making it more difficult on customers, informing them that in order to limit their personal liability, they are responsible for "properly and timely revoking any authorization provided to an AI Agent," and that they "must retain evidence of such revocation and must provide such evidence to us, at our request."⁶

This may be an understandable short-term reaction to the rapid emergence of third-party AI agents, but it’s not a winning strategy long term.

2 READING RECOMMENDATIONSCopy anchor linkCopied

#1: A Material World (by Kiah Haslett, Fintech Takes Banking) 📚Copy anchor linkCopied

What exactly are material financial risks and how are bank regulators defining them?

Kiah has you covered.

#2: Follow the Money (by Marc Rubinstein, Net Interest) 📚Copy anchor linkCopied

I thought this meta-analysis of Marc’s writing over the last six years was really interesting. A good time to dig into his stuff, if you haven’t already.

*Bonus: A Skeptic’s Guide to Stablecoins (by me, with Rain) 📚Copy anchor linkCopied

For most of their history, stablecoins existed to facilitate crypto trading. That changed first in the least glamorous corner of payments: cross-border money movement, and dollar savings for those whose local banks never offered a USD account. This guide, drawn from my June virtual event with Rain, explains why and what a skeptic should still ask. Read it here.

*This rec is brought to you by one of our fantastic brand partners.

1 QUESTION FROM FINITYCopy anchor linkCopied

There are a TON of interesting questions being asked in Finity (our digital community for fintech and banking nerds). I’ll share one question, sourced from the community, each week. However, if you’d like to join the conversation, please apply to join!

Is there any reason to think that the authors of the Durbin Amendment intended for capped debit card transaction pricing to vary by transaction type rather than to be consistent across all transactions?

If you have any thoughts on this question, reply to this email or DM me in Finity!

Thanks for the read! Let me know what you thought by replying back to this email.

— Alex