November 28 was “Giving Tuesday,” but that didn’t stop the Treasury Department from asking Congress that day for additional anti-money laundering (AML) powers over cryptocurrency activity. The best that can be said of the Treasury’s wish list of bad ideas is that at least it bothered to ask Congress rather than simply assert feigned authority.

The fact that Treasury had to ask, though, is telling. The ask reveals what we and others have grown hoarse from shouting: that existing regulatory frameworks designed for centralized financial intermediaries do not suit the reality of decentralized crypto technologies. This substantive mismatch between the legacy AML regime and the nature of crypto technology cannot be papered over with legislative power grants, and regulators’ insistence to the contrary risks damaging both Americans’ liberty interests and America’s national interest.

One of the primary ways that Treasury has asked Congress to expand the agency’s crypto AML authority is by designating a series of core crypto technologies as “financial institutions” under the Bank Secrecy Act (BSA). Thereupon, these tools would become subject to the type of “requirements to which banks and other financial institutions are already subject.”

But most of the crypto tools that the Treasury would like to see covered under the BSA do not resemble traditional banks and financial institutions in meaningful ways. As we’ve pointed out, and as Treasury itself acknowledges, the parts of the crypto ecosystem that do resemble more traditional financial intermediaries—such as centralized crypto exchanges that custody customer funds—already are subject to the BSA regime, as they’re typically considered covered “money services businesses.” Treasury, however, would like to expand this coverage to include other parts of the crypto ecosystem: decentralized finance (DeFi) service providers, noncustodial wallet providers, miners, and validators.

Absurdly, Treasury’s request would require crypto technologies (such as miners, validators, and DeFi protocols) that do not directly interface with transacting counterparties to collect those users’ personal information and verify their identities as part of know-your-customer (KYC) programs.

Validators and miners are crypto’s backend infrastructure: computers running software to confirm the authenticity of transactions and secure cryptocurrency networks. DeFi protocols—likely covered by Treasury’s vague reference to DeFi service providers—also do not directly face users, and the applications used to access them can vary based on users’ own choices. Requiring crypto infrastructure to implement KYC programs would be as inappropriate as asking a bank’s IT contractors—from cloud computing to hardware providers—to identify the bank’s customers.

Such unworkable compliance requirements would amount to de facto bans on US crypto activity. And where crypto infrastructure providers did seek to somehow comply, it would only increase cybersecurity risk by creating—in the words of entrepreneur and Columbia Business School Professor Austin Campbell—“the least secure, biggest honeypot, most information-exposing ecosystem possible.”

Noncustodial (or self-custody) wallets—the providers of which Treasury would declare financial institutions—directly interface with crypto users. However, subjecting wallet providers to the AML/KYC regime is problematic for separate reasons. Conceptually, noncustodial wallets more closely resemble physical wallets holding cash than traditional digital payment apps. Fundamentally, a noncustodial crypto wallet is simply a tool for safeguarding the credentials (private keys) for accessing a user’s own crypto holdings.

The most basic form of a noncustodial wallet is merely a piece of paper recording a user’s credentials (or a mnemonic phrase for recovering them). Even where crypto credentials are stored via software or hardware tools, subjecting the providers of those tools to AML/KYC requirements still would be like subjecting the manufacturer of a leather wallet to rules designed for banks. In both cases, the maker of the wallet (for cash or crypto) is essentially giving the user a tool for controlling her own funds and is not inherently responsible for the broader payment ecosystem.

If Treasury nonetheless believes its proposed invasion of one of the last two redoubts of financial privacy—self-custodied cash and crypto—is justified because noncustodial crypto wallets present a greater illicit finance risk than cash wallets do, then it must make that argument. But that argument likely would be a loser because—by Treasury’s own repeated admission—traditional assets are more often used for illicit finance than crypto is.

Simply stating, as Treasury does in its ask to Congress, that Hamas has used “unhosted wallets,” ignores that when it comes to terror finance, “Crypto is currently a very small part of the puzzle,” as the former chair of the Israel Money Laundering and Terror Financing Prohibition Authority, Dr. Shlomit Wagman, recently told Congress.

Even if Treasury could persuasively make the case that noncustodial crypto wallets presented a compelling risk requiring an AML intervention, Treasury would still have to justify applying the legacy KYC regime. Speaking at the Blockchain Association’s Policy Summit last week, Deputy Treasury Secretary Wally Adeyemo urged the crypto ecosystem to “design new tools, and pursue new ways to protect digital assets from being abused.” But Treasury’s insistence on imposing legacy regimes that require comprehensive KYC programs would stand in the way of applying innovative solutions that may combat illicit finance risk.

Emerging crypto technologies like zero-knowledge proofs offer the ability to, for example, confirm that an individual is not a sanctioned terrorist without having to divulge that individual’s identity and complete set of personal information. It’s far from clear, however, that regulators would consider such innovations to satisfy existing prescriptive KYC rules that call for verifying customer identification and collecting specific personal information, unless those rules were reformed.

Treasury’s wish list similarly proposes draconian solutions for US Dollar-denominated stablecoins (crypto tokens designed to maintain a 1:1 peg to the Dollar) that would jeopardize the benefits those stablecoins can bring to the Dollar’s status as the world’s reserve currency. Treasury asks Congress for jurisdiction over USD-pegged or denominated stablecoins even where such “stablecoin transactions involve no US touchpoints.”

Even putting aside arguments that this assertion of extraterritorial jurisdiction is unprecedented and raises a host of questions, the Treasury Department loses the plot by conceiving USD-denominated stablecoins as a threat rather than an opportunity. As Campbell testified before the House Financial Services Committee earlier this year, “[S]tablecoins are a key to expanding the reach of the dollar”:

The United States runs a significant deficit we must fund. Simultaneously, the dollar, thanks to the strength of the American economy, the solidity of our legal system, and the core rights that come with that, is demanded globally. In the world of blockchain and crypto, the preferred fiat currency is, unsurprisingly, also the dollar. The only thing that could stop that would be the interdiction of usage of the dollar on blockchains, meaning that if the United States embraces the innovation of stablecoins, then as the usage of blockchains and crypto grows, the reach of the dollar will also grow commensurately. US Dollar stablecoins expand the reach of the dollar into a new, rapidly growing market, cementing the usage of the dollar for global trade.

When US regulators look askance at stablecoins, they shouldn’t be surprised if stablecoin users around the globe begin to consider alternatives to USD-denominated options.

The AML authorities on Treasury’s wish list are not the first examples of US regulators’ allergy to crypto technology. Part of that allergy stems from a tendency of US regulators to miss the forest for the trees on crypto, and whether it’s “los[ing] sight and focus from the big picture” when it comes to crypto’s relatively narrow role in illicit finance to date or ignoring the potential of crypto technology to serve America’s economic interests at home and abroad, it all leads to overreach and counterproductive interventions.

On our crypto policy wish list this year (and every previous year) is for US regulators to get out of Americans’ way. That policymakers respect financial privacy, base their interventions on evidence, and allow innovation to solve problems really should not be too much to ask for.

Whether or not Section 230 applies to Artificial Intelligence (AI) is a hotly debated question. Somewhat surprisingly, the authors of Section 230 claimed it may not apply, but it is likely more complicated than just a simple yes or no answer. Section 230 has been critical to how the internet has expanded free speech online by creating a market that provides opportunities for users to speak, as well as reflecting core principles about the ability of private platforms to make decisions about their services. 

Legislating an AI carveout from Section 230, however, would have much deeper consequences for both online speech as we already experience it as well as the future development of AI. 

A Refresher on Section 230 and What It Tells Us About the Debate on If It Applies to AI 

The basic text of Section 230 reads, “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” In analyzing whether Section 230 applies to AI, we should go back to the text as drafted.

Generative AI likely is an interactive computer service but there may remain some debate on who is the speaker when a generative AI produces content. (A debate that is also playing out involves questions about the application of certain intellectual property principles.) However, these questions won’t often be of concern. Most questions about AI and Section 230 are not about the mere production of content or an image, but rather involve a user reposting the content on other platforms or are otherwise connected to the content generated by a user. 

Removing Section 230 for AI Would Have Far More Significant Consequences 

While generative AI services like DALL‑E and ChatGPT gained popularity in 2022, AI has been used in many ways, including popular user-generated content features, for much longer. As a result, attempts to remove Section 230 protection for AI through legislation would likely impact much more content than the narrower subsection of generative AI services. 

AI, including generative AI, is already used in many aspects of online services such as social media and review sites. AI can help identify potential SPAM content and improve search results for a specific user. Beyond that, it is also already used in many popular features.

For example, removing protection for AI could eliminate commonly used filters on social media photo sites and even raise questions about the use of certain features that could help generate captions for videos. This would be considered the type of user-generated content and creativity supported by Section 230. But an AI exception would likely lead many platforms to disable such tools rather than risk opening themselves up to increased liability. 

An AI exception to Section 230 also undermines much of the framework and solution intended by the law. First, it would shift away from the American approach that has encouraged innovators to offer creative tools to users by punishing the same innovators for what others may do with those tools. This undermines the basis of Section 230 and hampers innovation that could be beneficial. It also misguidedly moves the responsibility from bad actors to innovators. 

Conclusion 

Some critics may still debate how Section 230 applies to specific elements of generative AI services, but a Section 230 AI carveout would bring more problems than solutions. AI already interacts with a wide array of user-generated content and such a loophole would have a broad impact both on the current experience of users on the internet and on the future development of AI. 

Deadlines tend to focus the mind…except for the House and Senate, which every few years wait until literally the last possible moment to deal with a law that this time around expires at 12:01 a.m. on January 1, 2024.

In this case, the law in question is Section 702 of the Foreign Intelligence Surveillance Act (FISA). Section 702 involves the interception of communications of “foreign intelligence” interest carried on the global telecommunications network and its related infrastructure.

Last month, a bipartisan group of House and Senate members introduced the Government Surveillance Reform Act. The GSRA would, among other things, extend the Section 702 program for four years but require a probable cause-based warrant to access the communications of Americans acquired under the program.

Yesterday, a separate bipartisan group of House members introduced the Protect Liberty and End Warrantless Surveillance Act (PLEWSA), whose lead author is the extremely controversial Rep. Andy Biggs (R‑AZ). Biggs has emerged as one of the most consistent and harsh critics of the Section 702 program, and his bill, like the GSRA, would impose a probable cause-based warrant requirement for the communications of Americans. Both bills would also apply the same requirement to government efforts to acquire data on Americans from third parties such as data brokers.

The bipartisan momentum behind these dueling legislative proposals is driven by the execrable record of surveillance abuse racked up by the Section 702 program and its masters—the FBI and NSA—over the last 15 years. Not surprisingly, national security state bureaucrats are fighting back.

The same day Biggs and his colleagues introduced their Section 702 reform bill, Punchbowl News reported that officials at the Justice Department and the Office of the Director of National Intelligence (ODNI) sent a letter to key Senate leaders on the Intelligence and Judiciary Committees claiming, among other things, that a lapse in Section 702 authority would “inject tremendous uncertainty and risk, endangering the IC’s ability to gain valuable intelligence.”

As I pointed out recently in the Orange County Register, that statement is false. During the Clinton administration, the Central Intelligence Agency (CIA) ran a program under Executive Order 12333 that appears to have been nearly identical to the “upstream” (or internet backbone) portion of current FISA Section 702 collection.

The reality is that the FBI and NSA simply hate having to abide by the Fourth Amendment’s individualized, particularized probable cause-based warrant requirement.

What they’ve never been able to credibly explain is why that standard—which governs criminal proceedings in conventional Article III courts every day in this country—is impossible to meet in the national security context. The truth is that it is indeed not only possible but absolutely necessary if the Fourth Amendment is to truly have any consistent meaning and effect. 

At present, the House and Senate are scheduled to leave DC by December 15—sixteen days before Section 702 is set to expire. Which reform proposal will become law, if any, is at this point anybody’s guess.

Two weeks ago I noted that one principle of fair elections, transparency, can be in tension with another, the secret ballot. The tension plays out in current discussion as to how far election administrators should go in making public the data that underlie election results even when doing so might allow inferences about how individuals voted. 

The controversy involves two different information formats often confused with each other that should be kept straight. Cast vote records are electronic summaries of individual ballots and the choices made on each, which may also carry additional information such as a timestamp of when the vote was received. These records can be of considerable interest to politics buffs. For example, they can reveal how persons who voted for a given candidate voted on other races—something you couldn’t necessarily deduce from conventional aggregated election results.

Ballot images go further: they are literal pictures of filled-out ballots, which means they also record stray marks and cross-outs, write-ins, coffee stains, and anything else that may have found its way onto the paper (you’re not supposed to write in the margins on your ballot, but some voters do, and even sign their names.)

Ballot image records can hold additional interest for researchers; for example, they can shed light on unintended consequences of ballot design for voter behavior. And they can offer a practical benefit in case of close elections by allowing the side that is behind to check quickly how many ballots are marked ambiguously, which can make the difference in whether it is worth pursuing a recount or challenge. 

For all these reasons, to pursue general goals of transparency, and sometimes because they see it as required by public records law, quite a few states and localities have been releasing one or both of these records for some time. There don’t seem to have been any privacy disasters—yet, at least.

What are the privacy hazards? If you’re one who likes to write and sign little messages on the ballot when you vote, obviously, the release of ballot images may bring both your message and your identity to the attention of strangers. But it’s possible that someone can deduce which ballot is yours even if you don’t do that, and without the visual image. You might be the only one in your small precinct to back a third-party candidate or write-in. The chances of identification rise if the record carries a timestamp or sequence-of-ballots-received number and someone remembers you voting first thing in the morning.

Administrators might evade these hazards by redacting or combining some data before public release—grouping precincts together, for example. But that comes at a cost in further expense and delay, as well as making the data less useful.

A new law enacted by the Minnesota legislature as part of wide-ranging election reform takes a middle course. It classifies ballot images themselves as sensitive individual data not to be released, but it directs that cast vote record (CVR) data be made public unless it falls into certain categories “likely to facilitate associating votes with particular voters, such as showing the order in which the votes were cast,” to quote one report. 

One reason the landscape is changing quickly is that election administrators have scrambled to respond to a wave of public records requests for cast votes; election conspiracy buff Mike Lindell has urged his followers to file such requests. Some offices calculate that pre-emptively releasing the records to everyone would be easier than coping with the request barrage.

Admittedly, the disclosure is unlikely to satisfy the most ardent #StopTheSteal believers, who may interpret redaction of timestamps, for example, as evidence that the authorities are trying to cover up midnight vote “dumps.” Yet the same data might persuade or reassure others.

Arizona Secretary of State Adrian Fontes, who favors aggressive transparency in a state torn by election bickering, says releasing the full data could force conspiracists to play on a level field with less committed observers who currently lack a way to evaluate claims of occult goings-on. If things went well, according to a Washington Monthly account sympathetic to the idea, fanciful claims of ballot mishandling “could also then be checked by other outside groups and individuals with direct access to the same ballot images.”

At a time when a majority of adherents to one political party tell pollsters they don’t accept the other side’s win as legitimate, it’s hard not to be curious about what greater transparency might accomplish.

When you use a product that’s closely supervised by the government, you might be tempted to assume the bureaucratic babysitting is somehow necessary for the product or its industry to run smoothly. Yet when regulators first propose special supervision years after you’ve already seen the product work as intended, you may be tempted to ask, “What gives?”

When it comes to the Consumer Financial Protection Bureau’s (CFPB) proposal to bring popular payment apps (like Apple Pay, Google Pay, PayPal, Venmo, and Cash App) under a supervisory regime, the answer is that the agency sees the apps have become quite popular, and the CFPB treats success alone as a reason for more invasive oversight.

The digital payment app market is hardly crying out for a regulator to ride to consumers’ rescue, and the CFPB’s proposed rule provides a real-time demonstration of how regulators won’t hesitate to “fix” something even when—and perhaps, especially when—“it ain’t broken,” as the old saw goes.

This month, the CFPB proposed subjecting major digital consumer payment applications to agency supervision by designating the apps as “larger participants” in a market for consumer financial services. The Dodd-Frank Act gives the CFPB the authority to supervise these larger participants, meaning that in addition to the ability to conduct enforcement actions for violations of consumer financial protection law, the CFPB also may proactively monitor and examine these specially designated businesses.

Under the proposed rule, covered digital payment apps would find themselves facing a host of potential CFPB supervisory activities, including on-site exams involving requests for records, regulatory meetings, record reviews, as well as compliance evaluations, reports, and ratings. The Bureau estimates such exams would take approximately eight to ten weeks on average.

All this mucking about while a business is trying to get work done conjures images of Homer Simpson’s brief stint supervising a team of engineers:

Homer: “Are you guys working?”

Team: “Yes, sir, Mr. Simpson.”

Homer: “Could you, um, work any harder than this?”

Who exactly would become subject to CFPB supervision under the proposal? The proposed rule would cover providers of “general-use digital consumer payment” apps—including both fund transfer and digital wallet apps—that meet requirements around transaction volume (five million transactions annually) and firm size (not being a small business as defined by law). The proposal contains some notable exclusions, including exemptions for apps that only facilitate payments for specific goods or services (i.e., are not general use), as well as for transactions with marketplaces through those marketplaces’ own platforms.

One question raised by the proposal, particularly its reference to digital wallets, is whether cryptocurrency transfers and wallets are in scope. The answer, in short, is sometimes.

According to the CFPB, covered fund transfers include crypto transfers, so the rule likely would cover hosted crypto wallets (where an intermediary controls the private keys for accessing users’ funds) used for those purposes. However, the proposed rule does not cover purchasing or trading cryptocurrencies, as it excludes exchanges of one form of funds for another, as well as purchases of securities and commodities regulated by the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). (Add this to the list of ways in which lingering questions about SEC and CFTC jurisdiction over crypto create unhelpful regulatory ambiguity.)

The proposed rule’s application to self-hosted crypto wallets (where users control their own private keys) likely will hinge on interpretive questions (including those related to the definition of “wallet functionality”), and these could leave the agency room to find some self-hosted wallets in-scope. (If the CFPB were to go this route, it would be yet another example of subjecting a core crypto technology to poorly conceived regulation.)

When it comes to the CFPB’s reasons for the proposal, perversely, the very data indicating that the market for digital payment applications is anything but broken is the data the CFPB cites as the basis for subjecting the market to special supervision. According to the agency, “The CFPB is proposing to establish supervisory authority over nonbank covered persons who are larger participants in this market because this market has large and increasing significance to the everyday financial lives of consumers.” Another way to put this is that fulfilling consumer demand alone calls for greater scrutiny.

How popular have these apps become? According to the CFBP itself, 76 percent of Americans have used one of four major payment apps; 61 percent of low-income consumers report using payment apps; merchant acceptance of payment apps “has rapidly expanded as businesses seek to make it as easy as possible for consumers to make purchases through whatever is their preferred payment method;” and adoption by younger users may drive even further growth.

Separate survey data tend to support the idea that consumers’ positive assessments of these apps line up with their revealed preferences. According to survey data compiled by Morning Consult in 2017, a sizable majority of American adults were either very satisfied or somewhat satisfied with a variety of digital payment apps, including Venmo (71 percent), Apple Pay (82 percent), Google Wallet (79 percent), and PayPal (91 percent). Recently, some even tried to frame Apple Pay as making payments “too easy” for consumers’ own good.

The CFPB’s proposal is not an example of a regulator seeking to impose sorely needed order in a broken and lawless sector, but rather an agency ratcheting up compliance requirements in an already regulated space. For instance, consumer financial products and services—which include consumer payment services via any technology—already are subject to the CFPB’s authority to enforce prohibitions against unfair, deceptive, or abusive acts or practices. Moreover, the CFPB already has the power to supervise relevant financial service providers where it issues orders determining, with reasonable cause, that the providers pose risks to consumers, something that the agency fails to do in any convincing manner in the proposal.

That the CFPB is seeking to assert supervisory authority over the digital payment app market without having to identify specific risks to consumers is emblematic of a fundamentally flawed approach to regulation.

In the case of digital payment apps, the proposed supervisory regime is not targeting a consumer financial service market failure but rather a market success. Witnessing this, it’s reasonable to ask what other supervisory regimes that consumers take for granted began as solutions in search of problems.

Canada’s link tax on online news goes into effect next month, but the preemptive embargo imposed by Google and Meta on news content is already having a significant, negative effect on smaller Canadian news outlets.

As Politico details, small news outlets are desperately begging Justin Trudeau’s administration for relief after a dramatic decline in online traffic:

“Between Google and Meta announcing their intention to exit news, we now expect a catastrophic 60 percent reduction in traffic,” ZoomerMedia’s chief operating officer Omri Tintpulver wrote to the prime minister’s office and heritage officials. “Jobs are going to be lost. Soon. Entire divisions may also be lost.”

This was an entirely predictable outcome. As I noted in my link tax analysis paper earlier this year, when Spain created a link tax variant — a “snippet tax” — in 2014, Google News pulled out of the Spanish market; and all 84 major Spanish newspapers endured a significant loss of traffic and revenue. The smaller the paper, the more severe the effects.

The outcomes from a link tax aren’t much better even when the social media platforms opt to fully comply rather than embargo the news as they did in Spain and Canada. When Australia passed a link tax in early 2021, Google and Meta eventually paid off the major media conglomerates to continue operating as usual. But small outlets weren’t able to shoulder-in at the link tax trough like their larger competitors, leading to the ongoing hyper-consolidation of the Australian news industry. The Big Ink news conglomerates are hiring away journalists from small newspapers or are simply acquiring their competitors outright.

You don’t have to take my word for it. It’s two years since the Aussie link tax was implemented and the early returns are coming in. It has been a bloodbath for small, local, and independent news outlets. Just look at all the red ink on this chart of Australian news outlet openings/​closures since early 2021!

It’s not only small news outlets that are struggling. As Politico noted, Canadian news publishers are worried that the link tax embargo will fall most heavily on newspapers serving Indigenous communities. They are right to worry. While I’ve yet to see data from Australia that specifically looks at the effects of their link tax on news outlets in Aboriginal communities, there is reason to suspect that the size-favoring incentives baked into the link tax especially hurt smaller outlets serving minority communities.

Were a link tax like the Journalism Competition and Preservation Act (JCPA) passed in the US, a similar effect would likely hold for smaller, independent newspapers serving black communities. As I wrote in my analysis:

The National Newspaper Publishers Association, formed in Washington, DC, in 1940, serves more than 200 black‐​owned newspapers, many of which have existed since the era when white‐​owned newspapers explicitly excluded black journalists and were generally disinterested in reaching black audiences. … The NNPA’s CEO called the JCPA a “blank check for large corporate media” that “leaves small minority‐​owned news out in the cold.” It would be perversely ironic if the JCPA, while seeking to preserve the newspaper industry, instead ends up preserving—or even deepening—the de facto segregation of the industry.

Of course, these aren’t the intended outcomes, but the road to policy hell is paved with good regulatory intentions. For example, the Minister of Canadian Heritage, Pascale St-Onge, is responsible for implementing their link tax. But St-Onge might just end up overseeing an erasure of Canada’s distinctive regional and cultural heritages as news outlets serving those specific interests and communities shut down, merge, or shrink. 

Indeed, it’s possible that St-Onge could feel the effects in a very direct way; she represents a district in Quebec, Canada’s predominantly French-speaking province. (She only eked out a victory over the Bloc Québécois candidate in 2021.) Even if Google/​Meta ended their news embargo, a link tax regime would still favor large, national, English-language news outlets at the expense of smaller, regional, French-language ones. I can’t imagine that losing local, French-language newspapers will warm the hearts of French Canadians towards their government representative in Ottawa.

American policymakers should pay attention. We now have clear indications from three different countries — Spain, Australia, and Canada — that link taxes are a failure on their own terms. They hurt rather than help local news outlets. They act as a cross-subsidy from Big Tech to Big Ink. Ultimately, link taxes mean fewer articles from fewer newspapers reaching fewer consumers.

Crossposted from the author’s newsletter. Click through and subscribe for more posts from the intersection of history, policy, and mass media.

This week, the Biden administration issued a long-anticipated Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (the “EO”). Given the breadth of the nearly 20,000-word document’s whole-of-government approach to AI—addressing the technology’s intersection with issues ranging from biosecurity to the labor force to government hiring—it unsurprisingly contains several provisions that address financial policy specifically.

Notably, the EO names financial services as one of several “critical fields” where the stakes of AI policy are particularly high. Nonetheless, by not providing a clear framework for financial regulators to validate the existence of heightened or novel risks from AI or to understand the cost of lost benefits due to intervention, the EO risks initiating agency overreach.

As a general matter, the EO largely calls on a host of administrative agencies to work on reports, collaborations, and strategic plans related to AI risks and capabilities. But the EO also orders the Secretary of Commerce to establish reporting mandates for those developing or providing access to AI models of certain capabilities. Under those mandates, developers of so-called “dual-use foundation models”—those meeting certain technical specifications and posing a “serious risk” to security and the public—must report their activities to the federal government.

In addition, those providing computing infrastructure of a certain capability must submit Know-Your-Customer reports to the federal government regarding foreign persons who use that infrastructure to train large AI models “that could be used in malicious cyber-enabled activity.” 

While it’s conceivable that these general-purpose reporting provisions could impact the financial services sector where financial companies develop or engage with covered advanced models, the provisions most relevant to fintech today are found elsewhere in the EO.

Where financial regulators are concerned, the EO requires varying degrees of study and action. As for studies, the Treasury Department must issue a report on AI-specific cybersecurity best practices for financial institutions. More concretely, the Secretary of Housing and Urban Development is tasked with issuing additional guidance on whether the use of technologies like tenant screening systems and algorithmic advertising is covered by or violative of federal laws on fair credit reporting and equal credit opportunity.

But the EO puts most financial regulators in a gray middle ground between the “study” and “act” ends of the spectrum, providing that agencies are “encouraged” to “consider” using their authorities “as they deem appropriate” to weigh in on a variety of financial AI policy issues. The Federal Housing Finance Agency and Consumer Financial Protection Bureau, for instance, are encouraged to consider requiring regulated entities to evaluate certain models (e.g., for underwriting and appraisal) for bias. More expansively, independent agencies generally—which would include the Federal Reserve and Securities and Exchange Commission—are encouraged to consider rulemaking and/​or guidance to protect Americans from fraud, discrimination, and threats to privacy, as well as from (supposed) financial stability risks due to AI in particular. 

The wisdom—or lack thereof—of these instructions can hinge on how the agencies interpret them. On the one hand, agencies should first ask whether existing authorities are relevant to AI issues—so as not to exceed those authorities. Similarly, agencies should ask whether applying those authorities to AI issues is appropriate—as opposed to blindly assuming AI presents heightened or novel risks requiring new rules without validating those assumptions.

On the other hand, to the extent agencies interpret the EO’s instructions as some version of “don’t just stand there, do something (or at least make it look like you are),” it could end up being the very thing that initiates misapplied authorities or excessive rules. Because the EO does not offer financial regulators a clear framework for confirming the presence of elevated or new risks from AI, or for minimizing the costs of intervention, it risks being interpreted more as a call for financial regulators to hurry up and regulate than to thoughtfully deliberate. In so doing, the EO risks undercutting its own goal of “[h]arnessing AI for good and realizing its myriad benefits” by mitigating risks.

For a chance to deliberate about financial AI policy questions, join the Cato Institute’s Center for Monetary and Financial Alternatives on November 16 for a virtual panel: “Being Predictive: Financial AI and the Regulatory Future.”