An AI Chatbot for Fintech Starts a Legal Clock the Moment a Customer Says “I Didn’t Make This Payment”

A customer types "I didn't make this payment" into your chat widget at 11:40 on a Saturday night. In the US, that sentence starts a ten-business-day clock under Regulation E. In the UK, if the payment was a bank transfer, it starts a five-business-day clock under the Payment Systems Regulator's reimbursement rules. Neither clock cares whether a person or a model read the message. And if your AI chatbot for fintech replied with a cheerful link to the FAQ and moved on, the clock is running and nobody in your company knows.

That is the whole problem with support automation in financial services, compressed into one exchange. Most of what a fintech support bot will be asked is boring and safe. A small slice is regulated, time-boxed, and expensive to get wrong. The job is telling the two apart, every time, without a human in the loop.

We build ChatterMate, an open-source AI support agent. This is how we think about what the bot must refuse to do in a fintech, with the regulators' own words where they exist.

The regulator has already read your chat logs

In June 2023 the US Consumer Financial Protection Bureau published an issue spotlight on chatbots in consumer finance. It is still the most direct thing any financial regulator has written about support bots, and it is not a friendly document.

The numbers first. All ten of the largest US commercial banks had deployed a chatbot. About 98 million people, roughly 37% of the US population, had used one in 2022. The CFPB then went through its own complaint database and quoted customers directly. One had been told in chat that a dispute was opened and provisional credit was coming in 48 hours; a week later there was no dispute on file and the next agent could not produce a case ID. Another was trying to pay a credit card bill on the due date, got sent in circles by the virtual assistant, and ended up with a late fee.

The report has a phrase for that second pattern. Doom loops.

Two findings in it matter more than the anecdotes. First, the CFPB says plainly that chatbots must comply with the same federal consumer financial laws as the humans they replace, and that firms "may be liable" when they don't. Second, it names the specific failure it is worried about: a bot that fails to recognise when a customer is raising a dispute or invoking a legal right, because only certain words or phrasings trigger the dispute flow. The customer said the thing. The bot didn't hear it. Legally, the firm did.

The report is three years old, and most of the bots in it were keyword menus. A modern model understands "someone's taken £300 out of my account and I don't know who" far better than a keyword tree did. But comprehension is not action. Understanding a dispute and then answering it with a paragraph about how disputes work is the 2026 doom loop, and just as much a compliance failure.

Two clocks an AI chatbot for fintech has to know about

Here are the deadlines, because "regulated" is too vague to design against.

United States, Regulation E. Under 12 CFR 1005.11, once a consumer gives notice of an error on an electronic fund transfer, the institution has ten business days to investigate and decide. It can take up to 45 days if it provisionally credits the disputed amount within those first ten business days and tells the customer within two business days of doing so. The notice can be oral. A chat message is notice.

United Kingdom, APP fraud reimbursement. Since 7 October 2024, the PSR's mandatory reimbursement requirement obliges the sending payment firm to reimburse victims of authorised push payment scams on Faster Payments and CHAPS, up to £85,000 per claim, within five business days of the claim, or within 35 business days if it needs to investigate. The cost is split 50/50 with the receiving firm. Microenterprises and charities count as consumers.

The volume behind those rules is not small. The Financial Ombudsman Service's annual data for 2025/26 shows 214,600 complaints received, down 30% from 305,700 the year before, mostly because cases brought by claims-management firms collapsed. Current accounts drew 32,900 complaints, and 18,900 of those were fraud and scams: authorised push payment scams, crypto fraud, "safe account" scams. Current accounts overtook motor finance as the most complained-about product in the second half of the year.

That is the ombudsman, the last stop. Every one of those cases went through the firm's own process first, and more and more of those first contacts happen in a chat window.

So the design constraint is simple to state. The bot's first job in a fintech is not to answer. It is to classify. Is this a regulated event with a deadline, or is it a question?

What the bot should refuse to do

We're a vendor, so take this section as a product opinion. It is also the opinion of the regulators quoted above, which is why we hold it.

Do not give financial advice, and do not drift into it. "Should I move my savings into the 4.1% account?" is an advice question. In the UK the advice/guidance boundary is a live regulatory line, and the FCA's Mills Review, opened in January 2026, is asking outright how that boundary should work when the customer's first contact is an AI. Until that is settled, a support bot that explains what the account is, what its rate is today, and how to open it is doing its job. A bot that says "yes, you should" is doing your compliance officer's job badly. The system prompt has to draw the line, and the grounding has to be tight enough that the bot cannot wander over it when a customer pushes.

Do not state account-specific facts it hasn't fetched. "Has my transfer landed?" has one correct answer, and it lives in your ledger, not in the model's head. Either the bot has an authenticated tool call that reads the transaction, or it says it can't see that and hands over. There is no third option that is not a hallucination waiting to be screenshotted. We've written about why support bots hallucinate and how grounding stops it; in a fintech, an invented "yes, it's cleared" is not an embarrassment. It is a disputed transaction with your logo on it.

Do not make promises with legal weight. "You'll get a refund", "we'll have this sorted in 24 hours", "you're fully protected". Each of those is something a customer will quote back to you, and in the UK a Consumer Duty complaint will ask whether the firm's communications supported good understanding. A grounded bot answers from the published policy, with a citation to it, and stops there.

Do not be the only door. The CFPB's sharpest criticism was of firms where "speak to a person" led nowhere. Keep a visible, working path to a human that needs no magic word.

The three intents that must hand off, every time

Escalation rules are usually written as "if confidence is low, hand off". In a fintech that is necessary and nowhere near sufficient. Some intents should hand off even when the bot is certain it understood, because the legal event has already happened.

Unauthorised or disputed transaction. "I didn't make this." "That's not my payment." "Someone's used my card." The bot's correct reply is to confirm that it has opened a dispute, give a reference, tell the customer what happens in the next ten business days (US) or five (UK), and route to a human queue that is staffed to hit that deadline. Not an explanation of the disputes policy. An action.

A scam in progress. The most dangerous message a fintech bot will ever receive is a calm one: "Your fraud team called and told me to move my money to a safe account, can you confirm the sort code?" That is the "safe account" scam the FOS data is full of, and the customer is about to authorise the payment themselves. Here the bot should break character entirely: state that no legitimate team will ask this, tell the customer to stop, and get a human on the line. A bot tuned to be helpful and agreeable is the worst possible respondent to a customer who is being socially engineered.

A vulnerable or distressed customer. "I can't feed my kids until this is fixed." "I'm going to lose my flat." The FCA's vulnerability guidance sits inside the Consumer Duty, and a model that answers that with a link to the fee schedule is generating evidence against you. Distress is a hard handoff, transcript attached, so the person does not have to repeat themselves.

We built ChatterMate's handoff around intent and rules, not only confidence, for exactly this reason. Our guide to a human handoff that doesn't frustrate the customer covers the mechanics; in a fintech, certain intents skip the "would you like to speak to someone?" step and just go.

Where an AI chatbot for fintech earns its keep

None of that makes the bot a liability. It makes it a specialist.

Look at what actually fills a fintech support queue. Why did my card decline at the petrol station. When will a Faster Payment land versus BACS. How do I raise my daily limit. What documents count for the address check. Why was I asked to re-verify. What is this fee on my statement. Is this text from you genuine. Which countries does the card work in. Why is my account restricted and what do I send you.

Repetitive, documented, and time-sensitive in a way the customer feels but a ticket queue does not: a declined card at a checkout is a five-minute problem or a five-hour one depending on whether an answer exists at that moment. Fraud does not keep office hours. Neither do people moving money before rent day.

A bot grounded in your help centre, your fee schedule and your published policies, answering with a citation to the page it drew from and saying "I can't see that" when the answer isn't in the documents, will clear most of that queue, and clear it at 11:40 on a Saturday. The Consumer Duty's consumer-support outcome is, in plain words, that customers can get help as easily as they could buy the product. Always-on, cited answers to documented questions are the clearest evidence of that outcome we know of. The FCA executive responsible for the Duty calls AI a "major opportunity" for it in the Mills Review. The opportunity is real. It just lives on the documented side of the line, not the regulated-event side.

The argument we made about SaaS support holds harder here: the value is not the tickets you deflect, it is the customers who did not leave because the answer arrived while they still needed it.

The chat log is now a regulated record

One more thing the CFPB report gets right and most fintech bot deployments get wrong. Chat logs are sensitive financial data. Customers type card numbers, dates of birth and account numbers into chat windows because they are trying to get help, and they will keep doing it no matter how many times the bot asks them not to.

The report's example is the 2018 Ticketmaster UK breach, where attackers compromised a third-party chat vendor's servers and recorded what customers typed on the payments page: 9.4 million data subjects, around 60,000 payment card details. The chat widget was the attack surface.

So where the transcripts live, who can read them, how long you keep them, and which model provider sees them are not implementation details. Your DPO and your regulator will ask, and "in the vendor's cloud, somewhere in the US, we think" is not an answer a fintech wants to give. It is why we made ChatterMate self-hostable and why our security page leads with data residency rather than features. If you do use a hosted model, redact before the prompt leaves your infrastructure.

Related, and covered in our piece on prompt injection in support bots: if the bot can call tools that touch money, the customer's message is untrusted input to a privileged system. Scope every tool to the authenticated customer. Never let a chat turn trigger a payment.

Where this advice is weakest

We'd rather say this than have you find it.

The CFPB report is from 2023 and is mostly about large US banks running rule-based bots. It shows regulators are watching and that the dispute-recognition failure is real. It says nothing about how well a modern grounded model performs in a fintech. Nobody has published that data. We have not either.

The FOS figures count complaints about outcomes, not about chatbots. We do not know what share of those 18,900 fraud complaints touched a bot on the way; "first contact increasingly happens in chat" is an observation, not a statistic.

As far as we can find, the Consumer Duty has not yet been enforced against a firm specifically for a chatbot's conduct, and the Mills Review is a call for input, not a rulebook. The line we draw between "documented question" and "regulated event" is how we read the rules. Your compliance team may draw it elsewhere, and they outrank us.

And yes, we sell a product whose architecture matches this advice: grounded answers with citations, refusal when the documents don't cover it, rule-based handoff on intent, self-hosting. That is because we designed it after reading the same reports. We claim no immunity. A bot that says its guardrails make mistakes impossible is describing a feeling, not a system.

A short list to hand to compliance

Not a framework. Just the things that decide whether the bot is an asset or an exhibit.

• Write down which intents are regulated events (dispute, unauthorised transaction, scam in progress, vulnerability, complaint) and make each a hard handoff that logs a timestamp. The clock starts there.
• Ground the bot only in published, versioned documents, with a citation on every answer. When the fee schedule changes, the answer changes with it.
• Read access to account data only through authenticated tool calls scoped to the logged-in customer. No write access to money. Ever.
• Decide where transcripts live and for how long, in writing, before launch.
• Test it with the sentences customers actually type, including the calm ones and the ones in bad English at midnight. Our notes on testing an AI chatbot before it meets customers are a starting point.
• A visible human path on every screen the bot appears on.

Do those six and the bot will spend its nights answering "why did my card decline" and its worst moments doing the one thing a regulator will thank you for: noticing, and getting out of the way.

Written by the ChatterMate team. We build an open-source AI support agent that answers from your documents with citations, hands off on rules you set, and runs on your own infrastructure if you want it to. Try ChatterMate free, no card required, first 300 chats on us.