How Community Banks Can Stay Data-Compliant Across State Lines

As Native American Bank grew from a small rural community bank in Browning, Montana, into a nationally chartered institution headquartered in Denver, its leaders recognized the value of its data and the need to manage, protect and govern it with greater diligence. The $350 million-asset community bank was founded in 2001 to serve the Native American community.

The bank now operates in Montana, Colorado and Washington state, so it needs to follow the local regulations of all three states. It must also adhere to the preferences or requirements of Tribal Nations, which are sovereign entities, “so they’ve got their own laws and own rules and regulations,” says Jay Williams, executive vice president and chief technology officer of Native American Bank.

Community banks operating in different states and territories are juggling each of those jurisdictions’ regulations when it comes to data, specifically data privacy, breach reporting requirements when data is compromised, and what AI is doing with data. 

In addition to being complicated for community banks that already operate in more than one state or territory, this web of laws and regulations can be a headache for community banks looking to expand, says Anjelica Dortch, vice president of operational risk and cybersecurity policy for ICBA. Data might not be top of mind when considering such expansion, but “regulations, especially consumer privacy regulations, certainly matter,” she adds. 

GLBA exemptions by state are changing: What multi-state banks should do

State data privacy laws can differ on whether and how financial institutions are exempt. Besides California, all states exempt financial institutions from their data privacy laws due to the Gramm-Leach-Bliley Act (GLBA), a federal law that requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data.

Community banks should be aware of recent shifts in exemptions, though. In October 2025, Montana and Connecticut removed their GLBA entity-level exemptions, so while community banks are still exempt, other entities like mortgage bankers are now subject.

For community banks working across states and territories, a regulatory change management program can help keep track of regulations, legislation and proposed change. 

“If you don’t have an automated process,” says Robert Brosh, director of regulatory intelligence at Ncontracts, a provider of governance, risk and compliance software, “it can be extremely difficult to stay on top of having a way to receive this information that goes beyond probably just an email subscription to every regulator under the sun that could potentially impact you.” 

Williams notes that, fortunately, data privacy regulations for Native American Bank’s three states look similar (and most Tribal Nation requirements have more to do with vendor procurement than data), so the bank works toward what is required at the federal level by agencies like the FDIC and Office of the Comptroller of the Currency. 

“We go through their documentation and make sure we have the right controls to mitigate any risk,” Williams says. But they’re also not just doing the bare minimum required of them, he adds, especially when it comes to customer data. That’s because they want to “protect our bank employees and customers as tightly as we possibly can.”

How to handle what to do in each state depends upon the bank, says Zoe Strickland, senior fellow at the Future of Privacy Forum, a global nonprofit concerned with data protection, AI and emerging technologies. Tactics like those taken by Native American Bank are not uncommon. But to find the right answer, banks need to map out where their customers are, determine which rules apply and find the best approach. 

“Do I create separate rules for consumers who are residing in California versus another state? Or do I just go to the streets and apply all that?” Strickland says, singling out California because it has the strictest consumer privacy laws in the country. 

Community banks can consider how much of their customer base is in each state, if and how different state laws apply and how they vary, and if a state requires something unique when it comes to breach reporting and other privacy rules. Then, they can determine if it makes sense to segment customers by state or to apply the strictest rules to everyone. 

“There’s pros and cons to either approach,” Strickland says.

AI regulations for community banks: Focus on explainable AI, oversight and bias

Staying on top of AI regulations at the state level is a challenge, because what’s proposed and what’s passed change constantly, says Dortch. And while there is no federal AI law, President Donald Trump signed an executive order, “Ensuring a National Policy Framework for Artificial Intelligence,” in December 2025. It directed state governments to stop working on AI regulations and wait for the federal government to step in, though some states have ignored it. 

While banks wait to see how AI-related laws shake out, nearly every AI law enacted or proposed is coalescing around three things, says Eddie Callis, vice president of IT risk and assurance at Abrigo:

• Explainable human oversight
• Discrimination and bias controls
• Accountability to avoid "black box" bias 

“It can’t be a black box, and it cannot introduce bias,” he says. “If an AI system helps make a decision, especially when it comes to a person, the bank has to be able to explain how that decision was reached and how that decision was fair.”

Community banks could not only put themselves in a regulatory bind by not sticking to those three areas; they could also face legal trouble. Workday, an HR, IT and finance platform, is facing a class-action lawsuit over allegations that the company violated California’s Fair Employment and Housing Act when its AI-powered software screened out candidates based on age, race and disability.

Brosh notes that state-level AI regulations might also apply to things that are tangentially related to banks, such as chatbots, “to make sure that a chatbot isn’t deceiving customers to think that they’re talking to a person,” he says. “They’re almost tangentially related to banking, because they’re more about business operations and laws that financial institutions are subject to.” 

Dortch says community banks should also be careful that AI is not creating a black box when it comes to using data for marketing purposes. Not only could it put them in trouble with AI regulations now and in the future; it can also affect how banks interact with their customers, sometimes for the worse. 

“You have to be careful if you’re using AI to augment [marketing] and that it’s not hallucinating or providing solutions that can make matters worse,” she says, noting examples such as when data shows that a customer account is being overdrawn multiple times and triggers potential products to pitch to them.

---