FHFA Drops Anthropic: What AI Vendor Risk Means for Financial Institutions

When the Federal Housing Finance Agency terminated all use of Anthropic AI products on March 2, 2026, the ripple effect reached far beyond the mortgage GSEs. Banks running AI-powered fraud detection through third-party platforms. Credit unions using vendor-embedded chatbots for member service. Mortgage companies relying on AI document classification inside their LOS. Every financial institution that depends on vendor AI, which is nearly all of them, suddenly had a case study in how fast an AI vendor relationship can unravel for reasons that have nothing to do with technology performance.

FHFA Director William Pulte confirmed that Fannie Mae and Freddie Mac would cease using Anthropic's Claude platform immediately. The action followed President Trump's directive ordering federal agencies to cut ties with Anthropic after the company refused to remove safety restrictions on its AI for Pentagon use. For CISOs and CIOs at banks, credit unions, and mortgage companies, this is a wake-up call about a risk category that most vendor management programs do not adequately address: upstream AI vendor disruption driven by political, regulatory, or geopolitical forces.

What Happened: FHFA Terminates Anthropic AI Contract

The termination started with a dispute between Anthropic and the Pentagon. The Department of Defense wanted to use Anthropic's Claude AI for all lawful purposes, including defense and intelligence operations. Anthropic drew two lines: Claude would not be used for autonomous weapons systems and would not be used for mass surveillance of American citizens. CEO Dario Amodei stated publicly that threats would not change their position.

Defense Secretary Pete Hegseth responded by designating Anthropic as a supply-chain risk to national security. President Trump then ordered all federal agencies to terminate Anthropic contracts. Within days, Treasury, FHFA, HHS, and the State Department began shedding their Anthropic relationships. Multiple agencies announced they would transition to OpenAI as an alternative.

FHFA's action carries unique weight for the financial services industry. Unlike Treasury or HHS, FHFA directly regulates Fannie Mae and Freddie Mac, the two entities that define secondary market access for mortgage lenders and shape risk expectations that OCC, FDIC, and NCUA examiners watch closely. When Director Pulte extended the termination to include both GSEs, the signal reached every corner of financial services: a federal regulator with direct authority over financial institutions considers this AI vendor unacceptable.

The government has a six-month runway to complete the phase-out. Anthropic has stated it will challenge the supply-chain risk designation in court.

Why Financial Institutions Should Pay Attention

The FHFA-Anthropic termination exposes a blind spot in how banks, credit unions, and mortgage companies manage vendor risk. Traditional third-party risk management focuses on operational stability, data security, and financial viability. Will the vendor stay in business? Will they protect customer data? Can they meet uptime requirements? Those questions still matter. But the Anthropic episode introduces a category that most vendor risk frameworks do not address: political and geopolitical disruption risk.

For banks, the OCC and FDIC already expect robust third-party risk management programs under OCC Bulletin 2023-17 and FDIC FIL-2023-29. But those programs were designed for traditional technology vendors, not for AI providers whose regulatory standing can change overnight based on national security policy. For credit unions, the challenge is compounded by limited staff. Most credit unions manage vendor oversight with two or fewer dedicated employees. For mortgage companies, the GSE connection is direct: when FHFA signals concern about an AI vendor, that concern flows through Fannie Mae and Freddie Mac selling and servicing requirements straight into your compliance obligations.

Consider the chain of events. Anthropic refused to relax AI safety restrictions. The Pentagon labeled them a supply-chain risk. The President ordered agencies to cut ties. FHFA extended that to the GSEs. If your core banking platform, credit union service organization, document AI provider, or LOS vendor uses Anthropic's models under the hood, you now have a vendor-within-a-vendor risk that sits squarely within your AI risk management framework.

The AI Governance Gap Across Financial Services

The disconnect between AI adoption and AI governance in financial services is stark. Seven out of ten financial services firms are formally using AI, but fewer than one in four have policies that specifically address third-party AI risk. That gap is where incidents like the FHFA-Anthropic termination cause the most damage. Institutions have embedded vendor AI into critical workflows without the governance framework to manage a sudden disruption.

This is not a small-institution problem. Only 12% of Chief Risk Officers across financial services describe their organization's AI governance as "highly developed," according to the ProSight and Oliver Wyman 2026 CRO Outlook Survey. The rest are operating with partial frameworks, informal guidelines, or nothing at all. When your AI vendor's regulatory status changes overnight, the difference between "highly developed" governance and "we are working on it" governance is the difference between an orderly transition and operational chaos.

The governance gap shows up differently across institution types, and so does the regulatory pressure:

Meanwhile, 49% of financial institutions have already experienced a vendor-related cyber incident, while 73% have two or fewer staff dedicated to managing vendor risk (Ncontracts 2025 Third-Party Risk Management Survey). The institutions most exposed are the ones least equipped to respond.

The AI Vendor Risk You Are Already Carrying

Most financial institutions use AI through their existing technology vendors without fully mapping where that AI comes from, how it works, or what would happen if it disappeared. The AI is not always labeled as AI. It shows up as "intelligent automation," "smart workflows," or "advanced analytics" inside vendor platforms you have used for years.

Here is where AI is likely embedded in your technology stack right now:

The question is not whether you use vendor AI. You almost certainly do. The question is whether you know which AI models power each of these functions, who provides them, and what your contingency plan is if one of those vendor relationships changes.

Third-Party AI Risk Assessment: A Practical Framework

If your institution does not have a formal AI vendor risk assessment process, build one now. The FHFA-Anthropic situation demonstrates that standard vendor due diligence is not sufficient for AI. You need to ask questions that go beyond uptime SLAs and SOC 2 reports. The broader pattern of automation risks across financial services is explored in our analysis of the hidden risks in financial services automation.

Key Questions for Every AI Vendor

• Where does the vendor's AI model come from? Does your vendor build its own models, license them from a foundation model provider (OpenAI, Anthropic, Google, Meta), or use open-source models? If they license from a third party, your vendor risk assessment must account for the upstream provider
• How is the model trained? What data was used to train the model? Does the model train on your data? How is model performance validated for your specific financial services use cases, whether that is BSA/AML monitoring at a bank, member lending at a credit union, or document classification at a mortgage company?
• What data does the AI access? Does the model process customer PII, credit data, member information, or financial documents? Where is that data stored and processed? Does data leave your environment?
• What happens if the vendor loses its AI capabilities? If the vendor's upstream AI provider is disrupted (as happened with Anthropic), does your vendor have a contingency plan? Can they switch to an alternative model without disrupting your operations?
• What is the exit strategy? Can you move to a different vendor without losing data, re-training models, or rebuilding integrations? What is the realistic timeline and cost for a vendor transition?

These questions align with the Interagency Guidance on Third-Party Relationships (OCC Bulletin 2023-17, FDIC FIL-2023-29), which establishes principles for managing third-party vendor risk that apply equally to banks, credit unions operating under NCUA guidance, and non-depository mortgage lenders. The guidance applies to AI vendors as much as it applies to any other technology relationship.

Contract Provisions Every Financial Institution Needs for AI Vendors

Your vendor contracts may need updating. Standard technology service agreements often do not address AI-specific risks. Based on regulatory guidance and the lessons of the FHFA-Anthropic termination, here are the provisions banks, credit unions, and mortgage companies should require in AI vendor contracts.

AI Model Transparency

• Require vendors to disclose which AI models their products use and identify any upstream model providers
• Require notification when the vendor changes the underlying AI model, training data, or model architecture
• Specify that the vendor must disclose any AI components added to existing products, not just purpose-built AI features

Audit and Testing Rights

• Retain the right to audit AI model performance, bias testing results, and validation documentation
• Require the vendor to provide model performance data relevant to your institution's specific use cases on a scheduled basis
• Include the right to conduct independent testing of AI outputs for fair lending, BSA/AML accuracy, and other compliance-sensitive functions

Data Handling Requirements

• Specify that customer and member data processed by vendor AI must not be used for model training without explicit consent
• Define data residency requirements for AI processing
• Require data portability provisions so your data can be extracted if the vendor relationship ends

Change Notification and Contingency

• Require advance notification of any material changes to AI functionality, model providers, or data handling practices
• Define what constitutes a material change that triggers notification
• Require the vendor to maintain a documented contingency plan if their upstream AI provider becomes unavailable

Regulatory Compliance Obligations

• Require the vendor to support your compliance with applicable regulatory requirements, whether OCC guidance for banks, NCUA expectations for credit unions, or Freddie Mac Section 1302.8 for mortgage seller/servicers
• Require the vendor to cooperate with examiner requests related to AI use, regardless of your primary regulator
• Include termination provisions if the vendor cannot demonstrate compliance with applicable regulatory requirements

Tenant-Grounded Microsoft 365 Copilot: The AI Vendor Risk Answer

FHFA-style vendor decisions push financial institutions to a simpler architectural question: when the AI provider sits inside the productivity tenant the institution already owns, the political and supply-chain disruption category largely disappears. Microsoft 365 Copilot runs grounded in the institution's own Microsoft 365 tenant, with Microsoft Entra ID identity, Microsoft Purview information protection and Audit, and Microsoft sensitivity labels enforcing the same data boundaries the institution applies to email and documents. The Copilot prompt never leaves the tenant. Customer NPI, credit data, and member records stay inside the institution's regulatory perimeter. The vendor-within-a-vendor exposure that broke for Anthropic customers is structurally absent because there is no third-party model handling the data outside the customer's tenant. For a CISO writing a vendor risk policy on the morning after an FHFA directive, the Purview-governed, tenant-grounded path is the only AI architecture that survives the political-disruption category cleanly.

Layered on top of that architecture is M365 Guardian, ABT's operating model for governed Microsoft 365 Copilot rollouts inside regulated financial institutions. Guardian is the configuration discipline that closes the standard Copilot rollout failure modes that examiners now look for: oversharing through legacy SharePoint permissions, sensitivity labels not enforced before pilot, Purview Audit retention left at the default, Conditional Access not blocking unmanaged-device prompts, and Communication Compliance review templates not tuned to FINRA Rule 3110 patterns. The Guardian framework defines the readiness scan, the labeling baseline, the audit retention window, the role-scoped pilot, and the ongoing 24/7 monitoring that keep a Microsoft 365 Copilot rollout inside the institution's regulatory perimeter. When the next political or supply-chain event takes another consumer-grade AI vendor off the table overnight, the institutions on a Guardian-managed Microsoft 365 Copilot deployment do not have to migrate, re-paper, or explain. The vendor is Microsoft, the AI runs inside the tenant the bank already owns, and Purview produces the audit evidence on demand.

Building AI Vendor Resilience

Risk assessment and contract provisions are defensive measures. Building genuine resilience requires a broader strategy that accounts for the speed at which AI vendor relationships can change.

Avoid Single-Vendor AI Dependency

If your entire fraud detection pipeline or document processing workflow depends on one AI vendor, a disruption to that vendor disrupts your operations. Where practical, evaluate alternative vendors for critical AI functions. Even if you do not switch today, knowing your options and having evaluated alternatives puts you in a stronger position if a change is forced.

The Financial Stability Board has flagged AI vendor concentration as a systemic risk for financial services. Black Kite's 2026 Third-Party Breach Report found an average of 5.28 downstream victims per third-party breach, the highest level recorded, indicating how vendor disruptions cascade through interconnected systems. For credit unions and community banks with limited vendor management staff, concentration risk is amplified. You have fewer resources to manage a forced transition.

Understand Your Vendor's Vendor

The Anthropic episode illustrates that your vendor's AI provider can become your problem. Ask your core banking provider, LOS vendor, fraud detection platform, and digital banking provider whether they use Anthropic, OpenAI, Google, or other foundation models. Map those upstream dependencies so you understand your full exposure. A credit union's CUSO, a bank's core processor, and a mortgage company's LOS vendor may all share the same upstream AI dependency without any of their customers knowing.

Build Internal AI Competency

You do not need to build your own AI models. But you do need staff who can evaluate AI vendor claims, test AI outputs, and make informed decisions about AI risk. Invest in AI literacy for your compliance, technology, and operations teams. For smaller institutions, this might mean designating one person as the AI vendor oversight lead rather than spreading the responsibility across a team that is already stretched thin.

Regular Vendor Reviews

Annual vendor reviews are not sufficient for AI vendors. AI technology changes faster than traditional software. Schedule quarterly reviews for vendors whose AI touches lending decisions, transaction monitoring, member data, or compliance-sensitive functions. Between reviews, require vendors to notify you of material changes to their AI components, including upstream provider changes.

ABT runs Microsoft 365 Copilot deployments under the M365 Guardian operating model for 750+ financial institutions, with Microsoft Purview Audit, sensitivity labels, and Communication Compliance configured to the standards examiners actually grade. As the largest Tier-1 Microsoft Cloud Solution Provider dedicated to financial services, ABT helps banks, credit unions, and mortgage companies move AI work out of consumer-vendor risk and into a tenant-grounded posture that holds up across OCC, FDIC, NCUA, and GSE oversight.

For more on protecting your technology environment, see our analysis of OWASP Top 10 for Agentic AI in Financial Institutions, our guide to the Treasury AI Risk Framework for Financial Institutions, and our walkthrough of Microsoft 365 Copilot Business pricing and licensing for community banks and credit unions.

Frequently Asked Questions

Justin Kirsch

CEO, Access Business Technologies

Justin Kirsch has guided Microsoft 365 deployments for regulated financial institutions since 1999. As CEO of Access Business Technologies, the largest Tier-1 Microsoft Cloud Solution Provider dedicated to financial services, he helps more than 750 banks, credit unions, mortgage companies, and securities firms move AI work out of consumer-vendor risk and into tenant-grounded Microsoft 365 Copilot deployments under the M365 Guardian operating model.