CFPB Issues Guidance on AI Use in Credit Decisions

On September 19, 2023, the Consumer Financial Protection Bureau (CFPB) issued a Consumer Protection Circular, “Adverse Action Notification Requirements and the Proper Use of the CFPB’s Sample Forms Provided in Regulation B” (Guidance), concerning lenders’ obligations when using artificial intelligence (AI) and other complex technologies to make consumer credit decisions.

In the press release, the CFPB reminds lenders that they must provide specific, accurate reasons when taking an adverse action against a consumer under the Equal Credit Opportunity Act (ECOA) and implementing Regulation B. The Guidance emphasizes the importance of this requirement in light of increased use of advanced algorithms in credit underwriting. It further cautions that a creditor may only use sample adverse action notice forms and the associated checklist of reasons if they adequately reflect the actual reasons for taking an adverse action.

Statement of reasons means statement of specific reasons

Under ECOA and Regulation B, a creditor taking an adverse action against a credit applicant must provide the applicant with a statement of reasons for the action taken that is “specific” and includes the “principal reason(s) for the adverse action.” In addition, the specific reasons must “relate to and accurately describe the factors actually considered or scored by a creditor.”[1] As such, a creditor may only use the sample adverse action notice forms and checklist if the reasons provided are specific and actually reflect the principal reason(s) for the adverse action. The CFPB emphasized that existing regulatory guidance instructs that the sample checklist should not be considered exhaustive.

Advances in credit underwriting

The Guidance highlights credit underwriting models that use complex algorithms involving AI and other predictive decision-making technologies, which can rely on data not found in a consumer’s credit file or credit application. It points out that a creditor taking adverse action against a consumer based on such information may not evade the requirement to specifically and accurately reflect the principal reason(s) that adverse action was taken against the credit applicant. This applies even in instances where creditors use factors that may surprise the consumer, such as data harvested from consumer surveillance that may not be intuitively related to the consumer’s finances or financial capacity.

The Guidance cites the Regulation B Commentary, which provides that the actual reasons for credit denial must be disclosed, “even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.”[2] The Guidance also highlights adverse action against consumers with existing credit lines. Specifically, lowering the limit on, or closing, a consumer’s credit line based on behavioral data (such as the type of establishment at which a consumer shops or the type of goods purchased) likely requires the statement of reasons to disclose more specific details about the consumer’s purchasing history (e.g., the type of establishment, the location of the business, or the type of goods purchased that resulted in the adverse action).

Key Takeaways

Creditors that use AI must comply with ECOA and Regulation B. Adverse action notice requirements apply to all ECOA-covered credit decisions, regardless of whether AI or complex algorithmic models are used to make them, and creditors are obligated to ensure that evolving data use and credit models comply with Regulation B and other consumer protection laws. This Guidance is consistent with and builds upon a May 2022 Consumer Financial Protection Circular, emphasizing that adverse action notification requirements under ECOA and Regulation B apply regardless of the technology used by creditors.

Model complexity does not eliminate those compliance obligations. According to the CFPB, ECOA and Regulation B do not permit creditors to use a “black-box” underwriting technology when doing so means that the creditor cannot provide specific and accurate reasons for an adverse action. As such, creditors cannot justify noncompliance with ECOA because their own technology is too complicated, opaque, or novel in its decision-making process. This Guidance is consistent with the banking agencies’ guidance on Model Risk Management, which sets an expectation for banks to understand and manage model risk in all aspects of a bank’s operation.

Creditors must provide specific reasons for taking an adverse action. Creditors must understand their credit decisioning and underwriting systems, without regard to complexity, so that they can comply with their fair lending obligations, including accurately informing applicants of reason(s) adverse action was taken. The sample adverse action notification forms in Appendix C to Regulation B should serve only as an example to creditors, and not an exhaustive list of applicable reasons for credit denial. The statement of reasons for adverse action must be specific and indicate the principal reason(s) for the adverse action; additionally, the stated reasons must accurately describe the factors actually considered or scored by the creditor. If the reasons listed on the forms are not actually used in credit-decisioning by a creditor, the creditor should modify the forms with their own reasons.

Given the CFPB’s focus on the intersection of technology and fair lending, creditors should take this opportunity to reexamine their adverse action notices to ensure the notices comply with all the adverse action notification requirements in Regulation B.

[1] 12 C.F.R. pt. 1002, Supp. I, cmt. 9(b)(2)-1 (emphasis added).

[2] 12 C.F.R. pt. 1002, Supp. I, cmt. 9(b)(2)-4.