QUESTION
We have used the model adverse action form for years. It is in our LOS. A question arose when our system put in a reason other than the model not accurately reflecting the basis for the adverse action.
This happened because we are using artificial intelligence in our credit models. I head underwriting and credit operations and serve on the AI committee. Our decision to use AI did not contemplate that AI would produce an adverse action other than the model form’s requirements.
Before making changes to our LOS or revising our policies, we want to find out if we must rely on the checklist of reasons for adverse action in Regulation B.
Is it acceptable not to use an adverse action reason not available in the adverse action notice?
How does artificial intelligence affect the accuracy required by Regulation B’s adverse action notice?
ANSWER
Creditors may not rely on the checklist of reasons provided in the sample forms (codified in Regulation B) to satisfy their obligations under the Equal Credit Opportunity Act (ECOA) if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action. Indeed, as a general matter, creditors should not rely on overly broad reasons to the extent that they obscure the specific and accurate reasons relied upon.
The ECOA, implemented by Regulation B, makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction based on race, color, religion, national origin, sex (including sexual orientation and gender identity), marital status, age (provided the applicant has the capacity to contract) or because all or part of the applicant’s income derives from any public assistance program, or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.[i]
When taking adverse action against an applicant, ECOA and Regulation B require that a creditor provide the applicant with a statement of reasons for the action.[ii] This statement of reasons must be “specific” and indicate the “principal reason(s) for the adverse action.”[iii] Furthermore, the specific reasons disclosed must “relate to and accurately describe the factors actually considered or scored by a creditor.”[iv]
Adverse action notice requirements promote fairness and equal opportunity for consumers engaged in credit transactions by serving as a tool to prevent and identify discrimination by requiring creditors to explain their decisions affirmatively.
Additionally, adverse action notices are supposed to provide consumers with an educational tool that allows them to understand the reasons for a creditor’s action and take steps to improve their credit status or rectify mistakes made by creditors.
Indeed, the CFPB does provide sample forms that creditors may use to satisfy their adverse action notification requirements, if appropriate. And these forms include a “checklist” of sample reasons for adverse action, which “creditors most commonly consider.”[v] But, note, there are open-ended fields for creditors to provide other reasons not listed.
Creditors use the sample forms to satisfy certain adverse action notice requirements under ECOA and the Fair Credit Reporting Act (FCRA),[vi] though the statutory obligations under each remain distinct.[vii] While the sample forms provide examples of commonly considered reasons for taking adverse action, “[t]he sample forms are illustrative and may not be appropriate for all creditors.”[viii]
So, be aware, reliance on the checklist of reasons provided in the sample forms will satisfy a creditor’s adverse action notification requirements only if the reasons disclosed are specific and indicate the principal reason(s) for the adverse action taken.
Now, concerning your question about artificial intelligence.
Some creditors use complex algorithms involving “artificial intelligence” and other predictive decision-making technologies in their underwriting models. The CFPB has previously issued guidance affirming that creditors are not excused from their adverse action notice obligations under ECOA simply because they rely on complex algorithmic underwriting models in making credit decisions.[ix]
These complex algorithms sometimes rely on data harvested from consumer surveillance or data not typically found in a consumer’s credit file or application. The CFPB has underscored the harm that can result from consumer surveillance and the risk these data may pose to consumers.[x]
Some of these data may not intuitively relate to the likelihood that a consumer will repay a loan. Consequently, the Bureau and the prudential regulators have previously noted that these data may create additional consumer protection risks.[xi] For instance, adverse action notice requirements under ECOA and Regulation B ensure that financial institutions use the data and advanced technologies in a way that fully complies with other legal requirements, such as the prohibition against illegal discrimination.[xii]
So, it is essential to understand that the CFPB, the Department of Justice, and other enforcement agencies have pledged to use their collective authorities to protect individual rights regardless of whether legal violations occur through traditional means or advanced technologies.[xiii]
Under ECOA and
Regulation B, a creditor must provide an applicant with a statement of specific
reason(s) for an adverse action. These reasons must “relate to and accurately describe
the factors actually considered or scored by a creditor.”[xiv] Thus,
a creditor may not rely solely on the unmodified checklist of reasons in the
sample forms provided by the CFPB if the reasons provided on the sample forms
do not reflect the principal reason(s) for the adverse action. As explained in
Regulation B,
“[i]f the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed.”[xv]
Rather, the sample forms merely provide an illustrative and non-exclusive list.[xvi] If the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the creditor’s responsibility – if it chooses to use the sample forms – either to modify the form or check “other” and include the appropriate explanation, thereby ensuring that the applicant against whom adverse action is taken receives a statement of reasons that is specific and indicates the principal reason(s) for the action taken.
Let me be clear: creditors that simply select the closest, but nevertheless inaccurate, identifiable factors from the checklist of sample reasons are not complying with the law. Creditors may not evade this requirement, even if the factors considered or scored by the creditor may surprise consumers – as certainly can happen when a creditor relies on complex algorithms using data not typically found in a consumer’s credit file or credit application.
Because it is unlawful for a creditor to fail to provide a statement of specific reasons for the action taken,[xvii] a creditor will not be complying with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action. Just as an accurate description of the factors actually considered or scored by a creditor is critical to ensuring compliant adverse action notifications, sufficient specificity is also required. Such specificity is necessary to ensure consumer understanding is not hindered by explanations that obfuscate the principal reason(s) for the adverse action taken.
Specificity with respect to artificial intelligence is a critical regulatory concern. To be sure, specificity is particularly important when creditors utilize complex algorithms. Consumers may not anticipate that certain data gathered outside their application or credit file and fed into an algorithmic decision-making model may be a principal reason for reaching a credit decision, particularly if the data are not intuitively related to their finances or financial capacity.
A creditor must “disclose the actual reasons for denial . . . even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.”[xviii] So, for instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations. That would be the case even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action.
I hope you are now getting a sense of how artificial intelligence impacts your credit decisioning and, by extension, the specificity required by the adverse action notice. Concerns regarding specificity may also arise when creditors take adverse action against consumers with existing credit lines.
An example can be
elucidated in an FTC complaint,[xix]
where a creditor decides to lower the limit on, or close altogether, a
consumer’s credit line based on behavioral data, such as the type of
establishment at which a consumer shops or the type of goods purchased. In this
instance, it would likely be insufficient for the creditor to simply state
“purchasing history” or “disfavored business patronage” as the principal reason
for the adverse action. Instead, the creditor would likely need to
disclose more specific details about the consumer’s purchasing history or
patronage that led to the reduction or closure, such as the type of
establishment, the location of the business, the type of goods purchased, or
other relevant considerations, as appropriate.[xx]
The Bureau has also clarified that adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or “black-box” algorithmic models or other technology that creditors may not understand sufficiently to meet their legal obligations.[xxii] As data use and credit models continue to evolve, creditors must ensure that these models comply with existing consumer protection laws.
Jonathan Foxx, PhD., MBA
Chairman & Managing Director[i] 15
USC 1691(a)
[ii] 15
USC 1691(d)(2); 12 CFR 1002.9(a)(2)(i); see also 12 CFR 1002.9(a)(2)(ii), which
allows creditors the option of providing notice or, following certain
requirements, to inform consumers of how to obtain such notice.
[iii] 15 USC 1691(d)(3); 12 CFR 1002.9(b)(2). See also Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B, Circular 2023-03, September 19, 2023, Consumer Financial Protection Bureau
[iv] 12
CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-2
[v] 12
CFR Part 1002, (App. C), Comment 3
[vi] Like
ECOA, FCRA also includes adverse action notification requirements. See 15 USC
1681m(a)(2). 15 USC 1681g(f)(1)(C); see also 1681g(f)(2)(B).
[vii] See
12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-9
[viii]
12 CFR Part 1002 (App. C), Comment 3
[ix]
[x]
Idem
[xi] Interagency
Statement on the Use of Alternative Data in Credit Underwriting, at 2 ,
Board of Governors of the Federal Reserve System, Consumer Financial Protection
Bureau, Federal Deposit Insurance Corp, National Credit Union Administration,
and Office of the Comptroller of the Currency.
[xii] Joint
Statement on Enforcement Efforts Against Discrimination and Bias in Automated
Systems, at 3 (April 23, 2023), Consumer Financial Protection Bureau,
Department of Justice, Equal Employment Opportunity Commission, and the Federal
Trade Commission.
[xiii]
Ibid. at 3
[xiv]
Op. cit. iv
[xv] 12
CFR Part 1002 (App. C), Comment 4
[xvi]
Op. cit. viii
[xvii]
Op. cit. ii
[xviii]
12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-4
[xix] FTC v. CompuCredit, Complaint, No. 1:08-cv-1976-BBM-RGV, 34-35 (N.D. Ga. filed June 10, 2008)
[xx] 12
CFR 1002.2(c)
[xxi] Revocations
or Unfavorable Changes to the Terms of Existing Credit Arrangements, 87 FR
30097 (May 18, 2022), Consumer Financial Protection Bureau. See also Credit
Card Line Decreases, (June 29, 2022), Consumer Financial Protection Bureau.
[xxii] Op.cit. ix
