AI Credit Score Underwriting

QUESTION 

Thank you for your recent columns on artificial intelligence in mortgage banking. I want to know how to handle credit scores using AI. I am the SVP Operations of a large wholesale lender. We want to include AI in our underwriting. In particular, we want to use it to evaluate a borrower's creditworthiness. However, our legal department has advised us that there are huge privacy issues. 

We do not want to be dependent on the credit reporting agencies for AI information. And we do not want to outsource AI in our credit score underwriting. The AI evaluation methods we discussed with legal have been shut down due to potential privacy violations. 

What are the privacy risks in using AI to determine a borrower's credit score? 

COMPLIANCE SOLUTION 

AI Policy Program for Mortgage Banking 

A well-constructed AI Policy Program is a proactive means designed to avoid and mitigate risks associated with Artificial Intelligence (AI). AI risk management is a key component of responsible development and use of AI systems. Responsible AI practices can help align the decisions about AI system design, development, and use with intended aims and values.

RESPONSE 

The privacy challenges associated with artificial intelligence are enormous, and the risks will only become more and more difficult to mitigate. In our recently issued AI Policy Program for Mortgage Banking, we sought to provide a comprehensive policy framework for using AI in mortgage banking. Indeed, one of the policies in the Policy Program is titled "Artificial Intelligence Credit Underwriting Policy." 

If you need a policy framework for AI, please request information about our Policy Program. 

AI credit score underwriting is an uncharted legal and regulatory territory! 

You will find that most of your legal department's concerns about AI in mortgage lending involve the collection and potential misuse of vast amounts of sensitive personal data, heightened cybersecurity vulnerabilities, and a lack of transparency that can lead to a loss of consumer trust and potential regulatory non-compliance. 

Broadening this out, AI in credit score underwriting stems from the extensive collection of sensitive, alternative data, the potential for unauthorized access and data breaches, and the difficulty in ensuring transparency and consumer control over how personal information is used. 

Whatever you do, you will need to be in lockstep with your legal advisors. This "territory" is dotted with legal minefields! Let's consider these risks. 

AI models require vast amounts of data, often going beyond traditional financial information to include "alternative data" such as geolocation, social media activity, online behavior, transaction histories, and even biometric data. The sheer volume and sensitive nature of this extensive data collection increase the overall risk to consumer privacy. 

Zero in on that data! It can be collected for one purpose but might be used for other, unforeseen purposes without the user's explicit consent. This lack of control over how personal data is processed raises significant privacy issues. From the legal perspective, this amounts to unauthorized use and repurposing. 

The large datasets used to train AI models are attractive targets for cyber attackers. Inadequate security measures or vulnerabilities in third-party vendor systems can lead to data breaches, exposing sensitive personal and financial information and increasing the risk of identity theft or fraud. Data security must be failsafe. 

AI algorithms can analyze seemingly innocuous data to infer highly personal attributes, such as health status, political views, or ethnic origin (a "predictive harm"). From a regulatory perspective, this risk arises from the inference of sensitive Information. In other words, this capability to derive sensitive insights can lead to potential discrimination and privacy infringements. 

Complex AI algorithms can be difficult to explain, even for their developers, creating a Black Box where it is unclear exactly how a specific credit decision was reached. This opacity, its lack of transparency, deprives consumers of understanding why they were denied credit and of exercising their right to an explanation or an appeal. I have written here about the Black Box "model" or "problem". 

Do not assume that so-called "anonymized" data effectively mitigates risk. Even when data is "anonymized," AI can sometimes de-anonymize individuals by cross-referencing various data points, compromising individual privacy.

Artificial Intelligence Disclosure

QUESTION 

I am the General Counsel and Compliance Officer of a mortgage lender. Our footprint is currently in 35 states. Recently, we have begun to use Artificial Intelligence in our loan origination process. However, I have some concerns about proper consumer disclosure. 

In my view, we should be disclosing our specific use of AI to borrowers. We should disclose the role AI plays in our loan applications from the point of sale to close, and, if applicable, beyond. But I do not find much regulatory guidance to lean on. I would appreciate your views on AI disclosure and, if possible, which areas would be subject to such disclosure. 

Is there a requirement for a mortgage lender to issue an AI consumer disclosure? 

What regulatory areas are potentially impacted by AI, thereby causing AI disclosure? 

COMPLIANCE SOLUTIONS 

AI Tune-up® 

Artificial Intelligence Statement  

RESPONSE 

There is currently no broad legal requirement for lenders to disclose the general use of AI in loan applications. However, under existing consumer protection and fair lending laws, lenders are legally required to disclose specific, accurate reasons for adverse actions, such as a loan denial, even if a complex AI or algorithmic system made the decision. 

This transparency is mandated by the Equal Credit Opportunity Act (ECOA), and regulatory bodies like the Consumer Financial Protection Bureau (CFPB) have issued guidance emphasizing that the complexity of AI is not an excuse for failing to provide a clear explanation. 

Regulatory Mandates 

Take, for instance, the regulatory mandates involving adverse action disclosure. The CFPB has directly addressed the issue of "black-box" models, which are AI systems whose logic is not clear even to their developers. The CFPB emphasizes that lenders cannot point to a broad category from a checklist, such as "purchasing history," if a consumer is denied credit based on AI analysis. Instead, the lender must provide specific details, such as the types of goods or places that influenced the decision. 

Also, there is no "AI exemption." A lender's use of AI or machine learning does not create a special exemption from fair lending laws. The CFPB has made it a priority to ensure that the use of technology does not allow lenders to circumvent established consumer protection regulations. In addition to the CFPB, regulators and the Federal Trade Commission have warned that there is no "AI exemption" for existing fair lending and consumer protection laws. Therefore, undisclosed AI could be found to violate these laws, leading to enforcement actions. 

The Colorado Artificial Intelligence Act 

Some state laws specifically address AI disclosure. For example, the Colorado Artificial Intelligence Act (CAIA) requires developers to test for algorithmic discrimination in consequential decisions, and some state consumer protection statutes allow for prosecution if an AI's biased outcomes cause consumer harm. This is a landmark act in many ways. If you are originating loans in Colorado, you should review the relevant regulations. However, you would do well to conduct a statewide review of AI legislation in all states where you are licensed to originate mortgage loans. 

CAIA may be a model for the direction states are going with respect to AI disclosure. The Act defines algorithmic discrimination, which is the unlawful differential treatment that disfavors an individual or group on the basis of protected characteristics. The algorithmic discrimination would be caused by high-risk artificial intelligence systems, defined as any system that, when deployed, makes — or is a substantial factor in making — a "consequential decision," which generally relates to those involving education, employment, financial services, housing, health care, or legal services. 

Under the CAIA, there are stipulated requirements for developers to clearly display on their website or in public use an up-to-date disclosure of any high-risk AI systems they have developed and make available how they manage known or reasonably foreseeable risks of algorithmic discrimination. Any determination that the AI system has caused or is reasonably likely to cause algorithmic discrimination must be brought to the attention of the Colorado attorney general, among others.

FICO to include BNPL Data

FICO (Fair Isaac Corp) is making updates to its credit score models to incorporate Buy Now, Pay Later (BNPL) data. It announced this update today: FICO Unveils Groundbreaking Credit Scores That Incorporate Buy Now, Pay Later Data. See the outline below for details.

FICO and BNPL provider Affirm released a study in February simulating the impact of credit score on BNPL loans. It showed that the "majority" of consumers with five or more BNPL loans from Affirm would experience "higher scores or no score changes." *

Key Details of FICO's Updates

New Scores: FICO will be introducing two new credit score models, FICO Score 10 BNPL and FICO Score 10 T BNPL, which will factor in BNPL repayment information.

Launch: These new scores are set to launch in the fall of 2025.

Purpose: FICO's aim is to provide lenders with a more comprehensive understanding of consumers' repayment behavior, especially for those with limited traditional credit history who utilize BNPL services.

Data Aggregation: FICO has developed an innovative approach that involves aggregating separate BNPL loans when calculating certain variables within their models.

Potential Impact: Early studies with Affirm, a major BNPL provider, suggest that for many consumers with five or more BNPL loans, the inclusion of this data could lead to higher scores or no change.

Availability: FICO Score 10 BNPL and FICO Score 10 T BNPL will be offered alongside the existing versions of the FICO Score, allowing lenders to evaluate the impact of BNPL data within their current processes. 

Why the Update Matters

Financial Inclusion: Incorporating BNPL data could help individuals with limited or no traditional credit history to build a credit profile and potentially access more traditional forms of credit.

Lender Visibility: Lenders will gain better insight into how consumers manage BNPL loans, helping them make more informed lending decisions.

"Phantom Debt": BNPL has sometimes been referred to as "phantom debt" because it was often not reported to credit bureaus, making it difficult for lenders to assess a borrower's overall financial health. FICO's update addresses this blind spot. 

Important Considerations

Lender Adoption: It will take time for lenders to widely adopt these new scores.

Bureau Reporting: The credit bureaus (Experian, Equifax, TransUnion) have begun collecting BNPL data, but the consistency of reporting from BNPL providers is still evolving.

Responsible Use: While BNPL can be helpful for building credit, it's crucial for consumers to be mindful of their usage, avoid overspending, and make timely payments to maintain a healthy credit profile. 

FICO's integration of BNPL data into its credit scoring models is meant to provide a more complete picture of consumer creditworthiness.

For inquiries regarding this update contact us for professional advice.

____________________________

* FICO and Affirm Unveil Industry-Leading Analysis of ‘Buy Now, Pay Later’ Loans, February 4, 2025, FICO Newsroom, Scoring Solutions

Joint Users of Credit Reports

QUESTION 

I am the Compliance Officer of a bank in the northwest. We run credit reports on applications. If we cannot make the loans, we provide them to our investors and other lenders. 

Be that as it may, our regulator suggests we revise our FCRA policy regarding transferring an applicant's credit report to other lenders for processing. They want us to include language requiring an applicant's express consent to transfer the credit report. 

What advice can you offer to revise our FCRA policy for transferring the credit report and application to another lender?

COMPLIANCE SOLUTION

Policies and Procedures 

ANSWER 

Let's begin with some basics about the Fair Credit Reporting Act (FCRA). In general, the FCRA affects any person or entity that is: 

·       A Consumer Reporting Agency (CRA), such as a credit bureau; 

·       Users of the consumer reports that a CRA produces; or 

·       Those who furnish information about consumers to CRAs. 

CRAs have several responsibilities under the FCRA, such as: 

·       Ensuring that consumer reports are provided to others only for a purpose permissible under the FCRA; 

·       Ensuring that consumer reports include required information but not information that is prohibited; 

·       Disclosing information on file to consumers in response to their request; and 

·       Investigating consumers' claims of inaccurate information in a consumer report and correcting the information if it is erroneous. 

Anyone who provides a consumer report to others becomes a CRA[i] and is subject to the regulations governing these agencies. This is true regardless of whether the person prepared the consumer report or provided a copy of a consumer report prepared by someone else. 

For example, if a financial institution obtains a consumer's credit report from a CRA (i.e., a credit bureau), it would become a CRA if it provided a copy of that credit report to anyone else. 

Most financial institutions do not want to become CRAs because they do not want the compliance responsibilities imposed on such agencies. Therefore, most financial institutions do not provide credit reports or information contained in credit reports to third parties unless doing so is specifically permitted under the FCRA. 

Which brings us to joint users of credit reports! 

Lenders are permitted to provide consumer report information to other lenders without violating the FCRA if they are "joint users" of the specific consumer report. Although not contained in the FCRA, this exception is established in a commentary of the Federal Trade Commission (FTC).[ii] 

Lenders who forward credit reports to other lenders jointly involved in a lending decision are not considered CRAs, provided the application is forwarded to the other lenders at the consumer's request. 

A loan application, including the credit report, is forwarded to several investors in many mortgage loan situations. If this exception were not permitted, the lender forwarding the credit report would be considered a CRA under the FCRA. However, because of the exception, the lender and the investors who receive the application and credit report are considered "joint users" involved jointly in the credit decision. 

The key to taking advantage of this exception is that the application is forwarded to these other lenders at the consumer's request: 

"In order for the additional creditors to whom your client forwards the loan application to have a permissible purpose to obtain a consumer report, the potential credit transaction must be initiated by the consumer. For this reason, … a lender may forward a loan application to another lender at the consumer's request. Accordingly, [the lender] must obtain the consumer's consent prior to forwarding such information to additional lenders."[iii] (My emphasis.) 

Note that consumer consent is required to forward the application. 

This leaves open the question of what form such consent should take. In light of this, the FTC concluded that the inclusion in a lender's loan application of a section that enables the consumer to indicate consent for the loan application file to be forwarded to "other lenders" would be 

"… sufficient to satisfy the requirement that subsequent creditors have a permissible purpose to receive the consumer report included in the file. Such action can only be taken, however, in pursuit of the approval of the loan application."[iv] 

Therefore, a consumer's written authorization to submit an application to other lenders should be included in any situation where it may occur. This can be done separately, as part of the application, or as part of a broker agreement with the consumer. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Fair Credit Reporting Act, Section 603(f); 15 USC section 1681a(f))

[ii] Elucidated regarding an earlier version of the FCRA. See “Joint Users” – FCRA §§ 603(f) and 604(a)(3)(A), Federal Trade Commission Letter, November 20, 1998, Division of Financial Practices, Federal Trade Commission. 16 CFR 600. See also Statement of General Policy or Interpretation; Commentary on the Fair Credit Reporting Act, 55 FR 18804, May 4, 1990, Rules and Regulations.

[iii] Idem

[iv] Op. cit. ii

Reasonable Investigation Standard under the FCRA

QUESTION 

I am the General Counsel for a servicer. You have written many times about RESPA’s requirement that mortgage loan servicers conduct reasonable investigations of QWRs. I don’t think there is a reliable definition of a reasonable investigation in RESPA, and I question whether there is one in the FCRA. 

To me, it seems to come down to an arbitrary and somewhat subjective understanding rather than a concrete, time-tested definition. I would like to be able to rely on something more legally applicable. 

My current concern involves credit repair agencies, about which you have written extensively. In particular, I want to know how a reasonable investigation is described procedurally in the Fair Credit Reporting Act with respect to credit repair agencies involved in potential violations. I am being specific because I am currently handling litigation relating to the FCRA and a credit reporting agency. 

I want to know if there is a reasonable investigative standard or set of requirements to follow that comply with the FCRA. 

What is the reasonable investigative standard that complies with the FCRA? 

ANSWER 

You might be interested in Radford v. LoanCare, LLC,[i] litigation alleging a violation of the Real Estate Settlement Procedures Act (RESPA). The case also examined whether LoanCare had complied with the Fair Credit Reporting Act (FCRA) with respect to the reasonable investigation requirement. 

First, let me set forth the requirements, so you have this information up front. 

The FCRA requires furnishers of information to provide accurate information to Credit Reporting Agencies (CRAs). It also requires them to investigate the accuracy of the information they provided if they receive notice of a dispute from a CRA. 

They must 

(1) conduct an investigation; 

(2) review all relevant information provided by the CRA; 

(3) report the results of the investigation to the CRA; 

(4) if the investigation finds that information is incomplete or inaccurate, report those results to all CRAs to which they provided information; and 

(5) if an item disputed by the consumer is found to be inaccurate or incomplete or cannot be verified after investigation, promptly modify that item, delete that item, or permanently block the reporting of that item. 

If the furnisher fails to comply with these requirements, a consumer may sue for actual damages caused by the failure, and seek punitive damages if the furnisher willfully fails to comply. 

Marcialene Radford claimed that LoanCare negligently and willfully violated the FCRA by failing to conduct a reasonable investigation into her credit disputes and verifying inaccurate information to the CRAs. LoanCare defended by arguing that it had investigated Radford’s payment history and determined the CRAs’ reports were accurate, and Radford did not show damages due to the alleged violation. 

Like RESPA, the FCRA does not define the level of investigation required. It simply requires the investigation to be reasonable. I realize you seem to believe the reasonable investigation standard is “arbitrary” and not “time-tested.” Here, the court concluded that the reasonableness of LoanCare’s investigation was genuinely disputed. 

At the time LoanCare received automated credit dispute verification (ACDV) requests from the CRAs, the loan notes on Radford’s account already reflected repeated disputes in the preceding months regarding her June and July payments, but LoanCare did not even claim that it had reviewed those complaints during its investigation. 

Here’s a takeaway: 

While a furnisher of information need investigate only what is contained in the CRA’s dispute notice as to the nature of the dispute, it must actually investigate. That is, it must conduct some degree of careful inquiry. 

In light of the information provided by Radford’s letter, a reasonable jury could conclude that the failure to examine Radford’s repeated disputes and communications fell short of this standard. 

As for damages, the court pointed out that because Radford had alleged both a negligent and a willful violation, she could recover statutory and punitive damages if she could prove a willful violation even if she did not suffer any actual damages. 

In any event, Radford provided evidence of actual damages by presenting some evidence of emotional distress and evidence that LoanCare’s failure to correct inaccurate information had caused her denial of credit. Specifically, her affidavit asserted that her attempts to co-sign her son’s applications for car loans in July and October 2022 were rejected after the car dealerships made credit inquiries with Equifax and Experian. This evidence was sufficient to present a genuine dispute of material fact regarding Radford’s actual damages. As a result, the court denied LoanCare’s motion for summary judgment. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
Lenders Compliance Group

---

[i] Radford v. LoanCare, LLC, 4:21 CV 1368 CDP (E.D. Mo. May. 2, 2023)

Investigating Direct Disputes

QUESTION

A recent audit of our servicing platform showed that we failed to investigate direct disputes in our reporting to the credit agencies. There seemed to be a gap in how we identified what dispute needed to be investigated and what dispute did not. 

We reviewed thousands of files and found that some of the disputes were definitely miscategorized. Because of the miscategorizing of them, we did not conduct investigations. That led to consumer complaints. Our regulator also contacted us about the consumer complaints. It is coming here in a few weeks to examine our process. 

We found out that our loan servicing software had incorrect rules for identifying the proper categorizing of the disputes. Now, we are putting in new rules and overriding the old rules. This was a preventable calamity. We want your guidance to know when we must conduct an investigation. 

When must we investigate a direct dispute over the information in a credit report? 

What are the exceptions to the requirements to conduct the investigation? 

ANSWER 

To begin, let's be clear about what is a "direct dispute." This is a statutorily defined term.[i] In essence, it is a dispute by a consumer directly to a furnisher – including a furnisher that is a debt collector – concerning the accuracy of any information in a consumer report and pertaining to an account or other relationship that the furnisher has or had with the consumer. 

By the word "accuracy," I mean reported information[ii] about an account or other relationship with the consumer that reflects the terms of and liability for the account (or other relationship), reflects the consumer's performance and other conduct with respect to the account (or other relationship), and identifies the appropriate consumer. 

So, when should you conduct an investigation in connection with a direct dispute involving a consumer report? What is required is a reasonable investigation. There are four primary direct disputes that require a reasonable investigation. Let's consider each of them.

 Required Investigation of a Direct Dispute

 1. The consumer's liability for a credit account or other debt with the furnisher, such as direct disputes relating to whether (a) there is or has been identity theft or fraud against the consumer, (b) whether there is individual or joint liability on an account, or (c) whether the consumer is an authorized user of a credit account;

 2. The terms of a credit account or other debt with the furnisher, such as direct disputes relating to the type of account, principal balance, scheduled payment amount on an account, or the amount of the credit limit on an open-end account;

3. The consumer's performance or other conduct concerning an account or other relationship with the furnisher, such as direct disputes relating to the current payment status, high balance, the date a payment was made, the amount of a payment made, or the date an account was opened or closed; or

 4. Any other information included in a consumer report regarding an account or other relationship with the furnisher that bears on the consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.[iii] 

Exceptions to Requiring an Investigation of a Direct Dispute 

Concerning the exceptions to the requirements to conduct the investigation, there are two primary exceptions. Specifically, the following direct disputes do not apply to a furnisher if:

(1) The direct dispute relates to:

 a) The consumer's identifying information (other than a direct dispute relating to a consumer's liability for a credit account or other debt with the furnisher, such as name(s), date of birth, Social Security number, telephone number(s), or address(es);

 b) The identity of past or present employers;

 c) Inquiries or requests for a consumer report;

 d) Information derived from public records, such as judgments, bankruptcies, liens, and other legal matters (unless provided by a furnisher with an account or other relationship with the consumer);

 e) Information related to fraud alerts or active duty alerts; or

 f) Information provided to a consumer reporting agency by another furnisher; or

 (2) The furnisher has a reasonable belief that the direct dispute is submitted by, is prepared on behalf of the consumer by, or is submitted on a form supplied to the consumer by a credit repair organization[iv] or an entity that would be a credit repair organization, but for any nonprofit organization which is exempt from taxation under as a 501(c)(3).[v]

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] 16 CFR § 660.2(b)

[ii] 16 CFR § 660.2(a)

[iii] 16 CFR § 660.4(a)

[iv] As defined in 15 USC § 1679a(3)

[v] 15 USC § 1679a(3)(B)(i). See also, § 501(c)(3) in 26 USC § 501 - Exemption from tax on corporations, certain trusts, etc.

Reasonable Investigation of a Direct Dispute

QUESTION 

One of the findings in our internal audit caused us some concern. The audit found that we did not follow the proper steps in conducting a “reasonable investigation” for FCRA complaints. It says our “direct dispute” procedures were flawed. 

The audit only gave us a brief overview of what should be done to fix the process but no guidance. So, we’re writing to you for some advice. We’ve done some research, but it’s not particularly helpful. We need a more precise outline of what would cause us to conduct a reasonable investigation. 

Here are our two questions:

What is a “direct dispute?” 

What are some criteria that trigger a “reasonable investigation?” 

Thank you so much for your weekly FAQs. We love them! 

ANSWER 

I appreciate your kind words. Ours is a labor of love that shows our commitment to the mortgage community. Through highs and lows, we should look after one another! 

Let’s start with a general understanding of “direct dispute.”[i] It is a term found in the Fair Credit Reporting Act (FCRA) that occurs when a dispute is submitted by a consumer directly to a furnisher (including a furnisher that is a debt collector) concerning the accuracy of any information in a consumer report and pertaining to an account or other relationship that the furnisher has or had with the consumer. 

Your policies and procedures should meet regulatory standards, and they need to be monitored periodically for implementation. In addition to periodic reviews, you should update them as necessary to ensure their continued effectiveness. 

As a furnisher, you must establish and implement reasonable written policies and procedures regarding the accuracy and integrity of the information relating to consumers that your organization furnishes to a consumer reporting agency. The policies and procedures must be appropriate to the nature, size, complexity, and scope of your furnisher’s activities. 

There are several regulatory requirements.[ii] Subject to exceptions, a furnisher must conduct a “reasonable investigation” of a direct dispute if the dispute relates to: 

1. The consumer’s liability for a credit account or other debt with the furnisher, such as direct disputes relating to whether there is or has been identity theft or fraud against the consumer, whether there is individual or joint liability on an account, or whether the consumer is an authorized user of a credit account. 

2. The terms of a credit account or other debt with the furnisher, such as direct disputes relating to the type of account, principal balance, scheduled payment amount on an account, or the amount of the credit limit on an open-end account. 

3. The consumer’s performance or other conduct concerning an account or other relationship with the furnisher, such as direct disputes relating to the current payment status, high balance, the date a payment was made, the amount of a payment made, or the date an account was opened or closed. 

4. Any other information included in a consumer report regarding an account or other relationship with the furnisher that bears on the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.

Exceptions

There are two exceptions to having to conduct a reasonable investigation. The obligation of a furnisher to conduct a reasonable investigation does not apply if: 

1. The direct dispute relates to:

 

a. The consumer’s identifying information, as name(s), date of birth, Social Security Number, telephone number(s), or address(es). However, the exception does not apply if the direct dispute relates to a consumer’s liability for a credit account or other debt with the furnisher, such as whether there is or has been identity theft or fraud against the consumer, whether there is individual or joint liability on an account, or whether the consumer is an authorized user of a credit account;

 

b. The identity of past or present employers;

 

c. Inquiries or requests for a consumer report;

 

d. Information derived from public records, such as judgments, bankruptcies, liens, and other legal matters (unless provided by a furnisher with an account of other relationship with the consumer); and

 

e. Information related to fraud alerts or active duty alerts. 

2. The furnisher has a reasonable belief that the direct dispute is submitted by, prepared on behalf of, or is submitted on a form that is supplied to the consumer by a credit repair organization[iii] or an entity that would qualify as a credit repair organization but for the exemption for nonprofit entities. 

Jonathan Foxx, Ph.D., MBA

Chairman & Managing Director

Lenders Compliance Group

---

[i] 12 CFR § 222.41

[ii] 12 CFR § 334.43(a)

[iii] 15 USC Section 1679a(3)

Artificial Intelligence Benefits and Risks

QUESTION

There has been a lot of news these days about AI. Recently, a Fintech firm pitched us on using their AI platform to enhance our customer services. They also offer many other AI services. Frankly, I am “old school.” I am suspicious of all this technology coming in and taking the place of humans. 

Our president, however, is very into tech and gadgets. He wants to use AI for credit decisions, risk management, and even cybersecurity. Our AML officer has climbed aboard the AI bandwagon and wants to use AI to flag potential SAR filings. 

I head up customer services. The human factor is what I know, and it works well. I need somebody to ease my aching mind about all these AI services. And that “somebody” is going to be you. A lot of people in the company read your newsletter. We like your straightforward approach. 

Here are our questions: 

How is AI used in mortgage banking operations? 

What are the risks of using AI in banks and nonbanks? 

ANSWER

Thank you for your kind words. I will always have a soft spot for the people in customer service, the unit you head. That’s because customer service is often the first contact a consumer has with a company. How communication is handled can make a big difference between a friendly business relationship and a consumer complaint. Consumer complaints risk damaging reputation and loss of business and can cause a lot of legal and regulatory havoc. 

Artificial Intelligence, known by its acronym “AI,” is with us to stay. I’m going to provide a few of the ways that financial institutions are using AI. The five banking agencies (viz., OCC, FRB, FDIC, CFPB, and NCUA) have reviewed AI use for a few years, including machine learning. My sense is that the agencies are receptive to AI innovation, with the caveat that companies ensure that the AI identifies and manages risks associated with AI use. 

I count at least six areas where banks and nonbanks are using AI. 

Using Artificial Intelligence

1. Flagging Unusual Transactions 

Many institutions use AI to identify potentially suspicious, anomalous, or outlier transactions (i.e., fraud detection and financial crime monitoring). This involves using different forms of data (i.e., email text, audio data), both structured, systematically organized or arranged,  and unstructured). The aim is to identify fraud or anomalous transactions with greater accuracy and timeliness. It also includes identifying transactions for Bank Secrecy Act/Anti-Money Laundering investigations, monitoring employees for improper practices, and detecting data anomalies. 

2. Personalization of Customer Services 

Institutions are using AI technologies to improve the customer experience and to gain efficiencies, thereby better managing the allocation of financial resources. An example would be voice recognition and Natural Language Processing (NLP), which generally refers to the use of computers to understand or analyze natural language text or speech. 

Another example is the use of chatbots. The term “chatbot” may be new to you. Generally, it refers to a software application used to conduct an online chat conversation via text or text-to-speech instead of providing direct contact with a live human agent. The chatbot automates routine customer interactions, including account opening activities and general customer inquiries. Chatbots are used in call centers to process and triage customer calls to provide customized service. In fact, some institutions are using chatbot technology to target marketing better and customize certain responses and recommendations. 

3. Credit Decisions 

Some institutions use AI to inform credit decisions to enhance or supplement existing techniques. This implementation of AI uses traditional data or “alternative data,” which is information not typically found in the consumer’s credit files of the nationwide consumer reporting agencies or customarily provided by consumers as part of credit applications. AI can enhance alternative data by providing cash flow transactional information from a bank account. 

4. Risk Management 

We have clients that use AI to augment risk management and control practices. For example, it can be used in credit analytics, where an AI program can complement and provide a check on another, more traditional credit model. Financial institutions may also use AI to enhance credit monitoring (including through early warning alerts), payment collections, loan restructuring and recovery, and loss forecasting. 

Sometimes, AI assists internal audit and independent risk management to increase the sample size (such as for testing), evaluate risk, and refer higher-risk issues to human analysts. AI may also be used in liquidity risk management. We have a client that uses AI for just such a purpose, seeking to enhance monitoring of market conditions or collateral management. 

5. Textual Analysis 

Textual analysis refers to using NLP (viz., natural language processing, supra) for handling unstructured data (generally text) and obtaining insights from that data or improving the efficiency of existing processes. Various applications include analysis of regulations, news flow, earnings reports, consumer complaints, analyst rating changes, and legal documents. 

6. Cybersecurity 

AI is being implemented in cybersecurity because financial institutions use it to detect threats and malicious activity, reveal attackers, identify compromised systems, and support threat mitigation. There are many examples worth noting, like real-time investigation of potential attacks, the use of behavior-based detection to collect network metadata, flagging and blocking of new ransomware and other malicious attacks, identifying compromised accounts and files involved in exfiltration, and deep forensic analysis of malicious files. 

So, it seems obvious that AI has the potential to provide more accurate, lower-cost, and faster underwriting, as well as expanded credit access for consumers who may not have obtained credit under traditional credit underwriting approaches. 

Risks of Artificial Intelligence

Notwithstanding the foregoing benefits, there are risks associated with AI, although it bears stating that many of the risks associated with using AI are not unique to AI. For instance, using AI could result in operational vulnerabilities, such as internal process or control breakdowns, cyber threats, and information technology lapses; nevertheless, these risks are also associated with the use of third parties, and various modeling risks, all of which could affect an institution’s safety and soundness. 

AI could create or increase consumer protection risks, such as risks of unlawful discrimination, violations relating to Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) under the Dodd-Frank Act, FTC’s UDAP rule (viz., unfair or deceptive acts or practices under the  FTC Act), or privacy concerns.

Credit Card Relief Scams

QUESTION 

We allow our loan applicants to pay for certain services by credit card. One service that we do not offer is credit relief. But our loan officers send applicants with poor credit to a credit relief company. The credit relief company repairs their credit, which makes it possible for us to get them a mortgage on improved terms. Most of the time, their credit problems involve credit card debt. 

Recently, an attorney for one of our loan applicants contacted us about the applicant being scammed by the credit relief company. He's threatening to contact law enforcement, the state banking department, the FTC, and the CFPB. For what it's worth, I had told the CEO not to use credit relief companies, but he ignored me. 

I know you have written about all kinds of scams over the years. I want to show the CEO your feedback. Maybe he will change his mind about using a credit relief company. 

What are some dangers of using a credit relief company? 

ANSWER 

Yes, indeed, I have written extensively about credit relief companies. They pose a threat to the banks and nonbanks in many ways. Your scenario, unfortunately, happens all the time. The Federal Trade Commission (FTC) is very aggressive in going after these companies. 

If your CEO calls me, I will tell him to knock it off! He's playing with fire. Whatever his reasons (which I assume are based on profit incentives), the risk is much too high to justify such a tactic to originate mortgage loans. 

There is a constant stream of administrative and litigious actions against credit card relief scams. I'll pick just one bad actor out of the barrel of thousands of bad actors that have been caught in the FTC's net. But other federal and state agencies are continually monitoring and prosecuting these scammers. If your company is referring clients to them, you could come in for rather unpleasant special treatment by these agencies. 

Let's take a brief look at the FTC's action against a credit card debt relief scheme operated by Sean Austin, John Steven Huffman, and John Preston Thompson and their affiliated companies that allegedly took millions from people by falsely promising to eliminate or substantially reduce their credit card debt. 

In the Complaint, Federal Trade Commission v Acro Services LLC, et al,[i] the FTC alleged that, since 2019, Austin, Huffman, and Thompson operated a network of companies incorporated in Tennessee, Nevada, New Mexico, and Wyoming that worked together as a common enterprise to support their deceptive credit card debt relief scheme.[ii] Their companies allegedly operated under multiple names, such as ACRO Services, American Consumer Rights Organization, Consumer Protection Resources, Reliance Solutions, Thacker & Associates, and Tri Star Consumer Group. 

The deceptive and unlawful tactics allegedly included:[iii] 

Deceptive Telemarketing

The operators violated the Telemarketing Sales Rule[iv] by using telemarketers to call consumers and pitch their deceptive scheme. The telemarketers often falsely claimed to be affiliated with a particular credit card association, bank, or credit reporting agency and promised they could greatly reduce or eliminate consumers' credit card debt in approximately 12-18 months. 

Making Phony Debt Relief Promises

In marketing their services, the scheme's operators claimed to use several bogus methods to reduce or eliminate consumers' credit card debt. For example, they falsely claimed that consumers may qualify for a federal debt relief program or that a consumer doesn't owe the debt because it hasn't been "validated." 

Charging Deceptive Upfront Fees

Consumers who agreed to sign up for the debt relief program were charged an upfront enrollment fee of thousands of dollars depending on a consumer's available credit. They were falsely told it is part of the debt that will be eliminated as part of the program. Consumers were also charged monthly fees ranging from $20-$35 for "credit monitoring" services. 

To compound the misery, consumers who signed up for the defendants' services were allegedly told to stop making payments to their credit card companies and communicating with those companies. Consumers, however, were never informed that as a result of such actions, they could be sued for failing to pay their credit card debt, may accrue even more debt, and could damage their credit scores, which could also harm their ability to get credit in the future, the FTC alleged. Nice guys! 

They wound up being temporarily shut down, and their assets were frozen.[v] QED 

Consumers often do not know how to spot a debt relief scam. Two signs of this fraud are (1) the consumer gets an unsolicited call from a scammer helping to eliminate their debt, and (2) the scammer asks for upfront fees. Another trick of this nasty scam is where the scammer tells the consumer to cut off communication with creditors. When a debt settlement company says the consumer must cut off all contact with the creditors and doesn’t disclose potential consequences such as collection actions or damage to the consumer’s credit, that’s a red flag of a debt settlement scam. 

Other ornery stratagems include where the scammer refuses to send the consumer information about the debt relief company unless the consumer first provides financial information (such as credit card account numbers and balances, and offering guarantees about lowering or erasing the debit. 

I do not want to paint all debt relief companies with too broad a brush. Legitimate debt relief companies can help consumers to avoid bankruptcy and get their credit back on track. Most debt relief companies are debt settlement companies whose ultimate goal is supposedly to help the consumer settle their debt, sometimes for less than what they owe. But their services are never free, and often costly, with some companies charging significant fees for their help. 

Debt settlement companies may tell the consumer to stop paying debts during the negotiation process with creditors to enable them to expedite the settlement process; however, they do not tell the consumer to cease contact with the creditors. The idea of negotiating is to convince the creditors that the consumer cannot repay the borrowed amount. Through the negotiation, leading to a debt management plan, the goal is for the creditor to settle for less rather than getting nothing by pushing the debtor into bankruptcy. 

If your CEO wants to continue to use a credit relief company, he should insist that the company comply with applicable FTC guidelines. According to the FTC, upfront, a debt settlement company must disclose the fees, conditions, and terms of service; how long it will take to achieve results; the amount the consumer must save in a dedicated savings account before the company makes an offer to each creditor on the consumer’s behalf; money in a dedicated account is the consumer’s to withdraw at any time without penalty; and the account administrator is not affiliated with the debt settlement provider and doesn’t get referral fees 

Based on your question, your company is currently at legal and regulatory risk. I have only grazed the surface. Careful planning and appropriate due diligence must be done. Until that undertaking is conducted, resulting in legally sound guidelines, your loan officers should stop referring applicants to any credit relief company. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Federal Trade Commission v Acro Services LLC, et al, US District Court, Middle District of Tennessee, 3:22-cv-00895, November 7, 2022

[ii] See FTC Halts Debt Relief Scheme that Bilked Millions from Consumers While Leaving Many Deeper in Debt, Release, November 30, 2022, Federal Trade Commission,

[iii] Idem

[iv] The Federal Trade Commission (FTC) enforces the Telemarketing Sales Rule.

[v] Temporary Restraining Order, Federal Trade Commission v Acro Services, et al, US District Court, Middle District of Tennessee, 3:22-cv-00895, November 21, 2022

Adverse Action Conundrum

QUESTION 

I have been told conflicting advice about the adverse action notice. Supposedly, these are people who are in the know. However, I am a compliance manager with no staff and don’t have a clear answer to my concerns. 

First, I want to know what information I need from a credit bureau to issue an adverse action notice. 

Secondly, I want to know what information I need from third parties that are not credit bureaus for me to issue the adverse action notice. 

Third, and the biggest issue for me, I want to know who we should notify when multiple applicants are on a loan application. I say this is the biggest issue because this is the one on which I get a lot of conflicting advice. 

So, here are my questions. 

What is required for adverse action based on credit bureau information? 

What is required for adverse action based on third parties? 

And, who is supposed to get the adverse action notice when the loan is for multiple applicants? 

ANSWER 

You are not alone in feeling some consternation. Many compliance professionals express some confusion about the notification requirements of adverse action. Section 615 of the Fair Credit Reporting Act (FCRA)[i] requires lenders to provide adverse action notices in cases where information from a consumer reporting agency is used and instances where information from other third parties is used to make the adverse credit decision. 

If you use a consumer credit report to take any type of adverse action that is based at least in part on information contained in a consumer report, you are required by the FCRA[ii] to notify the consumer. The notification may be in writing, orally, or by electronic means. 

You may already be familiar with what the notice must contain, such as: 

·      A numerical credit score[iii] used in taking any adverse action based in whole or in part on any information in a consumer report along with the following related information:[iv] 

o   The range of possible credit scores under the model used;

o   All of the key factors that adversely affected the credit score of the consumer in the model used, not to exceed four;

o   The date on which the credit score was created; and

o   The name of the person or entity that provided the credit score or credit file upon which the credit score was created. 

However, the adverse action notice must also include the following: 

-  The name, address, and telephone number of the credit reporting agency (CRA) (including a toll-free telephone number, if it is a nationwide CRA) that provided the report;

-  A statement that the CRA did not make the adverse decision and cannot explain why the decision was made;

-  A statement setting forth the consumer’s right to obtain a free disclosure of the consumer’s file from the CRA if the consumer requests the report within 60 days; and

-  A statement setting forth the consumer’s right to dispute directly with the CRA the accuracy or completeness of any information provided by the CRA. 

I suggest you review the model adverse action forms in Appendix C of Regulation B, the implementing regulation of the Equal Credit Opportunity Act (ECOA), which include model language for making the above disclosures, including the credit score information. 

Your second question is about adverse action notices based on information obtained from third parties that are not CRAs. I would add affiliates to that category. When a lender denies (or increases the charge for) credit for personal, family, or household purposes based either wholly or partly on information from a person other than a consumer reporting agency (such as a credit bureau), the FCRA[v] requires that the institution clearly and accurately discloses to the consumer their right to obtain disclosure of the nature of the information that was relied on by making a written request within 60 days of notification. The financial institution must provide the disclosure within a reasonable period of time following the consumer’s written request. 

You may take an adverse action involving insurance, employment, or a credit transaction initiated by the consumer, based on information of the type covered by the FCRA. If this information was obtained from an entity affiliated with the institution by common ownership or control, the FCRA[vi] requires the financial institution to notify the consumer of the adverse action. The notification must inform the consumer that they may obtain a disclosure of the nature of the information relied on by making a written request within 60 days of receiving the adverse action notice. And if the consumer makes such a request, the financial institution must disclose the nature of the information no later than 30 days after receiving the request. The applicable section of the FCRA[vii], however, does not cover information obtained directly from an affiliated entity relating solely to its transactions or experiences with the consumer and information from a consumer report obtained from an affiliate. 

Finally, you wanted to know about disclosing the adverse action notice where multiple applicants are on a loan application. The answer invokes both Regulation B as well as the Fair Trade Commission’s interpretation of the FCRA. In some cases, the rules of Regulation B regarding who must be provided the adverse action notice will differ from the rules under the FCRA. This is due to a Federal Trade Commission interpretation of Section 615(a) of the FCRA. The explanation is going to be a bit nerdy, but hang in there! 

Section 615(a) of the FCRA requires that “any consumer,” with respect to whom adverse action is taken, must receive the disclosures mandated by this section if that action is based “in whole or in part” on information from a consumer report. In the FTC’s view, the plain language “any consumer” includes a co-applicant. Neither the applicable section of Regulation B[viii] nor the combined disclosure permitted in Appendix C remove or modify that requirement for co-applicants. The objective of the combined disclosures permitted by the Federal Reserve Board in Appendix C to Regulation B is only to simplify the paperwork involved in making ECOA and FCRA notifications to a single applicant, where both are required – for instance, where the action by the creditor is both adverse to the applicant (ECOA) and is based in whole or in part on information from that applicant’s consumer report (FCRA).