Will AI Reduce Fair Lending Violations?

YOUR COMPLIANCE QUESTION 

Our company is building an AI engine to monitor for fair lending violations. The AI system is extensive and includes chatbots. It will be integrated into our LOS and several other systems. We are a large mortgage originator and servicer. We use one of the most well-known platforms for loan originating and servicing. The system offers several new AI features. But we ran our own test against the LOS and found that our AI engine is identifying more fair lending issues than the one embedded in the LOS. 

As the company's General Counsel and Chief Risk Officer, I was shocked that building our own AI system could produce better results than a highly rated, well-established LOS. Granted, our AI system is proprietary and reflects our unique compliance needs. Full disclosure: We have been a client of yours for over 15 years, and we have discussed these and other AI findings with your team in order to mitigate compliance risk. 

I wonder if a one-size-fits-all AI integration in the LOS can really be effective, given that fair lending involves many state and federal regulations. We are testing and monitoring our AI integration, but many companies lack the resources we have and will rely on their LOS provider's results. 

Do you think a generic AI system can reduce fair lending violations? 

Signed, 

Risk Averse 

OUR COMPLIANCE SOLUTION 

AI POLICY PROGRAM FOR MORTGAGE BANKING™ 

Our AI Policy Program aligns with Freddie Mac's AI governance requirements for Freddie Mac Sellers/Servicers. Responsible AI practices can help align AI system design, development, and use with applicable legal and regulatory guidelines. 

Our AI Policy Program consists of the following policies: 

1.      Artificial Intelligence Governance Policy

2.      Artificial Intelligence Use Policy

3.      Artificial Intelligence Workplace Policy

4.      Artificial Intelligence Credit Underwriting Policy

5.      Artificial Intelligence Do & Do Not Policy

6.      Artificial Intelligence Ethics Policy

7.      Artificial Intelligence Vendor Management Policy 

Contact us for the presentation and pricing.  

RESPONSE TO YOUR QUESTION 

Let me begin with my conclusion: there is currently no one-size-fits-all, generic AI system that can be thoroughly relied on to reduce fair lending violations. 

Most companies will rely on originating and servicing platforms that integrate AI into fair lending analytics. Unfortunately, companies are generally liable for AI errors, particularly when AI causes financial losses, safety issues, or provides consumers with false information. Legal responsibility typically falls on the business deploying the technology, even if it properly monitors, tests, or ensures that the AI is fit for fair lending detection. 

Legal and Regulatory Risk 

Put another way, your business is responsible for any misinformation provided by your AI chatbots. As you likely know, there are certain aspects of tort law, like duty of care, that require individuals and entities to act with reasonable care to avoid causing foreseeable harm to others. It forms the basis of negligence claims; if this duty is breached and causes injury, the responsible party may be held liable. 

I have repeatedly said that companies must ensure AI systems are properly trained and monitored to avoid liability for errors caused by biased AI. Although developers may be liable for inherent defects, the business deploying the AI is often responsible for how the system is used. 

If you are going to use AI to detect fair lending, you must be able to identify disparate impact patterns across demographic groups, monitor for "redlining" analogs in digital lending, flag outlier decisions that deviate from modeled norms, and generate audit trails for regulatory review. 

AI is rapidly transforming the mortgage industry, promising increased efficiency, faster decision-making, and improved risk assessment. Still, its integration poses significant challenges related to fair lending compliance, data bias, and transparency. While AI can expand credit access by utilizing alternative data, it risks perpetuating historical biases if models are trained on biased data or utilize "black box" algorithms that make decisions hard to explain.

Artificial Intelligence Disclosure

QUESTION 

I am the General Counsel and Compliance Officer of a mortgage lender. Our footprint is currently in 35 states. Recently, we have begun to use Artificial Intelligence in our loan origination process. However, I have some concerns about proper consumer disclosure. 

In my view, we should be disclosing our specific use of AI to borrowers. We should disclose the role AI plays in our loan applications from the point of sale to close, and, if applicable, beyond. But I do not find much regulatory guidance to lean on. I would appreciate your views on AI disclosure and, if possible, which areas would be subject to such disclosure. 

Is there a requirement for a mortgage lender to issue an AI consumer disclosure? 

What regulatory areas are potentially impacted by AI, thereby causing AI disclosure? 

COMPLIANCE SOLUTIONS 

AI Tune-up® 

Artificial Intelligence Statement  

RESPONSE 

There is currently no broad legal requirement for lenders to disclose the general use of AI in loan applications. However, under existing consumer protection and fair lending laws, lenders are legally required to disclose specific, accurate reasons for adverse actions, such as a loan denial, even if a complex AI or algorithmic system made the decision. 

This transparency is mandated by the Equal Credit Opportunity Act (ECOA), and regulatory bodies like the Consumer Financial Protection Bureau (CFPB) have issued guidance emphasizing that the complexity of AI is not an excuse for failing to provide a clear explanation. 

Regulatory Mandates 

Take, for instance, the regulatory mandates involving adverse action disclosure. The CFPB has directly addressed the issue of "black-box" models, which are AI systems whose logic is not clear even to their developers. The CFPB emphasizes that lenders cannot point to a broad category from a checklist, such as "purchasing history," if a consumer is denied credit based on AI analysis. Instead, the lender must provide specific details, such as the types of goods or places that influenced the decision. 

Also, there is no "AI exemption." A lender's use of AI or machine learning does not create a special exemption from fair lending laws. The CFPB has made it a priority to ensure that the use of technology does not allow lenders to circumvent established consumer protection regulations. In addition to the CFPB, regulators and the Federal Trade Commission have warned that there is no "AI exemption" for existing fair lending and consumer protection laws. Therefore, undisclosed AI could be found to violate these laws, leading to enforcement actions. 

The Colorado Artificial Intelligence Act 

Some state laws specifically address AI disclosure. For example, the Colorado Artificial Intelligence Act (CAIA) requires developers to test for algorithmic discrimination in consequential decisions, and some state consumer protection statutes allow for prosecution if an AI's biased outcomes cause consumer harm. This is a landmark act in many ways. If you are originating loans in Colorado, you should review the relevant regulations. However, you would do well to conduct a statewide review of AI legislation in all states where you are licensed to originate mortgage loans. 

CAIA may be a model for the direction states are going with respect to AI disclosure. The Act defines algorithmic discrimination, which is the unlawful differential treatment that disfavors an individual or group on the basis of protected characteristics. The algorithmic discrimination would be caused by high-risk artificial intelligence systems, defined as any system that, when deployed, makes — or is a substantial factor in making — a "consequential decision," which generally relates to those involving education, employment, financial services, housing, health care, or legal services. 

Under the CAIA, there are stipulated requirements for developers to clearly display on their website or in public use an up-to-date disclosure of any high-risk AI systems they have developed and make available how they manage known or reasonably foreseeable risks of algorithmic discrimination. Any determination that the AI system has caused or is reasonably likely to cause algorithmic discrimination must be brought to the attention of the Colorado attorney general, among others.

FICO to include BNPL Data

FICO (Fair Isaac Corp) is making updates to its credit score models to incorporate Buy Now, Pay Later (BNPL) data. It announced this update today: FICO Unveils Groundbreaking Credit Scores That Incorporate Buy Now, Pay Later Data. See the outline below for details.

FICO and BNPL provider Affirm released a study in February simulating the impact of credit score on BNPL loans. It showed that the "majority" of consumers with five or more BNPL loans from Affirm would experience "higher scores or no score changes." *

Key Details of FICO's Updates

New Scores: FICO will be introducing two new credit score models, FICO Score 10 BNPL and FICO Score 10 T BNPL, which will factor in BNPL repayment information.

Launch: These new scores are set to launch in the fall of 2025.

Purpose: FICO's aim is to provide lenders with a more comprehensive understanding of consumers' repayment behavior, especially for those with limited traditional credit history who utilize BNPL services.

Data Aggregation: FICO has developed an innovative approach that involves aggregating separate BNPL loans when calculating certain variables within their models.

Potential Impact: Early studies with Affirm, a major BNPL provider, suggest that for many consumers with five or more BNPL loans, the inclusion of this data could lead to higher scores or no change.

Availability: FICO Score 10 BNPL and FICO Score 10 T BNPL will be offered alongside the existing versions of the FICO Score, allowing lenders to evaluate the impact of BNPL data within their current processes. 

Why the Update Matters

Financial Inclusion: Incorporating BNPL data could help individuals with limited or no traditional credit history to build a credit profile and potentially access more traditional forms of credit.

Lender Visibility: Lenders will gain better insight into how consumers manage BNPL loans, helping them make more informed lending decisions.

"Phantom Debt": BNPL has sometimes been referred to as "phantom debt" because it was often not reported to credit bureaus, making it difficult for lenders to assess a borrower's overall financial health. FICO's update addresses this blind spot. 

Important Considerations

Lender Adoption: It will take time for lenders to widely adopt these new scores.

Bureau Reporting: The credit bureaus (Experian, Equifax, TransUnion) have begun collecting BNPL data, but the consistency of reporting from BNPL providers is still evolving.

Responsible Use: While BNPL can be helpful for building credit, it's crucial for consumers to be mindful of their usage, avoid overspending, and make timely payments to maintain a healthy credit profile. 

FICO's integration of BNPL data into its credit scoring models is meant to provide a more complete picture of consumer creditworthiness.

For inquiries regarding this update contact us for professional advice.

____________________________

* FICO and Affirm Unveil Industry-Leading Analysis of ‘Buy Now, Pay Later’ Loans, February 4, 2025, FICO Newsroom, Scoring Solutions

Risk-Based Pricing Notice: Timing

QUESTION 

We have a question about the risk-based pricing method. Our procedures already cover the required format of the pricing notice and the types of credit covered. What we want to know is when we are required to provide the risk-based pricing notice for closed-end credit transactions. Also, a question that concerns us is if we need to provide it if we are not going to do the loan. 

When are we required to provide the risk-based pricing notice for closed-end credit? 

Do we have to provide the risk-based notice if we don’t do the loan? 

COMPLIANCE SOLUTION 

Policies & Procedures 

ANSWER 

FACTA  (Fair and Accurate Credit Transactions Act), which amended the FCRA (Fair Credit Reporting Act), added a requirement that mandates that if you use a consumer report in connection with an application for, or a grant, extension, of other provision of, credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through your financial institution, based in whole or in part on a consumer report, then you must provide a notice to the consumer containing specific information. 

The purpose of the requirement is to alert the consumer as to how information in their consumer report and their credit score can affect the terms of credit they receive. It is meant to enable the consumer to assess if there are any errors in their consumer report and, further, allows them to understand better how certain factors may influence their credit standing. 

Timing is a central feature of the risk-based pricing notice (“Notice”). The timing of the Notice depends on the particular situation. However, I can summarize the general timing rules for a closed-end credit transaction.

Suppose you are granting, extending, or offering some other provision of closed-end credit. In that case, the Notice must be provided to the consumer before consummation of the transaction – but not earlier than the time the decision to approve an application for, or a grant, extension, or other provision of, credit is communicated to the consumer by the financial institution required to provide the Notice. 

In the case of a review of credit that has been extended to a consumer, the Notice must be provided to the consumer at the time the decision to increase the APR (Annual Percentage Rate) based on a consumer report is communicated to the consumer by the financial institution required to provide the Notice. 

If no Notice of the increase in the APR is provided to the consumer before the effective date of the change in the APR, the Notice must be provided no later than five days after the effective date of the change in the APR.[i] 

Now, your other question is often asked because the answer does not seem intuitive. You asked if a Notice must be provided if a financial institution does not grant, extend, or otherwise provide credit. 

The short answer is No! 

The requirement to provide a Notice applies only when, based in whole or in part on a consumer report, a financial institution grants, extends or otherwise provides credit to a consumer on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers from or through that financial institution. That leads to a brief discussion of adverse action. 

There is an express exception to the Notice requirement when a consumer is provided with an adverse action notice.[ii] Potentially, a financial institution may need to provide a Notice if it grants, extends, or otherwise provides credit and the consumer does not accept the credit, because the deadline by which a Notice must be provided may be reached before the financial institution learns that the consumer will not accept the credit.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] 75 FR 2724, 12 CFR § 222.73(c); 16 CFR § 640.4(c)

[ii] 75 FR 2724, 2731

Joint Users of Credit Reports

QUESTION 

I am the Compliance Officer of a bank in the northwest. We run credit reports on applications. If we cannot make the loans, we provide them to our investors and other lenders. 

Be that as it may, our regulator suggests we revise our FCRA policy regarding transferring an applicant's credit report to other lenders for processing. They want us to include language requiring an applicant's express consent to transfer the credit report. 

What advice can you offer to revise our FCRA policy for transferring the credit report and application to another lender?

COMPLIANCE SOLUTION

Policies and Procedures 

ANSWER 

Let's begin with some basics about the Fair Credit Reporting Act (FCRA). In general, the FCRA affects any person or entity that is: 

·       A Consumer Reporting Agency (CRA), such as a credit bureau; 

·       Users of the consumer reports that a CRA produces; or 

·       Those who furnish information about consumers to CRAs. 

CRAs have several responsibilities under the FCRA, such as: 

·       Ensuring that consumer reports are provided to others only for a purpose permissible under the FCRA; 

·       Ensuring that consumer reports include required information but not information that is prohibited; 

·       Disclosing information on file to consumers in response to their request; and 

·       Investigating consumers' claims of inaccurate information in a consumer report and correcting the information if it is erroneous. 

Anyone who provides a consumer report to others becomes a CRA[i] and is subject to the regulations governing these agencies. This is true regardless of whether the person prepared the consumer report or provided a copy of a consumer report prepared by someone else. 

For example, if a financial institution obtains a consumer's credit report from a CRA (i.e., a credit bureau), it would become a CRA if it provided a copy of that credit report to anyone else. 

Most financial institutions do not want to become CRAs because they do not want the compliance responsibilities imposed on such agencies. Therefore, most financial institutions do not provide credit reports or information contained in credit reports to third parties unless doing so is specifically permitted under the FCRA. 

Which brings us to joint users of credit reports! 

Lenders are permitted to provide consumer report information to other lenders without violating the FCRA if they are "joint users" of the specific consumer report. Although not contained in the FCRA, this exception is established in a commentary of the Federal Trade Commission (FTC).[ii] 

Lenders who forward credit reports to other lenders jointly involved in a lending decision are not considered CRAs, provided the application is forwarded to the other lenders at the consumer's request. 

A loan application, including the credit report, is forwarded to several investors in many mortgage loan situations. If this exception were not permitted, the lender forwarding the credit report would be considered a CRA under the FCRA. However, because of the exception, the lender and the investors who receive the application and credit report are considered "joint users" involved jointly in the credit decision. 

The key to taking advantage of this exception is that the application is forwarded to these other lenders at the consumer's request: 

"In order for the additional creditors to whom your client forwards the loan application to have a permissible purpose to obtain a consumer report, the potential credit transaction must be initiated by the consumer. For this reason, … a lender may forward a loan application to another lender at the consumer's request. Accordingly, [the lender] must obtain the consumer's consent prior to forwarding such information to additional lenders."[iii] (My emphasis.) 

Note that consumer consent is required to forward the application. 

This leaves open the question of what form such consent should take. In light of this, the FTC concluded that the inclusion in a lender's loan application of a section that enables the consumer to indicate consent for the loan application file to be forwarded to "other lenders" would be 

"… sufficient to satisfy the requirement that subsequent creditors have a permissible purpose to receive the consumer report included in the file. Such action can only be taken, however, in pursuit of the approval of the loan application."[iv] 

Therefore, a consumer's written authorization to submit an application to other lenders should be included in any situation where it may occur. This can be done separately, as part of the application, or as part of a broker agreement with the consumer. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Fair Credit Reporting Act, Section 603(f); 15 USC section 1681a(f))

[ii] Elucidated regarding an earlier version of the FCRA. See “Joint Users” – FCRA §§ 603(f) and 604(a)(3)(A), Federal Trade Commission Letter, November 20, 1998, Division of Financial Practices, Federal Trade Commission. 16 CFR 600. See also Statement of General Policy or Interpretation; Commentary on the Fair Credit Reporting Act, 55 FR 18804, May 4, 1990, Rules and Regulations.

[iii] Idem

[iv] Op. cit. ii

Money Mules: ID Theft and AML Compliance

QUESTION 

Our company is under investigation by the banking department and law enforcement for allowing "money mules" to use our financial services. They managed to use our mortgage and depository services. The crooks targeted people in nursing homes and hospice care facilities. 

The banking department is now determining if we properly implemented an Identity Theft Protection Program and Anti-Money Laundering Program. They're looking back at the procedures as well as the level of testing and training. Our CEO has told us that she expects an administrative action against us. 

We haven't updated our Identity Theft Protection Program and Red Flags Rule in years. We're reviewing it now. Well, better late than never! 

But we do the Anti-Money Laundering Program testing and training as required. The banking department is closely scrutinizing both written policies. Yesterday, we received a notice from FinCEN that they are investigating our SAR filings. 

The news fallout has been devastating. We have been in business for decades and have never had a hit to our reputation, let alone something as shocking as being an unwitting accessory to an identity theft and money-laundering scheme. There's not enough money in the world to reestablish trust! 

How do "money mules" operate? 

How do "money mules" exploit the stealing of identities? 

How do "money mules" undermine anti-money laundering procedures? 

ANSWER 

Your situation reminds me of a recent arrest in California involving money mules. The victims' money is often initially handled by "money mules," individuals who permit their addresses or bank accounts to be used or agree to receive or negotiate cashier's checks. In brief, a money mule moves money obtained illegally on behalf of another individual. Funds are transferred in person, digitally, or through mail or courier. 

I have discussed money mules previously. Here is one about how the COVID pandemic was used by criminals to bilk the public: COVID-19: Imposters and Money Mules. 

Money mules can be – but are not always! – aware they are involved in laundering money obtained illegally. The purpose of this illegal activity is to obscure the source of funds. They are a key element in the money laundering and identity theft process. 

Scheme 

With some variance and nuances here and there, the following are the steps to money mule schemes: 

Step 1: Criminal looking to launder money employs a money mule to layer illicit funds. 

Step 2: Criminal transfers the funds to the money mule in person or electronically. 

Step 3: Money mule either places[i] the money into the financial system or receives money that has already been integrated[ii] into the financial system. 

Step 4: Money mule uses a series of transfers and transactions to layer[iii] the money. 

Step 5: Money mule returns the layered funds to the criminal. 

In the case I have in mind,[iv] the FBI arrested money mules involved in scams that bilked grandparents. This is brutal, wicked, and heartless, of course, but crooks will do what crooks will do! A con is a con. A mark is a mark. As Hamlet observed, "one may smile, and smile, and be a villain!"[v] 

Two money mules were arrested and indicted for their scheme to launder at least $2 million in proceeds obtained from victims of grandparent scams who were defrauded with false claims that their relatives were in distress and urgently needed funds. 

The indictment detailed how perpetrators of grandparent scams convince victims to send money – purportedly to help relatives, frequently their grandchildren, who are typically described as being in legal trouble – "to bank accounts, business entities, and physical addresses specified by the scammers, using interstate wires and cashier's checks…for the supposed purpose of assisting the relatives in distress." 

One of the money mules is said to be a manager of money mules, and the other, thus recruited, recruited his own money mules. Federal prosecutors further assert that the manager created business entities and opened bank accounts using information stolen from identity theft victims. 

Once the money was in the accounts associated with the money mules or identity theft victims, the two money mules allegedly engaged in transactions designed to conceal the true nature of the funds, which, in this case, had been obtained via wire fraud. 

The indictment specifically alleges that the scheme laundered funds obtained from victims of grandparent scams who live in California and Pennsylvania. The bank fraud scheme alleged in the indictment involves fraudulently obtained funds held in suspense in an account set up in the name of an identity theft victim. 

The two money mules and a co-conspirator allegedly worked in concert to contact the bank and impersonate the identity theft victim to secure the issuance of a check for nearly $83,000 that was remaining in the account. 

As I noted above, money mules can be unwittingly involved in a money mule scam. That seems hard to believe. Investigators find that the trail usually ends with the money mule, who might not have realized that they are laundering money for crime gangs. Unfortunately, the process often depends on the unwitting money mule for its effectuation. The enforcement authorities have found at least three primary types of money mules: (1) unwitting, (2) witting, and (3) complicit. Here's a synopsis of each type. 

Types 

(1) Unwitting Individuals are unaware they are involved in criminal activity and engage in it thinking it's legal. They are often deceived into doing the activity for someone they believe to be an employer, acquaintance, perhaps a romance scammer, or somebody in a position of some trust. 

(2) Witting Individuals who should be aware they are involved in suspicious activity but engage in it anyway. While they aren't fully aware of the extent to which they are involved in criminal activity, they typically ignore clear indicators that what they do is illegal or suspicious. 

(3) Complicit Individuals know they are involved in criminal activity yet still engage in it willfully. This type of money mule ranges from inexperienced individuals unaware of their involvement to experienced and adept fraudsters who run entire money mule rings. 

Identity Theft Prevention Program 

Beyond the legal ramifications of acting as a money mule,[vi] the people who serve as money mules may open themselves up to identity theft. All of their personally identifiable information ("PII") can be stolen by criminals, leading to the theft of their financial assets. Victims often wind up with drained accounts, damaged credit, and deprivation of medical treatment due to loss of cash liquidity. 

Stealing an individual's identity is a fraud committed or attempted using the identifying information of another person without authority.[vii] The "identifying information" of a victim is particularly onerous because such information means "any name or number that may be used, alone or in conjunction with any other information, to identify a specific person."[viii] 

The Red Flags Rule (" Rule") goes back to 2007 under a section in the Fair and Accurate Credit Transaction Act (FACTA), which amended the Fair Credit Reporting Act (FCRA).[ix] The Rule was promulgated in 2010.[x] 

If you haven't reviewed your written Identity Theft Protection Program – which is statutorily required – it is a bit late now, given that the regulators are currently involved in an investigation. In compliance, it is not the case to throw up your hands and, as you do, declare it is "better late than never." Indeed, that phrase harks all the way back to Geoffrey Chaucer in the 14^th century, who said, "For better than never is late; never to succeed would be too long a period."[xi] 

In compliance, virtually everything has a tail, a trace, a remnant, a vestige, some lingering scintilla of activity, a dash of evidence that cannot escape discovery at some point and in some way. Thus, "better late than never" is not functionally good enough in compliance. 

Pay attention to the second half of Chaucer's statement, "never to succeed would be too long a period." There are no viable exceptions to maintaining regulatory vigilance, and if there is a systemic or some other failure, admitting the mistake and fixing it permanently. Regulators are sometimes sympathetic to companies that recognize and willingly fix mistakes. But be assured that most of the time, they will find out about the errors you prefer not to tell them about. To succeed in compliance, you must proactively review, monitor, test, train, and implement regulatory requirements. 

There are notorious correlations between money mules and identity theft. I have been discussing "traditional" money mules, but there are "synthetic identities" used by money mules. Synthetic identities are created using a discrete combination of PII to fabricate a person or entity. Given the availability of stolen data on the dark web, these identities are easy to create on a large scale. 

If you haven't reviewed your Identity Theft Prevention Program in some time, you are quite remiss, and, from a regulatory compliance perspective, you are not only opening yourself to regulator scrutiny but may also be recklessly endangering your customers. 

Anti-Money Laundering Program 

You asked, How do "money mules" undermine anti-money laundering procedures? In our Anti-Money Laundering test audits, we have noted weaknesses in screening for money mules. The results of our findings are provided in our Executive Summary, and we offer our work papers so that you can see how deep we have gone to evaluate your AML program. We provide recommendations to fix the weaknesses. 

Our reviews have uncovered many money mule schemes. However, catching the scams is a never-ending task because the crooks are remarkably inventive in finding ways to undercut even the best AML programs. 

There are telltale elements that might indicate a money mule has landed on your AML radar. We are always adding to our audit list as crooks invent new schemes and scams. You should do the same! These scams come up repeatedly in our AML test audits to the point that we consider them triggers to conducting an investigation to determine if a Suspicious Activity Report (SAR) should be filed with FinCEN[xii]. 

Our organization maintains a list of warning signs that a money mule may be making their way onto a client's AML radar. Our list contains elements provided by CISA[xiii], and we build on these elements continually. In our estimation, AML compliance must include, among other things, periodic testing, employee training, due diligence, transaction monitoring, Identity Theft Protection Program mandates, KYC and KYB[xiv] requirements, CIP[xv], OFAC[xvi], identity theft[xvii] "frozen credit" alerts, and historical SAR filings. 

An example of due diligence is conducting your own investigation. Money mules can contaminate PII. During an investigation, a client of ours discovered that a money mule group used fake websites and social media profiles to trick victims into providing their personal information. It then used that PII to open bank accounts, apply for mortgage loans, and set up cryptocurrency wallets. This criminal group then laundered the stolen funds through a network of money mules, who received and transferred the funds on behalf of the criminals.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Placement is where illegitimate funds are introduced to the legitimate financial system.

[ii] Integration is where layered funds (which now appear legitimate) are returned to the criminal.

[iii] Layering is where the criminal intentionally moves funds to disguise where the money actually originated.

[iv] Two Indicted in Scheme that Allegedly Laundered over $2 Million Generated by ‘Grandparent Scams’ Targeting Elderly Victims, Press Release, Department of Justice, U.S. Attorney's Office, Central District of California, December 12, 2023

[v] Hamlet, Act 1, Scene 5, Shakespeare

[vi] For instance, among other things, the charge of conspiracy to commit money laundering carries a statutory maximum penalty of 20 years in federal prison, and the charge of conspiracy to commit bank fraud carries a sentence of up to 30 years.

[vii] 16 CFR 603.2(a)

[viii] 16 CFR 603.2(b)

[ix] The Red Flags Rule was issued in 2007 under § 114 of the Fair and Accurate Credit Transaction Act of 2003 (FACT Act), Pub. L. 108-159, amending the Fair Credit Reporting Act (FCRA), 15 USC 1681m(e). The Red Flags Rule is published at 16 CFR 681.1. See also 72 FR, Nov. 9, 2007.

[x] The Rule was amended in 2010 by the Red Flag Program Clarification Act of 2010, 15 U.S.C. 1681m(e)(4), Pub. L. 111-319, 124 Stat. 3457 (December 18, 2010).

[xi] Actually, the phrase is a direct translation from the Latin “potiusque sero quam nunquam” (viz., and better late than never) in Livy’s fourth book Ab Urbe Condita (History of Rome), 27 BC. The full quote in Livy is “Their insolence and recklessness must be opposed, and better late than never.” (My translation.)

[xii] Financial Crimes Enforcement Network (FinCEN), for nonbanks, see Anti-Money Laundering Program and Suspicious Activity Report Filing Requirements for Residential Mortgage Lenders and Originators, Financial Crimes Enforcement Network, 77 FR 8148-8160 (February 14, 2012), as revised from time to time.

[xiii] CISA provides several publications involving money mules and other schemes. One example is Understanding and Protecting Yourself Against Money Mule Schemes, Matthew DeSantis, Chad Dougherty, Mindi McDowell, US-CERT, Cybersecurity & Infrastructure Security Agency

[xiv] Respectively, Know Your Customer (KYC) and Know Your Business (KYB)

[xv] Customer Information Program (CIP)

[xvi] Office of Foreign Assets Control (OFAC)

[xvii] FCRA Identity Theft Rules, Op. cit. ix

Artificial Intelligence: Adverse Action Notice

QUESTION 

We have used the model adverse action form for years. It is in our LOS. A question arose when our system put in a reason other than the model not accurately reflecting the basis for the adverse action. 

This happened because we are using artificial intelligence in our credit models. I head underwriting and credit operations and serve on the AI committee. Our decision to use AI did not contemplate that AI would produce an adverse action other than the model form’s requirements. 

Before making changes to our LOS or revising our policies, we want to find out if we must rely on the checklist of reasons for adverse action in Regulation B. 

Is it acceptable not to use an adverse action reason not available in the adverse action notice? 

How does artificial intelligence affect the accuracy required by Regulation B’s adverse action notice? 

ANSWER 

Creditors may not rely on the checklist of reasons provided in the sample forms (codified in Regulation B) to satisfy their obligations under the Equal Credit Opportunity Act (ECOA) if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action. Indeed, as a general matter, creditors should not rely on overly broad reasons to the extent that they obscure the specific and accurate reasons relied upon. 

The ECOA, implemented by Regulation B, makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction based on race, color, religion, national origin, sex (including sexual orientation and gender identity), marital status, age (provided the applicant has the capacity to contract) or because all or part of the applicant’s income derives from any public assistance program, or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.[i]  

When taking adverse action against an applicant, ECOA and Regulation B require that a creditor provide the applicant with a statement of reasons for the action.[ii] This statement of reasons must be “specific” and indicate the “principal reason(s) for the adverse action.”[iii] Furthermore, the specific reasons disclosed must “relate to and accurately describe the factors actually considered or scored by a creditor.”[iv]  

Adverse action notice requirements promote fairness and equal opportunity for consumers engaged in credit transactions by serving as a tool to prevent and identify discrimination by requiring creditors to explain their decisions affirmatively. 

Additionally, adverse action notices are supposed to provide consumers with an educational tool that allows them to understand the reasons for a creditor’s action and take steps to improve their credit status or rectify mistakes made by creditors. 

Indeed, the CFPB does provide sample forms that creditors may use to satisfy their adverse action notification requirements, if appropriate. And these forms include a “checklist” of sample reasons for adverse action, which “creditors most commonly consider.”[v] But, note, there are open-ended fields for creditors to provide other reasons not listed. 

Creditors use the sample forms to satisfy certain adverse action notice requirements under ECOA and the Fair Credit Reporting Act (FCRA),[vi] though the statutory obligations under each remain distinct.[vii] While the sample forms provide examples of commonly considered reasons for taking adverse action, “[t]he sample forms are illustrative and may not be appropriate for all creditors.”[viii]  

So, be aware, reliance on the checklist of reasons provided in the sample forms will satisfy a creditor’s adverse action notification requirements only if the reasons disclosed are specific and indicate the principal reason(s) for the adverse action taken. 

Now, concerning your question about artificial intelligence. 

Some creditors use complex algorithms involving “artificial intelligence” and other predictive decision-making technologies in their underwriting models. The CFPB has previously issued guidance affirming that creditors are not excused from their adverse action notice obligations under ECOA simply because they rely on complex algorithmic underwriting models in making credit decisions.[ix] 

These complex algorithms sometimes rely on data harvested from consumer surveillance or data not typically found in a consumer’s credit file or application. The CFPB has underscored the harm that can result from consumer surveillance and the risk these data may pose to consumers.[x] 

Some of these data may not intuitively relate to the likelihood that a consumer will repay a loan. Consequently, the Bureau and the prudential regulators have previously noted that these data may create additional consumer protection risks.[xi] For instance, adverse action notice requirements under ECOA and Regulation B ensure that financial institutions use the data and advanced technologies in a way that fully complies with other legal requirements, such as the prohibition against illegal discrimination.[xii] 

So, it is essential to understand that the CFPB, the Department of Justice, and other enforcement agencies have pledged to use their collective authorities to protect individual rights regardless of whether legal violations occur through traditional means or advanced technologies.[xiii] 

Under ECOA and Regulation B, a creditor must provide an applicant with a statement of specific reason(s) for an adverse action. These reasons must “relate to and accurately describe the factors actually considered or scored by a creditor.”[xiv] Thus, a creditor may not rely solely on the unmodified checklist of reasons in the sample forms provided by the CFPB if the reasons provided on the sample forms do not reflect the principal reason(s) for the adverse action. As explained in Regulation B,

 

“[i]f the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed.”[xv]  

Rather, the sample forms merely provide an illustrative and non-exclusive list.[xvi] If the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the creditor’s responsibility – if it chooses to use the sample forms – either to modify the form or check “other” and include the appropriate explanation, thereby ensuring that the applicant against whom adverse action is taken receives a statement of reasons that is specific and indicates the principal reason(s) for the action taken. 

Let me be clear: creditors that simply select the closest, but nevertheless inaccurate, identifiable factors from the checklist of sample reasons are not complying with the law. Creditors may not evade this requirement, even if the factors considered or scored by the creditor may surprise consumers – as certainly can happen when a creditor relies on complex algorithms using data not typically found in a consumer’s credit file or credit application. 

Because it is unlawful for a creditor to fail to provide a statement of specific reasons for the action taken,[xvii] a creditor will not be complying with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action. Just as an accurate description of the factors actually considered or scored by a creditor is critical to ensuring compliant adverse action notifications, sufficient specificity is also required. Such specificity is necessary to ensure consumer understanding is not hindered by explanations that obfuscate the principal reason(s) for the adverse action taken. 

Specificity with respect to artificial intelligence is a critical regulatory concern. To be sure, specificity is particularly important when creditors utilize complex algorithms. Consumers may not anticipate that certain data gathered outside their application or credit file and fed into an algorithmic decision-making model may be a principal reason for reaching a credit decision, particularly if the data are not intuitively related to their finances or financial capacity. 

A creditor must “disclose the actual reasons for denial . . . even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.”[xviii] So, for instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations. That would be the case even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action. 

I hope you are now getting a sense of how artificial intelligence impacts your credit decisioning and, by extension, the specificity required by the adverse action notice. Concerns regarding specificity may also arise when creditors take adverse action against consumers with existing credit lines. 

An example can be elucidated in an FTC complaint,[xix] where a creditor decides to lower the limit on, or close altogether, a consumer’s credit line based on behavioral data, such as the type of establishment at which a consumer shops or the type of goods purchased. In this instance, it would likely be insufficient for the creditor to simply state “purchasing history” or “disfavored business patronage” as the principal reason for the adverse action. Instead, the creditor would likely need to disclose more specific details about the consumer’s purchasing history or patronage that led to the reduction or closure, such as the type of establishment, the location of the business, the type of goods purchased, or other relevant considerations, as appropriate.[xx]

 The CFPB has determined[xxi] that the requirements under ECOA extend to adverse actions taken in connection with existing credit accounts (i.e., an account termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts), as well as new credit applications. However, such factors in a credit model may be improper for other reasons, including that using such factors may violate ECOA or other laws if they constitute unlawful discrimination on a prohibited basis. 

The Bureau has also clarified that adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or “black-box” algorithmic models or other technology that creditors may not understand sufficiently to meet their legal obligations.[xxii] As data use and credit models continue to evolve, creditors must ensure that these models comply with existing consumer protection laws. 

Jonathan Foxx, PhD., MBA

Chairman & Managing Director 

Lenders Compliance Group

---

[i] 15 USC 1691(a)

[ii] 15 USC 1691(d)(2); 12 CFR 1002.9(a)(2)(i); see also 12 CFR 1002.9(a)(2)(ii), which allows creditors the option of providing notice or, following certain requirements, to inform consumers of how to obtain such notice.

[iii] 15 USC 1691(d)(3); 12 CFR 1002.9(b)(2). See also Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B, Circular 2023-03, September 19, 2023, Consumer Financial Protection Bureau 

[iv] 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-2

[v] 12 CFR Part 1002, (App. C), Comment 3

[vi] Like ECOA, FCRA also includes adverse action notification requirements. See 15 USC 1681m(a)(2). 15 USC 1681g(f)(1)(C); see also 1681g(f)(2)(B). 

[vii] See 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-9

[viii] 12 CFR Part 1002 (App. C), Comment 3

[ix] Adverse action notification requirements in connection with credit decisions based on complex algorithms, Circular 2022-03, May 26, 2022, Consumer Financial Protection Bureau

[x] Idem

[xi] Interagency Statement on the Use of Alternative Data in Credit Underwriting, at 2 , Board of Governors of the Federal Reserve System, Consumer Financial Protection Bureau, Federal Deposit Insurance Corp, National Credit Union Administration, and Office of the Comptroller of the Currency.

[xii] Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems, at 3 (April 23, 2023), Consumer Financial Protection Bureau, Department of Justice, Equal Employment Opportunity Commission, and the Federal Trade Commission.

[xiii] Ibid. at 3

[xiv] Op. cit. iv

[xv] 12 CFR Part 1002 (App. C), Comment 4

[xvi] Op. cit. viii

[xvii] Op. cit. ii

[xviii] 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-4

[xix] FTC v. CompuCredit, Complaint, No. 1:08-cv-1976-BBM-RGV, 34-35 (N.D. Ga. filed June 10, 2008)

[xx] 12 CFR 1002.2(c)

[xxi] Revocations or Unfavorable Changes to the Terms of Existing Credit Arrangements, 87 FR 30097 (May 18, 2022), Consumer Financial Protection Bureau. See also Credit Card Line Decreases, (June 29, 2022), Consumer Financial Protection Bureau.

[xxii] Op.cit. ix