Deregulation Doesn't Mean Lower Risk

QUESTION 

My main concern is that AI is about to take over my human responsibilities. It may come as a surprise, but I am a lawyer who serves as internal counsel for a lender in 35 states. You might think that a lawyer should have nothing to worry about when it comes to AI. I started here two years ago. The company continues to grow. There were four lawyers in our legal department. Yet, now there are three. One of them was fired, and in her place is an AI tool. I have a feeling that I am next to go! 

What are we doing to ourselves? Why are we allowing AI to put us out of work and take our livelihoods from us? These are not humans, yet they can take our human knowledge, pose as humans, and replace us. I see the downsizing of AI replacing humans. 

We are using your AI Policy Program to help us navigate AI’s compliance risks. It looks like AI is here to stay. AI regulations should protect consumers, and AI should not threaten our jobs! 

I see slow-to-no AI regulations and very little understanding of how it will adversely affect humans.   

What is being done to regulate artificial intelligence? 

OUR COMPLIANCE SOLUTION

AI POLICY PROGRAM FOR MORTGAGE BANKING™    

Our AI Policy Program aligns with Freddie Mac's and Fannie Mae’s requirements.   

Our AI Policy Program consists of the following policies:  

1.       AI Governance Policy 

2.       AI Use Policy  

3.       AI Workplace Policy  

4.       AI Credit Underwriting Policy  

5.       AI Do & Do Not Policy  

6.       AI Ethics Policy  

7.       AI Vendor Management Policy 

8.       AI Mortgage Fraud Policy 

9.       AI Anti-Money Laundering Policy

Contact us for Information! 

RESPONSE 

You say AI is not human, and it certainly isn't. Indeed, the Internet and its derivatives, such as social media, are not human. The Internet, social media, and AI are all inanimate, lifeless, insentient, spiritless, uninhabited, inorganic, labyrinthine, concatenating chains that are composed of winding strands of human meaning. 

These chains have no significance other than the understanding we invent for them. They are not our essence. We follow those chains, each of them like endless sands on a vast beach. The sands are unlimited, but the ones in our hourglass are finite. 

We are Hansel and Gretel, following breadcrumbs that lead to the cannibalistic witch. Inevitably, these brute, cold, insensate vessels into which we pour our being do not know we are there. They are numb, dumb, and oblivious, soullessly mimicking us, like an alien intelligence whose center is everywhere. 

Attempts to regulate AI technologies have not shown much foresight. Some of this negligence is by design and stems from an inability to recognize its implications. The mad dash into a new, unregulated, or semi-regulated technology is hubris borne of money, politics, and ego. AI technologies are expanding at a rate that outpaces the development of regulatory frameworks to mitigate their risks. 

The alien intelligence is ready for us. Are we ready for it? 

Over the past year, federal regulators have sharply pulled back on AI-related enforcement, including fair lending. The CFPB has scaled back liability for disparate impact under ECOA. Bank examiners are conducting fewer fair lending risk assessments. The administration has made deregulation its explicit policy goal. It would be easy to read this as a green light. It isn't. 

"Deregulation" Doesn't Mean Lower Risk 

What's actually happening is a shift in venue, not a reduction in exposure. Enforcement is moving from Washington to state attorneys general, private litigation, and a separate federal statute that nobody has rolled back. For mortgage originators and servicers using AI in underwriting, pricing, marketing, or servicing, the practical compliance burden hasn't gone away. It is just coming from different directions, and those directions are harder to predict than a single federal rulebook ever was.

Financial Penalties for Advertising Violations

YOUR QUESTION 

We have been using a marketing company for our advertising. We relied on their compliance to make sure the advertisements met the guidelines. Unfortunately, a banking department just cited us for violations in our advertising. So, we fired the marketing company. Meanwhile, we're stuck. The banking department has asked for all our advertising going back three years!   

My partner hired a lawyer to handle our case. The lawyer reviewed the advertisements from the last three years and informed us that there are many violations in them. It is scary how much money we will need to pay in financial penalties. The lawyer says there could also be remuneration to the borrowers. We don't have the money for all of these violations. We just don't. We may have to close down the company. We're going to meet with the department next week to discuss the situation. 

I need some more guidance. I want to be more prepared for the meeting. I need to know what we're facing in penalties. We have been told that your firm conducts advertising reviews before their publication, so I hope you can enlighten me about what to expect. 

What are the financial and other penalties for violations of mortgage advertisements? 

COMPLIANCE SOLUTIONS 

Advertising & Marketing Compliance Reviews 

Advertising Tune-up 

Advertising Manual 

Please contact us to discuss these solutions!

ANSWER TO YOUR QUESTION 

I am sorry to learn of this happening. This situation is avoidable, yet many companies get caught up in the dragnet of defective advertisements. You can't farm out your liability to marketing companies. Many of them claim to have compliance staff, but in reality, their compliance is sparse, if it exists at all. And forget about the testimonials of their awesome success; for goodness sake, they are marketing companies – what kind of testimonials do you expect them to provide? 

Yes, we provide relatively inexpensive advertising and marketing campaign reviews. We've offered advertising compliance for twenty years. The advertising review is expeditious. We hold the final masters in our extranet, so that clients can access them at any time. Our staff works with the client to ensure the advertisements both meet their marketing goals and comply with regulatory mandates. Some clients have even retained us to review the compliance procedures of their marketing companies.

If you want assistance with advertising compliance, please contact me. Get your company into a reliable advertising compliance program. Forget the bells and whistles. Forget the marketing company route! 

If you are not an expert in advertising compliance, you need compliance support. 

A hefty violation could cost you the company! 

Here's what happens when your advertising compliance is not reliable.

 

Recently, a company was shuttered for alleged deceptive advertising. Its home office was located in California. It was licensed in 30 states and Puerto Rico. In that case, specifically, the mortgage lender allegedly used the names and logos of the VA and FHA in its advertisements, described loan products as part of a "distinctive program offered by the U.S. government," and instructed consumers to call the "VA Interest Rate Reduction Department" at a phone number belonging to the mortgage lender, thus implying that government agencies sent the mailings. The result of this matter was a consent order permanently banning the company from engaging in any mortgage lending activities, or from "otherwise participating in or receiving remuneration from mortgage lending, or assisting others in doing so." In addition, the company, while neither admitting nor denying the allegations, was required to pay a $1 million civil money penalty. 

Fortunately, many compliance departments have a very good understanding of the restrictions on advertising, which are meant to protect consumers from misleading practices and ensure fair access to credit. 

Here is a list of a few basic Acts and regulations. 

Some Acts and Regulations 

Truth in Lending Act (TILA) (Regulation Z) 

TILA requires clear and accurate disclosure of loan terms, including the annual percentage rate (APR), loan amount, loan term, and repayment terms, presented clearly and conspicuously. Certain "trigger terms" (for instance, specific interest rates or monthly payment amounts) require additional disclosures.

Artificial Intelligence Disclosure

QUESTION 

I am the General Counsel and Compliance Officer of a mortgage lender. Our footprint is currently in 35 states. Recently, we have begun to use Artificial Intelligence in our loan origination process. However, I have some concerns about proper consumer disclosure. 

In my view, we should be disclosing our specific use of AI to borrowers. We should disclose the role AI plays in our loan applications from the point of sale to close, and, if applicable, beyond. But I do not find much regulatory guidance to lean on. I would appreciate your views on AI disclosure and, if possible, which areas would be subject to such disclosure. 

Is there a requirement for a mortgage lender to issue an AI consumer disclosure? 

What regulatory areas are potentially impacted by AI, thereby causing AI disclosure? 

COMPLIANCE SOLUTIONS 

AI Tune-up® 

Artificial Intelligence Statement  

RESPONSE 

There is currently no broad legal requirement for lenders to disclose the general use of AI in loan applications. However, under existing consumer protection and fair lending laws, lenders are legally required to disclose specific, accurate reasons for adverse actions, such as a loan denial, even if a complex AI or algorithmic system made the decision. 

This transparency is mandated by the Equal Credit Opportunity Act (ECOA), and regulatory bodies like the Consumer Financial Protection Bureau (CFPB) have issued guidance emphasizing that the complexity of AI is not an excuse for failing to provide a clear explanation. 

Regulatory Mandates 

Take, for instance, the regulatory mandates involving adverse action disclosure. The CFPB has directly addressed the issue of "black-box" models, which are AI systems whose logic is not clear even to their developers. The CFPB emphasizes that lenders cannot point to a broad category from a checklist, such as "purchasing history," if a consumer is denied credit based on AI analysis. Instead, the lender must provide specific details, such as the types of goods or places that influenced the decision. 

Also, there is no "AI exemption." A lender's use of AI or machine learning does not create a special exemption from fair lending laws. The CFPB has made it a priority to ensure that the use of technology does not allow lenders to circumvent established consumer protection regulations. In addition to the CFPB, regulators and the Federal Trade Commission have warned that there is no "AI exemption" for existing fair lending and consumer protection laws. Therefore, undisclosed AI could be found to violate these laws, leading to enforcement actions. 

The Colorado Artificial Intelligence Act 

Some state laws specifically address AI disclosure. For example, the Colorado Artificial Intelligence Act (CAIA) requires developers to test for algorithmic discrimination in consequential decisions, and some state consumer protection statutes allow for prosecution if an AI's biased outcomes cause consumer harm. This is a landmark act in many ways. If you are originating loans in Colorado, you should review the relevant regulations. However, you would do well to conduct a statewide review of AI legislation in all states where you are licensed to originate mortgage loans. 

CAIA may be a model for the direction states are going with respect to AI disclosure. The Act defines algorithmic discrimination, which is the unlawful differential treatment that disfavors an individual or group on the basis of protected characteristics. The algorithmic discrimination would be caused by high-risk artificial intelligence systems, defined as any system that, when deployed, makes — or is a substantial factor in making — a "consequential decision," which generally relates to those involving education, employment, financial services, housing, health care, or legal services. 

Under the CAIA, there are stipulated requirements for developers to clearly display on their website or in public use an up-to-date disclosure of any high-risk AI systems they have developed and make available how they manage known or reasonably foreseeable risks of algorithmic discrimination. Any determination that the AI system has caused or is reasonably likely to cause algorithmic discrimination must be brought to the attention of the Colorado attorney general, among others.

Endorsements and Testimonials - FTC Rules

QUESTION 

I am the Director of Marketing at a mortgage lender in the Northwest. We are developing a marketing campaign using endorsements and testimonials on social media, social media influencers, press, radio, YouTube, and TV. While our compliance and legal departments are happy to review these promotions, they are not giving us clear guidelines to follow. 

Our legal department tells us that, because of the wide distribution of our campaign channels, some of the rules we must follow are based on the Federal Trade Commission's rules. I don't know if this is so, but I do know those rules can be kind of strict. I need to find out about some of the FTC's regulations involving endorsements and testimonials. 

What are some FTC guidelines for endorsements and testimonials? 

SOLUTION 

Advertising Tune-up

Marketing Tune-up

Advertising Manual

Advertising Compliance  

RESPONSE 

The Federal Trade Commission's (FTC) regulations are essential to follow for marketing campaigns. Indeed, the FTC implemented the Mortgage Acts and Practices – Advertising (MAP) rules![i] MAP rules are designed to prohibit misrepresentations regarding mortgage products. Yes, there are other Acts, regulations, and laws – federal and state – such as the following (to name a few salient ones): 

·       Fair Housing Act,

·       Equal Credit Opportunity Act,

·       Truth-in-Lending Act,

·       FHA/HUD, VA, USDA Regulations,

·       Real Estate Settlement Procedures Act,

·       State Regulations,

·       Fair Lending,

·       Unfair, Deceptive, or Abusive Acts or Practices, and

·       Federally required logos and disclosures. 

The Federal Trade Commission's MAP rules must be implemented in your marketing campaign. 

Advertising and marketing compliance is a highly complex area that requires very careful consideration prior to launching a marketing campaign. If you do not handle endorsements and testimonials appropriately, you can easily cause legal disputes and attract regulators. 

I have listed a few compliance solutions above. You can always contact me to discuss your particular marketing plan. We have worked for years with banks and nonbanks on their marketing campaigns. Here are just a few articles we've published on advertising compliance. 

The FTC requires endorsers to clearly and conspicuously disclose their sponsorship by the advertiser and requires that endorsements reflect the honest experience or opinion of the endorser and not contain representations that would be deceptive or unsubstantiated if the advertiser made them directly.[ii] Therefore, if an endorsement represents that the endorser uses the advertiser's product, the endorser must actually use the product at the time they endorse it.[iii] 

Advertisers using "consumer endorsements" must make clear whether the endorser's experience reflects the actual experience of typical consumers who use the product rather than the experience of a few individuals.[iv] Ensuring this clarity is critical because, in 2009, the FTC revised its guidance regarding consumer endorsements to eliminate the safe harbor previously provided for the use of disclaimers in conjunction with non-representative consumer testimonials, such as "results not typical" and "not all consumers will get this result." In other words, these disclaimers are no longer acceptable because the FTC believes they are not sufficient to overcome the misleading implication that a non-representative result depicted in an advertisement is what consumers will generally experience.

Elder Theft and Elder Scams

QUESTION 

Our bank formed a group to prevent elder financial exploitation. Most of our clients are seniors and elderly, so we want to be sure our customers are protected from being exploited. They revised a number of screening procedures to catch fraud. They report directly to our Chief Compliance Officer. 

In the last year, we have seen a substantial increase in elder financial exploitation. What bothers me is that most of the crooks seem to get away with financially exploiting older people because we sometimes catch the crooks after the fraud happens. This means we are constantly revising the filters, and we are continually having to update our training. 

As a member of the group, I have been asked to contact you to help us further develop our policy and procedures involving the prevention of elder financial exploitation. In particular, we are interested in outlining the difference between Elder Theft and Elder Scams because we plan to separate the policy into those two primary parts. We have read your articles on elder financial exploitation and have heard you speak on this subject. We need some assistance in developing better filters. 

What is the difference between Elder Theft and Elder Scams? 

COMPLIANCE SOLUTIONS 

EFE TUNE-UP®

Elder Financial Exploitation - Prevention 

POLICIES AND PROCEDURES 

ANSWER 

I have published extensively on the financial abuse and scams referred to as Elder Financial Exploitation (EFE). My efforts have included numerous articles and published White Papers, lectures, and webinars, being a panelist in organizational conferences, and, of course, working with clients who needed to file a Strategic Activity Report (SAR) or notify the FBI with respect to EFE concerns. 

Here are a few of my writings on this subject: 

Suspicious Activity and Elder Financial Abuse 

Elder Financial Abuse: Disclosure, Schemes, and “Red Flags” 

Elder Financial Exploitation 

Elder Financial Exploitation: Prevention and Filing SARs 

Elder Financial Abuse Epidemic 

Elder Financial Abuse: Prevention and Remedies (PDF) 

Elder Financial Abuse (PDF) 

The Articles section of our website has several articles that directly and indirectly relate to Elder Financial Exploitation. Use them to help build your policy and procedures document. 

My firm even provides a free checklist of Behavioral and Financial Red Flags – Elder Financial Abuse! Contact us for a copy! 

I will tell you straight out: EFE seems to keep happening relentlessly – and growing rapidly. 

My answer here is going to be in the form of a “preamble” to your policy. Consider using these preambles as a base for the further formulation of your policies and procedures relating to Elder Theft and Elder Scams. 

For many years, amid rampant fraud and abuse targeting older adults, FinCEN has urged financial institutions to detect, prevent, and report suspicious financial transactions. Every year since 2006, FinCEN has issued an advisory in support of World Elder Abuse Awareness Day[i], commemorated on June 15^th. The statistics are not getting better. They are worsening. 

For instance, depository institutions filed 46,888 EFE-related BSA reports from March 2023 to May 2023, accounting for nearly 30 percent of the total EFE-related reports filed in the review period. This pace appears to be continuing, as FinCEN received an average of 15,993 EFE BSA reports per month between 15 June 2023 and 15 January 2024.[ii] You do the math! 

Before we get too far into my response, let me put down a working definition of EFE: 

Elder Financial Exploitation (EFE) is the illegal or improper use of an older adult’s funds, property, or assets. Older adults are typically considered individuals aged 60 or older. EFE consists of two primary subcategories: elder theft and elder scams. 

Elder theft consists of schemes involving the theft of an older adult’s assets, funds, or income by a trusted person. Elder scams involve the transfer of money to a stranger or imposter for a promised benefit or good that the older adult did not receive. EFE is one type of elder abuse, which includes physical, emotional, and financial abuse. Elder abuse and EFE definitions vary statutorily by state.[iii] 

Elder theft often occurs when persons known and trusted by older adults steal victim funds, while elder scams involve fraudsters with no known relationship to their victims. Indeed, some scammers are located outside the United States.[iv] Sadly, elder theft is likely to be underreported and can go undetected because the perpetrators are typically individuals whom the victim trusts.[v] 

FinCEN analysis of Bank Secrecy Act (BSA) information indicates that elder scams mostly rely on less sophisticated scam typologies. However, some scammers make their scams more complex by blending multiple scam types into one victimization and using victims both as a source of funds and to launder illicit gains.[vi] 

Scammers are often organized, with fraud rings ranging from small groups of individuals to organizations with hundreds of members. There are violent criminal organizations known to carry out fraud schemes, including EFE-related fraud. 

Unfortunately, perpetrators of EFE schemes often do not stop after first exploiting their victims. In both elder theft and elder scams, older adults are frequently re-victimized[vii] and subject to potentially further financial loss, isolation, and emotional or physical abuse long after the initial exploitation due to the significant illicit gains at stake. Scammers may also sell victims’ Personally Identifiable Information (PII) on the black market to other criminals who continue to target the victims using new and emerging scam typologies.[viii] 

ELDER THEFT 

Elder theft is so insidious because the family of the victim is often the perpetrator. Another form of elder theft is where a non-family caregiver financially abuses the relationship from t a position of trust. In 2019, FinCEN analyzed SARs based on elder theft narratives.[ix] The analysis found that a family member was involved in the theft of assets from older adults in 46 percent of elder theft cases reported between 2013 and 2019. 

Who were these perpetrators? Family members, familiar associates, acquaintances such as neighbors, friends, financial services providers, business associates, or those in routine close proximity to the victims. 

Considerable studies have been undertaken by senior citizen organizations, FinCEN, DOJ, and many state governmental authorities to find a pattern to this criminality. It turns out elder theft often follows a similar methodology in which trusted persons may use deception, intimidation, and coercion against older adults in order to access, control, and misuse their finances. Criminals frequently exploit victims’ reliance on support and services and will take advantage of any cognitive and physical disabilities.[x] Environmental factors such as social isolation lead to elder theft. 

The criminal’s goal is to establish control over the victims’ accounts, assets, or identity.[xi] Here are just a few of the ways in which financial exploration takes place. The elder may be financially abused by the exploitation of legal guardianships[xii] and power of attorney arrangements[xiii] or the use of fraudulent investments such as Ponzi schemes[xiv] to defraud older adults of their income and retirement savings. These relationships lead to repeated abuse, as the trusted person repeatedly abuses the victims by liquidating their savings and retirement accounts, stealing Social Security benefit checks and other income, transferring property and other assets, or maxing out credit cards in the name of the victims until most of their assets are stolen.[xv] 

ELDER SCAMS 

Criminals involved in elder scams defraud victims into sending payments and disclosing PII under false pretenses or for a promised benefit or good the victims will never receive. These scammers are often located outside of the United States and have no known previous relationship with the victims. 

Like Elder Theft, a pattern of criminality can be identified. Elder scams often follow a similar methodology in which scammers contact older adults under a fictitious persona via phone call, robocall, text message, email, mail, in-person communication, online dating apps and websites, or social media platforms. In order to appear legitimate and establish trust with older adults, scammers commonly impersonate government officials, law enforcement agencies, technical and customer support representatives, social media connections, or family, friends, and other trusted persons. 

There are several typical types of elder scams. To name but a few: 

·       Government Imposter Scams; 

·       Romance Scams;[xvi] 

·       Emergency or Person-in-Need Scams; 

·       Lottery and Sweepstakes Scams; 

·       Tech and Customer Support Scams. 

This set-up is a con that evokes stress in the victim. Perpetrators often create high-pressure situations by appealing to their victims’ emotions and taking advantage of their trust or by instilling fear to solicit payments and PII. This is, in effect, an Imposter Scam.[xvii] Scammers often request victims to make payments through wire transfers at money services businesses (MSBs) but are increasingly requesting payments via prepaid access cards, gift cards, money orders, tracked delivery of cash and high-valued personal items through the U.S. Postal Service, ATM deposits, cash pick-up at the victims’ houses, and convertible virtual currency (CVC).[xviii] 

Money Mules are a particularly deceitful way to trap victims into an elder scam.[xix] A money mule is a person who, wittingly or unwittingly, transfers or moves illicit funds at the direction of or on behalf of another, in this case, transfers or moves illicit funds at the direction of the scammers. The victim of an elder scam can also serve as a money mule: the scammer convinces the victim to set up a bank account or Limited Liability Corporation (LLC) in the victim’s name to receive, withdraw, deposit, or transfer multiple third-party payments from other victimized older adults to accounts controlled by the scammer under the illusion of a “business opportunity.” In some circumstances, victims of EFE acting as money mules may be prosecuted for this illegal activity and are liable for repaying the other victims. They may also be subject to damaged credit and further victimized through their stolen PII.[xx] 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
Lenders Compliance Group

---

[i] World Elder Abuse Awareness Day, Administration for Community Living, launched by the International Network for the Prevention of Elder Abuse and the World Health Organization at the United Nations.

[ii] Financial Trend Analysis, Elder Financial Exploitation: Threat Pattern & Trend Information, June 2022 to June 2023, April 2024, Financial Crimes Enforcement Network.

[iii] Memorandum on Financial Institution and Law Enforcement Efforts to Combat Elder Financial Exploitation, Consumer Financial Protection Bureau (CFPB) and FinCEN, August 30, 2017; see also, Elder Abuse and Elder Financial Exploitation Statutes, U.S. Department of Justice (DOJ).

[iv] Advisory on Elder Financial Exploitation, FinCEN Advisory, FIN-2022-A002, June 15, 2022

[v] Recovering from Elder Financial Exploitation, A Framework for Policy and Research, September 2022, Consumer Financial Protection Bureau

[vi] Phantom Hacker Scams Target Senior Citizens and Result in Victims Losing their Life Savings, Alert Number I-091223-PSA, September 29, 2023, Federal Bureau of Investigations Internet Crime Complaint Center

[vii] For additional information on re-victimization in EFE schemes, see Addressing the Challenge of Chronic Fraud Victimization, March 2021, FINRA Investor Education Foundation (FINRA Foundation), American Association of Retired Persons (AARP), and Heart+Mind Strategies.

[viii] List Brokerage Firm Pleads Guilty to Facilitating Elder Fraud Schemes, September 28, 2020, Department of Justice

[ix] Elders Face Increased Financial Threat from Domestic and Foreign Actors, December 2019, FinCEN Financial Trend Analysis

[x] Idem

[xi] Associate Deputy Attorney General Paul R. Perkins Delivers Remarks at the ABA/ABA Financial Crimes Enforcement Conference, December 9, 2020, Department of Justice

[xii] Court-Appointed Pennsylvania Guardian and Virginia Co-Conspirators Indicted for Stealing Over $1 Million from Elderly Wards, June 30, 2021, Department of Justice

[xiii] Franklin, Tennessee Couple Charged With Defrauding Elderly Widow of $1.7 Million, May 12, 2021, Department of Justice; and Former Waterloo Medicaid Provider Sentenced to More than Five Years in Federal Prison for Defrauding Elderly Victim, June 28, 2021, Department of Justice

[xiv] Arizona Man Sentenced for Multimillion-Dollar Nationwide Investment Fraud Scheme, March 15, 2021, Department of Justice

[xv] Annual Report to Congress on Department of Justice Activities to Combat Elder Fraud and Abuse, October 18, 2021, Department of Justice

[xvi] In Romance Gone Awry: A Tale of AML and Negligence, April 14, 2022, I outline litigation involving a Romance Scam. Visit https://mortgage-faqs.blogspot.com/2022/04/romance-gone-awry-tale-of-aml-and.html. See O’Rourke v. PNC Bank, 2022 Del. Super. (Del. Sup. Ct. February 15, 2022)

[xvii] The Federal Trade Commission provides extensive information about Imposter Scams. Visit its webpage How To Avoid Imposter Scams, https://consumer.ftc.gov/features/how-avoid-imposter-scams. See my articles, such as Imposter Robocalls, February 9, 2023, https://mortgage-faqs.blogspot.com/2023/02/imposter-robocalls.html and COVID-19: Imposters and Money Mules, August 6, 2020, https://mortgage-faqs.blogspot.com/2020/08/covid-19-imposters-and-money-mules.html.

[xviii] FBI Warns of a Grandparent Fraud Scheme Using Couriers, Alert Number I-072921-PSAJuly 29, 2021, FBI; New Twist to Grandparent Scam: Mail Cash, December 3, 2018, Federal Trade Commission

[xix] See my article Op. cit. xvi COVID-19: Imposters and Money Mules.

[xx] The FBI maintains a website to increase public awareness of money mules. Visit Money Mules at https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/money-mules

Joint Users of Credit Reports

QUESTION 

I am the Compliance Officer of a bank in the northwest. We run credit reports on applications. If we cannot make the loans, we provide them to our investors and other lenders. 

Be that as it may, our regulator suggests we revise our FCRA policy regarding transferring an applicant's credit report to other lenders for processing. They want us to include language requiring an applicant's express consent to transfer the credit report. 

What advice can you offer to revise our FCRA policy for transferring the credit report and application to another lender?

COMPLIANCE SOLUTION

Policies and Procedures 

ANSWER 

Let's begin with some basics about the Fair Credit Reporting Act (FCRA). In general, the FCRA affects any person or entity that is: 

·       A Consumer Reporting Agency (CRA), such as a credit bureau; 

·       Users of the consumer reports that a CRA produces; or 

·       Those who furnish information about consumers to CRAs. 

CRAs have several responsibilities under the FCRA, such as: 

·       Ensuring that consumer reports are provided to others only for a purpose permissible under the FCRA; 

·       Ensuring that consumer reports include required information but not information that is prohibited; 

·       Disclosing information on file to consumers in response to their request; and 

·       Investigating consumers' claims of inaccurate information in a consumer report and correcting the information if it is erroneous. 

Anyone who provides a consumer report to others becomes a CRA[i] and is subject to the regulations governing these agencies. This is true regardless of whether the person prepared the consumer report or provided a copy of a consumer report prepared by someone else. 

For example, if a financial institution obtains a consumer's credit report from a CRA (i.e., a credit bureau), it would become a CRA if it provided a copy of that credit report to anyone else. 

Most financial institutions do not want to become CRAs because they do not want the compliance responsibilities imposed on such agencies. Therefore, most financial institutions do not provide credit reports or information contained in credit reports to third parties unless doing so is specifically permitted under the FCRA. 

Which brings us to joint users of credit reports! 

Lenders are permitted to provide consumer report information to other lenders without violating the FCRA if they are "joint users" of the specific consumer report. Although not contained in the FCRA, this exception is established in a commentary of the Federal Trade Commission (FTC).[ii] 

Lenders who forward credit reports to other lenders jointly involved in a lending decision are not considered CRAs, provided the application is forwarded to the other lenders at the consumer's request. 

A loan application, including the credit report, is forwarded to several investors in many mortgage loan situations. If this exception were not permitted, the lender forwarding the credit report would be considered a CRA under the FCRA. However, because of the exception, the lender and the investors who receive the application and credit report are considered "joint users" involved jointly in the credit decision. 

The key to taking advantage of this exception is that the application is forwarded to these other lenders at the consumer's request: 

"In order for the additional creditors to whom your client forwards the loan application to have a permissible purpose to obtain a consumer report, the potential credit transaction must be initiated by the consumer. For this reason, … a lender may forward a loan application to another lender at the consumer's request. Accordingly, [the lender] must obtain the consumer's consent prior to forwarding such information to additional lenders."[iii] (My emphasis.) 

Note that consumer consent is required to forward the application. 

This leaves open the question of what form such consent should take. In light of this, the FTC concluded that the inclusion in a lender's loan application of a section that enables the consumer to indicate consent for the loan application file to be forwarded to "other lenders" would be 

"… sufficient to satisfy the requirement that subsequent creditors have a permissible purpose to receive the consumer report included in the file. Such action can only be taken, however, in pursuit of the approval of the loan application."[iv] 

Therefore, a consumer's written authorization to submit an application to other lenders should be included in any situation where it may occur. This can be done separately, as part of the application, or as part of a broker agreement with the consumer. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Fair Credit Reporting Act, Section 603(f); 15 USC section 1681a(f))

[ii] Elucidated regarding an earlier version of the FCRA. See “Joint Users” – FCRA §§ 603(f) and 604(a)(3)(A), Federal Trade Commission Letter, November 20, 1998, Division of Financial Practices, Federal Trade Commission. 16 CFR 600. See also Statement of General Policy or Interpretation; Commentary on the Fair Credit Reporting Act, 55 FR 18804, May 4, 1990, Rules and Regulations.

[iii] Idem

[iv] Op. cit. ii

Artificial Intelligence: Adverse Action Notice

QUESTION 

We have used the model adverse action form for years. It is in our LOS. A question arose when our system put in a reason other than the model not accurately reflecting the basis for the adverse action. 

This happened because we are using artificial intelligence in our credit models. I head underwriting and credit operations and serve on the AI committee. Our decision to use AI did not contemplate that AI would produce an adverse action other than the model form’s requirements. 

Before making changes to our LOS or revising our policies, we want to find out if we must rely on the checklist of reasons for adverse action in Regulation B. 

Is it acceptable not to use an adverse action reason not available in the adverse action notice? 

How does artificial intelligence affect the accuracy required by Regulation B’s adverse action notice? 

ANSWER 

Creditors may not rely on the checklist of reasons provided in the sample forms (codified in Regulation B) to satisfy their obligations under the Equal Credit Opportunity Act (ECOA) if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action. Indeed, as a general matter, creditors should not rely on overly broad reasons to the extent that they obscure the specific and accurate reasons relied upon. 

The ECOA, implemented by Regulation B, makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction based on race, color, religion, national origin, sex (including sexual orientation and gender identity), marital status, age (provided the applicant has the capacity to contract) or because all or part of the applicant’s income derives from any public assistance program, or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.[i]  

When taking adverse action against an applicant, ECOA and Regulation B require that a creditor provide the applicant with a statement of reasons for the action.[ii] This statement of reasons must be “specific” and indicate the “principal reason(s) for the adverse action.”[iii] Furthermore, the specific reasons disclosed must “relate to and accurately describe the factors actually considered or scored by a creditor.”[iv]  

Adverse action notice requirements promote fairness and equal opportunity for consumers engaged in credit transactions by serving as a tool to prevent and identify discrimination by requiring creditors to explain their decisions affirmatively. 

Additionally, adverse action notices are supposed to provide consumers with an educational tool that allows them to understand the reasons for a creditor’s action and take steps to improve their credit status or rectify mistakes made by creditors. 

Indeed, the CFPB does provide sample forms that creditors may use to satisfy their adverse action notification requirements, if appropriate. And these forms include a “checklist” of sample reasons for adverse action, which “creditors most commonly consider.”[v] But, note, there are open-ended fields for creditors to provide other reasons not listed. 

Creditors use the sample forms to satisfy certain adverse action notice requirements under ECOA and the Fair Credit Reporting Act (FCRA),[vi] though the statutory obligations under each remain distinct.[vii] While the sample forms provide examples of commonly considered reasons for taking adverse action, “[t]he sample forms are illustrative and may not be appropriate for all creditors.”[viii]  

So, be aware, reliance on the checklist of reasons provided in the sample forms will satisfy a creditor’s adverse action notification requirements only if the reasons disclosed are specific and indicate the principal reason(s) for the adverse action taken. 

Now, concerning your question about artificial intelligence. 

Some creditors use complex algorithms involving “artificial intelligence” and other predictive decision-making technologies in their underwriting models. The CFPB has previously issued guidance affirming that creditors are not excused from their adverse action notice obligations under ECOA simply because they rely on complex algorithmic underwriting models in making credit decisions.[ix] 

These complex algorithms sometimes rely on data harvested from consumer surveillance or data not typically found in a consumer’s credit file or application. The CFPB has underscored the harm that can result from consumer surveillance and the risk these data may pose to consumers.[x] 

Some of these data may not intuitively relate to the likelihood that a consumer will repay a loan. Consequently, the Bureau and the prudential regulators have previously noted that these data may create additional consumer protection risks.[xi] For instance, adverse action notice requirements under ECOA and Regulation B ensure that financial institutions use the data and advanced technologies in a way that fully complies with other legal requirements, such as the prohibition against illegal discrimination.[xii] 

So, it is essential to understand that the CFPB, the Department of Justice, and other enforcement agencies have pledged to use their collective authorities to protect individual rights regardless of whether legal violations occur through traditional means or advanced technologies.[xiii] 

Under ECOA and Regulation B, a creditor must provide an applicant with a statement of specific reason(s) for an adverse action. These reasons must “relate to and accurately describe the factors actually considered or scored by a creditor.”[xiv] Thus, a creditor may not rely solely on the unmodified checklist of reasons in the sample forms provided by the CFPB if the reasons provided on the sample forms do not reflect the principal reason(s) for the adverse action. As explained in Regulation B,

 

“[i]f the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed.”[xv]  

Rather, the sample forms merely provide an illustrative and non-exclusive list.[xvi] If the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the creditor’s responsibility – if it chooses to use the sample forms – either to modify the form or check “other” and include the appropriate explanation, thereby ensuring that the applicant against whom adverse action is taken receives a statement of reasons that is specific and indicates the principal reason(s) for the action taken. 

Let me be clear: creditors that simply select the closest, but nevertheless inaccurate, identifiable factors from the checklist of sample reasons are not complying with the law. Creditors may not evade this requirement, even if the factors considered or scored by the creditor may surprise consumers – as certainly can happen when a creditor relies on complex algorithms using data not typically found in a consumer’s credit file or credit application. 

Because it is unlawful for a creditor to fail to provide a statement of specific reasons for the action taken,[xvii] a creditor will not be complying with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action. Just as an accurate description of the factors actually considered or scored by a creditor is critical to ensuring compliant adverse action notifications, sufficient specificity is also required. Such specificity is necessary to ensure consumer understanding is not hindered by explanations that obfuscate the principal reason(s) for the adverse action taken. 

Specificity with respect to artificial intelligence is a critical regulatory concern. To be sure, specificity is particularly important when creditors utilize complex algorithms. Consumers may not anticipate that certain data gathered outside their application or credit file and fed into an algorithmic decision-making model may be a principal reason for reaching a credit decision, particularly if the data are not intuitively related to their finances or financial capacity. 

A creditor must “disclose the actual reasons for denial . . . even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.”[xviii] So, for instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations. That would be the case even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action. 

I hope you are now getting a sense of how artificial intelligence impacts your credit decisioning and, by extension, the specificity required by the adverse action notice. Concerns regarding specificity may also arise when creditors take adverse action against consumers with existing credit lines. 

An example can be elucidated in an FTC complaint,[xix] where a creditor decides to lower the limit on, or close altogether, a consumer’s credit line based on behavioral data, such as the type of establishment at which a consumer shops or the type of goods purchased. In this instance, it would likely be insufficient for the creditor to simply state “purchasing history” or “disfavored business patronage” as the principal reason for the adverse action. Instead, the creditor would likely need to disclose more specific details about the consumer’s purchasing history or patronage that led to the reduction or closure, such as the type of establishment, the location of the business, the type of goods purchased, or other relevant considerations, as appropriate.[xx]

 The CFPB has determined[xxi] that the requirements under ECOA extend to adverse actions taken in connection with existing credit accounts (i.e., an account termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts), as well as new credit applications. However, such factors in a credit model may be improper for other reasons, including that using such factors may violate ECOA or other laws if they constitute unlawful discrimination on a prohibited basis. 

The Bureau has also clarified that adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or “black-box” algorithmic models or other technology that creditors may not understand sufficiently to meet their legal obligations.[xxii] As data use and credit models continue to evolve, creditors must ensure that these models comply with existing consumer protection laws. 

Jonathan Foxx, PhD., MBA

Chairman & Managing Director 

Lenders Compliance Group

---

[i] 15 USC 1691(a)

[ii] 15 USC 1691(d)(2); 12 CFR 1002.9(a)(2)(i); see also 12 CFR 1002.9(a)(2)(ii), which allows creditors the option of providing notice or, following certain requirements, to inform consumers of how to obtain such notice.

[iii] 15 USC 1691(d)(3); 12 CFR 1002.9(b)(2). See also Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B, Circular 2023-03, September 19, 2023, Consumer Financial Protection Bureau 

[iv] 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-2

[v] 12 CFR Part 1002, (App. C), Comment 3

[vi] Like ECOA, FCRA also includes adverse action notification requirements. See 15 USC 1681m(a)(2). 15 USC 1681g(f)(1)(C); see also 1681g(f)(2)(B). 

[vii] See 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-9

[viii] 12 CFR Part 1002 (App. C), Comment 3

[ix] Adverse action notification requirements in connection with credit decisions based on complex algorithms, Circular 2022-03, May 26, 2022, Consumer Financial Protection Bureau

[x] Idem

[xi] Interagency Statement on the Use of Alternative Data in Credit Underwriting, at 2 , Board of Governors of the Federal Reserve System, Consumer Financial Protection Bureau, Federal Deposit Insurance Corp, National Credit Union Administration, and Office of the Comptroller of the Currency.

[xii] Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems, at 3 (April 23, 2023), Consumer Financial Protection Bureau, Department of Justice, Equal Employment Opportunity Commission, and the Federal Trade Commission.

[xiii] Ibid. at 3

[xiv] Op. cit. iv

[xv] 12 CFR Part 1002 (App. C), Comment 4

[xvi] Op. cit. viii

[xvii] Op. cit. ii

[xviii] 12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-4

[xix] FTC v. CompuCredit, Complaint, No. 1:08-cv-1976-BBM-RGV, 34-35 (N.D. Ga. filed June 10, 2008)

[xx] 12 CFR 1002.2(c)

[xxi] Revocations or Unfavorable Changes to the Terms of Existing Credit Arrangements, 87 FR 30097 (May 18, 2022), Consumer Financial Protection Bureau. See also Credit Card Line Decreases, (June 29, 2022), Consumer Financial Protection Bureau.

[xxii] Op.cit. ix