QUESTION
We have used the model
adverse action form for years. It is in our LOS. A question arose when our
system put in a reason other than the model not accurately reflecting the basis
for the adverse action.
This happened because we
are using artificial intelligence in our credit models. I head underwriting and
credit operations and serve on the AI committee. Our decision to use AI did not
contemplate that AI would produce an adverse action other than the model form’s
requirements.
Before making changes to
our LOS or revising our policies, we want to find out if we must rely on the
checklist of reasons for adverse action in Regulation B.
Is it acceptable not to
use an adverse action reason not available in the adverse action notice?
How does artificial
intelligence affect the accuracy required by Regulation B’s adverse action
notice?
ANSWER
Creditors may not rely
on the checklist of reasons provided in the sample forms (codified in
Regulation B) to satisfy their obligations under the Equal Credit Opportunity
Act (ECOA) if those reasons do not specifically and accurately indicate the
principal reason(s) for the adverse action. Indeed, as a general matter,
creditors should not rely on overly broad reasons to the extent that they
obscure the specific and accurate reasons relied upon.
The ECOA, implemented by
Regulation B, makes it unlawful for any creditor to discriminate against any
applicant with respect to any aspect of a credit transaction based on race,
color, religion, national origin, sex (including sexual orientation and gender
identity), marital status, age (provided the applicant has the capacity to
contract) or because all or part of the applicant’s income derives from any
public assistance program, or because the applicant has in good faith exercised
any right under the Consumer Credit Protection Act.[i]
When taking adverse
action against an applicant, ECOA and Regulation B require that a creditor provide
the applicant with a statement of reasons for the action.[ii] This
statement of reasons must be “specific” and indicate the “principal reason(s)
for the adverse action.”[iii]
Furthermore, the specific reasons disclosed must “relate to and accurately
describe the factors actually considered or scored by a creditor.”[iv]
Adverse action notice
requirements promote fairness and equal opportunity for consumers engaged in
credit transactions by serving as a tool to prevent and identify discrimination
by requiring creditors to explain their decisions affirmatively.
Additionally, adverse
action notices are supposed to provide consumers with an educational tool that
allows them to understand the reasons for a creditor’s action and take steps to
improve their credit status or rectify mistakes made by creditors.
Indeed, the CFPB does provide
sample forms that creditors may use to satisfy their adverse action
notification requirements, if appropriate. And these forms include a “checklist”
of sample reasons for adverse action, which “creditors most commonly consider.”[v] But,
note, there are open-ended fields for creditors to provide other reasons not
listed.
Creditors use the sample
forms to satisfy certain adverse action notice requirements under ECOA and the
Fair Credit Reporting Act (FCRA),[vi]
though the statutory obligations under each remain distinct.[vii] While
the sample forms provide examples of commonly considered reasons for taking
adverse action, “[t]he sample forms are illustrative and may not be appropriate
for all creditors.”[viii]
So, be aware, reliance
on the checklist of reasons provided in the sample forms will satisfy a
creditor’s adverse action notification requirements only if the reasons
disclosed are specific and indicate the principal reason(s) for the adverse
action taken.
Now, concerning your
question about artificial intelligence.
Some creditors use
complex algorithms involving “artificial intelligence” and other predictive
decision-making technologies in their underwriting models. The CFPB has
previously issued guidance affirming that creditors are not excused from their
adverse action notice obligations under ECOA simply because they rely on
complex algorithmic underwriting models in making credit decisions.[ix]
These complex algorithms
sometimes rely on data harvested from consumer surveillance or data not
typically found in a consumer’s credit file or application. The CFPB has
underscored the harm that can result from consumer surveillance and the risk these
data may pose to consumers.[x]
Some of these data may
not intuitively relate to the likelihood that a consumer will repay a loan. Consequently,
the Bureau and the prudential regulators have previously noted that these data
may create additional consumer protection risks.[xi] For
instance, adverse action notice requirements under ECOA and Regulation B ensure
that financial institutions use the data and advanced technologies in a way
that fully complies with other legal requirements, such as the prohibition
against illegal discrimination.[xii]
So, it is essential to
understand that the CFPB, the Department of Justice, and other enforcement
agencies have pledged to use their collective authorities to protect individual
rights regardless of whether legal violations occur through traditional means
or advanced technologies.[xiii]
Under ECOA and
Regulation B, a creditor must provide an applicant with a statement of specific
reason(s) for an adverse action. These reasons must “relate to and accurately describe
the factors actually considered or scored by a creditor.”[xiv] Thus,
a creditor may not rely solely on the unmodified checklist of reasons in the
sample forms provided by the CFPB if the reasons provided on the sample forms
do not reflect the principal reason(s) for the adverse action. As explained in
Regulation B,
“[i]f the reasons listed on the forms are not the factors
actually used, a creditor will not satisfy the notice requirement by simply
checking the closest identifiable factor listed.”[xv]
Rather, the sample forms
merely provide an illustrative and non-exclusive list.[xvi] If
the principal reason(s) a creditor actually relies on is not accurately
reflected in the checklist of reasons in the sample forms, it is the creditor’s
responsibility – if it chooses to use the sample forms – either to modify the
form or check “other” and include the appropriate explanation, thereby ensuring
that the applicant against whom adverse action is taken receives a statement of
reasons that is specific and indicates the principal reason(s) for the action
taken.
Let me be clear: creditors
that simply select the closest, but nevertheless inaccurate, identifiable
factors from the checklist of sample reasons are not complying with the law.
Creditors may not evade this requirement, even if the factors considered or
scored by the creditor may surprise consumers – as certainly can happen when a
creditor relies on complex algorithms using data not typically found in a
consumer’s credit file or credit application.
Because it is unlawful
for a creditor to fail to provide a statement of specific reasons
for the action taken,[xvii] a
creditor will not be complying with the law by disclosing reasons that are
overly broad, vague, or otherwise fail to inform the applicant of the specific
and principal reason(s) for an adverse action. Just as an accurate description
of the factors actually considered or scored by a creditor is critical to
ensuring compliant adverse action notifications, sufficient specificity is
also required. Such specificity is necessary to ensure consumer
understanding is not hindered by explanations that obfuscate the principal
reason(s) for the adverse action taken.
Specificity with respect
to artificial intelligence is a critical regulatory concern. To be sure, specificity
is particularly important when creditors utilize complex algorithms. Consumers
may not anticipate that certain data gathered outside their application or
credit file and fed into an algorithmic decision-making model may be a
principal reason for reaching a credit decision, particularly if the data are
not intuitively related to their finances or financial capacity.
A creditor must
“disclose the actual reasons for denial . . . even if the relationship of that
factor to predicting creditworthiness may not be clear to the applicant.”[xviii] So,
for instance, if a complex algorithm results in a denial of a credit
application due to an applicant’s chosen profession, a statement that the
applicant had “insufficient projected income” or “income insufficient for
amount of credit requested” would likely fail to meet the creditor’s legal
obligations. That would be the case even if the creditor believed that the
reason for the adverse action was broadly related to future income or earning
potential, providing such a reason likely would not satisfy its duty to provide
the specific reason(s) for adverse action.
I hope you are now
getting a sense of how artificial intelligence impacts your credit decisioning
and, by extension, the specificity required by the adverse action notice. Concerns
regarding specificity may also arise when creditors take adverse action against
consumers with existing credit lines.
An example can be
elucidated in an FTC complaint,[xix]
where a creditor decides to lower the limit on, or close altogether, a
consumer’s credit line based on behavioral data, such as the type of
establishment at which a consumer shops or the type of goods purchased. In this
instance, it would likely be insufficient for the creditor to simply state
“purchasing history” or “disfavored business patronage” as the principal reason
for the adverse action. Instead, the creditor would likely need to
disclose more specific details about the consumer’s purchasing history or
patronage that led to the reduction or closure, such as the type of
establishment, the location of the business, the type of goods purchased, or
other relevant considerations, as appropriate.[xx]
The CFPB has determined[xxi]
that the requirements under ECOA extend to adverse actions taken in connection
with existing credit accounts (i.e., an account termination or an unfavorable
change in the terms of an account that does not affect all or substantially all
of a class of the creditor’s accounts), as well as new credit applications. However,
such factors in a credit model may be improper for other reasons, including
that using such factors may violate ECOA or other laws if they constitute
unlawful discrimination on a prohibited basis.
The Bureau has also clarified
that adverse action notice requirements apply equally to all credit decisions,
regardless of whether the technology used to make them involves complex or
“black-box” algorithmic models or other technology that creditors may not
understand sufficiently to meet their legal obligations.[xxii] As
data use and credit models continue to evolve, creditors must ensure that these
models comply with existing consumer protection laws.
Jonathan Foxx, PhD., MBA
Chairman & Managing Director Lenders Compliance Group
[ii] 15
USC 1691(d)(2); 12 CFR 1002.9(a)(2)(i); see also 12 CFR 1002.9(a)(2)(ii), which
allows creditors the option of providing notice or, following certain
requirements, to inform consumers of how to obtain such notice.
[iii] 15
USC 1691(d)(3); 12 CFR 1002.9(b)(2). See also Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B, Circular 2023-03, September 19, 2023, Consumer Financial Protection Bureau
[iv] 12
CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-2
[v] 12
CFR Part 1002, (App. C), Comment 3
[vi] Like
ECOA, FCRA also includes adverse action notification requirements. See 15 USC
1681m(a)(2). 15 USC 1681g(f)(1)(C); see also 1681g(f)(2)(B).
[vii] See
12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-9
[viii]
12 CFR Part 1002 (App. C), Comment 3
[ix] Adverse action notification requirements in connection with credit decisions based on complex algorithms, Circular 2022-03, May 26, 2022, Consumer Financial Protection Bureau
[xi] Interagency
Statement on the Use of Alternative Data in Credit Underwriting, at 2 ,
Board of Governors of the Federal Reserve System, Consumer Financial Protection
Bureau, Federal Deposit Insurance Corp, National Credit Union Administration,
and Office of the Comptroller of the Currency.
[xii] Joint
Statement on Enforcement Efforts Against Discrimination and Bias in Automated
Systems, at 3 (April 23, 2023), Consumer Financial Protection Bureau,
Department of Justice, Equal Employment Opportunity Commission, and the Federal
Trade Commission.
[xv] 12
CFR Part 1002 (App. C), Comment 4
[xviii]
12 CFR Part 1002 (Supp. I), § 1002.9, para. 9(b)(2)-4
[xix] FTC v. CompuCredit, Complaint, No. 1:08-cv-1976-BBM-RGV, 34-35 (N.D. Ga. filed June 10,
2008)
[xxi] Revocations
or Unfavorable Changes to the Terms of Existing Credit Arrangements, 87 FR
30097 (May 18, 2022), Consumer Financial Protection Bureau. See also Credit
Card Line Decreases, (June 29, 2022), Consumer Financial Protection Bureau.
