Artificial intelligence (“AI”) and complex credit models may help lending institutions make decisions on credit applications more efficiently, but they’re also inviting increased scrutiny from regulators. On September 20, 2023, the Consumer Financial Protection Bureau (“CFPB”) issued Circular 2023-03 providing guidance to creditors who use AI in their underwriting models regarding their notice obligations when taking adverse actions on consumer credit applications.
The bottom line is this: When AI or complex credit models are used to make credit decisions, creditors cannot simply rely on the checklist of reasons for adverse action notices contained in the Regulation B sample forms, nor may they rely on broad or vague reasons to the extent that they obscure the specific and accurate reasons relied upon by the creditor. Rather, the checklist of reasons provided in the sample forms can only satisfy a creditor’s adverse action notice obligation if the reasons disclosed specifically and accurately indicate the factors the creditor actually considered when taking the adverse action.
Regulation B Background
Regulation B implements the Equal Credit Opportunity Act (“ECOA”). ECOA makes it unlawful for any creditor to discriminate against any applicant regarding a credit transaction on the basis of certain protected categories like race, religion, natural origin, marital status, and others. ECOA and Regulation B require creditors to issue an adverse action notice to consumers when denying a credit application in order to provide the applicant with a statement of reasons for the denial. As discussed further below, the reasons for adverse action contained in the notice must be specific and accurately describe the factors actually considered or scored by a creditor.
Circular 2023-03 describes some of the public policy justifications underlying the ECOA adverse action notice requirement. For example, the CFPB noted that the requirement promotes fairness and equal opportunity for consumers because requiring creditors to affirmatively explain their decisions can help prevent and identify discrimination. Moreover, such notices can serve as an educational tool for consumers by allowing them to understand the reasons for a creditor’s action and take steps to improve their credit status or rectify mistakes made by creditors.
The CFPB has provided sample adverse action notice forms, codified in Regulation B, that creditors can generally use to satisfy their adverse action notice requirements “if appropriate.” These forms include a checklist of sample reasons creditors most commonly consider before taking an adverse action with respect to a consumer credit application. However, the CFPB has commented that the “sample forms are illustrative and may not be appropriate for all creditors.
What does Circular 2023-03 Say About AI and Complex Credit Algorithms?
The CFPB’s Circular 2023-03 reminds creditors that the adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves algorithmic models. And because the types of data relied upon by these models can obfuscate why an adverse decision was made, the “specificity” requirement of the notice becomes increasingly important.
AI and complex credit models can sometimes rely on data that is not typically found in a consumer’s credit file or credit application, and the CFPB posits that some of this data may not intuitively relate to the likelihood that an applicant will repay a loan.
The Circular provides some examples of how AI and complex credit algorithms can affect the specificity requirement of the adverse action notice. For example, if a creditor’s algorithm denies a credit application due to an applicant’s profession, providing a notice stating that the applicant had “insufficient projected income” or “insufficient income for the amount of credit requested” would not satisfy the specificity requirement. In another example, the CFPB provides that if a creditor decides to lower the limit on a consumer’s credit line based on behavioral data like the types of stores a consumer shops at, the specificity requirement would not be met if the adverse action notice only stated “purchasing history” or “disfavored business patronage.” Instead, the CFPB states that Regulation B requires more specific details about the applicant’s purchasing history to be disclosed such as the type of establishment, the location of the business, the type of goods purchased, or other relevant considerations.
Reasons for Adverse Action Must Be Accurate and Specific
As noted above, under ECOA and Regulation B, creditors must provide consumer credit applicants with a statement of specific reasons for why a credit application was denied, and those reasons must “relate to and accurately describe the factors actually considered or scored by a creditor.” While Regulation B provides sample adverse action notice forms containing a checklist of common reasons for denial, Circular 2023-03 explains that the sample forms merely provide an illustrative and non-exclusive list, and if the reasons listed on the sample forms do not accurately reflect the principal reasons for the adverse action, a creditor cannot rely solely on the unmodified checklist of reasons.
As such, reliance on the checklist of reasons provided in the sample forms only satisfies the creditors’ notice requirement if the reasons selected actually indicate the principal reason for the adverse action, actually describe the factors considered, and are sufficiently specific. If the reasons on the sample form do not meet these requirements, a creditor may not simply pick from among the factors listed to comply with the ECOA adverse action notice requirement. Rather, the CFPB stated in Circular 2023-03 that “if the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the duty of the creditor—if it chooses to use the sample forms—to either modify the form or check ‘other’ and include the appropriate explanation.” The bureau cautioned that “Creditors that simply select the closest, but nevertheless inaccurate, identifiable factors from the checklist of sample reasons are not in compliance with the law,” and that “Creditors may not evade this requirement, even if the factors actually considered or scored by the creditor may be surprising to consumers, as may be the case when a creditor relies on complex algorithms.
In addition to accurately indicating the reasons relied on when taking an adverse action, creditors must also ensure information is presented with sufficient specificity so that consumers are able to understand the reasons for the adverse action taken. The CFPB instructs that “a creditor will not be in compliance with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action.
Conclusions
It is crucial for creditors that use AI or complex credit models in their consumer credit underwriting to pay special attention to the data sets considered by an algorithm when an adverse action decision is made. Based on the CFPB’s guidance provided in Circular 2023-03, such creditors should ensure that when they take an adverse action such as a credit application denial, they are fulfilling the heightened adverse action notice requirements associated with such alternative credit models as described in the circular.
In particular, such creditors must specifically describe the reasons for adverse action in their notices and ensure that the reasons listed on the notice are actually the factors that were considered by the creditor in its decision making. While the adverse action notice sample forms in Regulation B may provide a useful starting point, overreliance on them could result in a violation of ECOA and Regulation B if the model checklist of reasons on the sample form does not accurately reflect the specific reasons for the adverse action.
Creditors that plan to frequently utilize AI, complex credit models, or other alternative data in their underwriting process should consider tailoring the Regulation B adverse action notice sample forms to their needs by adding to the list any specific reasons for adverse action that the creditor anticipates may arise with respect to their particular credit offerings, while leaving the option open to check “other” and describe more unique circumstances as needed.
