CFPB Says Creditors Must Provide Reasons For Taking Adverse Action, Even When Relying On AI

EXECUTIVE SUMMARY

On May 26th, 2022, the Consumer Financial Protection Bureau (“CFPB”) published a Consumer Financial Protection Circular (the “Circular”), confirming that creditors must provide specific reasons for taking adverse action against an applicant, even when the creditor relies on black-box models or complex algorithms for credit-making decisions. While black-box models and complex algorithms are widely used among creditors for credit-making decisions, the reasoning behind some of the model and algorithmic outputs may not be known or fully understood by creditors or model developers. Nevertheless, the CFPB confirmed that use of such models and algorithms does not exempt creditors from their duty to disclose to consumers specific and accurate reasons for taking adverse action, as required by the Equal Credit Opportunity Act and its implementing Regulation B (collectively, “ECOA”).

ADVERSE ACTION UNDER ECOA

ECOA makes it unlawful for any creditor to discriminate against any applicant, with respect to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex or marital status, or age (provided the applicant has the capacity to contract); because all or part of the applicant's income derives from any public assistance program; or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.^[1] To promote transparency and fairness in the credit underwriting process, ECOA requires creditors taking adverse action against consumers to provide consumers with a written statement that indicates the specific, principal reason(s) for the adverse action. It is paramount that the reasons provided in the adverse action notice be “specific” with respect to the consumer’s application information or circumstances that did not meet the creditor’s underwriting criteria. It is insufficient to provide vague or general statements that the adverse action was based on the creditor's internal standards or policies or that the consumer failed to achieve a qualifying score on the creditor's credit scoring system.^[2]

RISE OF BLACK-BOX CREDIT MODELS OR COMPLEX ALGORITHMS

In the Circular, the CFPB acknowledges that although financial institutions have long used complex underwriting and other computational methods for driving credit risk decisions, they are still able to provide specific adverse action statements to comply with ECOA. More recently, however, the financial industry has begun relying on models and algorithms with increasingly detailed data sets and complex methodologies, often including some form of artificial intelligence (“AI”) that processes large volumes of data, making it exceedingly difficult to identify the specific criteria that led to the denial of a consumer’s request for credit. Some algorithms and credit models employ machine learning, which may effectively change the creditworthiness standards or reinforce biases in the model over time. Many companies who develop or market these decision-making models to financial institutions consider the technology to be proprietary information, providing users with little insight into how, or on what basis, outputs are delivered. This lack of access into or understanding of the model’s decisioning and rationale, can prevent creditors from being able articulate the specific reason(s) for an adverse credit decision.

Previously, the CFPB has appeared supportive of AI, machine learning, and the use of alternative data in expanding consumers’ access credit. In 2017, the CFPB granted its first No-Action Letter to Upstart Network, Inc., a company using alternative data to make credit and pricing decisions.^[3] The CFPB has also represented that it hopes to “facilitate the use of this promising technology [AI/ML] to expand access to credit and benefit consumers.”^[4] This support and these aspirations contrast starkly with the ominous tone of the CFPB’s recent Circular, especially when juxtaposing its tone with that of a CFPB blog post published in 2020 during the prior administration by Patrice Alexander Ficklin, Director of the CFPB’s Office of Fair Lending. Her 2020 blog post evoked a spirit more accommodating of innovation by industry participants and experimentation with AI models, citing ECOA^[5] in acknowledging that the “existing regulatory framework has built-in flexibility that can be compatible with AI algorithms.”^[6]

The CFPB, however, has since added a disclaimer to that 2020 blog post, warning that it “conveys an incomplete description of the adverse action notice requirements of ECOA and Regulation B” and that ECOA does “not permit creditors to use technology for which they cannot provide accurate reasons for adverse actions,” referring readers instead to the Circular.^[7] This evolution in the CFPB’s policy position is less surprising given that CFPB Director Rohit Chopra has long been vocal about the risk of embedded bias that he perceives in aggregated data and black-box model decisioning and the need for consumer protection laws to account for that risk — specifically drawing the distinction between AI or machine learning generally and black-box models that cannot be explained.^[8] In 2021, Director Chopra again foreshadowed, “[a]lgorithms can help remove bias, but black box underwriting algorithms are not creating a more equal playing field and only exacerbate the biases fed into them.”^[9]

CFPB CONFIRMS THAT SPECIFIC REASONS FOR ADVERSE ACTION ARE REQUIRED, REGARDLESS OF THE TECHNOLOGY USED

Given the increased use of black-box models and algorithms and under the leadership of Director Chopra, the Circular responded to the following question: “When creditors make credit decisions based on complex algorithms that prevent creditors from accurately identifying the specific reasons for denying credit or taking other adverse actions, do these creditors need to comply with the Equal Credit Opportunity Act’s requirement to provide a statement of specific reasons to applicants against whom adverse action is taken?” The CFPB’s short answer: “Yes.”^[10]

The CFPB confirms that ECOA’s adverse action requirements apply equally to all creditors, regardless of the technology used for credit decisioning. Accordingly, the CFPB affirms that ECOA does not permit the use of black-box models or complex algorithms for credit decisions “when doing so means [creditors] cannot provide the specific and accurate reasons for adverse action.” Ultimately, a creditor’s lack of understanding of the decisioning technology it employs does not justify noncompliance with ECOA.^[11]

The CFPB also notes that it is considering the use of black-box models and algorithms beyond adverse action notices, referencing its recent spotlight on automated valuation models.

While both the CFPB and the industry seem to acknowledge the potential benefits of these new technologies in the credit decisioning space, it is clear that the CFPB is focused on transparency in the credit-decisioning process and assured compliance with ECOA. Creditors should be attentive to the potential for consumer harm that could arise out of the models or technology they choose to employ in the credit-decisioning process and take reasonable steps to ensure an understanding of and transparency in such models or technology. Creditors should also establish and maintain a strong fair lending program^[12] and model risk management framework,^[13] leveraging industry standards and practices, to ensure models are appropriately onboarded, validated, and monitored.

For specific recommendations on how to mitigate your compliance risk in light of the CFPB’s recent focus on black-box models and algorithms, or if you would like additional information about any of the issues discussed in this client alert, please contact Josh Burlingham, Kimberly Monty Holzel, Tony Alexis, Thomas M. Hefferon, or the Goodwin lawyer with whom you typically consult.

---

^[1]15 U.S.C. 1691(a); 12 CFR 1002.1(b).
^[2]15 U.S.C. 1691(d)(2)(A); 12 CFR 1002.9(b)(2).
^[3]See CFPB Announces First No-Action Letter to Upstart Network | Consumer Financial Protection Bureau (consumerfinance.gov).
^[4]See Innovation spotlight: Providing adverse action notices when using AI/ML models | Consumer Financial Protection Bureau (consumerfinance.gov).
^[5]12 CFR 1002.9(b)(2)-3 and 1002.9(b)(2)-4.
^[6]See https://www.consumerfinance.gov/about-us/blog/innovation-spotlight-providing-adverse-action-notices-when-using-ai-ml-models/
^[7]See https://www.consumerfinance.gov/about-us/blog/innovation-spotlight-providing-adverse-action-notices-when-using-ai-ml-models/
^[8]See Prepared Remarks of Commissioner Rohit Chopra at FTC Hearings on Competition and Consumer Protection, George Mason University, Antonin Scalia Law School - October 15, 2018; Comment of Commissioner Chopra on the Department of Housing and Urban Development’s Proposed Rule Regarding the Fair Housing Act’s Discriminatory Effects Standard - October 16, 2019 (ftc.gov); Prepared Remarks of Commissioner Rohit Chopra at Silicon Flatirons Conference (ftc.gov); Remarks of Director Rohit Chopra at a Joint DOJ, CFPB, and OCC Press Conference on the Trustmark National Bank Enforcement Action | Consumer Financial Protection Bureau (consumerfinance.gov).
^[9]See Remarks of Director Rohit Chopra at a Joint DOJ, CFPB, and OCC Press Conference on the Trustmark National Bank Enforcement Action | Consumer Financial Protection Bureau (consumerfinance.gov).
^[10]See Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau (consumerfinance.gov).
^[11]See CFPB Acts to Protect the Public from Black-Box Credit Models Using Complex Algorithms | Consumer Financial Protection Bureau (consumerfinance.gov).
^[12]See 201510_cfpb_ecoa-narrative-and-procedures.pdf (consumerfinance.gov).
^[13]See SR 11-7 attachment: Supervisory Guidance on Model Risk Management (federalreserve.gov); OCC 2011-12: Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (treas.gov); fil17022.pdf (fdic.gov); The Fed - SR 21-8: Interagency Statement on Model Risk Management for Bank Systems Supporting Bank Secrecy Act/Anti-Money Laundering Compliance (federalreserve.gov).