CFPB Issues Guidance on Credit Denials Involving Artificial Intelligence

On Sept. 19, 2023, the CFPB issued guidance (Guidance) concerning the legal obligations creditors must observe when employing complex algorithms, marketed as artificial intelligence (AI), and other predictive decision-making technologies in their underwriting models.

The Guidance builds on the CFPB’s previously issued guidance affirming that creditors are not excused from their adverse action notice obligations under the Equal Credit Opportunity Act (ECOA) simply because they rely on complex algorithmic underwriting models in making credit decisions. The Guidance, in conjunction with previously issued guidance, highlights the CFPB’s ongoing focus and scrutiny of the use of AI in financial services.

The ECOA, implemented by Regulation B, requires that when a creditor takes adverse action against an applicant, they must furnish the applicant with a statement of specific reasons for their decision.¹ This statement of reasons must be “specific” and indicate the “principal reason(s) for the adverse action”²; moreover, the specific reasons disclosed must “relate to and accurately describe the factors actually considered or scored by a creditor.”³ The purpose of adverse action notice requirements is to promote fairness and equal opportunity for consumers involved in credit transactions.

The CFPB provides sample forms (currently codified in Regulation B) that creditors may use to satisfy their adverse action notification requirements, if appropriate. These forms include a checklist of sample reasons for adverse action that “creditors most commonly consider,”⁴ as well as an open-ended field for creditors to provide other reasons not listed. While the sample forms provide examples of commonly considered reasons for taking adverse action, “[t]he sample forms are illustrative and may not be appropriate for all creditors.”⁵

The Guidance explains that if the primary reason(s) that a creditor relies on are not precisely represented in the checklist of reasons provided in the sample forms, it is the creditor’s duty, if opting to use these sample forms, to either adapt the form to accurately reflect their reasons or select the “other” option and provide an appropriate explanation. This ensures that applicants who face adverse action receive a statement of reasons that both is specific and reveals the principal reason(s) behind the decision. The Guidance makes clear that creditors who merely choose the closest, albeit inaccurate, identifiable factors from the sample checklist of sample reasons “are not in compliance with the law.”

In the context of creditors utilizing complex algorithms and predictive decision-making technologies, which occasionally leverage data sourced from consumer surveillance or data not typically present in a consumer’s credit file or credit application, the Guidance underscores the heightened significance of specificity. This is because consumers may not anticipate that information gathered from sources beyond their application or credit file could serve as a primary determinant in a credit decision. This situation is exacerbated when the data in question lacks an intuitive connection to consumers’ financial circumstances or capacity.⁶

The Guidance reiterates that requirements under the ECOA extend to adverse actions taken in connection with existing credit accounts (i.e., an account termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts), as well as new applications for credit. The Guidance offers two illustrative examples, listed below.

1. If a complex algorithm results in a denial of a credit application based on an applicant’s profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations. Even if the creditor believed the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action.
   
   
2. If a consumer’s credit line limit is decreased based on behavioral spending data, the lender should furnish details regarding the exact negative behaviors rather than vague explanations like “purchasing history.” Failure to provide accurate reasons, even if those reasons are unconventional or unexpected, will be considered non-compliant with the law. Additionally, the CFPB has advised that changes to existing credit terms necessitate the issuance of adverse action notices.

As noted in our previous discussion of the CFPB and federal partners’ commitment to pursue enforcement efforts against companies utilizing AI, the CFPB is placing significant importance on the intersection of fair lending and technological advancements. The Guidance represents the most recent step in a series of agency initiatives aimed at regulating the use of advanced technologies in credit decision-making. For example, the CFPB has stressed the need for corporate landlords to issue adverse action notices in the context of algorithmic tenant scoring. Furthermore, the Guidance builds on an April 2023 joint statement reflecting the CFPB’s dedication to addressing digital biases, especially within sectors such as the mortgage market.

Takeaways

Creditors should remain vigilant in light of ongoing scrutiny of automated systems and advanced technology, particularly those marketed as AI, to ensure compliance with federal laws and regulations. Creditors employing AI or other complex models in credit decision-making should consider assessing their current practices and, if necessary, adopting additional procedures to ensure adverse action notices sent to consumers capture the specific reasons for credit decisions and ensure their outputs can be interpreted and communicated clearly. Additionally, these businesses may wish to evaluate their audit processes for adverse action explanations to assure they meet the requisite level of specificity mandated by law.

¹ See 15 U.S.C. 1691(d)(2); 12 C.F.R. § 1002.9(a)(2)(i); see also 12 C.F.R. § 1002.9(a)(2)(ii) (allowing creditors the option of providing notice or following certain requirements to inform consumers of how to obtain such notice).

² 15 U.S.C. 1691(d)(3); 12 C.F.R. § 1002.9(b)(2).

³ 12 C.F.R. Part 1002 (Supp. I), Sec. 1002.9, Para. 9(b)(2)-2.

⁴ 12 C.F.R. Part 1002, (App. C), Comment 3.

⁵ Id.

⁶ The CFPB makes clear that the Guidance does not address whether the inclusion of any particular type of factor or data in a credit model otherwise complies with the law.