Compliance Blog

A few months ago, we blogged about the various guidance the federal financial regulators had published regarding artificial intelligence (AI). Last week there was a development regarding that topic – the Consumer Financial Protection Bureau (CFPB, or bureau) published a new Consumer Financial Protection Circular (circular) which discussed Adverse Action Notice (AAN) requirements and how they apply when AI is used.

In many ways, the circular merely announces that existing requirements under Regulation B continue to apply when AI is involved. Let’s review:

Section 1002.9(a) requires a credit union to provide an AAN when it takes adverse action. This requirement applies when adverse action is taken on a credit application or even on an existing account. The regulation also requires that the AAN provide a “statement of the specific reasons for the action taken” (emphasis added). The CFPB has discussed this requirement in a previous Consumer Financial Protection Circular that the bureau published in May 2022 (Circular 2022-03, or 2022 circular). That 2022 circular discussed “black box algorithms” and notes that a credit union must be able to understand and articulate the reasons why an algorithm results in adverse action. According to the bureau, merely stating “our algorithm denied your application,” without saying why the algorithm denied the application, would not be sufficient to comply with Regulation B.

This new 2023 circular builds upon that foundation and specifically discusses AI. The circular notes that AI underwriting programs may evaluate “data that are harvested from consumer surveillance or data not typically found in a consumer’s credit file or credit application.” The circular gives examples of such data, such as an applicant’s chosen profession or their purchase history. The new circular indicates that, if a credit union were to use an AI program in which such data factors into the “principal reasons” for taking adverse action, Regulation B will require the credit union to articulate those reasons in the AAN.

The circular notes that Regulation B requires specificity when providing the reasons for the adverse action. This could require disclosing the specific data considered, especially when a consumer may not understand how that data relates to his or her creditworthiness:

“Consumers may not anticipate that certain data gathered outside of their application or credit file and fed into an algorithmic decision-making model may be a principal reason in a credit decision, particularly if the data are not intuitively related to their finances or financial capacity. As noted in the Official Commentary to Regulation B, a creditor must “disclose the actual reasons for denial . . . even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.” For instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations.”

(emphasis added) (footnotes omitted).

Additionally, the circular discusses the use of the model AAN provided in Appendix C to Regulation B. Some credit unions may choose to use the model form, which provides a list of possible reasons for the adverse action that a credit union can select from, as well as an option for “other.” Appendix C notes that the pre-set list of reasons on the form may not be appropriate in all situations. The Appendix states:

“The sample forms are illustrative and may not be appropriate for all creditors. They were designed to include some of the factors that creditors most commonly consider. If a creditor chooses to use the checklist of reasons provided in one of the sample forms in this appendix and if reasons commonly used by the creditor are not provided on the form, the creditor should modify the checklist by substituting or adding other reasons. For example, if “inadequate down payment” or “no deposit relationship with us” are common reasons for taking adverse action on an application, the creditor ought to add or substitute such reasons for those presently contained on the sample forms.

If the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed.”

(emphasis added).

As the quote above illustrates, the model form provides the option to select from a list of common reasons for adverse action, but the bureau notes in the Appendix that those reasons are not an exhaustive list. A credit union may take adverse action based on a reason that is not listed on the model form – when that happens, the appendix clearly states that a credit union would not satisfy Regulation B by choosing the “closest identifiable factor.” Instead, the CFPB states that a credit union should either select “other” and describe the actual reason for the adverse action, or the credit union may even want to modify the model form to list their own commonly used reasons for adverse action. This new 2023 circular on AI reiterates that this guidance still applies when the reason for adverse action is based on AI and the alternative data considered:

“Thus, if the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the duty of the creditor—if it chooses to use the sample forms—to either modify the form or check “other” and include the appropriate explanation, so that the applicant against whom adverse action is taken receives a statement of reasons that is specific and indicates the principal reason(s) for the action taken.”

Taking all these things together, the new CFPB circular seems to say that a credit union must understand the reasons why use of an AI program resulted in adverse action and must provide the actual reasons for the adverse action on the AAN. If a credit union uses the sample form provided in Appendix C, then the CFPB states that the credit union may need to select “other” or modify the form so that the actual reasons can be provided on the form.

Overall, this seems consistent with the bureau’s previous statements, which indicate that existing laws and regulations – such as antidiscrimination laws, Regulation B, Regulation E and others – continue to apply regardless of the technology used. As credit unions continue to adopt new and developing technologies, compliance professionals may want to consider how they will be able to comply with existing laws and regulations.  

**********

🌟4.8 Star Rating for NAFCU’s 2023 Credit Union Compliance Roadmap! 

"Everything is explained well in a way that’s easy to understand. This is my first go-to for research!” - 2023 Purchaser | Read a portion for free.