Consumer Financial Protection Circular 2023-03

Question presented

When using artificial intelligence or complex credit models, may creditors rely on the checklist of reasons provided in CFPB sample forms for adverse action notices even when those sample reasons do not accurately or specifically identify the reasons for the adverse action?

Response

No, creditors may not rely on the checklist of reasons provided in the sample forms (currently codified in Regulation B) to satisfy their obligations under ECOA if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action. Nor, as a general matter, may creditors rely on overly broad or vague reasons to the extent that they obscure the specific and accurate reasons relied upon.

Analysis

The Equal Credit Opportunity Act (ECOA), implemented by Regulation B, makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex (including sexual orientation and gender identity), marital status, age (provided the applicant has the capacity to contract), because all or part of the applicant’s income derives from any public assistance program, or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act.¹ ECOA and Regulation B require that, when taking adverse action against an applicant, a creditor must provide the applicant with a statement of reasons for the action taken.² This statement of reasons must be “specific” and indicate the “principal reason(s) for the adverse action”³; moreover, the specific reasons disclosed must “relate to and accurately describe the factors actually considered or scored by a creditor.”⁴ Adverse action notice requirements promote fairness and equal opportunity for consumers engaged in credit transactions, by serving as a tool to prevent and identify discrimination through the requirement that creditors must affirmatively explain their decisions. In addition, such notices provide consumers with a key educational tool allowing them to understand the reasons for a creditor’s action and take steps to improve their credit status or rectify mistakes made by creditors.⁵

The CFPB provides sample forms (currently codified in Regulation B) that creditors may use to satisfy their adverse action notification requirements, if appropriate. These forms include a checklist of sample reasons for adverse action which “creditors most commonly consider,”⁶ as well as an open-ended field for creditors to provide other reasons not listed. The sample forms are used by creditors to satisfy certain adverse action notice requirements under ECOA and the Fair Credit Reporting Act (FCRA), though the statutory obligations under each remain distinct.⁷ While the sample forms provide examples of commonly considered reasons for taking adverse action, “[t]he sample forms are illustrative and may not be appropriate for all creditors.”⁸ Reliance on the checklist of reasons provided in the sample forms will satisfy a creditor’s adverse action notification requirements only if the reasons disclosed are specific and indicate the principal reason(s) for the adverse action taken.

Some creditors use complex algorithms involving “artificial intelligence” and other predictive decision-making technologies in their underwriting models.⁹ These complex algorithms sometimes rely on data that are harvested from consumer surveillance or data not typically found in a consumer’s credit file or credit application. The CFPB has underscored the harm that can result from consumer surveillance and the risk to consumers that these data may pose. Some of these data may not intuitively relate to the likelihood that a consumer will repay a loan. The CFPB and the prudential regulators have previously noted that these data may create additional consumer protection risk.¹⁰ This Circular addresses adverse action notice requirements under ECOA and Regulation B; financial institutions also must ensure their use of data and advanced technologies fully complies with other legal requirements, such as the prohibition against illegal discrimination. The CFPB, along with the Department of Justice and other enforcement agencies, have pledged to vigorously use the agencies’ collective authorities to protect individuals’ rights regardless of whether legal violations occur through traditional means or advanced technologies.¹¹

Under ECOA and Regulation B a creditor must provide an applicant with a statement of specific reason(s) for an adverse action; these reasons must “relate to and accurately describe the factors actually considered or scored by a creditor.”¹² A creditor therefore may not rely solely on the unmodified checklist of reasons in the sample forms provided by the CFPB if the reasons provided on the sample forms do not reflect the principal reason(s) for the adverse action. As explained in Regulation B, “[i]f the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed.”¹³ Rather, the sample forms merely provide an illustrative and non-exclusive list.¹⁴ Thus, if the principal reason(s) a creditor actually relies on is not accurately reflected in the checklist of reasons in the sample forms, it is the duty of the creditor—if it chooses to use the sample forms—to either modify the form or check “other” and include the appropriate explanation, so that the applicant against whom adverse action is taken receives a statement of reasons that is specific and indicates the principal reason(s) for the action taken. Creditors that simply select the closest, but nevertheless inaccurate, identifiable factors from the checklist of sample reasons are not in compliance with the law. Creditors may not evade this requirement, even if the factors actually considered or scored by the creditor may be surprising to consumers, as may be the case when a creditor relies on complex algorithms that, for instance, consider data that are not typically found in a consumer’s credit file or credit application.

Because it is unlawful for a creditor to fail to provide a statement of specific reasons for the action taken,¹⁵ a creditor will not be in compliance with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action. Just as an accurate description of the factors actually considered or scored by a creditor is critical to ensuring compliant adverse action notifications, sufficient specificity is also required. Such specificity is necessary to ensure consumer understanding is not hindered by explanations that obfuscate the principal reason(s) for the adverse action taken. For instance, Regulation B provides the example that a creditor should disclose “insufficient bank references” and not “insufficient credit references,” which is listed on the CFPB’s sample form, if the creditor considers only references from banks and other depository institutions and not from other institutions.¹⁶

Specificity is particularly important when creditors utilize complex algorithms. Consumers may not anticipate that certain data gathered outside of their application or credit file and fed into an algorithmic decision-making model may be a principal reason in a credit decision, particularly if the data are not intuitively related to their finances or financial capacity. As noted in the Official Commentary to Regulation B, a creditor must “disclose the actual reasons for denial . . . even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.”¹⁷ For instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had “insufficient projected income” or “income insufficient for amount of credit requested” would likely fail to meet the creditor’s legal obligations. Even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action. Concerns regarding specificity may also arise when creditors take adverse action against consumers with existing credit lines. For example, if a creditor decides to lower the limit on, or close altogether, a consumer’s credit line based on behavioral data, such as the type of establishment at which a consumer shops or the type of goods purchased, it would likely be insufficient for the creditor to simply state “purchasing history” or “disfavored business patronage” as the principal reason for adverse action.¹⁸ Instead, the creditor would likely need to disclose more specific details about the consumer’s purchasing history or patronage that led to the reduction or closure, such as the type of establishment, the location of the business, the type of goods purchased, or other relevant considerations, as appropriate.¹⁹

As discussed in an Advisory Opinion, these requirements under ECOA extend to adverse actions taken in connection with existing credit accounts (i.e., an account termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts²⁰), as well as new applications for credit.²¹ The CFPB has also made clear that adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or “black-box” algorithmic models, or other technology that creditors may not understand sufficiently to meet their legal obligations.²² As data use and credit models continue to evolve, creditors have an obligation to ensure that these models comply with existing consumer protection laws.