The CFPB has issued a Circular addressing adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B when using artificial intelligence (AI) and complex credit models, and requirements imposed on financial institutions to ensure their use of data and advanced technologies comply with other legal requirements, such as the prohibition against illegal discrimination. The Circular builds on prior CFPB guidance affirming that creditors that rely on complex algorithmic underwriting models in making credit decisions have adverse action notice obligations under the Equal Credit Opportunity Act (ECOA). The Circular is an important resource for creditors and financial institutions that engage in credit transactions with consumers.

Background

By way of background, the ECOA, implemented by Regulation B, makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction on the basis of race, color, religion, national origin, sex (including sexual orientation and gender identity), marital status, age (provided the applicant has the capacity to contract), whether all or part of the applicant's income derives from any public assistance program, or whether the applicant has in good faith exercised any right under the Consumer Credit Protection Act. ECOA and Regulation B require that, when taking adverse action against an applicant, a creditor must provide the applicant with a statement of reasons for the action taken.

Specificity Is Required in Adverse Action Notices

The Circular notes that the statement of reasons must provide specificity and indicate the "principal reason(s) for the adverse action." The Circular warns that specific reasons disclosed under adverse action notice requirements in credit transactions must "relate to and accurately describe the factors actually considered or scored by a creditor." The CFPB explains that adverse action notice requirements promote fairness and equal opportunity for consumers engaged in credit transactions, by serving as a tool to prevent and identify discrimination through the requirement that creditors must affirmatively explain their decisions. In addition, such notices provide consumers with a key educational tool that allows them to understand the reasons for a creditor's action and take steps to improve their credit status or rectify mistakes made by creditors.

To assist creditors with fulfilling their adverse action notice requirements under the ECOA and the Fair Credit Reporting Act (FCRA), the CFPB provides sample forms (currently codified in Regulation B) that creditors may use to satisfy their adverse action notice requirements, if appropriate, though the statutory obligations under each remain distinct. These forms include a checklist of sample reasons for adverse actions, which creditors "most commonly consider," as well as an open-ended field for creditors to provide other reasons not listed.

According to the Circular, while the sample forms provide examples of commonly considered reasons for taking adverse action, the Circular notes that they may not be appropriate for all creditors. The CFPB believes that reliance on the checklist of reasons provided in the sample forms would satisfy a creditor's adverse action notification requirements only if the reasons disclosed are specific and indicate the principal reason(s) for the adverse action taken. The Circular explains:

"Because it is unlawful for a creditor to fail to provide a statement of specific reasons for the action taken, a creditor will not be in compliance with the law by disclosing reasons that are overly broad, vague, or otherwise fail to inform the applicant of the specific and principal reason(s) for an adverse action. Just as an accurate description of the factors actually considered or scored by a creditor is critical to ensuring compliant adverse action notifications, sufficient specificity is also required. Such specificity is necessary to ensure consumer understanding is not hindered by explanations that obfuscate the principal reason(s) for the adverse action taken. For instance, Regulation B provides the example that a creditor should disclose "insufficient bank references" and not "insufficient credit references," which is listed on the CFPB's sample form, if the creditor considers only references from banks and other depository institutions and not from other institutions."

(citations omitted). The Circular stresses that creditors must carefully consider the specific circumstances of each case and ensure that the reasons disclosed in the adverse action notice accurately reflect the factors that were considered in making the decision.

Use of AI and Adverse Action Notices

Furthermore, the Circular addresses adverse action when creditors use complex algorithms involving "artificial intelligence" and other predictive decision-making technologies in their underwriting models. According to the CFPB, these complex algorithms sometimes rely on data that is harvested from consumer surveillance or data not typically found in a consumer's credit file or credit application. The CFPB has underscored the harm that can result from consumer surveillance and the risk to consumers that this data may pose.

As discussed in the Circular, "[c]onsumers may not anticipate that certain data gathered outside of their application or credit file and fed into an algorithmic decision-making model may be a principal reason in a credit decision, particularly if the data are not intuitively related to their finances or financial capacity." The Circular provides the following examples:

"For instance, if a complex algorithm results in a denial of a credit application due to an applicant's chosen profession, a statement that the applicant had "insufficient projected income" or "income insufficient for amount of credit requested" would likely fail to meet the creditor's legal obligations. Even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action. Concerns regarding specificity may also arise when creditors take adverse action against consumers with existing credit lines. For example, if a creditor decides to lower the limit on, or close altogether, a consumer's credit line based on behavioral data, such as the type of establishment at which a consumer shops or the type of goods purchased, it would likely be insufficient for the creditor to simply state "purchasing history" or "disfavored business patronage" as the principal reason for adverse action. Instead, the creditor would likely need to disclose more specific details about the consumer's purchasing history or patronage that led to the reduction or closure, such as the type of establishment, the location of the business, the type of goods purchased, or other relevant considerations, as appropriate."

The Circular cites to a prior CFPB Advisory Opinion, that the disclosure specificity requirements under ECOA "extend to adverse actions taken in connection with existing credit accounts (i.e., an account termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor's accounts), as well as new applications for credit." In CFPB Circular 2022-03 the CFPB also advised that the adverse action notice requirements apply equally to all credit decisions, regardless of whether the technology used to make them involves complex or "black-box" algorithmic models, or other technology that creditors may not understand sufficiently to meet their legal obligations.

Consumer Financial Protection Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B