On September 20th, the Consumer Financial Protection Bureau (“CFPB”) published guidance – Consumer Financial Protection Circular, 2023-03 – regarding the list of reasons that must be provided when an applicant is denied credit, per the Equal Credit Opportunity Act, and its implementing Regulation, Regulation B. Accompanying Regulation B is an Appendix that contains a Sample Notification Form listing 23 denial reasons, as well as one open-ended denial reason, that could be used in an adverse action notice sent to the applicant regarding why they were denied credit. The CFPB’s guidance states that while “[t]hese forms include a checklist of sample reasons for adverse action which ‘creditors most commonly consider’”, they have concluded that a creditor “may not rely solely on the unmodified checklist of reasons ... if the reasons provided on the sample forms do not reflect the principal reason(s) for the adverse action.”
Practitioners should note the CFPB’s use of “solely” in their conclusion. In the past, prudential regulator examiners have highlighted an institution’s failure to use at least the checklist of reasons for their adverse action notices, even when some of the reasons do not apply, as being potentially non-compliant. With an unmodified list that extends to 23 denial reasons, many lenders have already had difficulty mapping each of these denial reasons to an aspect of their credit modeling (i.e., the programming can become quite cumbersome with so many variables and denial reasons in play). Accordingly, as lenders have shifted their credit models to reflect new sources of data and more accurate ways of evaluating an applicant’s credit risk, many have resorted to choosing a combination of denial reasons from the sample checklist that are the “closest, but nevertheless inaccurate, identifiable factors.” Nevertheless, this guidance clearly indicates that the CFPB expects lenders to expand the list of denial reasons to include as many additional denial reasons that “relate to and accurately describe the factors actually considered or scored by a creditor.” In other words, lenders will need to expand their list of denial reasons well past the 23 provided in the sample checklist, if applicable, but should be careful to continue to include at least those 23 denial reasons.
The CFPB’s guidance also provides more targeted commentary on how lenders should expect to characterize denial reasons that result from the use of artificial intelligence (AI) solutions. As mentioned in guidance issued last year by the CFPB (which we covered in “No, Fancy Technology Does Not Excuse Compliance Obligations”), AI solutions often operate in a “black-box” that makes it difficult for humans to ascertain the exact reason for the results provided by the AI solution. At that time, the CFPB mandated the use of so-called “explainable AI”, especially when it comes to denial reasons for adverse action notices. To wit, the instant circular provides the following example for how specific the denial reasons should be, especially when AI solutions are involved: “For instance, if a complex algorithm results in a denial of a credit application due to an applicant’s chosen profession, a statement that the applicant had ‘insufficient projected income’ or ‘income insufficient for amount of credit requested’ would likely fail to meet the creditor’s legal obligations. Even if the creditor believed that the reason for the adverse action was broadly related to future income or earning potential, providing such a reason likely would not satisfy its duty to provide the specific reason(s) for adverse action.”