CFPB Issues Guidance on Credit Denials by Lenders Using Artificial Intelligence
Overview: On September 19, 2023, the Consumer Financial Protection Bureau (“CFPB”) issued guidance describing procedures that lenders must follow when using artificial intelligence (“AI”) and other complex credit underwriting models (the “Guidance”). The Guidance states that lenders must provide specific and accurate reasons for denying credit when using AI models. This means that lenders may not be able to use the CFPB’s sample adverse action forms if those forms do not include the actual reason for denial of credit. The Guidance builds upon previous CFPB policy statements concerning AI and suggests the CFPB remains skeptical of the use of AI models.
Background
In the past two years, the CFPB has issued a series of interpretations and policy statements concerning AI. These statements have primarily focused on the intersection of AI and fair lending principles, including the CFPB’s concern that lenders’ use of AI and other complex models could have unintended discriminatory effects. For example, in one of his first public statements after assuming leadership of the CFPB, Director Rohit Chopra expressed concern that AI models could exacerbate lending bias and indicated that the CFPB would conduct investigations of lenders’ use of AI.
The CFPB’s primary fair lending authority comes from the Equal Credit Opportunity Act ( “ECOA”). In addition to prohibiting lenders from discriminating in providing credit, ECOA requires lenders to provide notices to consumers when taking adverse action on credit applications. ECOA requires that these adverse action notices include a statement of the specific reasons a lender took adverse action.
In May 2022, the CFPB issued guidance affirming that ECOA requires lenders to explain the specific reasons for taking adverse actions, even when their use of AI and other complex algorithmic underwriting models may make it difficult to identify those reasons with precision. The September 2023 Guidance expands upon the May 2022 guidance.
The Guidance Limits the Utility of Sample Adverse Action Forms
The regulation that implements ECOA, Regulation B, has long included sample adverse actions notice forms with a checklist of approximately a dozen potential reasons a lender may select from in describing why it has taken adverse action on a credit application. The forms also include a blank “other” category that lenders may use to customize the sample form. Most lenders use these sample forms, or close adaptations of the forms, to provide adverse action notices to consumers.
The Guidance clarifies the CFPB’s view that the sample forms are merely illustrative and may not be appropriate for all lenders. It further clarifies that reliance on the checklist of reasons in the forms will only satisfy a lender’s adverse action obligations under ECOA if the reasons disclosed specifically describe the principal reason(s) the lender took adverse action on a credit application.
In particular, the Guidance states that a lender may not rely solely on the unmodified checklist of reasons in the sample forms if the reasons provided on the sample forms do not reflect the principal reason(s) for the adverse action. If the principal reason(s) a lender actually relies on is not accurately reflected in the sample checklist of reasons in the sample forms, the lender must either modify the sample form or check “other” and include an appropriate, specific explanation.
Lenders’ Use of Alternative Data and “Black-Box” Algorithms
In the CFPB’s view, it is increasingly likely that lenders using AI or other complex underwriting models may not be able to rely simply on the list of reasons in the sample adverse action notice checklist. The sample forms generally refer to traditional credit underwriting practices, and may not contain sufficient specificity where lenders’ AI models incorporate “alternative” data gathered outside of a credit application or credit report. For example, the CFPB states that if a credit denial results from an AI model that incorporates a consumer’s profession, providing a statement that the consumer had insufficient income (which is a reason included on the sample form) would likely not be precise enough to meet the lender’s obligation under ECOA.
The Guidance also emphasizes that adverse action notices may be required for consumers with existing credit lines if, for example, a lender decides to lower a consumer’s credit limit or close a consumer’s credit account altogether. In circumstances where a lender uses behavioral data to take that form of adverse action, specific disclosures are required. For example, if a lender takes adverse action based on the stores where a consumer shops or the types of goods a consumer purchases, it would likely be insufficient for a lender to simply state that “purchasing history” is the reason for adverse action. Instead, a lender would likely need to disclose specific details about a consumer’s purchasing history, such as the type or location of the store, the type of goods purchased, or other relevant information.
The Guidance also makes clear that the in the CFPB’s view, lenders must provide specific adverse action notices regardless of the technology used to arrive at credit decisions. For example, lenders still have an obligation under ECOA to provide a notice that includes the specific reason(s) for adverse action even when using a so-called “black box” algorithm that makes it challenging to ascertain the specific reason a model recommends denial of credit. In the CFPB’s view, if a model cannot provide a specific reason for adverse action, it may not be appropriate for a lender to use that model in consumer credit decisioning.
Outlook: The Guidance continues the CFPB’s series of policy statements and interpretations expressing skepticism of the use of AI and “black box” models in the consumer financial services industry. Lenders using such models should prepare for the CFPB to focus its supervisory efforts on compliance with the ECOA and other existing consumer financial services laws.
CFPB Issues Advisory Opinion to Curtail Junk Fees Imposed by Large Banks
Overview: Effective October 16, 2023, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) issued guidance in the form of an advisory opinion to large banks and credit unions about certain practices and fees that the Bureau views as illegal under the Consumer Financial Protection Act (“CFPA”).
The Bureau’s Efforts on Junk Fees
In January 2022, the CFPB launched an initiative to review what it termed “junk” fees associated with bank accounts, credit cards, and other financial products. Shortly after that, the Bureau issued a Request for Information concerning “junk” fees that received more than 10,000 responses. Initially, the Bureau focused on two broad categories of junk fees: hidden or surprise fees that conceal the actual cost of a consumer financial product, and fees for expenses that exceed the actual costs to the financial institution for that service.
Later that year, the CFPB fined one bank $50 million and ordered it to refund $141 million to customers for illegal surprise overdraft fees and fined another $1.7 billion and ordered it to pay back more than $2 billion to consumers for an extensive list of violations, including surprise overdraft fees.
In early October 2023, the Bureau released a special edition of its Supervisory Highlights on the topic of junk fees. The report stated, “Supervision continues to focus significant resources on identifying and eliminating junk fees charged by supervised institutions.” The Bureau went on to indicate that its examiners have recently focused on non-sufficient funds (NSF) and overdraft fees as well as “statement fees and surprise depositor fees.” For example, the Bureau noted that certain supervised institutions charged customers fees for the printing and delivery of paper account statements, which constitute an unfair act or practice. “Indeed, in one instance, a senior citizen discovered that her account was almost entirely depleted because an account statement had been returned undelivered five years prior and the institution had been assessing statement fees each month since.” The Bureau also found violations during exams in the form of fees assessed to consumers when an institution returns a check, unprocessed, that the consumer attempted to deposit.
As this is an ongoing area of high-focus for the Bureau, it has established a dedicated page on its website gathering its various efforts related to combating junk fees.
The Advisory Opinion
Section 1034(c) of the CFPA requires large banks and credit unions supervised by the CFPB (those with total assets of more than $10 billion) to comply in a timely manner with consumer requests for information concerning their accounts, including the provision of supporting written documentation. According to the advisory opinion, even though Section 1034(c) has been a current and ongoing legal obligation since July 21, 2011, the Bureau has never previously issued exam findings or regulatory guidance, or pursued enforcement actions, under this provision of the CFPA.
The advisory opinion explains that a consumer request for information “concerning” an account encompasses a wide range of information, including:
- Information that appears on periodic statements or on online account portals (e.g., balance, interest rate, and transaction history).
- Information regarding bill payment and other recurring transactions.
- The terms and conditions of the account or financial product, including a complete schedule of fees.
- Status of liens on real property, including old, released liens.
By contrast, the Bureau noted that information about the financial institution’s operating procedures, financial performance, marketing strategy, or employee training programs would not fall under Section 1034(c).
The Bureau interprets the term “supporting written documentation” very broadly, to include documents that will substantiate the information provided in response to consumer questions or will otherwise assist consumers with understanding or verifying the information about their accounts. This information is crucial to consumers’ ability to stay current and avoid fees, identify and resolve errors, resolve disputes, and generally manage their finances. Therefore, the Bureau is adopting a strict stance that conditions that unreasonably impede a consumer’s ability to obtain the information covered by Section 1034(c) violate the institution’s obligation to timely comply with the consumer’s request.
As an example, requiring a consumer to pay a fee to request account information is likely to unreasonably impede the consumer’s ability to exercise the rights granted by Section 1034(c). In the CFPB’s view, this includes charging fees for:
- Responding to consumer inquiries regarding deposit account balances.
- Responding to consumer inquiries regarding loan balances or pay-off amounts.
- Responding to requests for specific types of supporting documents (such as a check image or original account agreement).
- Time spent on consumer requests for information and supporting documents regarding an account.
The advisory opinion also warns covered institutions that conditions or obstacles other than fees may also violate Section 1034(c) by unreasonably impeding a consumer’s ability to make an information request. Examples of conditions or obstacles that might constitute unreasonable impediments (depending on the specific facts and circumstances) include:
- Forcing consumers to endure excessively long wait times to speak to a customer service representative.
- Requiring consumers to submit the same request multiple times.
- Requiring consumers to interact with a chatbot that does not understand or adequately respond to consumers’ requests.
- Directing consumers to obtain information that the institution possesses from a third party instead.
It is worth noting that Section 1034(c) provides four exceptions to the financial institution’s obligation to reply to consumer information requests. Specifically, those exceptions apply to: (i) confidential commercial information, including an algorithm used to derive credit scores or other risk scores or predictors; (ii) information collected for the purpose of preventing fraud or money laundering, or detecting or reporting unlawful conduct; (iii) information required to be kept confidential by any other provision of law; and (iv) any nonpublic or confidential information, including confidential supervisory information. Covered banks and credit unions are not required to respond to consumer requests for information that falls into one of these four exceptions.
Regarding what constitutes a “timely” response, the Bureau notes that the CFPA does not specify a fixed time limit for responding. Accordingly, the Bureau will consider the specific circumstances and nature of a particular request to determine compliance.
Outlook: The new advisory opinion provides clear indication of the CFPB’s continuing focus on junk fees and related practices, part and parcel of a larger push by the Biden Administration to root out junk fees throughout much of the economy. The advisory opinion also provides reasonable guidance about what practices covered financial institutions should avoid. CFPB Director Rohit Chopra summarized the core concept of the advisory opinion this way: “when people request basic information about their accounts, big banks cannot charge them junk fees or trap them in endless customer service loops.” The advisory opinion gives covered institutions more than a year to review and address their practices: the Bureau does not intend to seek monetary penalties for violations of Section 1034(c) that occur before February 1, 2024.
______________________________________________________________________________________________________________________
AUTHOR INFORMATION:
Craig Saperstein, a member of Nacha’s Government Relations Advisory Group, is a partner in the Public Policy practice of Pillsbury Winthrop Shaw Pittman LLP in Washington, D.C. In this capacity, he provides legal analysis for clients on legislative and regulatory developments and lobbies congressional and Executive Branch officials on behalf of companies in the payments industry. Deborah Thoren-Peden is a partner and member of the Financial Institutions Team at Pillsbury Winthrop Shaw Pittman LLP. She provides advice to financial institutions, bank and non-bank, and financial services companies. Daniel Wood is a Counsel and member of the Financial Services Regulatory Team. He provides analysis for financial institutions, technology companies, and clients that offer consumer financial products. Brian Montgomery is a Senior Counsel and member of the Financial Services Regulatory Team. He provides analysis for financial institutions, technology companies, and clients that offer consumer financial products. The information contained in this update does not constitute legal advice and no attorney-client relationship is formed based upon the provision thereof.