Chris Willis delves into the current state of machine learning and artificial intelligence models in underwriting and fraud detection.
In this episode of the Consumer Finance Podcast, Chris Willis, co-leader of Troutman Pepper Locke's Consumer Financial Services Regulatory practice, delves into the current state of machine learning and artificial intelligence (AI) models in underwriting and fraud detection. Chris provides an overview of the regulatory expectations set by the Consumer Financial Protection Bureau, including the historical context and recent developments. He discusses the importance of fair lending considerations, the use of less discriminatory alternative analysis, and the skepticism around certain types of alternative data. Chris also explores the potential impact of state regulations and the need for a long-term approach to fair lending risk. Tune in to stay informed about the evolving landscape of AI and machine learning in consumer finance.
The Consumer Finance Podcast — The FinReg Frontier: AI and Machine Learning in Consumer Finance
Host: Chris Willis
Date Aired: April 10, 2025
Chris Willis:
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper Locke's consumer financial services regulatory practice. And today I'm going to be talking about the current state of play with regard to machine learning and AI underwriting and fraud models. But before we dive into that topic, let me remind you to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. Don't forget to check out all of our other podcasts, FCRA Focus, The Crypto Exchange, Unauthorized Access, Payments Pros, and Moving the Metal. All of those are available on all popular podcast platforms. Speaking of those platforms, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and let us know how we're doing. Now, as I said, today I'm going to be diving into what I perceive as the current sort of state of the art with regard to regulatory expectations around the development and testing of machine learning, or sometimes called AI, models that are used in the origination of credit transactions like underwriting or fraud models.
Now, what I'm going to do is bring you up to date as to where the CFPB was at the end of the last administration, and then we'll have some discussion about what might be the case going forward. So that's basically what I'm planning on doing today. In order to tell this story, I think it's important to go back a little ways in history, back to about 2022. And it was at that time that the then head of the CFPB's Fair Lending Office, Patrice Ficklin, made a speech at a consumer advocacy conference in which she said, for the first time, that she expected creditors with automated decisioning models to engage in analysis to see if they could find a less discriminatory alternative to any model that they put into production. Now, historically, that was not thought of as an aspect of fair lending testing that was required, but it is part of the three-step burden shifting framework under disparate impact that was established by the Supreme Court back in the 1970s in the employment context, and which was then adopted under the context of the Equal Credit Opportunity Act.
But the idea in this speech was, if you develop a model and if it has some disparate impact, it might still be okay if it has a business justification, as credit models do, but it's incumbent on the creditor to then go and look and see if there's a variation of the model that is as predictive or almost as predictive in terms of predicting credit loss, but which may carry less disparate impact for members of protected classes. So, this was not a very official way to announce this expectation. As I said, it was a speech at a consumer advocacy conference. But over the ensuing year or two, we started seeing the CFPB start to apply this in supervisory examinations. And then in the summer of 2024, the CFPB stated publicly in a comment letter it wrote in response to a request for information from the U.S Treasury relating to the use of artificial intelligence and financial services.
And the CFPB said in that comment letter, finally, for the first time in an official channel, that it expected this less discriminatory alternative analysis. And it even stated that it would be doing supervisory exams in which it did its own less discriminatory alternative analysis of creditors models and would be applying that in its supervisory efforts. After that, the CFPB was engaged in a series of supervisory exams related to this issue. And as the new year dawned and the election happened, and then the administration change was about to occur, and in fact on the Friday before the Monday when the inauguration happened in January of 2025, the CFPB released a special edition of supervisory highlights to memorialize its then current thinking about model development and testing with regard to any kind of automated underwriting or fraud type origination models. And the highlights of that supervisory highlights were the following, at least to me.
First, there was an emphasis on ensuring that in the development of any model that a creditor is developing itself, or perhaps a third party is developing like a consumer reporting agency, that fair lending considerations needed to be in evidence and considered at every aspect of a model creation process. So from the selection of the development data set to make sure it's adequately representative, to a look at the potential variables for the model to make sure none of them is a proxy for a protected class or is otherwise a variable that the regulators have warned us off of, to the documentation of the business justification of the model, and then an expectation that the model will be subject to full disparate impact testing, and, again, a less discriminatory alternative analysis. And the CFPB didn't specify that there was one method that a creditor must use to do that LDA analysis, but it did make reference to open-source de-biasing tools.
And what the CFPB meant by that was there are tools that will take a machine learning model and spin out variations of that model that you then can compare in terms of their predictive efficacy and the level of disparate impact that they may have on an applicant population. And the idea was that if you find a model that's just as good at predicting who's going to pay and who's not, but that carries less disparate impact for members of a protected class, well, you should adopt that model. That's a less discriminatory alternative. But in all events, the CFPB was saying, you need to look for such an alternative. And that was, again, the most official statement yet that we'd seen. It was in supervisory highlights as compared to this Treasury RFI letter or a speech at a conference. The other interesting highlights, I thought, in the supervisory highlights, were also the following. There was skepticism expressed by the CFPB about machine learning models that have large numbers of variables, and some of them do have a thousand, 1500 or more attributes in them, many of which are very similar to one another.
They're just variations on a theme, like inquiries in the last three days, inquiries in the last week, inquiries in the last month, things like that. And so, the CFPB expressed skepticism that it was necessary to have all those variables in a model, and further expressed skepticism that you could really accurately give adverse action notices when there were such fine-grained distinctions between variables that were very similar to one another. And the CFPB, of course, also, as was customary throughout the last administration, expressed skepticism about the use of certain types of alternative data. There was a lot of feedback in that direction during the last administration on anything ranging from things that weren't really controversial, like the use of social media or web shopping behavior, to underwrite a credit transaction, which I've never heard of anybody doing that in the industry anyway, to things that were more the subject of real efforts by the CFPB, the use of things like what was your course of study in school or what kind of school did you go to? What was your occupation? What was your educational attainment? And do you have a criminal background?
All those were attributes that seemed to land on the do not use list during the last administration. And we saw the CFPB put a lot of pressure on the use of those through, again, supervisory examinations, and the supervisory highlights sort of enshrined the hostility to some of that. So that was really the state of play as of the Friday before inauguration with the CFPB and models. And the CFPB, as I said, had been doing a series of exams throughout 2024, and some were still in process when the administration changed, and we don't know how those are going to turn out. But my view was that the CFPB was going to continue to use its supervisory authority to apply these expectations to market actors and make changes and progress towards its goals in that way. None of this felt like it was going to be an enforcement matter to me, even under the previous administration. I thought it was going to be all supervisory. And in fact, that's what it had been up until the inauguration.
So now we have a new administration in Washington that certainly we don't know what's going to happen with the CFPB because the agency, as of the time of this recording, is still not really functioning very much. But you have an administration that, elsewhere in the executive, has expressed a lot of hostility to anything related to diversity, equity or inclusion, and so the possibility exists that there'll be a significant reaction to the fair lending focus that we saw during the last administration. We don't know whether that'll be the case or not. But the thing is, from the standpoint of creditors, it's not just the CFPB that we had to worry about with respect to this issue. There are other actors out there that are interested in fair lending and from which pressure may come. And those include, for example, state regulators. There have been a couple of state attorneys general that have been interested in fair lending issues. State financial services regulators.
New York Department of Financial Services in particular stands out in my mind as one that has a very high level of focus on fair lending in its supervisory exams of the non-banks and the New York Chartered banks that it has supervisory authority over. And in fact, those exams were just as thorough in searching as any that I saw the CFPB ever do, including full out regression analyses and other statistical methods of trying to detect disparate impact. And of course, there's always the possibility of private litigation as well. It doesn't happen all the time, but it does happen some. And we saw a number of fairly high profile, privately brought fair lending cases over the last several years. But in addition to those state regulatory actions, we also have the possibility of state laws aimed at "artificial intelligence" as imposing potentially new duties or duplicative of federally imposed duties on creditors.
The Colorado AI Act is the only one that's been passed so far, but it does include specific provisions that say when you use an artificial intelligence system that's high risk, and high risk means that it will either make a decision on a credit transaction or serve as a recommendation or a basis for a decision in a credit transaction, then the user of that system and the developer of that system have the obligation to take reasonable measures to avoid algorithmic discrimination as it's defined in that statute. And there are quite a few other states that have AI laws that are similar to Colorado's in that regard, with some variations, of course. Those have not been enacted yet, but the possibility exists that a number of them will be enacted in the coming few years, and this idea of fair lending testing of models may become required by statute under state law just like it was required by expectation under the Equal Credit Opportunity Act at the federal level.
And interestingly, two states, Massachusetts and California, have had state regulators come out and say, "We don't need an AI law to impose those obligations on industry actors, rather our existing laws require that sort of attention to avoiding discrimination." And they would list the existing laws that they have. In Massachusetts, it was the Attorney General's office, in California, it was the Department of Financial Protection and Innovation, California DFPI, and those statements both came out roughly over the past year. We'll have to sort of see what happens from the states, but I don't think it's safe to say even if the CFPB is less active in this area, that industry can avoid continuing to examine fair lending issues in its operations. And of course, the other thing that always has to weigh in our mind is any inattention that we may experience at the federal level to fair lending will likely be temporary.
During the last Trump administration, between 2017 and 2021, there wasn't a huge amount of attention to fair lending. There was some, there were fair lending enforcement cases brought, including redlining cases, but it wasn't as hard of a press as we saw during the Biden administration. But the thing is, there's always another administration four years away, and the statute of limitations under the Equal Credit Opportunity Act is five years, which means anything that we do over the next four years is subject to examination and potential enforcement by a new federal administration that may come in in the next election cycle. And so, I think that counsels against making radical changes to the way we think about fair lending risk in the financial services industry because our focus necessarily has to be in the long term. If we want to stay in business and keep originating loans and avoid enforcement or other unpleasant consequences later, we have to take that long view, at least as long as the statute of limitations, which, of course, as I said, is five years. So, we'll have to see what the CFPB does with expectations around models.
I do have a couple of hopes that are on my wish list that I would like to share with you, but I do think in general, the focus on fair lending from the industry standpoint has to stay in place. Now, there are a couple of things that I thought might be subject to revisiting under a new administration. It'll be interesting to see whether any of these come true. But here are the things that I had in mind. First of all, there was a significant whipsawing in the CFPB's attitude towards alternative data between the last Trump administration and the Biden administration. If you go back to the summer of 2020, and just in general the time period during the last Trump administration, the CFPB was making all kinds of statements encouraging the use of alternative data as a way to make financial products more accessible to what it called the Credit Invisibles. That is American adults who don't have a credit bureau score or who have a thin file. So, they don't have enough of a credit bureau file to make an underwriting decision on.
And the CFPB estimated there were 40 million adults in the United States who fell into that category, wrote three reports about the Credit Invisibles and was urging industry to try to serve them, in part through the use of alternative data and machine learning models. We didn't hear any of that during the Biden administration. In fact, there was never anything that seemed very encouraging with respect to alternative data. But my own view is there are plenty of types of alternative data that are accurate, that are safe to use and that are highly predictive of a customer's ability and likelihood to repay a credit transaction, and I thought that the assault on alternative data of those types during this past administration was really unwarranted. I would really like to see the regulatory focus be on ensuring that alternative data is used appropriately in both underwriting and fraud models to serve legitimate business interests, again, when it's accurate to do so.
And I'm not arguing in favor of using social media or web browsing or web shopping or anything like that, but there are a number of things that are highly predictive that the agencies put off limits during the last administration, and I don't know why we should cue to that idea when that information could help us make better credit decisions and avoid fraud. The other thing that was really unmistakable over the last administration was the lack of reconciliation between the regulator's attitudes on fair lending issues and the need to use information and techniques to avoid fraud. It's been the case for years now, and remains the case today, that the financial services industry is suffering from an epic amount of fraud, and those fraud losses impact consumers. They impact consumers who are the subject of identity theft, and they impact consumers in the sense they translate into the higher cost of credit for people who aren't committing fraud. And so, it's a real, real problem for the financial services industry.
But whenever there was any kind of conflict between fraud and any kind of fair lending principle at all, fair lending always won with no consideration whatsoever given to fraud. A great example of this was the communique that the CFPB put out demanding the super highly specific adverse action reasons to be given to failed applicants. And in the fraud context, giving that level of detailed information to someone who you just caught attempting to perpetrate a fraud does nothing more than equip the fraudsters who are, again, mostly organized criminals. They're not like a 16-year-old sitting in his basement. They're organized crime rings. It equips them to evade those fraud controls more effectively the next day and therefore increases the level of fraud and identity theft that everybody experiences. That idea of these highly specific adverse action reasons cannot be squared with the language of Reg B or its official commentary or the official form that accompanies Reg B that has sample adverse action reasons that are quite general in my view.
And so, I thought there the CFPB was going out of its way to depart from established precedent under the Equal Credit Opportunity Act in a way that was highly detrimental to the industry's ability to resist fraud. And I'm hoping that there'll be more consideration given not only to the historical interpretation of adverse action notices dating all the way back to the Federal Reserve's Stewardship of the Equal Credit Opportunity Act, but also in recognition of the harm that can be done to anti-fraud efforts by being too stringent on things like adverse action notices. Those are true of my hopes for the next four years. We'll see if either of those happens to come true. And of course, we'll be reporting both on our blog and on our podcast on whatever we see happening with respect to models, whether it's at the federal level or at the state level, so be sure to continue listening to this podcast and checking out our blog for that.
Thanks for listening today. As I said, don't forget to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it, why not head over to our website at Troutman.com and add yourself to our Consumer Financial Services email list. That way we can send you copies of the alerts and advisories that we send out, as well as invitations to our industry-only webinars that we hold from time to time. And of course, stay tuned for a great new episode of this podcast every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.