CFPB Circular 2022-03, issued in May 2022, told creditors that complex algorithms do not excuse unexplained credit denials: the Equal Credit Opportunity Act requires specific reasons however the decision was computed (CFPB, 2022). A September 2023 follow-up added that check-the-box reasons not matching the model's actual output are themselves violations (CFPB, 2023). Together they frame AI underwriting in consumer credit.
Nuv Media publishes information, not financial advice. This explainer sticks to operational facts: where models enter the credit decision, what the law requires when they say no, and how banks document the machinery.
Where do machine-learning models enter the credit decision?
Four points of use dominate. Risk ranking models score applicants against historical repayment outcomes, often blending bureau attributes with trended and cash-flow data. Fraud-at-origination models flag synthetic identities and income misrepresentation before underwriting runs. Pricing models set risk-based rates within approved bands. Collections and line-management models run after origination, deciding credit-line increases and hardship treatment.
Most institutions keep the final decision hybrid. A model produces a score or probability of default; policy rules set the cutoffs by product, term and exposure; and human underwriters handle overrides, exceptions and edge cases inside documented limits. Machine learning replaces the scoring function more often than the decision structure — a distinction examiners care about, because it preserves an auditable chain from model output to action.
The data envelope widened with open banking. Bank-transaction histories let lenders underwrite thin-file applicants on demonstrated cash flow rather than borrowed-repayment history alone — the practice regulators call cash-flow underwriting — and the CFPB's 2024 data-rights rule gives consumers a consent-based channel to share those accounts with lenders (CFPB, 2024).
What must an adverse-action notice say when a model decides?
Regulation B requires notice within 30 days of a completed application, stating the specific principal reasons for denial — not categories, not codes the applicant cannot decode (12 CFR 1002.9). The CFPB's circulars close the algorithmic loopholes: a lender cannot claim the model is too complex to explain (Circular 2022-03), and it cannot mail reasons pulled from a standard checklist if the model's dominant factors were different (Circular 2023-03).
In practice, that forces reason-code engineering. Lenders extract per-applicant reason codes from the model itself — ranking which features pushed the score below cutoff for that individual — and map them to Regulation B language. The testing burden is accuracy: sampled denials must show that the stated reasons correspond to the model's actual drivers, because a mismatch is now an explicit compliance defect, not a stylistic one.
Two adjacent duties travel with the notice. If a consumer report or specialty data contributed, the Fair Credit Reporting Act requires naming the bureau. And if the application involved a credit score, the disclosure requirements attach regardless of whether a human or a gradient-boosted ensemble produced the number.
How do banks test the models for fair lending?
Equal Credit Opportunity Act mechanics apply unchanged to models: decisions may not consider prohibited bases such as race, sex or age, and facially neutral factors that operate as proxies draw scrutiny. Institutions run disparate-impact testing on model outputs across protected-class proxies, search for alternative models with similar performance and less disparity — often described as a less-discriminatory-model search — and document why the chosen model is necessary.
Monitoring continues after launch. Population drift, macroeconomic shifts and new data sources can move a model's performance and its disparity profile, so fair-lending testing runs on a recurring cycle alongside accuracy monitoring. Examiners from the prudential agencies review those artifacts during fair-lending exams, and the same files back up the bank if a denial is challenged.
Vendor models do not transfer the duty. A bank buying scoring software owns the adverse-action explanation and the fair-lending analysis; vendors' claims of proprietary algorithms run into the same wall the CFPB described in 2022 — if the bank cannot extract reasons, the bank cannot lawfully deploy the model for covered decisions.
What does model inventory require in practice?
Supervisory guidance set the template in 2011 and has not changed. Federal Reserve SR 11-7 and OCC Bulletin 2011-12 require each bank to maintain a model inventory, tier models by risk, validate them independently — conceptual soundness, outcomes testing, benchmarking — and monitor performance through the model's life (Federal Reserve, 2011). AI underwriting models enter that inventory with heavier documentation: training data lineage, feature definitions, drift monitoring and the reason-code extraction method itself.
The inventory is what turns a credit model into an examinable asset. Examiners trace one application from input features to adverse-action notice, and the file must reproduce the decision months later. Institutions that treat documentation as a release requirement — written before deployment, versioned with the model — handle supervisory requests as lookups; those that treat it as an afterthought rebuild it under deadline.
Where does AI underwriting stand as of mid-2026?
Operationally, the direction is settled: machine-learned risk scoring is standard at large card and personal-loan issuers, cash-flow data is a growing input, and documentation depth is the differentiator under supervision. On regulation, no final rule specific to AI underwriting had been adopted as of July 2026 — the operative federal requirements remain ECOA, Regulation B, the FCRA and the 2011 model-risk guidance, with the 2022 and 2023 circulars defining how those apply to algorithmic decisions. For credit teams, the practical reading is that capability has outrun neither the explanation duty nor the governance file — both travel with every model-scored decision.
For more context, read How Machine Learning Models Score Payment Fraud in Real Time.
For more context, read open banking consent flow.
For more context, read How Agentic Commerce Would Let AI Agents Pay for You.
