AI Credit Decisions and Adverse Action Notices

The Equal Credit Opportunity Act prohibits discrimination in credit and, through Regulation B, requires creditors to notify applicants of action taken on an application, generally within 30 days after receiving a completed application. When the action is adverse, such as a denial, the creditor must provide a statement of specific reasons or tell the applicant how to request them. Regulation B's commentary says reasons must be specific and relate to the factors actually considered; statements that the applicant did not meet internal standards or failed to achieve a qualifying score are not sufficient. The commentary also notes that disclosing more than four reasons is not likely to be helpful. Separately, the Fair Credit Reporting Act requires notices when a consumer report was used, including credit score information and key factors. The CFPB has addressed AI directly. In Circular 2022-03 it stated that creditors cannot avoid these requirements because the technology they use is too complex or opaque to identify the reasons. In Circular 2023-03 it said that creditors cannot simply pick the closest reasons from the sample forms if those do not accurately describe the real reasons, a point with particular force when models use unconventional data. Agency guidance and priorities can change over time, but the statutory and regulatory requirement for specific reasons remains. Lenders generate reasons with explanation methods. The traditional approach for scorecards compares each attribute's points with the maximum possible points. For complex models, lenders often use feature attribution methods such as SHAP values, computing each feature's contribution for an applicant relative to a reference point. A common misconception is that any explainability tool automatically produces compliant reasons. Attributions can be unstable, can split credit among correlated features, and depend on the reference chosen. Reasons must be accurate for the individual and understandable, which requires validation, not just a library call.