The CFPB regulates AI in lending through existing consumer law — chiefly the Equal Credit Opportunity Act and Regulation B — and its position is that complexity is no defense: a lender using machine-learning underwriting must still give specific, accurate reasons for denying credit. It reaffirmed this in Circular 2026-03 (May 2026), which tells lenders that black-box models do not excuse vague adverse-action notices.
| Full name | Consumer Financial Protection Bureau |
| Role | Consumer-protection regulator |
| Force on banks | Binding law |
| Applies to | Banks, credit unions, mortgage lenders, and fintechs offering consumer financial products in the US |
| Key document | Circular 2026-03 — adverse action notices for ML underwriting (May 2026) |
| Latest move | May 2026 circular: lenders using ML underwriting remain fully responsible for specific, accurate adverse-action reasons |
The CFPB's AI doctrine has been consistent across administrations: ECOA and Regulation B apply regardless of the technology making the decision. Circular 2022-03 first established that creditors cannot hide behind 'the algorithm' when explaining adverse action; the May 2026 circular renews that position for modern ML underwriting, requiring reasons that are specific and accurate to the individual applicant.
Alongside adverse-action doctrine, the Bureau has examined AI chatbots in customer service (a 2023 report warning about obstruction of customers) and digital-marketing algorithms. For banks, the operational consequence is explainability: whatever model architecture is used, the institution must be able to extract legally sufficient, individually accurate denial reasons from it.
| Date | Type | Document / event |
|---|---|---|
| May 26, 2022 | Circular | Circular 2022-03: adverse action from complex algorithms. Creditors using black-box models must still provide specific reasons for credit denials under ECOA — 'the model is too complex' is not a defense. |
| Jun 6, 2023 | Report | Report on AI chatbots in consumer finance. Warns that poorly deployed chatbots can obstruct customers, give inaccurate information, and create legal risk for institutions. |
| May 5, 2026 | Circular | Circular 2026-03: adverse action notices and ML underwriting. Reaffirms that lenders using machine-learning underwriting models must provide specific, accurate reasons for adverse action — updated for the current generation of models. |
- Enforcement actions testing adverse-action doctrine against modern ML and generative-AI-assisted underwriting
- Fair-lending (disparate impact) analysis of AI models under ECOA amid the shifting federal posture
- State-level AI consumer-protection laws filling any federal gaps
Can a bank use a black-box AI model for credit decisions?
Only if it can still comply with ECOA and Regulation B: the lender must give applicants specific, accurate reasons for adverse action. CFPB Circulars 2022-03 and 2026-03 both state that model complexity does not excuse vague or generic denial reasons — which effectively requires explainability tooling around any underwriting model.
Does the CFPB have AI-specific regulations?
No — and it has said it doesn't need them. The Bureau applies existing consumer law (ECOA, Regulation B, UDAAP) to AI systems. Its circulars clarify how those laws apply to algorithmic credit decisions, chatbots, and digital marketing.
What is CFPB Circular 2026-03?
A May 2026 circular advising that lenders using complex algorithms, including machine-learning underwriting models, remain fully responsible for providing specific and accurate reasons when they deny or take adverse action on credit — the Bureau's updated statement of its adverse-action doctrine for the modern model stack.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →