How does the CFPB regulate AI in banking?

For years the Bureau's operative position was set by Circular 2022-03 (May 2022) and Circular 2023-03 (September 2023): a creditor that uses complex algorithms or machine-learning underwriting must still provide the specific, accurate principal reasons for adverse action required by ECOA and Regulation B §1002.9, and cannot hide behind a sample checklist or the model's opacity. Both circulars were withdrawn on May 12, 2025 as part of a rescission of 67 guidance documents — but they were interpretations, not rules. The statutory duty they described (15 U.S.C. 1691(d), 12 CFR 1002.9) is unchanged and remains enforceable by the CFPB, the prudential regulators, state attorneys general and private plaintiffs.

The bigger 2026 change is the Regulation B final rule published April 22, 2026 and effective July 21, 2026: it declares that ECOA does not authorize disparate-impact liability, narrows the 'discouragement' concept, and restricts special-purpose credit programs. Disparate impact was the fair-lending theory most often applied to algorithmic underwriting, so the rule materially lowers federal fair-lending exposure for AI models — while leaving adverse-action notices, FCRA key-factor disclosures and UDAAP fully intact, and while state laws (New York DFS, Colorado) move in the opposite direction.

What are the US regulatory requirements for automated credit decisions?

No US law regulates automated credit decisions as such — but four separate bodies of requirement apply to every model that decides who gets credit. Consumer law binds first and hardest: ECOA and Regulation B require a notice stating the specific principal reasons for any adverse action within 30 days of a completed application, and the FCRA adds credit-score key factors when a consumer report is used — neither has an exception for model complexity. Prudential guidance adds development, validation and governance duties for banks under the April 2026 interagency model risk framework. State law is now the fastest-moving layer: Colorado's ADMT Act reaches consequential lending decisions from January 1, 2027 with no bank exemption. The April 2026 Regulation B rule removed disparate-impact liability under ECOA — narrowing federal fair-lending exposure without changing a single notice obligation.

The two documents most often cited as “the CFPB's AI rules” — Circulars 2022-03 and 2023-03 — were withdrawn on May 12, 2025, alongside 65 other guidance documents. Their withdrawal changed nothing about the underlying obligation. The specific-reasons requirement is statutory (15 U.S.C. 1691(d)) and sits in the regulation itself (12 CFR 1002.9); it is enforceable by the Bureau, by the prudential regulators through their own examination authority, by state attorneys general under Dodd-Frank §1042, and by private plaintiffs. What was withdrawn was the Bureau's published interpretation of how that duty applies to complex models — not the duty, and not the case law.

The April 2026 Regulation B rule is the most consequential federal change for algorithmic underwriting in a decade. Disparate impact was the theory under which a model producing discriminatory outcomes from facially neutral inputs could be challenged; removing it narrows federal exposure substantially. It reaches ECOA only. Disparate-treatment claims survive — including the argument that a proxy variable amounts to intentional discrimination — as do state fair-lending and UDAP statutes, mortgage-specific fair-housing law, and the contractual and reputational consequences of a model nobody can explain.

California's ADMT regulations are the most-cited state rules in this area and the most misread for banks. The California Privacy Protection Agency's package was approved on September 22, 2025, took effect January 1, 2026 and requires ADMT compliance by January 1, 2027. Lending is the first-listed “significant decision” — 11 CCR 7001(ddd) defines financial or lending services as the extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing, and installment payment plans. Two things narrow it sharply for banks. First, scope: ADMT means technology that replaces or substantially replaces human decision-making (7001(e)), so a genuine human decision-maker — one who actually knows how to interpret the output, reviews it, and has authority to change the outcome — takes a credit model out of the article entirely. Second, and more decisive, the CCPA's exemption at Cal. Civ. Code §1798.145(e) is written at the level of the information, not the institution: personal information collected or processed subject to the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act or the Farm Credit Act sits outside the statute. The Agency confirmed this reading in its Final Statement of Reasons, rejecting an entity-level exemption because the CCPA “instead includes a data-level exemption for information subject to the GLBA.” At a GLBA-covered lender the application, income, credit-bureau, account and adverse-action data behind a credit decision is exactly that, so the ADMT obligations largely do not reach the credit decision itself. Where they do reach a bank is everything GLBA does not cover — above all employment, since HR, applicant and contractor data has been inside the CCPA since January 1, 2023 and hiring and compensation are themselves significant decisions — plus prospect and advertising data, non-GLBA product lines, and model training data. Mixed-input models, where GLBA and non-GLBA data are combined, are the genuinely unresolved edge: the Agency was asked to draw a line and declined. Risk assessments covering 2026–27 processing must be submitted with an executive attestation, under penalty of perjury, by April 1, 2028.

Beyond California and Colorado, no other US state has an in-force or dated law that specifically governs automated decision-making in consumer credit — a point worth checking against the many summaries that say otherwise. Connecticut is the common error: the 2025 bill whose consequential-decision definition covered financial and lending services died, and the AI act Connecticut actually enacted in 2026 does not reach credit. Texas's Responsible AI Governance Act, in force since January 1, 2026, bans discrimination only where intent is shown — a disparate impact is expressly insufficient — and carries a safe harbor for federally insured institutions. Illinois amended only the employment article of its Human Rights Act, leaving the financial-credit article untouched; Virginia's high-risk AI bill was vetoed; New York's automated-decision statute binds state agencies, and its DFS circular covers insurers. Maryland and Oregon are the instructive near-misses: both list financial or lending services as decisions with legal or similarly significant effects and give consumers a profiling opt-out, but both then exempt financial institutions at the entity level — the mirror image of California, where the exemption follows the data instead. For a multi-state lender that asymmetry is the whole planning problem: the same credit model can be out of scope in Oregon because of what you are, out of scope in California because of what the data is, and squarely in scope in Colorado because it is neither.

For a bank the practical test is rarely “is there an AI rule?” It is two questions asked in different rooms. Can you produce the reason? — a consumer-law duty that applies to the very first automated decision, at any institution size, with no materiality threshold. And can you defend the model? — a supervisory expectation that scales with the model's materiality and the institution's size. A lender can satisfy the second and still fail the first.

WHAT THIS MEANS IN PRACTICE

• Every declined application needs a reason that maps to a factor the model actually used. Explainability tooling is a compliance requirement for anyone running a non-linear model, not an engineering preference.
• Regulation B and the FCRA are two notices, not one. Satisfying the specific-reasons requirement does not satisfy the key-factor disclosure when a score was used.
• Automated line management, term changes and re-pricing are adverse actions when unfavorable — compliance scoping that stops at originations misses the account-management models entirely.
• The documentation that satisfies the April 2026 model risk framework — development evidence, independent validation, outcomes analysis — is the same evidence base used to defend a fair-lending challenge. Build it once.
• A vendor that will not explain its scoring is a compliance problem, not a commercial one: under third-party guidance the bank still owns the outcome and still owes the applicant a reason.
• Read California's ADMT rules through the §1798.145(e) data exemption before budgeting for them: at a GLBA-covered lender they bite hardest on employment decisions, not on credit ones.
• A real human decision-maker can put a credit model outside California's ADMT article altogether — but the test is substantive, not a rubber stamp: the reviewer must understand the output, actually review it, and be able to change the result.
• Colorado's January 1, 2027 date is the binding US deadline for explanation duties on consequential decisions. Scope remediation to it rather than to the deferred EU timeline.

What has the CFPB actually published on AI?

Which of the 100 largest US banks answer to the CFPB on AI?

82 of the 100 bank pages on this site name the CFPB among the authorities their AI programme answers to. Each page lists the documents that apply and why.

• Litigation challenging the April 2026 Regulation B rule's elimination of disparate-impact liability, and whether states (New York DFS, Colorado, California) fill the gap for AI underwriting
• Whether the Bureau issues any replacement guidance on adverse-action notices for machine-learning models after withdrawing Circulars 2022-03 and 2023-03
• Private ECOA and FCRA litigation testing whether model-derived denial reasons are 'specific' and 'accurate' enough
• Colorado's Automated Decision-Making Technology Act rules (effective January 1, 2027) as the de facto US standard for consequential AI decisions in financial services