OCC vs CFPB on AI in Lending: Model Risk vs Consumer Law

What is the difference between OCC and CFPB on AI lending?

The OCC treats AI in lending as a model risk and safety-and-soundness question; the CFPB treats it as a consumer-protection question under ECOA and Regulation B. The sharpest difference is force: Regulation B requires every adverse-action notice to give "specific" principal reasons whatever model is used, while the OCC's revised model risk guidance "does not set forth enforceable standards". Both stepped back in 2025–26: the CFPB withdrew its AI adverse-action circulars and removed disparate impact from Regulation B; the OCC stopped examining for disparate impact.[1][2][3][4][5][6]

At a glance

	OCC	CFPB
Instrument	Office of the Comptroller of the Currency — safety and soundness: model risk guidance (Bulletin 2026-13), supervisory statements and fair lending examinations	Consumer Financial Protection Bureau — consumer protection: ECOA and Regulation B adverse-action notices (12 CFR 1002.9), circulars and rules
Status	Bulletin 2026-13 in force since Apr 17, 2026; genAI RFI promised	§ 1002.9 in force; AI circulars withdrawn May 12, 2025; amended Reg B effective Jul 21, 2026
In the tracker	OCC Bulletin 2026-13 · Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025) Authority: OCC	ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) · CFPB Circular 2022-03 · CFPB Circular 2023-03 · CFPB withdrawal of 67 guidance documents (May 2025) · Regulation B final rule on disparate impact (April 2026) Authority: CFPB

Side by side

How do the OCC and the CFPB approach AI credit models?

Dimension	OCC	CFPB
Lens	Risk management: the OCC "emphasizes the importance of robust risk management practices for AI applications, consistent with conventional model risk management practices", including risks such as "bias, security vulnerabilities, and fraud".[1]	Consumer protection: ECOA, implemented by Regulation B, "makes it unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction" on a prohibited basis, and requires notice of adverse action.[7][2]
Main instrument	OCC Bulletin 2026-13, the revised interagency Model Risk Management guidance issued with the Federal Reserve and FDIC on April 17, 2026.[3]	Regulation B, 12 CFR 1002.9 (Notifications): a creditor must notify an applicant of action taken, including within 30 days after receiving a completed application.[2]
Legal force	"This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization."[3]	A regulation: the statement of reasons "must be specific and indicate the principal reason(s) for the adverse action"; statements that the applicant failed the creditor's internal standards or "failed to achieve a qualifying score" are "insufficient".[2]
Which models are covered	Models are "complex" quantitative methods; the principles apply to "traditional statistical and quantitative models and non-generative, non-agentic AI models"; generative and agentic AI are "not within the scope of this guidance".[3][8]	Circular 2022-03 said the adverse action requirements "apply equally to all credit decisions, regardless of the technology used to make them". The circular was withdrawn in May 2025; § 1002.9 itself draws no distinction by technology.[9][4][2]
Explainability of complex models	Hood: AI's reliance on intricate algorithms may cause some uses "to produce outputs through processes that may be more difficult to understand or explain". The guidance lets validators use "interpretability measures or benchmarking to other models" to assess conceptual soundness.[1][8]	Circular 2022-03: ECOA and Regulation B "do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions" (withdrawn May 12, 2025).[9][4]
Reason codes and sample forms	The OCC rescinded Bulletin 1997-24, "Credit Scoring Models: Examination Guidance", and its appendix on "Safety and Soundness and Compliance Issues on Credit Scoring Models", on April 17, 2026.[3]	Reasons "must relate to and accurately describe the factors actually considered or scored by a creditor". Circular 2023-03 (withdrawn) said creditors "may not rely on the checklist of reasons provided in the sample forms" if those reasons are not specific and accurate.[2][7][4]
Alternative data	Hood: "AI can utilize alternative data, such as rent payments and cash flow information, to improve credit models and increase financial inclusion."[1]	Circular 2023-03 (withdrawn) warned that complex algorithms "sometimes rely on data that are harvested from consumer surveillance or data not typically found in a consumer's credit file or credit application".[7][4]
Disparate impact	OCC Bulletin 2025-16 (July 14, 2025): examiners "should no longer examine for disparate impact"; fair lending examinations continue to look for evidence of disparate treatment.[6]	The April 2026 final rule "provides that ECOA does not authorize disparate-impact liability (effects test)"; effective July 21, 2026. The rule is being challenged in federal court.[5][10]
AI-specific guidance today	None for generative or agentic AI: the OCC and the other agencies "plan to issue in the near future a request for information" on model risk management and banks' use of AI.[3]	None in force: Circulars 2022-03 and 2023-03 were among the guidance documents withdrawn as of May 12, 2025.[4]

What it means for a bank

What does a bank using AI credit models owe each agency?

Keep reason-code capability for every credit model: § 1002.9 still requires specific principal reasons that "accurately describe the factors actually considered or scored", whatever the technology.[2]
Do not treat the withdrawn circulars as a change in the rule: they interpreted § 1002.9, which remains in the current regulation.[4][2]
Validate machine-learning underwriting models under the revised guidance in proportion to materiality; generative and agentic AI used in lending workflows need controls from the bank's broader risk management, because the guidance excludes them.[3][8]
Disparate impact is off the federal examination and Regulation B agenda for now, but the Regulation B change is in litigation, so the position may not be final.[6][5][10]
State law adds its own duties: from January 1, 2027 Colorado's SB 26-189 lets a creditor's ECOA/Regulation B (and, where applicable, FCRA) notice satisfy the Colorado notice duties only if that notice also meets them.[11]

Timeline

When did each happen?

Date	Instrument	Event
May 26, 2022	CFPB	CFPB Circular 2022-03: adverse action requirements apply to credit decisions based on complex algorithms.[9]
Sep 19, 2023	CFPB	CFPB Circular 2023-03 on the sample forms and AI or complex credit models (published in the Federal Register April 17, 2024).[7]
Apr 29, 2025	OCC	Acting Comptroller Hood's remarks on AI in financial services.[1]
May 12, 2025	CFPB	CFPB withdrawals applicable, including Circulars 2022-03 and 2023-03.[4]
Jul 14, 2025	OCC	OCC Bulletin 2025-16: examiners no longer examine for disparate impact.[6]
Apr 17, 2026	OCC	OCC Bulletin 2026-13: revised model risk guidance; generative and agentic AI out of scope; Bulletin 1997-24 on credit scoring models rescinded.[3]
Apr 22, 2026	CFPB	Regulation B final rule published: ECOA does not authorize disparate-impact liability.[5]
May 27, 2026	CFPB	National Fair Housing Alliance and others sue the CFPB over the rule (D.D.C., No. 1:26-cv-01820).[10]
Jul 21, 2026	CFPB	Amended Regulation B takes effect.[5]
Jan 12, 2027	CFPB	Last summary-judgment brief due in NFHA v. CFPB under the court's scheduling order.pending[10]

Contested or pending

What is still open?

The April 2026 Regulation B rule is being challenged in NFHA v. CFPB; under the scheduling order, cross-motions for summary judgment are briefed from September 29, 2026 to January 12, 2027.[10]
The OCC, Federal Reserve and FDIC have promised, but not yet issued, a request for information on model risk management and banks' use of AI, including generative and agentic AI.[3]

Common questions

Does the CFPB still require adverse action reasons for AI credit models?

Yes. Regulation B § 1002.9 requires a statement of specific principal reasons for adverse action, and its official interpretation says the reasons must accurately describe the factors actually considered or scored. The withdrawn circulars had applied that rule to complex algorithms; the rule itself is still in the regulation.[2][4]

Were CFPB Circulars 2022-03 and 2023-03 withdrawn?

Yes. Both are on the list of guidance documents the CFPB withdrew in a Federal Register notice published May 12, 2025, with the withdrawals applicable as of that date.[4]

Does the OCC examine AI lending models for disparate impact?

No. Since OCC Bulletin 2025-16 (July 14, 2025), examiners no longer examine for disparate impact; OCC fair lending supervision continues to analyze evidence of disparate treatment.[6]

Does OCC Bulletin 2026-13 cover AI credit underwriting models?

Non-generative, non-agentic AI models fall within the principles of the revised guidance; generative and agentic AI models are outside its scope. The guidance is expected to be most relevant to banking organizations with over $30 billion in total assets.[8][3]

Is disparate impact still part of Regulation B?

Not since July 21, 2026: the CFPB's final rule, published April 22, 2026, provides that ECOA does not authorize disparate-impact liability. The rule is being challenged in NFHA v. CFPB in the U.S. District Court for the District of Columbia.[5][10]

Who regulates AI in lending at a national bank, the OCC or the CFPB?

Both, from different angles: the OCC through safety-and-soundness supervision and its model risk guidance, and ECOA and Regulation B through the adverse-action and anti-discrimination rules that apply to every creditor.[3][2][7]

Sources

Acting Comptroller Rodney E. Hood, "AI in Financial Services" (remarks, National Fair Housing Alliance Responsible AI Symposium) — Office of the Comptroller of the Currency, Apr 29, 2025 · tracker page
12 CFR 1002.9 Notifications (Regulation B), current version with official interpretation — Consumer Financial Protection Bureau, Jul 21, 2026 · tracker page
OCC Bulletin 2026-13, Model Risk Management: Revised Guidance — Office of the Comptroller of the Currency, Apr 17, 2026 · tracker page
Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal (90 FR 20084) — Federal Register (CFPB), May 12, 2025 · tracker page
Equal Credit Opportunity Act (Regulation B), final rule (91 FR 21620) — Federal Register (CFPB), Apr 22, 2026 · tracker page
OCC Bulletin 2025-16, Fair Lending: Removing References to Disparate Impact — Office of the Comptroller of the Currency, Jul 14, 2025
Consumer Financial Protection Circular 2023-03: Adverse Action Notification Requirements and the Proper Use of the CFPB's Sample Forms Provided in Regulation B (89 FR 27361) — Federal Register (CFPB), Apr 17, 2024 · tracker page
Revised Guidance on Model Risk Management (interagency text, SR 26-2 attachment) — Federal Reserve Board, FDIC and OCC, Apr 17, 2026
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms — Consumer Financial Protection Bureau, May 26, 2022 · tracker page
National Fair Housing Alliance v. Consumer Financial Protection Bureau, No. 1:26-cv-01820 (D.D.C.), docket — U.S. District Court for the District of Columbia (via CourtListener), May 27, 2026
Colorado SB 26-189, Concerning the Use of Automated Decision-Making Technology in Consequential Decisions (signed act) — Colorado General Assembly, May 14, 2026 · tracker page

Every cell and answer on this page cites the official text it comes from; quotations are verbatim. Last reviewed Sep 24, 2026.

Navigate