What does Massachusetts AG Earnest Operations settlement (July 2025) say about AI in banking?

What are the key points of Massachusetts AG Earnest Operations settlement (July 2025)?

• Payment (¶64): Earnest pays $2,500,000 to the Commonwealth within 30 days of the Effective Date, defined (¶9) as the date the AOD is filed in a Massachusetts court; the Attorney General may use the funds for consumers, the General Fund, the Local Consumer Aid Fund or consumer-protection programs (¶65).
• Allegations (¶5, ¶¶23–63): failing to guard against disparate outcomes in algorithmic and judgmental underwriting; using the Cohort Default Rate (CDR) variable, which the AOD says was a weighted input in the student loan refinance model until September 13, 2017 and produced disparate impact for Black and Hispanic applicants; an immigration-status knockout rule in use until June 30, 2023; and inaccurate adverse-action notices under ECOA and Regulation B.
• Governance (¶¶67–72): a written corporate governance system of fair lending testing, internal controls and risk assessments for AI models, reviewed at least annually; an internal algorithmic oversight team with a named chairperson; and a way for anyone at Earnest to report algorithmic-bias concerns without repercussions.
• Policies (¶¶73–75): written policies for responsible design, development and deployment of AI models, including a Model Risk Management policy with specific provisions for compliance with Regulation B; annual fair lending testing of algorithmic underwriting models with defined trigger events; an annual inventory of models covering training algorithms, training and test data, parameters, dates in use and test results; and four-year retention of decision documentation.
• Knockout rules and judgmental underwriting (¶¶76–77): annual fair lending testing, inventory and a designated steward for knockout rules; training, annual assessment and override controls for human underwriters, with four-year records.
• Adverse action (¶78): policies to ensure adverse-action models comply with 15 U.S.C. §1691(d), including methods to use interpretable models for credit underwriting, to validate the accuracy of every decline reason, and to ensure notices state the principal reasons specifically and accurately.
• Prohibitions (¶¶79–82): no AI model or process may use the school rank or Cohort Default Rate variables as inputs; the immigration-status knockout must stay discontinued and not be replicated by any model; Earnest may not ask consumers for access to a social-media account as a step in applying for a loan.
• Oversight (¶¶83–89): self-review of ECOA, Regulation B and AOD compliance within 180 days of the Effective Date (an independent third party may assist), corrective action within 90 days, a written report to the Attorney General within 60 days, then annual reports for three years, plus raw data on request; the Attorney General must give 10 days' notice and meet and confer before seeking judicial intervention (¶89).

What did Massachusetts AG Earnest Operations settlement (July 2025) change for banks?

The settlement turned the Attorney General's April 2024 AI advisory into a concrete expectation for lenders: fair-lending testing of models and of the human judgment layered on top of them, a model inventory, a named oversight function, and decline reasons that can be traced to the model's real drivers. It also shows the office is willing to treat a lender's failure to test for disparate impact, and training a model on arbitrary human selections, as an unfair or deceptive practice under c. 93A. It does not create new law and the allegations are unproven, but its governance terms are a ready-made checklist for any bank's model risk and fair-lending teams.

What does the Massachusetts AG's Earnest settlement require of an AI lender?

The Earnest Operations LLC assurance of discontinuance, announced July 10, 2025, requires a $2.5 million payment and a fair-lending-centred AI governance program. Earnest must maintain a written governance system with an internal algorithmic oversight team, run annual fair-lending tests of its algorithmic underwriting models, knockout rules and judgmental underwriting, keep an annual inventory of every underwriting model and rule, retain four years of decision documentation, use interpretable models with validated adverse-action reasons, and stop using the Cohort Default Rate and school rank variables and the immigration-status knockout. It must review its own compliance within 180 days of the effective date, fix gaps, and report to the Attorney General annually for three years. The AOD binds only Earnest and Earnest denies the allegations, but it is the most detailed public template of what the office expects from a lender using AI.

The AOD's allegations explain its remedies. The office alleged that Earnest trained a scorecard model on human-selected variables and weights without firm procedures for deciding whether they predicted default, that the Cohort Default Rate subscore penalized Black and Hispanic applicants more than White applicants, that a later model was designed in part to replicate those earlier decisions, and that nobody tested the models or the human underwriting layer for disparate impact. It also alleged that the compliance officer never received the written certification Earnest's own policy required before a new underwriting criterion went live. Each undertaking in Part IV answers one of those findings.

The adverse-action terms are the most transferable. The AOD alleges that Earnest's staff picked decline reasons from a drop-down menu that omitted variables the models actually used, such as Cohort Default Rate, school rank and degree type, and chose an available reason instead, and that an auto-generated reasons model sometimes produced nothing specific. The remedy is a requirement to use interpretable models, to validate each reason on every notice, and to state the principal reasons accurately, which is a direct application of ECOA and Regulation B to AI.

The AOD is not a rule and binds only Earnest, which denies the allegations. Its release does not bind other private or governmental entities. For banks it is evidence of the Attorney General's enforcement theory under c. 93A, and a benchmark for how a regulator might measure a lender's AI governance. Federally chartered institutions answer first to their federal regulators and the AOD does not address preemption.

WHAT THIS MEANS IN PRACTICE

• Map every credit model and knockout rule into a single inventory with training data, parameters, dates in use and latest fair lending test results, refreshed at least annually and after trigger events.
• Run annual disparate-impact testing on models, on their individual weighted inputs and on human overrides, and keep the reports, documentation and analyses as examinable records.
• Reconcile the reason codes in adverse-action systems against the variables the models actually use, and test that a model-generated decline always yields a specific, accurate reason.
• Review any variable that proxies for school, geography or immigration status, and any rule that denies applicants before creditworthiness is assessed, for national-origin and race risk.
• Name an accountable oversight function (a chair or committee) with a protected route for staff to raise algorithmic-bias concerns, and make sure compliance sign-off on new underwriting criteria really happens and is recorded.