AI in credit decisions and fair lending: reasons, the withdrawn circulars and the EU

In the Bank of England and Financial Conduct Authority survey published on 21 November 2024, gradient boosting models were the most common type of AI model, at 32% of all reported use cases [13]. Gradient boosting is a machine learning method that combines many small decision rules into one model. A model built this way can weigh many inputs, and the lender still has to give each denied applicant specific reasons.

This page sets out the rules that govern that explanation in the United States and the EU, as of 26 October 2026. It is part of the guide on AI in banking. Some of the rules below are law and some were guidance that has been withdrawn. A bank should confirm with its own counsel how each applies to its lending.

The reasons rule in Regulation B

Regulation B carries out the Equal Credit Opportunity Act (ECOA), the US law against discrimination in lending. Section 1002.9 says a creditor must notify an applicant of the action it took within "30 days after receiving a completed application concerning the creditor's approval of, counteroffer to, or adverse action on the application" [1]. Adverse action means a denial or another unfavourable decision on a credit application.

The rule says the statement of reasons "must be specific and indicate the principal reason(s) for the adverse action. Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient" [1].

The official interpretations, which the Consumer Financial Protection Bureau (CFPB) publishes with the rule, add four points [2]:

Official interpretation	What it says
Comment 9(b)(2)-2	The reasons "must relate to and accurately describe the factors actually considered or scored by a creditor" [2]
Comment 9(b)(2)-4	For credit scoring, "no factor that was a principal reason for adverse action may be excluded from disclosure" [2]
Comment 9(b)(2)-5	"The regulation does not require that any one method be used for selecting reasons" from a credit scoring system [2]
Comment 9(b)(2)-1	"disclosure of more than four reasons is not likely to be helpful to the applicant" [2]

The rule and the interpretations make no exception for the type of model. A gradient boosting model, a neural network (another type of machine learning model) and a simple points table face the same test: the reasons given must describe the factors that actually drove the decision. Section 1002.9 and its official interpretations are unchanged in the current electronic Code of Federal Regulations [1][2].

What the withdrawn CFPB circulars said

In May 2022 the CFPB released Circular 2022-03. It said: "ECOA and Regulation B do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions" [3]. A footnote dealt with explanation methods that approximate a model after the fact: "creditors must still be able to validate the accuracy of those approximations, which may not be possible with less interpretable models" [3].

In September 2023 the CFPB released Circular 2023-03. It answered a question about AI and the sample notice forms: "No, creditors may not rely on the checklist of reasons provided in the sample forms (currently codified in Regulation B) to satisfy their obligations under ECOA if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action" [4].

On 12 May 2025 the CFPB withdrew both, in a Federal Register notice that withdrew 67 guidance documents by this guide's count [5]. The notice said "The withdrawals are applicable as of May 12, 2025" [5], that withdrawn guidance "should not be enforced or otherwise relied upon by the Bureau while this review is ongoing" [5], and that "Such withdrawal is not necessarily final" [5]. This guide found no new CFPB circular in the Federal Register between the withdrawal and 26 October 2026.

Document	Date	Status as of 26 October 2026	Kind
Regulation B, 12 CFR 1002.9	Current text	In force, unchanged [1]	Law
Official interpretations to 1002.9	Current text	In force, unchanged [2]	Official interpretation
CFPB Circular 2022-03	Released 26 May 2022	Withdrawn 12 May 2025 [5]	Was guidance
CFPB Circular 2023-03	Released 19 September 2023	Withdrawn 12 May 2025 [5]	Was guidance
Regulation B final rule on the effects test	Effective 21 July 2026	In force; challenged in court [7][8]	Law
Office of the Comptroller of the Currency (OCC) Bulletin 1997-24, credit scoring model examination guidance	1997	Rescinded 17 April 2026 [12]	Was guidance

Section 1002.9 still sets out what a denial notice must contain, and a bank should treat that duty as unchanged by the withdrawal.

The effects test rule of 2026

A CFPB final rule published on 22 April 2026 and effective on 21 July 2026 changed section 1002.6. The current text says: "The Act does not provide that the 'effects test' applies for determining whether there is discrimination in violation of the Act" [6]. The effects test, also called disparate impact, is a way of finding discrimination from the results a lending practice has on different groups of applicants.

The explanation the CFPB published with the rule records that some commenters argued the test matters more "particularly with the growth of complex technologies and processes driven by artificial intelligence" [7]. In its decision, the CFPB wrote: "The Bureau now finalizes the rule as proposed" [7].

Fair housing groups sued on 27 May 2026, in National Fair Housing Alliance et al. v. CFPB et al., No. 1:26-cv-01820, in the US District Court for the District of Columbia [8]. A Consumer Finance Monitor post of 10 August 2026, from the law firm Ballard Spahr, says the plaintiffs did not seek a preliminary injunction, a court order that would pause the rule while the case runs, that the written arguments run into January 2027, and that "Unless and until the court ultimately sets aside the challenged provisions, creditors are subject to the revised Regulation B" [8]. This guide did not check the court's own record after that date.

The case could restore the test or confirm its removal. A bank should ask its counsel which fair lending rules apply to its products and states, and should keep its bias testing records in a form that would still serve if the rule changes.

The EU: a credit score can be an automated decision

On 7 December 2023 the Court of Justice of the European Union (CJEU) decided Case C-634/21, known as SCHUFA after the German credit agency involved. The Court held that "the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes 'automated individual decision-making'" under Article 22 of the General Data Protection Regulation (GDPR), "where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person" [9].

The Court said Article 22 "is therefore subject to three cumulative conditions" [9]: there must be a decision, it must be based solely on automated processing, and it must have a legal effect or a similarly important effect on the person. It noted that the term decision "covers, for example, the automatic refusal of an online credit application" [9]. In the case, the referring court had found that a low score "leads, in almost all cases, to the refusal of that bank to grant the loan applied for" [9].

Where Article 22 permits such a decision under a contract or with consent, the controller, the company that decides how the data is used, must provide "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision" [10]. A person also has the right to "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing" [9], in the words of GDPR Article 15(1)(h) as the Court quoted it.

The EU AI Act adds a second layer. It lists AI used to "evaluate the creditworthiness of natural persons or establish their credit score" as high-risk [11], and its high-risk duties for those systems apply from 2 December 2027. The page the EU AI Act for banks covers those duties.

The US and the EU side by side

Question	United States	European Union
Must the applicant get reasons?	Yes, specific principal reasons within 30 days of a completed application [1]	Meaningful information about the logic involved [9]
Is an automated score itself a decision?	The reasons rule applies to the creditor's action on the application [1]	Yes, when the lender draws strongly on it (SCHUFA) [9]
Where the rule sits	12 CFR 1002.9 and its official interpretations [1][2]	GDPR Articles 15 and 22, as read in SCHUFA [9][10]
AI-specific rules	The two CFPB circulars on AI and denial reasons were withdrawn [5]	AI Act high-risk duties from 2 December 2027 [11]

What a bank should build

Reveneau's view is that testing is how a bank shows it meets the reasons rule. A machine learning model can produce reasons through an explanation method, a technique that estimates which inputs drove a particular output. Regulation B's official interpretation requires reasons that "accurately describe the factors actually considered or scored" [2], so a bank that uses an explanation method needs evidence that its output matches the model. The withdrawn Circular 2022-03 made the same point about checking such approximations [3].

The testing needs four records. First, a written method for choosing the principal reasons for each denial. Second, tests that compare the reasons the method gives with what the model did, on a fixed set of applications the bank chooses, run before release and after each change. Third, tests for differences in outcomes between groups of applicants, kept whatever the outcome of the court case. Fourth, a check that no notice relies on a phrase like "failed to achieve a qualifying score", which the rule calls insufficient [1].

The page running an AI pilot inside a bank covers how to test a model before wider use, and the AI vendor question list for banks includes the questions to put to a vendor whose model makes credit decisions. For the method behind repeatable tests, see the guide on LLM evals.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau.