The Equal Credit Opportunity Act, codified at 15 U.S.C. § 1691, makes it unlawful for a creditor to discriminate against an applicant with respect to any aspect of a credit transaction on a prohibited basis. That phrase is doing enormous work. It is not limited to the approve-or-decline decision. It reaches marketing and prescreening, application handling, pricing, credit limits, collateral requirements, servicing, loss mitigation, and collection.
Regulation B implements the statute and adds the operational duty most lenders trip over: when an application is denied or existing credit is adversely changed, the creditor must give notice stating the specific principal reasons for the action, or disclose the applicant's right to request them. A generic statement — "you did not meet our credit standards" — does not satisfy that requirement, and the fact that a machine learning model made the decision does not excuse it.
The prohibited bases, and the two that surprise people
ECOA prohibits discrimination on the basis of race, color, religion, national origin, sex, marital status, or age (provided the applicant has capacity to contract), because all or part of the applicant's income derives from a public assistance program, or because the applicant has in good faith exercised a right under the Consumer Credit Protection Act.
Two entries deserve emphasis because they generate real cases. Marital status means a creditor generally cannot require a spouse's signature on an individually qualified applicant's loan, cannot ask about marital status in most individual-credit contexts, and cannot treat a divorced applicant differently on that basis alone. Public assistance income means benefits income cannot be discounted or excluded as a category; the question is whether income is reasonably reliable, applied consistently to all sources.
The retaliation basis matters for servicing teams: an applicant who disputed a credit report entry, exercised billing-error rights, or filed a complaint cannot be treated worse for having done so. Mortgage servicers face a sharper version of the problem, because the borrower asserting a right is usually doing it through a formal statutory channel — the notice-of-error and information-request procedure under Regulation X — which date-stamps exactly when the servicer learned of the complaint and makes any later adverse treatment easy to line up against it.
Watch out: ECOA is not the only fair lending statute. The Fair Housing Act covers residential real-estate-related transactions with an overlapping but different list of protected characteristics, including familial status and disability. A mortgage program has to satisfy both. The proof framework in housing cases is discussed in our guide to fair housing claims and how they are proved.
Three theories of liability, three evidence problems
Overt discrimination
A policy or statement that facially treats a protected group differently. Rare in written policy today, but it still surfaces in marketing copy, scripts, dealer or broker communications, and informal exception practices.
Disparate treatment
Similarly situated applicants treated differently because of a protected characteristic. Proof is usually comparative: matched-pair file reviews, exception logs, pricing discretion analysis. Discretion is the recurring risk — wherever a human can adjust a rate, waive a fee, or grant an exception, the pattern of who receives those adjustments becomes the evidence.
Disparate impact
This is the theory that matters most for automated systems. Disparate impact analysis applies to facially neutral policies and practices — rules that say nothing about race or sex but fall more harshly on a protected group. The framework runs in three steps:
- Does the neutral policy produce a disproportionate adverse effect? This is a statistical question about outcomes across groups, run on the actual portfolio, not on intentions.
- Is the policy justified by a legitimate business necessity? The creditor must show the practice genuinely serves a substantial, legitimate, nondiscriminatory business objective — typically that a variable actually predicts default. A hunch, a vendor's assertion, or "the model chose it" is not a justification.
- Is there a less discriminatory alternative? If a different variable set, cutoff, or model achieves the same business objective with less disparity, the original practice remains problematic even if it is predictive.
The third step is where automated underwriting is most exposed and also where it offers the most opportunity. Modern search techniques can generate many candidate models with similar predictive power and different disparity profiles. If you can search that space, an examiner will reasonably ask whether you did.
Adverse action notices when a model made the decision
Regulation B requires notification of action taken on an application, generally within 30 days, and where the action is adverse, either a statement of the specific principal reasons or a disclosure of the right to obtain them. If a credit score was used, additional score disclosure obligations attach under the Fair Credit Reporting Act.
"Specific principal reasons" is a substantive standard. The reasons must be the actual, principal drivers of the decision for that applicant, described accurately enough to be useful. Practical consequences for model-driven lending:
- A fixed menu of sample reason codes is only acceptable if the codes you send genuinely reflect what drove the individual outcome.
- Complexity is not a defense. If a model cannot be interrogated well enough to identify the principal reasons, that is a problem with deploying the model, not a permission to send vague notices.
- Reason codes drawn from post-hoc explanation methods need validation that they actually track the model's behavior, and that validation should be documented.
- Counteroffers and pricing changes can also be adverse actions; the notice analysis is not limited to outright denials.
- For business applicants, the content and timing rules differ, and small-business applicants have specific entitlements under Regulation B — an area also touched by the separate data-collection regime discussed in our guide to the small business lending data rule.
What a defensible testing program looks like
| Stage | Primary risk | Typical test |
|---|---|---|
| Marketing and prescreening | Redlining; audience selection that excludes protected groups | Geographic distribution analysis; review of targeting parameters and lookalike audiences |
| Application and underwriting | Disparate impact from variables and cutoffs | Outcome analysis by group; variable-level contribution review; alternative-model search |
| Pricing | Discretionary adjustments and dealer or broker markups | Regression on pricing outcomes controlling for legitimate factors; exception log review |
| Line management | Reductions and closures falling unevenly | Portfolio analysis of adverse changes; adverse action notice audit |
| Servicing and loss mitigation | Uneven access to hardship options | Comparative review of workout approvals and denials |
| Vendors and models | Third-party scores and data with embedded disparity | Vendor due diligence and documentation review — see third-party risk management |
Where models come from outside the institution, fair lending diligence becomes a vendor management problem as much as a modeling problem. The contractual right to obtain model documentation, testing results, and audit access has to be negotiated before deployment, not after an examination request — a theme developed in our guide to third-party risk management for financial institutions.
Practical step: keep the fair lending testing record separate and complete: model documentation, variable justifications, the alternatives you evaluated, the disparity metrics you used, and why you chose the model you deployed. Examiners and plaintiffs both ask the same question — what did you know, and what did you do about it?
Fair lending as part of model governance
Fair lending testing works best inside a broader governance structure that treats models as controlled assets: documented purpose, approved data sources, validation before deployment, monitoring for drift, and a defined owner accountable for outcomes. Federal banking supervisors publish model risk management expectations, and the Federal Reserve and OCC supervisory materials are the standard reference points for regulated institutions. Non-bank lenders are not examined the same way but face the same substantive law, plus state examination authority.
The governance patterns overlap heavily with those required for other automated decisions, including in employment and insurance contexts — our guide to legal governance for automated and AI-assisted decisions covers the structure. State law is again a live variable: several states have enacted or proposed requirements around automated decision-making, and the obligations differ enough that a national lender should map them rather than assume uniformity.
Quick answers
If our model never sees race or sex, are we safe from fair lending claims?
No. Excluding protected characteristics from the input data addresses one theory of liability, not all of them. Disparate impact analysis applies precisely to facially neutral practices, and variables correlated with protected characteristics — geography, education, device data, shopping patterns — can reproduce disparity without ever naming it. Blindness to the characteristic also makes it harder to test for the disparity you may be creating.
Do we have to send an adverse action notice if the applicant withdrew?
A genuine withdrawal by the applicant is not adverse action, but the distinction has to be real. Applications that go stale because the creditor stopped responding, or files coded as withdrawn after an internal decline decision, are a recurring examination finding. Document the applicant's own communication, and treat incomplete applications under the regulation's separate incompleteness procedures.
Can we use alternative data such as cash-flow or education information?
Alternative data is not prohibited, and some of it — cash-flow information in particular — has been discussed as potentially expanding access to credit. The requirements are the same as for any variable: it must serve a legitimate business objective, be tested for disparate impact, be capable of generating accurate adverse action reasons, and be sourced consistently with credit reporting law. Education-related variables have drawn particular scrutiny.
Does ECOA apply to small business lending?
Yes. ECOA covers business credit, not only consumer credit. Regulation B adapts some notice and record-retention requirements for business applicants, with different treatment depending on revenue size, but the core prohibition on discrimination in any aspect of a credit transaction applies to commercial applications as well as consumer ones.
Who enforces fair lending law?
Several authorities at once. The CFPB supervises and enforces for covered institutions, the prudential banking agencies examine the banks they supervise, the Department of Justice brings pattern-or-practice cases, and private plaintiffs can sue under ECOA. State attorneys general and state financial regulators add another layer, and their authority varies by state.
Where this leaves you
Fair lending is a documentation discipline as much as a modeling one. Map every point in the credit lifecycle where a decision or a discretionary adjustment happens, and confirm each one is tested. Make sure adverse action notices state reasons a person could act on, and that those reasons trace to what the model actually did. Search for less discriminatory alternatives before deployment and record the search, because that record is the difference between a defensible program and an indefensible one.
If a consumer believes a credit decision was discriminatory, complaints can be filed with the CFPB, and the underlying credit data can be checked and corrected through the process in our guide to correcting credit report errors. Related lending and product-structuring guides sit in the banking, payments, and fintech pathway.