Fair Lending laws

Fair lending laws are the statutes prohibiting discrimination in credit. In the United States the principal ones are named by the regulator itself: the Consumer Financial Protection Bureau “ensures that financial institutions comply with federal fair lending laws, including the Equal Credit Opportunity Act (ECOA) and Home Mortgage Disclosure Act (HMDA).” Enforcement is shared — the Bureau “works closely with other federal agencies, including the Department of Justice, Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, National Credit Union Administration, and Federal Trade Commission.”

The important structural point for anyone building or governing credit models is that two different things have to be tracked, and only one of them is stable. The statutes change rarely. The theory an agency will pursue under them can change with an administration — and did.

The stable part: what the statutes prohibit

ECOA prohibits discrimination in credit transactions on prohibited bases and requires creditors to give applicants notice of adverse action — an explanation of why an application was declined. HMDA is a disclosure statute: it requires reporting of mortgage application and origination data, which is what makes patterns across lenders observable at all.

Those two do different work, and the pairing is deliberate. One creates the obligation; the other creates the data that lets anyone — regulator, researcher, or the lender itself — see how decisions were distributed. HMDA reporting makes mortgage patterns across lenders available for examination; it does not replace an institution’s own reviews and tests.

The part that moves: what an agency will pursue

Two legal theories have historically been used in this area. Disparate treatment is intentional differential treatment on a prohibited basis. Disparate impact is a facially neutral policy that produces materially different outcomes across groups without adequate justification.

As of a September 2026 reading of the Bureau’s own page, its use of the second has stopped. It states that “in 2025, the CFPB made changes to its fair lending program,” and specifically: “the CFPB is no longer using disparate impact in its supervision or enforcement of fair lending laws.” The change was applied retroactively to open matters — the Bureau “has closed all elements of open supervision exams and enforcement investigations that relied on disparate impact liability and terminated CFPB orders that relied on disparate impact liability.”

Its stated focus now: “the CFPB focuses its fair lending efforts on intentional discrimination with identified victims. If a financial institution has intentionally discriminated, the CFPB will seek the maximum penalties.”

Related positions from the same page, since they bear on programs teams may have built. On special purpose credit programs, the Bureau “no longer consults with institutions regarding any special purpose credit programs that rely on race, national origin, or sex,” and has “engaged in rulemaking to prohibit creditors from offering programs that rely on the race, national origin, or sex of the applicant.” And a newer area of attention is access rather than denial — evaluating institutions “for compliance with the Equal Credit Opportunity Act (ECOA) and Fair Credit Reporting Act (FCRA), particularly the adverse action notice requirements under these laws.”

Two cautions about reading any of that as “the risk is gone.” A federal agency’s enforcement posture is one source of legal exposure among several: courts interpret the statutes, state regulators and state law operate independently, and private litigation does not depend on an agency’s priorities. And postures change again. The durable lesson is the one this entry is organized around — record which statute you are complying with and which enforcement theory you are designing against, separately, with dates. A control justified only by “the regulator looks at this” has no foundation when the regulator’s list changes.

What stays true for model builders

Independently of which theory an agency pursues, two obligations come from the law itself, adverse action notices and record retention, and a third practice, proxy review, is a design choice that supports compliance. All three are worth treating as design requirements.

• You must be able to state why an application was declined. The adverse action notice requirement (Regulation B, which implements ECOA) is a legal obligation on the outcome of your model, not a nice-to-have explanation feature — and it constrains model choice wherever a decline reason cannot be produced from the model that made the decision.
• Decisions and their inputs should be reconstructable. Regulation B requires creditors to retain application records and adverse action notices for set periods (25 months for most consumer credit, 12 months for business credit). Any dispute is about a specific application on a specific date, which means the data as it stood then, not only the model’s current behavior, so versioning inputs and models to make a decision reproducible is a sound way to meet those retention duties and answer such disputes. In practice that is an audit log requirement and a data retention requirement at once.
• Proxy variables deserve deliberate review. This is a design practice rather than a rule the statutes spell out in this form. A feature that is not a prohibited basis can stand in closely for one. Whether that creates liability is a legal question that depends on the theory in force; whether it is a thing you want in your model is a question you can answer without waiting for the law.

Model behavior also moves after deployment as applicant populations shift, so a fairness assessment made at launch is a statement about launch — see drift detection. And because these obligations attach to a system that decides about people, they sit inside the wider practice of AI governance rather than beside it, with a model card being one reasonable place to record intended use, evaluation, and limitations.

This entry explains a term and is not legal advice. Descriptions of enforcement posture were read from the CFPB’s site in September 2026 and are the part most likely to be out of date; verify before relying on any of it.

References

• Consumer Financial Protection Bureau, Fair Lending (read September 2026)