The Consumer Financial Protection Bureau (CFPB) is a U.S. government agency responsible for consumer protection in the financial services sector. Like many other regulators around the world, including its UK-equivalent, the Financial Conduct Authority, the CFPB is increasingly signaling its intentions to regulate AI.

Much of this activity has occurred in 2023, which is emblematic of the fact that the CFPB has been less active than regulators in other sectors and is yet to take decisive action.

Nevertheless, the CFPB is indicating that it could now ramp up efforts to address AI and protect consumers from harm.

In this blog post, we provide an overview of some of these key activities.

Joint statement on AI and existing laws

Together with the Equal Employment Opportunity Commission (EEOC), Department of Justice’s Civil Rights Division (DOJ), and the Federal Trade Commission, the CFPB released a statement on AI and automated systems in April 2023.

While the joint statement did not announce the advancement of any AI-specific regulatory efforts, it did reiterate that enforcement powers of the federal agencies also apply to AI and automated decision making, with a number of agencies having already taken enforcement action against AI under their existing enforcement authority.

In particular, the joint statement highlighted that multiple components of these tools – including data and datasets, model transparency, and deployment – can all lead to violations of federal laws if they are not considered or accounted for throughout the entire lifecycle of AI systems.

Proposed rule for AI in home appraisals

On 1 June 2023, the CFPB proposed a new rule, titled Quality Standards for Automated Valuation Models. The rule’s aim is to promote fairness and accuracy in home appraisals made using AI in conjunction with the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Federal Housing Finance Agency, National Credit Union Administration, and Office of the Comptroller of the Currency. Under the rule’s terms, automated valuation models are computerised models used by mortgage originators and secondary market issuers to determine the collateral worth of a mortgage on a property.

This would implement the quality control standards mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act). Under the proposed rule, institutions would have flexibility to set quality controls for AVMs based on their size and risk, as well as the complexity of the transactions for which the AVM will be used. Comments on the new section 1125 were open until 31 August 2023 after being published in the Federal Register at the end of June 2023.

CFPB spotlight on conversational AI in banking

On 6 June 2023, the CFPB issued a spotlight on the use of AI-driven chatbots in banking. While the spotlight also did not advance any regulatory activities, it did highlight a number of concerns surrounding the use of AI in banking activities. In particular, concerns were raised about the efficacy of conversational AI to answer customer questions, with the chatbots performing better for simple tasks while being unable to provide satisfactory responses for more complex tasks.

Moreover, there are concerns about privacy and security risks resulting from the use of AI chatbots in banking due to the sensitive nature of the data being handled. As such, the spotlight reminds banks that they are liable for the inputs and outputs of any chatbots they use, and that they are responsible for compliance with relevant laws.

CFPB Circular 2023-03 on adverse action notices

More recently, on 19 September 2023, the CFPB published Circular 2023-03, which clarified requirements for adverse action notices provided by creditors, whereby creditors taking adverse action against an applicant must supply a statement with the specific reasons for taking that action.

This is enforced by the Equal Credit Opportunity Act (ECOA), which is implemented by Regulation B. Under these terms, it is unlawful for any creditor to discriminate against any applicant with respect to any aspect of a credit transaction based on protected attributes.

The CFPB provides sample forms for issuing adverse action, but the circular letter was published to remind creditors that the reasons provided in the statement must be specific and accurate. As such, creditors cannot rely on an unmodified checklist to provide notice if the reasons provided on the sample notice are not relevant to that specific reason for adverse action. This is particularly important when using AI and automated decision making, since the templates may not provide applicable reasons for taking the adverse action.

Circular 2023-03 follows on from Circular 2022-03, which also addressed how to provide adverse notice actions when using complex algorithms to make credit decisions. Here, the circular confirmed that adverse action notices must be provided even when using complex algorithms. It asserted that such complex algorithms should not be used if it would prevent creditors from providing accurate notices when adverse action was taken against an applicant.

Time to get compliant

Is your organisation developing or deploying AI in the financial services sector?

Regulators and lawmakers are ramping up their efforts to regulate AI, both in your industry and beyond.

Make sure you are equipped to navigate existing and emerging legislation with Holistic AI.

Our Governance, Risk, and Compliance Platform and suite of innovative solutions are trusted by global companies.

Schedule a call with a member of our specialist team to find out how we can help your business.

‍

Authored by Airlie Hilliard, Senior Researcher at Holistic AI.