CFPB Commentary on AI and Emerging Technology in Consumer Finance

One of the things I love about my role as GC of Sagent is leading the team of lawyers, paralegals, third-party risk and corporate governance professionals working to stay on top of legal and regulatory developments across the mortgage space. Sagent is brimming with enthusiasm about our AI-powered solutions that mortgage servicers are using today, plus a suite of functionality that will reshape the servicing industry for years to come. We are at the cutting edge of so many exciting areas of innovation and thought leadership in this fast-evolving space.  We all know that with innovation… comes regulation… and that is one more ball we have to keep our collective eye on as we guide the business into the future.

Along the path to the AI-powered future of mortgage, we’re seeing regulators, innovators, agencies, investors and other key stakeholders preparing a framework for implementation and adoption of this technology in a way that simplifies and enhances the borrower experience – but that is also systemically safe for our industry and the homeowners we serve. One recent publication on the matter was the CFPB’s August 2024 commentary on the Treasury Department’s Request for Information (RFI) on the uses, opportunities and risks of AI in the financial services sector. 

The Sagent Legal team is responsible for understanding and advising our organization about the potential impacts of pronouncements like these. But more than that, we dig in from varying perspectives to discern intent, spot the omissions, and find what’s “between the lines” of statements that, historically, tend to influence longstanding policy. We discuss long and short-term impacts as well as potential scenarios and strategies for Sagent and its customers. 

So, what are some of the takeaways from the CFPB on AI? My team and I thought we’d share some of the key themes from the Bureau’s recent commentary on AI in our space. This is just a general overview and in no way intended as legal guidance — just our thoughts on the signals the CFPB is sending to the industry, and more importantly, our customers and partners. 

Point #1: Although institutions sometime behave as if there are exceptions to the federal consumer financial protection laws for new technologies – that is not the case. 

• There are no exceptions to federal consumer protection laws for new technology 

• The CFPB is monitoring what they refer to as the “Uber model of consumer finance” – i.e., providing services without complying with the law and waiting for the legal system to ‘catch up.’ 

• The CFPB has made its position known – firms must comply with existing consumer protection laws when adopting and using new technology; and the flip-side of that is – if regulated entities in financial services cannot manage using a new technology in a lawful way, then they should not use the technology. 

Some specific examples in the commentary highlight what the CFPB is already seeing in the marketplace: 

• Automated Customer Service Technology 
  The CFPB noted that when these systems are built on large language models, they may provide incorrect information, fail to provide meaningful dispute resolution and raise privacy and security risks. 

• Monitoring this technology for ECOA (discrimination) and UDAAP (unfair and deceptive practices) will be very important, in the extension of credit, mortgage servicing and debt collection in terms of what options are offered to struggling customers. 

• Algorithms, machine learning and other types of automated decision making can produce bias that rises to the level of violations of both laws. 

• Fraud Screening 
  The CFPB is witnessing an increase in the use of new technology in fraud screening, often through third-party vendors who assign individualized “risk scores” as part of an application for the extension of credit. 

• It is the CFPB’s position that this adaptation of AI has also demonstrated a potential for violation of ECOA and UDAAP. 

• Because these tools are adapted for use  determining credit worthiness, the requirements of the FCRA are also in play. Prior bulletins from the CFPB have indicated that institutions using algorithms or AI for decisioning must be able to articulate the specific basis upon which the loan or other financial services product was denied/declined. The Bureau has made clear  it is not enough to state generally the denial is based on proprietary metrics/algorithms – the specific criteria that failed must be explained. 

• Underwriting 
  The CFPB reaffirmed that ECOA and UDAAP provisions apply to underwriting tools that use novel or complex technology and that they are tracking ECOA impacts. 

• The CFPB will continue to closely monitor and review the fair lending testing regimes of regulated entities (both in original extension of credit and in the context of loan modifications), including reliance on complex models 

• The bureau indicates testing should be conducted for bias, disparate treatment, disparate impact and unintended discrimination. 

• The CFPB is interested in how data is interpreted for trending and implementation of less discriminatory alternatives. 

• The CFPB is also looking at automated “de-biasing” technology with the potential to provide alternative models to the underwriting models used by institutions. 

Point #2: Ensuring that all market participants comply with the rules fosters innovation” and “Innovation is also fostered by clear regulatory requirements that do not unfairly advantage incumbent businesses or afford special treatment to firms.

• The CFPB mentioned that it has used a “sandbox” approach and offered no-action letters in the past to a handful of institutions in order to foster and observe innovation. 

• The CFPB’s position is that innovation is fostered when regulators ensure that all market participants follow the same law and regulation to compete on a level playing field, and they will be discontinuing any similar programs. 

• These programs did not yield the desired results and the CFPB does not wish to open the door to favoritism or abuse. 

Point #3: The CFPB states that it will be “fostering innovation and competition that truly benefits consumers” by: 

• Making clear that there is no exception to federal consumer protection laws for new technology, the CFPB pointed back to prior guidance disallowing the use of “black box” credit models and the FCRA/ECOA expectation of providing borrowers accurate and specific reasons for adverse action no matter how complex or opaque the data model may be, or the type of AI involved/used in a credit decision. The Bureau also reiterated a commitment to clarity for consumers. 

• Ensuring regulations don’t stifle competition in pricing or favor to incumbents – the CFPB touted its recent move to close a credit card late fee loophole and set up a proposed rule requiring greater transparency re: interest rates and fees on overdraft loans, claiming that this was the first in many moves to require uniform consumer disclosures and price transparency that will encourage competition on a level playing field 

• Encouraging consistent treatment under the law for similar products – the CFPB noted that innovation is not just technological – new products such as “buy now, pay later” programs and “earned wage” consumer products, will also be required to comply with rules and regulations in the consumer  financial services space (similar to those required for credit cards) and that includes compliance with regard to the technology used to open and manage accounts with expanded time lines for either payment or access to funds. 

• Combatting anticompetitive practices – the CFPB is evaluating whether companies offering comparison shopping tools to assist consumers in selecting financial products are providing users with manipulated results and whether those skewed results are tied to undisclosed kickbacks. The Bureau has issued guidance, warning that the use of dark patterns and manipulated results may violate federal consumer protection laws. The CFPB also referred to the pending proposed rule regarding personal financial data rights designed to prevent data hoarding and enable consumers to direct persons with whom their data should and should not be shared. The CFPB contends this rule will allow consumers to shop the market more efficiently and allows easy switching to better products. 

• Monitoring the market and assuring accountability – the CFPB identified several areas of focus for ongoing monitoring, including: 

• They will be evaluating whether and how companies are using and testing algorithms for lending decisions against ECOA protected classes, and, if there is evidence of disparities, the CFPB will be looking for evidence that regulated entities looked for less discriminatory alternatives to the models that were used. 

• They will be closely monitoring how tech firms expanding into offering bank-like services in virtual worlds carry appropriate consumer protections. 

• They will be monitoring how bad actors are using generative AI tools to impersonate others, and emerging methods of committing fraud. 

• The CFPB will be looking to require large technology companies that offer services like digital wallets and payment services to align oversight of their products to that of banks and other financial institutions. 

 Putting It All Together – Food For Thought: New technology requires diligent analysis and flexibility in calibrating compliance to meet regulatory expectations.  

We’re all in this together, so here are some emerging themes what we can watch for across the industry:  

• We’ll need to be able to identify and articulate where and how emerging technologies are being utilized, especially AI, along with mapping and explaining what AI has been “taught,” what it is designed to do, what it “learns” if generative, what kind of testing/monitoring is being performed and what occurs with test results that indicate bias (positive or negative) or any other issue. 

• We’ll need to assure decisioning models (underwriting and loss mitigation) are well documented and regularly tested as well, with any issues or anomalies promptly investigated and remediated if necessary. (For Sagent’s part, we’ve collabortated closely with the GSEs on our decisioning “waterfalls” and we’ll continue to collaborate this way with our industry.) 

• We’ll need to prepare a strategy for managing inquiries into these subjects, by borrowers, customers and regulators, with appropriate documentation and audit trails demonstrating effective AI governance, sound processes and the reliability of the technology deployed. 

• We’ll need to understand that spin-off and non-routine litigation in the default servicing space will likely involve defending against borrower claims regarding loss mitigation, and potential new challenges the legitimacy of a technologically-supported loss mitigation denial decision and/or the unavailability of a more favorable option. 

• We’ll need to balance the need for transparency and reportability in monitoring our systems against the need to protect intellectual property and confidential and proprietary business information forming the basis for innovative features 

These points apply in equal measure whether you’re a servicer that’s developing your own proprietary solutions, you’re considering Dara by Sagent to power your servicing operations, or even if you’re a tech provider such as Sagent.  

That is what the brave new frontier looks like. Our team in Sagent Legal is proud to be of service supporting Sagent product innovation and the tireless efforts of the business to deliver for our valued customers in enhancing the borrower experience.  There has never been a more exciting time to be in fintech!