The industry has been discussing “Fair Banking” (discriminatory practices outside of the lending context where the Equal Credit Opportunity Act (“ECOA”) and other laws make it clear discrimination based on prohibited characteristics is prohibited) for years. The CFPB just made it clear that the Fair Banking concept is alive and well and they will use Unfair, Deceptive, or Abusive Acts and Practices (“UDAAP”) to enforce it.
On March 16, 2022 the Consumer Financial Protection Bureau (“CFPB”) updated its examination manual on Unfair, Deceptive or Abuses Acts and Practices. The update provides insight as to when discrimination may meet the criteria for “unfairness”. An action may be “unfair” by causing substantial harm to consumers that they cannot reasonably avoid, where that harm is not outweighed by countervailing benefits to consumers or competition. Discrimination can be unfair in cases where the conduct may also be covered by ECOA, as well as in instances where ECOA does not apply. For example, denying access to a checking account because the individual is of a particular race could be an unfair practice even in those instances where ECOA may not apply. The CFPB also makes it clear that for discrimination to be prohibited, it does not need to be intention (sounds a lot like “disparate impact” to me!).
The CFPB will examine for discrimination in credit, servicing, collections, consumer reporting, payments, remittances and deposits. They will also require supervised entities to show their processes for assessing risks and discriminatory outcomes. This examination may include requiring companies to show their processes for assessing risks and discriminatory outcomes, including documentation of customer demographics and the impact of products and fees on different demographic groups.
The CFPB will look at how companies test and monitor their decision-making processes for unfair discrimination, as well as discrimination under ECOA.
What should you do next?
Pointer 1: Conduct a Risk Assessment
Now is the time to conduct a UDAAP risk assessment, which includes assessing discrimination risk, outside of your lending products if you’ve not done one. If you this assessment is already part of your regular process, review the updated examination procedures to determine whether your process needs any updating. Don’t stop there! It is not enough to do the risk assessment, but you must also react to/address any findings.
Pointer 2: Determine How to Identify Demographic Information for Testing
The CFPB doesn’t give any guidance on how financial institutions should determine UDAAP/discrimination risks and outcomes for products where demographic information isn’t obtained. It seems reasonable that companies can use a similar technique that is used to assess these risks in credit cards, by using proxies.
