Consumer credit and fair lending,explained

Fair lending: ECOA and Regulation B

The Equal Credit Opportunity Act prohibits discrimination against an applicant on prohibited bases including race, colour, religion, national origin, sex, marital status, age, and because income comes from public assistance. Regulation B puts the operational detail around it, most visibly the requirement to give an applicant notice of adverse action with the specific principal reasons for the decision.

Regulators look at two theories. Disparate treatment is treating a protected applicant differently. Disparate impact is a neutral policy that falls harder on a protected group without a sufficient business justification. The second is the one that catches firms by surprise, because nobody wrote a discriminatory rule; the outcome data simply came out skewed.

Disclosure: TILA and Regulation Z

The Truth in Lending Act exists so a borrower can compare the cost of credit. Regulation Z prescribes what has to be disclosed and how, including the annual percentage rate, the finance charge, the amount financed, and the payment schedule, along with rules on advertising, billing errors, and the right to rescind in certain secured transactions.

The recurring failure mode is not the initial disclosure, it is drift: a pricing or product change ships, and the disclosure logic and the marketing copy are updated on a different schedule from the code that calculates the number.

Data: FCRA and HMDA

• FCRA governs consumer reports: pull them only for a permissible purpose, give the required notice when you take adverse action based on one, and investigate disputes within the statutory window.
• If you furnish data to the bureaus, you carry accuracy and dispute-handling obligations of your own, which are examined.
• HMDA requires covered mortgage lenders to collect and report loan-level data, which regulators and the public then use to look for lending disparities.

Conduct: UDAAP and collections

Beyond the specific statutes sits a general prohibition on unfair or deceptive acts or practices, extended in the consumer-finance context to abusive practices as well. It is deliberately broad, and it is the hook used when a practice is harmful but no line-item rule squarely forbids it. On the back end, the debt-collection rules constrain how, when and how often you may contact a consumer, and what you must tell them.

Automated and AI underwriting

Model-driven credit decisions do not get a lighter touch. Regulators have been explicit that using a complex or machine-learned model is not an excuse for a vague adverse action notice: if you cannot explain the specific principal reasons a particular applicant was declined, you cannot use the model for that decision. Expect to evidence model documentation, the variables used and rejected, proxy analysis for prohibited bases, ongoing outcome testing, and human review of overrides.

The UK picture

The UK route is different in shape but similar in intent. Consumer credit firms are authorised by the FCA and follow the CONC sourcebook, with creditworthiness and affordability assessments at the centre, and the Consumer Duty layered on top requiring firms to deliver good outcomes across products, price and value, understanding, and support. Equality law rather than ECOA carries the anti-discrimination weight.

How it relates to security frameworks

ISO 27001 and SOC 2 carry a real slice of this: records retention, access control over applicant data, change management over the systems that price and decide, vendor oversight, logging, and an independent assurance habit. What they do not carry is the substance, meaning the disclosure content, the fairness testing, and the notice obligations. Treat the security programme as the foundation and the credit rules as a distinct control layer that reuses the same evidence where it genuinely applies.