Building a Fair Lending Compliance Program

Define the program's legal perimeter

A fair lending compliance program should begin with an inventory of credit activities, customers and responsible legal entities. ECOA and Regulation B apply to covered US credit activities, but the applicable duties vary with the transaction and the particular rule. List consumer loans, credit cards, credit-limit adjustments, broker-originated products, marketing channels and account servicing where relevant. Identify each creditor, intermediary and technology vendor without assuming that outsourcing transfers statutory obligations. Record the governing law, product classification and operational owner. A program designed for US lending should not be presented as a global standard: EU Member States and the United Kingdom have different credit, equality and data-protection frameworks. Start with a dated regulatory inventory that distinguishes binding law, supervisory guidance, court decisions and voluntary company policy.

Translate current Regulation B into controls

The Equal Credit Opportunity Act prohibits discrimination on specified grounds in covered credit transactions. Regulation B contains rules addressing credit applications, evaluation, notifications and record retention, among other matters. The CFPB's April 22, 2026 final rule, effective July 21, 2026, changed regulatory provisions concerning disparate impact, discouragement and special purpose credit programs. In particular, it removed the regulatory effects test and stated the agency's position regarding disparate-impact liability. A compliance framework should use the current text and distinguish the CFPB's regulatory position from any separate judicial or state-law questions. For each applicable requirement, specify the triggering event, customer touchpoint, accountable team, control activity and evidence. Do not treat every statistical difference as a violation or assume that a neutral-looking practice can never warrant investigation.

Assign accountability across the credit lifecycle

Fair lending controls need owners in marketing, product design, underwriting, pricing, servicing, collections and complaints. Marketing teams should document audience eligibility and offer criteria. Underwriters should apply approved standards and provide reasons for permitted departures. Pricing owners should track rate and fee exceptions, while servicing teams should document treatment of limit reductions, delinquency and hardship requests. Compliance should independently challenge unusual trends and investigate credible complaints. Senior management needs reporting that separates confirmed control breaches, unresolved questions and ordinary portfolio variation. A committee charter is useful only if actual decisions, escalations and corrective actions are recorded. Assign authority to pause a problematic practice, correct individual accounts and approve revised policies. Vendors must provide sufficient information for the creditor to oversee activities affecting consumers.

Test decisions and explain results

A testing plan should evaluate credit decisions with methods appropriate to the product, available information and current legal framework. Review eligibility, approval, pricing, credit limits, adverse actions and relevant servicing outcomes. Use comparison groups and legitimate risk factors carefully; missing protected-characteristic data, small samples and changing applicant populations can distort findings. Statistical monitoring can identify anomalies worth investigating, but cannot substitute for legal analysis. Manual overrides, model thresholds and broker discretion should be included where material. For covered adverse actions, section 1002.9 requires notifications and specific principal reasons under its conditions. Ensure those reasons correspond to factors actually used, including when algorithms participate. Sample real decisions against archived policy and model versions instead of relying solely on an aggregate dashboard.

Create an accessible complaint and correction process

Customers may raise concerns about a rejection, unexpected price, changed limit, inaccurate information or inconsistent treatment. Provide clear routes to submit complaints and correct factual errors, subject to the applicable legal duties. Distinguish an adverse-action explanation from a reconsideration request, a credit-report dispute and an allegation of discrimination. These involve different events and potentially different rights. Track the complaint's receipt, category, assigned owner, response, evidence and eventual remedy. Staff should avoid suggesting that every complaint proves an unlawful act or that automated processing removes the lender's responsibility. Analyse recurring issues across branches, digital channels and vendors. When a systemic error is confirmed, determine whether affected customers require revised notices, corrected terms or other appropriate remediation.

Preserve records and protect sensitive information

Recordkeeping enables a lender to demonstrate what information was available, how decisions were made and which communications were sent. Regulation B section 1002.12 generally specifies a 25-month retention period for many consumer-credit application records, subject to details, exceptions and extended preservation triggers. The requirement is not an instruction to keep all personal data indefinitely. Preserve relevant applications, written or recorded evaluation information, notices, statements of adverse-action reasons and documented complaints according to the operative provisions. Version-control pricing rules, underwriting criteria, models, test methods and approval records. Where legally permissible fair lending tests use sensitive characteristics, restrict access and justify retention. A current policy cannot replace historic decision evidence. Ensure the retrieval process can reconstruct a transaction without exposing unrelated consumer records.

Operate a repeatable review and remediation cycle

Set a review calendar covering regulatory change, new products, marketing updates, vendor releases, model recalibration and complaint trends. Specify thresholds for escalating unusual outcomes without representing those thresholds as legal definitions of discrimination. When testing finds a concern, document the hypothesis, investigation, applicable law, business explanation, resolution and responsible approver. Re-run the affected test after remediation and check for unintended consequences. Review changes in national law when the lender operates outside the United States. EU CCD2 implementing measures apply from 20 November 2026 subject to transition rules, while the UK framework needs a distinct assessment. The final program record should include the legal inventory, controls matrix, testing results, training evidence, complaints, management reporting and change log. It should tell an independent reviewer what happened, not merely declare that the firm is compliant.

Frequently asked questions

Related research

Fair lending compliance pillar ↗

Documenting Fair Lending Controls ↗