Documenting Fair Lending Controls

Why documentation is central to fair lending

A fair lending program needs evidence of how a creditor defined lawful criteria, applied them and addressed exceptions. Policies alone cannot establish how an individual application was treated. Map the customer journey from marketing and application through pricing, credit limits, servicing and account closure. For each stage, identify decision makers, technology vendors, discretion and the records required to understand a result. A regulator or internal reviewer should be able to reconstruct what information was available and why an action occurred. The applicable laws vary by market: US ECOA and Regulation B differ from UK equality and credit-conduct requirements and from EU national measures. Avoid describing a single global policy as if it satisfies every legal obligation.

Build a law-to-control inventory

Create a matrix matching each credit activity to the legal provision, covered actor, operational requirement, evidence source and control owner. In the United States, the current Regulation B text matters: the CFPB April 2026 amendments became effective on July 21 and changed regulatory interpretations concerning disparate impact and discouragement. Existing policy quotations should be reviewed before being reused. Keep ECOA adverse action and recordkeeping obligations distinct from FCRA or Regulation Z obligations. For each country or state, note whether the source is binding law, regulator guidance or internal policy. Track effective dates and superseded text. Where a legal issue remains uncertain, record the uncertainty and the responsible legal reviewer instead of assigning an unsupported pass result.

Document underwriting and pricing decisions

Keep approved criteria for income assessment, credit-risk thresholds, permitted data sources, discounts, fees and credit-limit changes. Map model scores and manual decisions to the policy in force at the relevant time. Where pricing depends on risk, preserve the factors and procedures used to support that decision. Employee discretion requires meaningful justification and review; a check box stating manager approved is not a complete explanation. Retain sufficient records to investigate suspected prohibited-basis treatment and inaccurate adverse action reasons, while observing applicable privacy and retention limits. Record how missing data, unusual borrower circumstances and verified corrections are handled. Exceptions should not disappear from the evidence trail after an application is resolved.

Test controls without overstating the law

A fair lending monitoring program may compare outcomes across appropriate customer groups, examine patterns in pricing or overrides and look for inconsistent treatment. The method should consider relevant credit factors, data limitations and statistical uncertainty. The 2026 Regulation B amendment removed the regulatory effects test and stated the CFPB position on disparate-impact liability. Do not label a difference as a violation solely because it exceeds a numerical threshold. Nor should the absence of an observed statistical gap be described as proof that intentional discrimination cannot occur. Record which legal test, risk indicator and methodology the review applies. Obtain qualified analysis where questions depend on judicial interpretations or state requirements beyond the current federal regulation.

Include marketing, servicing and complaints

Credit access can be influenced before the customer submits an application, including through offers, targeting and sales communication. After origination, hardship assistance, collections and account-management discretion can create further risks. Document approved marketing audiences, customer-facing scripts and differences between channels. In servicing, record eligibility criteria for waivers, extensions and settlement offers. Complaint files should connect reported treatment to the responsible team, underlying policy and final outcome. Distinguish a consumer who is ineligible under documented credit rules from one who was discouraged or treated differently for a prohibited reason. Monitor outsourced activities with appropriate agreements and access to useful records. Keep remediation steps and follow-up assessments linked to individual control findings.

Govern models, vendors and change history

Automated models can change when training data, input mappings, policy thresholds or third-party services change. Maintain a model inventory with owner, approved purpose, features, independent validation and version history appropriate to its risk. Document predeployment checks and postdeployment monitoring, including relevant complaints and errors. When fairness indicators change, determine whether the underlying cause is data quality, customer composition, a software defect or legally problematic treatment. Vendor compliance claims should be backed by evidence and contractual oversight, not accepted without review. Reviewers need access to enough decision information to assess adverse-action notices and exceptions. Restrict sensitive data used in testing and maintain retention schedules required by applicable law. Record approvals before release and investigation results after release.

Assemble an audit-ready evidence package

A complete evidence package combines the current legal register, written policy, product classification, procedures, training records, application samples, decision explanations and results of monitoring or complaint investigations. It should specify the population, date range, systems and limitations covered. Confirm that control testing can be reproduced and that the responsible officer signed off on material findings. Record agreed remediation, affected consumers, due dates and subsequent verification. Check that public statements about non-discrimination reflect actual operating practices. Document legal changes, including amendments that invalidate previously used interpretation text. Audit teams should distinguish incomplete evidence from a confirmed legal breach and report both accurately. Schedule reassessment after product, model, market or statutory changes rather than declaring permanent compliance after a single review.

Frequently asked questions

Related research

Fair lending pillar ↗

ECOA and Regulation B Explained ↗