Explainable AI credit scoring: what the denial letter demands

Explainable AI credit scoring is usually discussed as a modelling question — which method to attach to a gradient-boosted scorecard, how to draw the chart for the model risk committee. In consumer lending it is a disclosure question first. Every decline produces a letter, and the reasons on that letter must, under Regulation B, "relate to and accurately describe the factors actually considered or scored by a creditor", and where a scoring system made the decision, "relate only to those factors actually scored in the system", with no principal reason left out. An explanation method that is plausible, stable and useful to a data scientist can still fail that test, because the test is about accuracy to the model rather than usefulness to the reader. Adverse Action Notice Automation does not make a model interpretable; it traces each reason on each letter back to the factor or rule that decided, checks the words against the model documentation for the version that decided, and holds the notice when they disagree.

Figures from the prototype use a fictional lender's sample lending data. The legal material comes from Regulation B and its Official Interpretations, from two CFPB circulars and the 2025 notice that withdrew them, and from the interagency model risk guidance issued in April 2026. The research is peer-reviewed or preprint work, cited where it appears.

What explainable AI credit scoring has to deliver, in law not in theory

The obligation is short and it has not moved in decades. The statute requires that a statement of reasons "contains the specific reasons for the adverse action taken" (15 U.S.C. 1691(d)(3)). Regulation B adds that the statement "must be specific and indicate the principal reason(s)", and that a failure to achieve a qualifying score is not a reason. The Official Interpretations then impose three constraints that bear directly on a machine learning model: the reasons must accurately describe the factors actually considered or scored; where the decision came from a scoring system they must relate only to factors actually scored; and no factor that was a principal reason may be excluded.

Put together, those constraints ask a model to answer a counterfactual-flavoured question about one applicant, not an average one. Which factors, for this person, drove this decline? Comment 9(b)(2)-5 offers two ways of answering it and accepts anything equivalent: compare the applicant's factor scores against the averages achieved by applicants "whose total score was at or slightly above the minimum passing score", or against the averages for all applicants, and take the factors that fall furthest below.

That comment, written for 1970s scorecards, describes a reference population and a per-factor contribution relative to it. Modern attribution methods do structurally the same thing: a contribution for each feature, measured against a background distribution. The regulation's silence on method is genuine freedom — but the choice of background set is the part that maps onto the comment, and a lender that cannot say what its background set is cannot say which of the two blessed methods it is approximating.

The creditor must disclose the actual reasons for denial (for example, "age of automobile") even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant.

Comment 9(b)(2)-4 to Regulation B

Do SHAP values satisfy adverse action notice requirements?

They can contribute to a compliant answer; they are not one by themselves. Three gaps stand between an attribution vector and a lawful statement of reasons, and each has to be closed explicitly.

The first is fidelity. A post-hoc attribution explains a surrogate of the model under assumptions about feature independence and a background distribution; it is an estimate of the model's behaviour, not a readout of it. The CFPB put this in a footnote in 2022 and the sentence has aged well: "While some creditors may rely upon various post-hoc explanation methods, such explanations approximate models and creditors must still be able to validate the accuracy of those approximations, which may not be possible with less interpretable models" (Circular 2022-03, 87 FR 35864). The validation burden is the creditor's, and it is a burden on the explanation, not only on the model.

The second is feature-to-factor translation. A model's inputs are rarely the things a letter can name. Dozens of engineered features may encode one underlying fact about an applicant, and an attribution spread thinly across them can rank below a single coarse feature while describing a larger effect. Grouping features into factors a human can name is a modelling decision that changes which reasons appear on letters, and it needs to be documented as part of the model, not as part of the template.

The third is the hard constraints the attribution does not know about. A failed knockout rule must be disclosed whatever its numerical contribution — comment 9(b)(2)-8 requires that where a method "contains features that call for automatic denial because of one or more negative factors", the creditor "must disclose that specific factor". And where a decision combines scoring with judgement, comment 9(b)(2)-7 requires that "the reasons for the denial must come from the component of the system that the applicant failed", with both components used when the file fell into a grey band and was then declined by a person.

When explanation methods disagree with each other

There is empirical work on the gap between explanation and accuracy, and it is uncomfortable. A study of six post-hoc explanation methods across four real-world datasets and six predictive models found that "state-of-the-art explanation methods often disagree in terms of the explanations they output", and that "machine learning practitioners often employ ad hoc heuristics when resolving such disagreements". The authors' conclusion is blunt: "practitioners may be relying on misleading explanations when making consequential decisions" (Krishna and others, The Disagreement Problem in Explainable Machine Learning).

For a credit lender this is not an academic worry; it is a reason-selection problem with a population attached. If two defensible methods produce different top-four factors for the same applicant, then the choice of method decides what the applicant is told, and that choice is being made by whoever configured the pipeline. Running two methods and comparing their top-ranked factors on a sample is a cheap diagnostic, and a persistent disagreement rate is a finding, not a curiosity.

Cynthia Rudin's argument goes further, and deserves to be heard in its own words rather than paraphrased into a slogan: "trying to explain black box models, rather than creating models that are interpretable in the first place, is likely to perpetuate bad practices and can potentially cause catastrophic harm to society". The same paper argues that where data are structured and the features naturally meaningful — which describes most tabular credit data — complex and simple classifiers often perform about equally, which would make the trade a real choice rather than a sacrifice.

What the CFPB said about black-box models, and what happened to that guidance

In May 2022 the CFPB published Circular 2022-03, answering the question "When creditors make credit decisions based on complex algorithms that prevent creditors from accurately identifying the specific reasons for denying credit or taking other adverse actions, do these creditors need to comply with the Equal Credit Opportunity Act's requirement to provide a statement of specific reasons to applicants against whom adverse action is taken?" The answer was yes, with a sharper corollary: "ECOA and Regulation B do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions." It closed by rejecting the obvious defence — "A creditor's lack of understanding of its own methods is therefore not a cognizable defense against liability".

In September 2023 the Bureau followed with Circular 2023-03 on the sample forms, holding that creditors "may not rely on the checklist of reasons provided in the sample forms … if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action", nor "rely on overly broad or vague reasons to the extent that they obscure the specific and accurate reasons relied upon" (Circular 2023-03, 89 FR 27361).

Both were withdrawn on 12 May 2025, in a notice that withdrew "many guidance documents issued since the CFPB assumed its functions in 2011", on the stated view that binding obligations should be imposed through rulemaking and adjudication rather than guidance (90 FR 20084). That is a real change in what the Bureau will cite, and any compliance manual, model risk policy or vendor questionnaire that rests its argument on a circular number now rests it on a withdrawn document.

The rule the guidance was describing has not changed

What the circulars did was restate Regulation B and its Official Interpretations with a worked application to algorithms. The underlying text is still in force word for word: section 1002.9(b)(2) on specific and principal reasons, comments 9(b)(2)-2 and -4 on accuracy and on factors actually scored, and Appendix C's instruction that "if the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed" (Appendix C to Regulation B).

Regulation B itself has been amended since, and it is worth knowing where. The CFPB's examination procedures, revised in July 2026, record that "in April 2026, the CFPB further amended Regulation B's provisions regarding disparate impact; discouragement; and special purpose credit programs" (CFPB, ECOA examination procedures, July 2026). None of those amendments touched the notification rules in section 1002.9. A model risk policy should therefore cite the regulation and the comments, which are stable and enforceable, and treat the circulars as history — useful for understanding how a supervisor read the rule, not as the authority.

Is an AI underwriting model a model under SR 26-2?

Almost certainly yes, and the newer definition is narrower than the one it replaced. On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued revised model risk guidance; SR 26-2 "supersedes and replaces SR letter 11-7" and SR 21-8 (SR 26-2). It defines the term: "the term 'model' refers to a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates", and expressly excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use" (SR 26-2 attachment).

A machine learning scorecard sits squarely inside that. So, in most readings, does the explainer attached to it, since it is a quantitative method producing estimates that drive a regulated output. A deterministic reason-code lookup, by contrast, falls outside — which is precisely why it escapes model governance and why it needs a control of its own, a point the guide on reason-code maps takes up.

Two qualifications matter for scoping. The guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets", and it states that it "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism". That is not a licence: supervisory action can still follow from "violations of law or unsafe or unsound practices stemming from insufficient management of model risk" — and an inaccurate statement of reasons is a violation of law, whatever the asset size. Usefully for this subject, SR 26-2 names interpretability as a validation tool in its own right: in validating conceptual soundness, "other assessments—such as interpretability measures or benchmarking to other models—may be more practical for other models".

What to test before a model writes a reason

The battery below is the one we would want to see evidenced before a model's explanations are allowed to become sentences in letters. None of it is required by name in any rule; all of it is directed at the thing the rules do require, which is that the reasons accurately describe the factors actually scored.

Adverse Action Notice Automation: the reasons, traced again from scratch

What to ask a vendor, and what to ask of your own build

The questions below separate a product that has thought about the notice from one that has thought about the dashboard. They apply equally to an internal platform; the honest version of this list is the one a bank uses on itself.

Where Adverse Action Notice Automation fits, and where it does not

It is worth being exact about the boundary, because the easy claim is the wrong one. The solution does not make an uninterpretable model interpretable. It does not produce attributions, choose a background population, validate a surrogate or improve a model's fidelity. Those are model risk work, and nothing downstream can substitute for them.

What it does is the layer between the model and the applicant, which is where the notice obligation actually bites. Six agents read the decision as it is made, rank the factors and failed policy rules into principal reasons, compare the words for each reason code against the model's documentation for the version that decided, check the FCRA content where a report was used, write the letter from the approved template for the product, action and state, and keep the clocks. A version mismatch always holds the notice. The agents never change a decision, never change the code map, and never send a letter: the compliance analyst approves each notice and signs the batch, and a map change needs both the model owner and the compliance officer.

The settings that matter for a model-heavy lender are few and they are settings, not assumptions: whether the map must match the model version, how many principal reasons a letter may carry, the plain-language reading level, who must approve a wording change, and how large the monthly accuracy sample is. Those are the levers a model risk function will want to hold, and the parts of the notice they feed into are checked on every letter regardless.

Adverse Action Notice Automation: the rules as settings, not assumptions

A last word on sequencing. A lender that has not solved reason accuracy should not start with a more complex model, and a lender that has should not assume the letters followed. The two work streams are separate and both are measurable — one by validation evidence, the other by a traced sample of what applicants actually received. The clocks decide whether the letter counts at all. To see a decision traced to its reasons on sample data, start from Adverse Action Notice Automation.

Questions people ask

Can a lender use a black-box model to decline consumer credit?

Only if it can state the specific principal reasons accurately for each decline. The duty applies whatever technology produced the decision, so the practical constraint is on the explanation rather than on the model class: if the reasons cannot be shown to describe the factors the model actually scored, the model cannot lawfully be used to decline. The CFPB made that point explicitly in 2022, in guidance it later withdrew, but the regulation it was describing is unchanged.

Do SHAP values satisfy adverse action notice requirements?

Not on their own. An attribution is an estimate of the model's behaviour against a chosen background population, so its accuracy has to be validated separately from the model's. It also has to be translated from engineered features into factors a letter can name, and combined with hard rules it knows nothing about, such as automatic-denial policies and underwriter overrides. Done with those three steps evidenced, attributions can be part of a compliant process.

Is Circular 2022-03 still in force?

No. It was withdrawn on 12 May 2025, together with Circular 2023-03 on the sample forms and many other guidance documents. What the circulars restated — the statute, section 1002.9(b)(2), the Official Interpretations and Appendix C comment 4 — remains in force unchanged. A policy or vendor questionnaire that cites a circular number should be rewritten to cite the regulation.

Is an AI credit model a model under SR 26-2?

A machine learning scorecard meets the definition: a complex quantitative method applying statistical theory to process inputs into quantitative estimates. The guidance expects to be most relevant to banking organisations above $30 billion in assets and says it sets no enforceable standards, but it also notes that supervisory action can follow from violations of law or unsafe practices arising from insufficient model risk management. A deterministic reason-code lookup falls outside the definition, which is why it needs a control of its own.

How many principal reasons should a machine learning model produce?

Enough to cover every principal reason, which is usually four and sometimes five. Regulation B sets no maximum; the Official Interpretations say only that more than four is not likely to help the applicant. A pipeline that truncates hard at four can drop a principal reason, which the rules do prohibit, so the safer design ranks the reasons, prints four and raises the case where a fifth is genuinely principal.

What should a model risk function test before letters are generated from a model?

Fidelity of the explanation to the model, its stability across re-runs, agreement between two defensible methods, the reference population used, how engineered features are grouped into nameable factors, whether knockout rules are always disclosed, whether reasons come from the component that failed where scoring and judgement combine, and an end-to-end back-test comparing a re-traced sample of decisions with the letters that were actually sent.