Fair lending model validation starts with a question of scope. A fair lending pricing review contains at least one model in the April 2026 sense, the significance test that decides whether a gap between borrower groups is likely to be chance, and usually a second one, the estimate of borrower race and ethnicity where it was not reported. Its other parts are not models: matching loans on fixed bands is a deterministic rule, computing a credit is arithmetic, and reading reasons with AI agents falls outside the guidance altogether. Botminds' Fair Lending Exception Monitoring has all of these parts, so this page takes the second line's questions in order: which pieces are in scope, what conceptual soundness means for each, how outcomes can be tested, and what has to be monitored after go-live. It is written for model risk managers, internal audit and the fair lending analysts who answer to them.
Fair Lending Exception Monitoring, part by part, under the April 2026 guidance
| Part | What it does | A model under the guidance? | What the second line should see |
|---|---|---|---|
| Exception collector | Pulls every concession, waiver and override against the rate sheet of the lock day | No: data extraction | Completeness: every price below the sheet is captured, flagged or not |
| Reason reader | Reads the officer's reason and looks for the evidence the policy requires | No: agentic AI is outside its scope | Bank governance: accuracy against a human-read sample, the rule that it never writes a reason |
| Peer matcher | Same product, score ±20, LTV ±5, same market, lock within 30 days on the same sheet | No: deterministic rule | The bands as policy, versioned; borrower group never used |
| Borrower group estimator | Surname-and-geography estimate where HMDA data is missing, with its probability | Yes: statistical estimate | Method, accuracy where the group is known, how uncertainty is carried |
| Disparity finder | Significance test with score, LTV, amount and product as controls | Yes: statistical inference | Specification, thresholds, power on small groups, sensitivity |
| Report writer | Credits as gap × loan amount; drafted actions and report | No: arithmetic and drafting | Arithmetic checks; every number traceable to loans |
Is a fair lending regression analysis a model?
Yes. A regression or significance test that turns loan data into an estimate of a gap applies statistical theory to produce a quantitative estimate, which is the guidance's definition; the rules and arithmetic around it are not. The revised interagency guidance, which "supersedes and replaces SR letter 11-7", defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates." It excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use" (revised guidance; SR 26-2).
"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."
Revised Interagency Guidance on Model Risk Management, footnote 3 (April 2026)
Three further points shape the work. The guidance "is expected to be most relevant to banking organizations with over $30 billion in total assets", though it "also may be relevant" to smaller banks with significant model exposure. It "does not set forth enforceable standards or prescriptive requirements." And the OCC has said the agencies "plan to issue in the near future a request for information" on model risk and AI, including agentic AI (OCC Bulletin 2026-13). For a bank under $30 billion, then, the guidance is a reference rather than an expectation; for any bank, the agentic parts need a governance answer of their own.
Conceptual soundness: the peer definition is a policy, the test is a model
The part a validator most needs to separate is the comparison set from the test run on it. The peer definition says who is "similar": in the sample configuration, the same product, a credit score within 20 points, loan-to-value within 5 points, the same branch market and a rate lock within 30 days on the same rate sheet. That is a business rule, and its soundness is a policy question: are these the factors that legitimately drive price at this bank? The interagency procedures frame the same question when they ask examiners whether differences are "fully explained by legitimate nondiscriminatory factors" (FFIEC, 2009).
The disparity test is where statistical theory enters. Where a group of at least 8 loans differs from its peers by more than the tolerance band, the disparity finder tests significance with score, LTV, amount and product as controls. A validator will want the specification written down: the unit of analysis, the controls and why they were chosen, how ties and missing values are treated, what the test assumes, and how it behaves on groups of 8 to 15 loans, where power is low and a single outlier moves the result.
Two kinds of component, two kinds of review
Rules and arithmetic: Peer bands, lock window, evidence rules, reason deadline, credit = gap × loan amount.
Statistical models: Significance test with controls; borrower-group estimate from surname and census tract.
Rules and arithmetic: Is the rule the bank's policy, and is it applied exactly as written?
Statistical models: Is the method sound, are its assumptions met, how accurate and stable is it?
Rules and arithmetic: Rule versions with dates and approvers; reconciliation of outputs to inputs.
Statistical models: Specification, back-tests, sensitivity runs, accuracy on known cases.
Rules and arithmetic: Compliance, as policy owner.
Statistical models: Model owner, with independent validation where the bank's tiering requires it.
Thresholds sit between the two and deserve their own sign-off. The Justice Department's Evolve order required the bank's analyses of "concession incidence and value of concessions in basis points" to "utilize methods, thresholds and controls approved in advance by the United States" (consent order, ¶13). Few banks are under an order, but the logic transfers: a tolerance band, a minimum cluster size and a significance level chosen after seeing the results can be set to find nothing. Approving them in advance, and keeping every change as a dated version, is what makes them a control.
Thresholds as settings, each change a new rule version
The effect shown beside the tolerance band is the sensitivity analysis a validator would otherwise have to run by hand.
How do you validate a BISG proxy?
Test it on the loans where the borrower's own answer exists, and measure both how well it ranks people and how well it counts them. Where the borrower did not report race or ethnicity, the analysis needs an estimate, and the estimate is a model in its own right. The CFPB's published method for its non-mortgage fair lending work, Bayesian Improved Surname Geocoding, "combines geography- and surname-based information into a single proxy probability for race and ethnicity." On mortgage applicants whose race was reported, the CFPB found the proxy ranked a reported Black borrower above a reported non-Black borrower 95% of the time (an AUC of 0.954), and that it beat surname-only and geography-only proxies (CFPB, 2014).
Ranking is half the test. The same CFPB report compared counts: on its mortgage pool, the proxy estimated 11,516 Hispanic applicants where 11,073 had reported as Hispanic, and it "tends to overestimate" Hispanic and other minority groups while underestimating non-Hispanic white applicants. A validator should run both checks on the bank's own HMDA loans, where reported and estimated groups sit side by side, and look at the probability bands: in the CFPB's pool, 65% of reported Hispanic applicants had proxy probabilities above 80%.
The second line's questions are about how the estimate is used, not only how good it is. Is the probability kept, or rounded to a label? Does the test weight loans by it, or assign each loan to its most likely group? How sensitive is a finding to that choice? Fair Lending Exception Monitoring uses HMDA-reported race, ethnicity and sex where given, estimates the rest from surname and census tract, keeps the probability, and restricts the result to the compliance role. The peer matcher never uses it. Validation can test the estimate directly on the loans where both the reported and the estimated group exist.
What is matched pair testing in fair lending?
Matched pair testing compares a borrower in one group with the most similar borrowers outside it, on the factors that legitimately set price or approval, and asks why their outcomes differ. It is the file-level form of what the interagency procedures call comparative evidence of disparate treatment: "differences in treatment that are not fully explained by legitimate nondiscriminatory factors" (FFIEC, 2009). Regression answers a different question, the average gap across a portfolio after controls, and it cannot by itself show which files make the gap or what their reasons say.
The two are complements, and a validator should know which one a system is running at each step. In the sample configuration, each exception is first matched to its peers (a median of 18), which is a rule; where a group of 8 or more differs beyond tolerance, a significance test with controls is run, which is a model; and the closest pair is then shown with both reasons, which is evidence for a person. The sample's pair is typical of what that produces: a 742-score loan with a 10 basis point concession beside a 738-score loan with 50, at a match distance of 0.06.
Outcomes analysis: how to validate a fair lending model on findings you know
The strongest outcomes test for a disparity finder is whether it reproduces findings the bank already has. If last year's manual review found a pricing gap at a branch, the system should find it in last year's data, with the same loans. If the manual review cleared a product, the system's result for it should be explainable. And because a review that only confirms known findings proves little about the rest, a validator can plant cases: shift concessions for a chosen set of loans by a known amount and check that the finder flags them at the expected size.
The investigation replays how the agents reached the flag
Each step in that trace can be checked by someone who was not there: the loans included, the peers chosen and why, the test and its result. A back-test on a full prior year, run before go-live, is the natural place to do this systematically; back-testing last year's exceptions sets out the pass marks.
The agentic parts: governance the bank writes for itself
The reason reader is an AI agent reading free text and documents. It is outside the guidance, which leaves the bank to decide its controls. Three are worth insisting on. Its accuracy should be measured against a sample of reasons read by people, with disagreements reviewed. Its authority should be narrow and enforced: it classes reasons, never writes one, never accepts a competitor match without the offer. And its errors should fail safe: a reason it cannot class should be shown to a person as unresolved rather than passed as supported. A Federal Reserve examiner's reminder applies to all of it: "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook, 2019). Where the line sits between those agents and the people who decide is set out in agents compare, people conclude.
What should a fair lending model validation report include?
An inventory that splits the system by kind, the test's specification and thresholds with their approvals, evidence of accuracy for the estimate, a back-test, agreement figures for the agentic parts, and a monitoring plan. The pack below is what the second line can ask the model owner to produce before go-live, and again whenever a rule version changes in a way that matters.
The validation pack a second line can ask for
- An inventory entry for each part
Which components are models, which are rules or arithmetic, which are agentic, with an owner for each.
- The specification of the disparity test
Controls, unit of analysis, minimum group size, significance level, treatment of missing values, behaviour on small groups.
- Thresholds approved before results
Tolerance band, cluster size and significance, with dates, approvers and every later change kept as a version.
- Accuracy of the borrower-group estimate
Measured on loans where the group was reported, and the effect on findings of using probabilities rather than labels.
- A back-test on a prior year
Known findings reproduced, cleared areas explained, planted gaps detected at the expected size.
- Reason-reader agreement with people
A read sample, disagreements reviewed, and a rule that unclassed reasons go to a person.
- Ongoing monitoring
Counts of exceptions, missing reasons and flags each quarter, with alerts when a rule version changes.
Ongoing monitoring: what changes after go-live
Fair lending analytics drift for reasons that have nothing to do with the code. A new product enters the rate sheet and has no peers for months. A branch opens and its first quarter is too small to test. Officers learn which reasons the reader accepts. Monitoring should therefore watch the inputs as closely as the outputs: the share of exceptions with no peers, the share of borrower groups estimated rather than reported, the mix of reason categories by officer, and the number of clusters below the minimum size that would have been flagged at a smaller one.
None of this asks the model risk function to judge fair lending. It asks the function to make sure the comparison a Fair Lending Officer relies on is complete, stable and honest about its uncertainty. For a reader who wants the public-data side of the same question, what HMDA pricing data shows an examiner explains what outside screens can and cannot control for. The Fair Lending Exception Monitoring page shows the whole system.
Questions people ask
Does SR 11-7 still apply to fair lending models?
No. The April 2026 interagency guidance superseded and replaced SR 11-7 and the OCC's 2011 bulletin. It applies principles to traditional statistical models and non-generative AI, and leaves generative and agentic AI to each bank's own governance for now.
What is fair lending regression analysis?
A statistical estimate of the gap in an outcome, such as rate or denial, between borrower groups after controlling for credit and loan factors. Examiners turn to it where a lender's volume is large enough to support it. It shows whether a gap exists on average; matched files show where it comes from.
Does the peer definition need validation?
It needs review as policy rather than validation as a model. The bands are business rules: the second line should check that they reflect what legitimately drives price at the bank, that they are applied exactly as written, and that each change is dated and approved.
What happens when a validator disagrees with a flag?
The disagreement is evidence about the model and goes into the validation findings. Because each flag carries its loans, peers and test, the validator can re-run it with a changed control or threshold and show exactly what moves.
Do we need independent validation for a bank under $30 billion?
The guidance expects to be most relevant above $30 billion and imposes no enforceable standard. Smaller banks set validation by their own risk tiering; a statistical test whose output can lead to borrower remediation is usually a reasonable candidate for an independent look.