Regulatory Framework
Fair Credit Reporting Act (FCRA)
- Accuracy of credit reports
- Consumer right to access credit information
- Dispute resolution process
- Permissible purposes for credit checks
- Adverse action notice requirements
Equal Credit Opportunity Act (ECOA)
- Prohibits discrimination based on protected characteristics
- Race, color, religion, national origin, sex, marital status, age
- Requires specific adverse action reasons
- Monitoring and reporting requirements
Fair Lending Laws
- Disparate treatment (intentional discrimination)
- Disparate impact (unintentional but discriminatory effect)
- CFPB enforcement and examinations
- Department of Justice oversight
Bias Detection & Mitigation
Sources of Bias
- Historical Bias: Past lending discrimination in training data
- Representation Bias: Underrepresented groups in dataset
- Measurement Bias: Different data quality across groups
- Proxy Variables: Features correlated with protected classes
Fairness Metrics
Demographic Parity: P(Decision=Approve | Group A) ≈ P(Decision=Approve | Group B)
Equal Opportunity: P(Approve | Repay, Group A) = P(Approve | Repay, Group B)
Calibration: P(Default | Score=X, Group A) = P(Default | Score=X, Group B)
Disparate Impact Ratio: Approval Rate(Protected) / Approval Rate(Reference) ≥ 0.80
Mitigation Strategies
- Pre-processing: Reweigh or resample training data
- In-processing: Fairness-constrained optimization
- Post-processing: Adjust decision thresholds by group
- Regular Audits: Quarterly fairness testing
Explainability Requirements
Adverse Action Notices
When denying credit, lenders must provide specific reasons:
- Primary reason (most impactful factor)
- Secondary reasons (2-4 additional factors)
- Consumer-friendly language
- How to obtain credit report
- Right to request additional information
SHAP-Based Explanations
Shapley Additive Explanations provide mathematically rigorous feature attribution:
- Calculate contribution of each feature
- Ensure sum of contributions = prediction - baseline
- Translate to consumer-friendly reasons
- Map technical features to understandable factors
Model Risk Management (SR 11-7)
OCC Guidance Requirements
- Model Development: Documentation of assumptions, data, methodology
- Model Validation: Independent review by qualified personnel
- Model Governance: Policies, procedures, controls
- Ongoing Monitoring: Performance tracking, recalibration
Model Documentation
- Business problem and model purpose
- Data sources and quality assessment
- Model development methodology
- Performance metrics and validation results
- Limitations and assumptions
- Implementation and integration details
- Ongoing monitoring plan
Privacy and Data Protection
GDPR (EU) Requirements
- Right to explanation for automated decisions
- Right to be forgotten (data deletion)
- Data minimization principle
- Explicit consent for data processing
- Data protection impact assessments
CCPA (California) Requirements
- Consumer right to know what data is collected
- Right to delete personal information
- Right to opt-out of data selling
- Non-discrimination for exercising rights
Best Practices
- Never use: Race, gender, religion, national origin directly
- Monitor proxies: ZIP code, names may correlate with protected classes
- Regular audits: Quarterly fairness testing across all protected groups
- Diverse training data: Ensure representative samples
- Human oversight: Manual review for borderline cases
- Transparency: Clear communication with consumers
- Third-party validation: Annual independent fairness audit
Compliance Checklist
- ☑ Model documentation complete and approved
- ☑ Fairness testing passed (disparate impact > 0.80)
- ☑ Adverse action notice generation functional
- ☑ Consumer data access portal implemented
- ☑ Audit trails for all decisions
- ☑ Regular monitoring dashboards active
- ☑ Incident response plan documented
- ☑ Staff training on fair lending completed
- ☑ Privacy policy updated and published
- ☑ Regulatory filings up to date
Next chapter presents real-world case studies demonstrating successful credit scoring implementations.