CFPB can do better by fintechs than a 'policy tool'

The Consumer Financial Protection Bureau recently finalized three policy tools meant to promote financial innovation by offering some regulatory certainty. But the agency may need to go further to convince fintechs such tools are safe and beneficial.

Two of those tools — the no-action letter and the compliance assistance sandbox — equip the CFPB with broad authorities to address various regulatory questions, including fair-lending risk associated with the use of machine learning and alternative data in credit underwriting.

One example of this is in an August blog post that updated its first issued no-action letter to Upstart Network, an online marketplace lender that uses alternative data for underwriting. In the post, the CFPB encouraged fintech lenders to take advantage of such policy tools to reduce their own fair-lending compliance risk.

More of these no-action letters that offer a “safe harbor” from the CFPB might benefit a handful firms, but the market as a whole will not reap the rewards until the agency issues generally applicable guidance.

When Upstart applied for the no-action letter in 2017, there was a tremendous amount of regulatory uncertainty around disparate impact testing — when disparities are found between groups, though unintentional — as related to the use of machine learning and nontraditional data.

Regulatory agencies had little experience with those new and innovative credit models. And there was little regulatory guidance to help new fintech lenders monitor and manage the enhanced fair-lending risk inherent in those models.

It was against that backdrop that CFPB staff issued a no-action letter to Upstart in 2017. In addition to market signaling, one primary goal of the letter was to afford the CFPB a ringside seat to gain experience and expertise that would enable the agency to formulate a sound, general policy in the future.

The Upstart letter has a number of novel ideas.

For example, a (very welcome) regulatory innovation is the use of a hypothetical model that contains traditional application and credit variables, but does not use machine learning as the baseline for credit-access analysis and disparate impact testing.

Too often, regulators compare the outcomes of innovation to a distant ideal rather than an imperfect status quo. Regulatory realism that recognizes the value of incremental improvements and gradual harm reduction is a step in the right direction.

The Upstart no-action letter for the first time provides a detailed roadmap of fair-lending compliance. Unfortunately, all of the regulatory and compliance innovation in the letter is confidential and so far, benefits just one company.

The regulatory uncertainty that existed in 2017 remains unchanged. What has changed, however, is that the CFPB (through the Upstart collaboration) has now developed a wealth of knowledge about how to manage and mitigate fair-lending risk for machine learning models.

Now is the time to leverage those insights to develop policies that benefit not just Upstart but the entire industry.

A good start would be for the CFPB to disclose key aspects of model risk management and compliance from its first no-action letter.

How should a hypothetical model be constructed? How can companies use such a model in access to credit evaluation and disparate impact testing? What are the steps firms may take to monitor and manage disparate impact risk?

While there may be many paths to compliance, answers to those questions will provide specificity so firms can learn and develop their own compliance approaches. Sharing the lessons from the Upstart no-action letter essentially provides an example of a safe harbor for fair-lending compliance that can address much of the existing regulatory uncertainty.

It is also important for the CFPB to work with the prudential banking agencies to issue formal fair-lending compliance guidance, since bank regulators enforce the Equal Credit Opportunity Act.

This would benefit not only fintechs but incumbent banks that also wish to safely use machine learning and alternative data in their credit decisions. Such joint guidance would provide ultimate certainty to the entire marketplace.

While the Upstart no-action letter was an example of policy innovation, issuing more of such letters on the same ground would be equivalent to innovation-by-permission. Let the market do what it does best: innovation through competition.

Regulatory agencies should do what they are supposed to do by providing clarity to regulated entities. Besides, only firms whose requests are handpicked by the CFPB will benefit from those one-off letters, while the rest of the industry continues to be kept in the dark.

More importantly, the CFPB cannot sufficiently protect firms that are granted no-action letters or approvals outside the agency’s jurisdiction, putting those recipients in great regulatory and legal jeopardy. A significant number of state attorneys general and financial regulators oppose the CFPB’s innovation policies.

This could lead to a scenario that muddies the waters even further. Imagine if the CFPB gives a no-action letter or approval to a lender that uses machine learning and nontraditional data. This same lender might subsequently be investigated or sued by one (or more) states for potential state fair-lending violations and/or unfair, deceptive or abusive acts or practices violations about the very conduct “endorsed” by the CFPB.

This would create huge confusion and uncertainty in the marketplace.

The best way forward is for the CFPB to share lessons with the public; build consensus with prudential regulators; mend fences with states; and put out specific and useful guidance.

By doing so, the agency can provide the kind of certainty and clarity firms need to harness the great potential of machine learning and alternative data, while promoting responsible access to affordable credit.