The Equal Credit Opportunity Act does not care whether a person or an AI agent touched the application. A lender that uses agents in credit must still avoid discrimination at every step, give specific reasons when it denies credit, and keep test results showing that outcomes do not fall unevenly on protected groups without a sound business reason.
What does ECOA require of a lender, in plain words?
ECOA and its implementing rule, Regulation B, forbid a creditor from discriminating against an applicant in any aspect of a credit transaction on a prohibited basis: race, colour, religion, national origin, sex, marital status, age, receipt of public assistance income, or the good-faith exercise of consumer credit rights. "Any aspect" is wide. It covers marketing, the questions asked, the documents requested, the terms and limits offered, how a file is handled and how an account is treated later.
Supervisors look for two kinds of failure. The first is treating an applicant differently because of a protected characteristic. The second is a neutral-looking practice whose results fall unevenly on a protected group, where the lender cannot show a legitimate business need that a less harmful practice would not meet just as well.
The Act also requires specific reasons when credit is denied or granted on worse terms, and that holds when a model is used. "The system decided" is not a reason.
Who does it apply to?
ECOA applies to creditors: anyone who regularly extends credit, decides whether to extend it, or sets its terms. That includes banks, credit unions, finance companies and fintech lenders, and it reaches business credit as well as consumer credit. Depending on the lender, the CFPB, the OCC, the Federal Reserve, the FDIC or a state regulator examines for it.
Buying the agent from someone else does not move the duty. The lender is still the creditor, so the lender must be able to show what the agent did and why. Our guide to what AI agents in banking may and may not do sets out the wider limits.
What changes when the system is an agent that acts?
A scorecard takes fixed inputs and returns a number. An agent reads, writes and acts across several steps, and each of those creates fair lending exposure a scorecard never had.
It reads free text. Bank statements, emails and application notes carry proxies for protected characteristics: names, languages, places of worship in spending, gaps in employment for caring duties. An agent summarising a file can surface a proxy that no scorecard ever saw.
It writes. A note to the underwriter that says an applicant "seemed unsure about her income" can steer the person deciding. Fair lending risk lives in the agent's words, not only in its scores.
It handles the file. The agent that chases missing documents can chase some applicants sooner, harder or more often than others. That is differential treatment in file handling, even if a person makes the final call.
This is why we keep consumer credit decisions at depth 2: the agent assembles the file and drafts a recommendation, and a named underwriter decides. Narrow, numeric work is a better fit for agents. An agent that helps spread financial statements for business lending produces figures a credit officer can check line by line.
How do you meet the fair lending duty with agents?
The controls sit around the agent's sources, its steps and its outputs. Each must leave evidence an examiner can sample.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| No prohibited basis used | The agent's sources exclude protected characteristics and known proxies; its brief forbids inferring them | Source list per agent, with version history |
| Consistent file handling | Document requests and chase timings set by the process, not chosen by the agent | Per-application action log with timestamps |
| No unexplained uneven outcomes | Regular outcome testing on approvals, pricing, limits and the agent's own referrals | Test reports with method, sample, findings and sign-off |
| Specific denial reasons | Agent drafts reasons only from factors actually used; a person confirms | Reason drafts linked to file data, with approver identity |
| Neutral language | Sampled review of agent notes for loaded wording | Review records and corrections |
| Changes do not reopen risk | Any change to brief, sources or model is re-tested before release | Pre-release test results |
What testing shows the duties are met?
Three kinds of test answer different questions, and you need all three.
Paired testing asks whether the agent treats like cases alike. Build pairs of synthetic applications that are identical except for one signal of a protected characteristic, such as a name, a pronoun or a spending pattern, and replay them through the agent. Compare summaries, recommendations, document requests and tone. Any material difference is a finding.
Outcome testing asks whether results fall unevenly. Regulation B limits when a lender may ask applicants about protected characteristics, so most lenders estimate group membership for testing, keep that work away from decisions, and document the method. Test the agent's intermediate outputs too: referral rates, time to decision and the number of document chases per applicant.
Replay testing asks whether the agent still does what it did when approved. Run it against a fixed set of real past cases from your own book after every change, and on a schedule. A shift in recommendations without a change in the cases is drift, and drift in credit is a fair lending question before it is a performance one.
What will an examiner ask?
Expect questions like these:
- Where in the credit process do agents act, and at what depth for each step?
- Which data sources does each agent read, and how were proxies screened out?
- Show us paired-test results for this agent, the method and who signed them off.
- How do you know the agent requests documents and follows up consistently?
- Pick three declined files: show the reasons, the factors behind them and who confirmed them.
- What happened the last time the agent's brief or model changed?
What does ECOA not cover?
ECOA governs discrimination and reasons. It does not set your model risk standards; SR 11-7 does that for banks. It does not cover data privacy, which falls under GLBA and state laws such as California's CCPA as amended by the CPRA. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions, which may add duties for lenders there. For the mechanics of reason codes, see our piece on Regulation B adverse action reasons when an agent is involved. Lenders serving people in the EU face separate duties because credit scoring is high-risk under the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme sets the depth each action needs, so an agent can be allowed to assemble a credit file and draft a recommendation while being refused the decision itself. Attest certifies the agent by replaying it against real cases from your own book, and a run that clears no depth drops it to depth 1 the same day. Every verdict is filed, so an examiner's sample can be traced step by step.
Questions people ask
Can a lender use an agent's credit recommendation if the agent never sees protected data?
Removing protected fields is necessary but not enough. Free text and behaviour data carry proxies, so the lender still needs paired and outcome testing to show the recommendations are not uneven in effect.
Does fair lending law apply to business loans an agent helps assess?
Yes. ECOA covers business credit, so an agent supporting small business underwriting needs the same source controls, consistent handling and testing as one in consumer lending.
How often should a lending agent be re-tested?
Before every change to its brief, sources or model, and on a fixed schedule in between. Certificates that lapse after a set period force that schedule rather than leaving it to good intentions.