In May 2025 the CFPB pulled the documents that told lenders how adverse-action notices had to work when a model made the call. If your reading was that algorithmic explainability just got easier, the statute is worth another look. Nothing in it moved.
On 12 May 2025 the Consumer Financial Protection Bureau withdrew 67 interpretive rules, policy statements and advisory opinions in a single Federal Register notice. Two of them mattered a great deal to anyone running a model against consumers.
Circular 2022-03 had said that a complex algorithm does not excuse a creditor from giving specific, accurate reasons when it takes adverse action. Circular 2023-03 had said that creditors using AI in underwriting cannot lean on the Bureau's sample notice forms when those forms do not capture the real reasons. Both are gone.
A number of teams read that withdrawal as a relaxation. It is worth being precise about what a withdrawal is. Guidance is an agency's published reading of a statute. Withdrawing the reading does not repeal the statute, and it does not create a defense for conduct the statute still prohibits.
Two independent duties made an unexplainable model a problem before 2025. Both are still on the books.
ECOA and Regulation B. Section 701(d) of the Equal Credit Opportunity Act, at 15 U.S.C. 1691(d), and Regulation B at 12 CFR 1002.9, still require a creditor to give an applicant the specific principal reasons for adverse action. That text was not touched by the withdrawal.
FCRA, which is broader. The Fair Credit Reporting Act's adverse-action duty does not attach to creditors. It attaches to any person who takes adverse action based in whole or in part on information in a consumer report. That sweeps in insurers, landlords, employers and any business using a consumer report inside a decision, whether or not credit is involved.
The second point is the one most often missed by teams who think of adverse action as a lending concept. If you decline, price up, or restrict a customer, and a consumer report contributed to that outcome, the duty is yours.
The bar did not come down. What changed is who holds you to it, and how much warning you get.
Two disclosures get conflated constantly, and they answer different questions.
Handing over the key factors that adversely affected a credit score is not the same as stating the specific reasons for the decision. The first describes a score. The second has to describe your action. A file can produce four score factors while the actual driver of your decline was a velocity rule, a device signal, or a match against an internal list. Disclosing the former does not discharge the obligation to state the latter.
The second failure is softer and more common. Reasons that restate the outcome are not reasons:
A reason has to name the thing about the applicant that drove the outcome, in terms they could recognise and respond to. If your model cannot produce that sentence, the notice cannot be written correctly, and no amount of careful drafting downstream fixes it.
Federal supervisory attention receded after the withdrawal. Enforcement did not disappear, it relocated. State regulators and private litigation are now the primary channels.
That is a materially different risk shape, and mostly not in your favour. A supervisor examines you on a cycle, issues findings, and gives you a remediation window. A plaintiff arrives years later with discovery, and the question becomes whether you can produce, for one specific decision on one specific date, the reason you gave and the basis on which you gave it.
An examination tests your policy. Litigation tests your records.
Independent of any vendor, this is the shape of what survives that second test. Per decision, retained for your record-retention period:
One consequence of that list deserves stating on its own, because it is where most architectures quietly fail.
Regenerating an explanation after the fact is not the same as having recorded one. If the model has been retrained since, the reconstruction is a current model's opinion about an old decision, not evidence of why that decision was made.
Systems that compute explanations on demand feel equivalent to systems that record them, right up until the moment the two diverge. They diverge on every retrain. The gap is invisible in normal operation and obvious in discovery.
Secondary sources report a CFPB circular dated 5 May 2026 restating the adverse-action requirement for machine-learning underwriting models, and separately a narrowing of Regulation B effective 21 July 2026. As of this writing neither appears on the Bureau's own circulars index, whose most recent listed item is from December 2024.
We are flagging that rather than citing it. Treat both as reported and unconfirmed, and check the Federal Register before you build anything on either. The argument in this piece does not depend on them: it rests on statutory text that has not moved since 1974 and 1970 respectively.
That caution is the point of the article in miniature. The last two years have demonstrated that guidance can be issued, withdrawn and apparently reissued inside a single compliance cycle. A control that depends on which circular is currently in force is a control with a short shelf life. A control built on the statute survives the churn.
If you are evaluating anything that scores people, four questions separate vendors quickly:
If the answers are uncomfortable, be clear about where the exposure lands. FCRA puts the duty on the person taking the action. A vendor's inability to explain its output becomes your inability to explain your decision, and the notice goes out under your name.
That is the whole reason we treat the decision record as part of the product rather than a reporting feature bolted on afterwards. A score you cannot defend is not an asset. It is a liability with a good UI.
This is not legal advice, and it is written by engineers rather than counsel. Statutory citations are given so you can read the primary text yourself, which you should do with your own compliance and legal teams before making decisions. Where reporting is unverified we have said so explicitly rather than leaving it to look settled.