Fair Lending Compliance in 2026: State AG Enforcement Is Filling the Federal Void

TL;DR:

• The CFPB rescinded 67 guidance documents in May 2025 and closed all statistical fair lending investigations — federal disparate impact enforcement has effectively ended for now
• State AGs are not following the federal retreat: New York, New Jersey, California, and Massachusetts have all enacted new laws or enforcement frameworks that expand fair lending obligations beyond what federal regulators now require
• The Massachusetts AG’s $2.5 million settlement against Earnest Operations in July 2025 established that existing ECOA + state UDAP statutes are enough to challenge biased AI underwriting — no new AI law needed
• HMDA data is public, the ECOA statute of limitations is five years, and Rohit Chopra is now advising the Democratic AGs working group — compliance teams that stand down on disparate impact monitoring are building a liability time bomb

The CFPB under the Trump administration made a deliberate choice: close every statistical fair lending investigation, rescind decades of guidance, and propose eliminating disparate impact liability under ECOA. Federal banking regulators followed. The OCC removed disparate impact from its examination handbook. The FDIC did the same.

If you read all of that and concluded that fair lending compliance is now a lower priority, you read it wrong.

State attorneys general — operating with independent enforcement authority under federal law, new state statutes, and the active counsel of former CFPB Director Rohit Chopra — are rebuilding the enforcement infrastructure at the state level. And they are working from a dataset (your HMDA data, which remains public) that accumulates annually regardless of who is examining it.

Here’s what actually happened, and what your program needs to do about it.

What the Federal Rollback Actually Did

The sequence matters. Understanding exactly what changed — and what didn’t — is the foundation for a defensible 2026 compliance posture.

May 12, 2025: The CFPB rescinded 67 guidance documents spanning fair lending, overdraft, mortgage servicing, FDCPA, credit reporting, and whistleblower protections. Interpretive rules, advisory opinions, policy statements — all gone.

May-June 2025: The CFPB closed all statistical fair lending investigations. Going forward: CFPB will act only on cases with direct evidence of intentional discrimination and identified victims. Disparate impact analysis — the statistical comparison of lending outcomes across demographic groups — is no longer an enforcement pathway.

April 30, 2025: CFPB announced it would not prioritize enforcement of ECOA Section 1071 small business lending data collection requirements.

July 14, 2025: OCC Bulletin 2025-16 formally removed all disparate impact references from the Comptroller’s Handbook. OCC examiners instructed to cease examining for disparate impact liability.

November 13, 2025: CFPB filed a proposed rulemaking (Federal Register 2025-19864) to eliminate disparate impact liability under ECOA entirely, narrow the discouragement prohibition to direct statements only, and restrict Special Purpose Credit Programs from using race or sex as eligibility criteria.

What none of this touched: The ECOA statute itself (15 U.S.C. § 1691). The Fair Housing Act. Regulation B’s adverse action notice requirements. The Supreme Court’s 2015 ruling in Texas Department of Housing v. Inclusive Communities affirming disparate impact under the FHA. The five-year ECOA statute of limitations. HMDA reporting requirements. And state law.

What State AGs Are Actually Doing

Massachusetts: AI Underwriting Disparate Impact ($2.5M, July 2025)

The Massachusetts AG’s July 2025 settlement with Earnest Operations LLC is the case everyone in fair lending compliance should have printed out.

Earnest’s AI underwriting model for student loans was found to produce disparate impact against Black applicants, Hispanic applicants, and applicants without permanent resident status — through 2023, the model penalized applicants without green cards and used variables that correlated with race and national origin. The settlement: $2.5 million, plus a mandatory AI model governance program, periodic fair lending testing, and ongoing compliance reporting to the AG’s office.

The legal theory: existing ECOA and Massachusetts UDAP statute. No new AI law. No dedicated algorithmic accountability requirement. The existing framework was sufficient. If that same model was operating in a bank examined by the OCC today, federal examiners wouldn’t flag it. The Massachusetts AG still would.

Texas + DOJ + CFPB: Colony Ridge ($68M, February 2026)

The Colony Ridge settlement — $68 million — involved a development company that targeted Hispanic borrowers with predatory land installment contracts: interest rates of 10.9-12.9% when market rates were 2.35-4.05%, no ability-to-repay verification, flood-prone land marketed almost exclusively in Spanish. Violations cited: ECOA, Fair Housing Act, Texas Deceptive Trade Practices Act, and the Consumer Financial Protection Act.

The settlement’s structure is telling — $48 million for infrastructure upgrades, $20 million to law enforcement, zero in direct victim restitution. The federal judge initially rejected it. DOJ moved forward under separate statutory authority. Active controversy as of this writing, but the case illustrates what coordinated multi-regulator enforcement against targeted lending can still look like.

DOJ Redlining Consent Order Terminations — But Not All of Them

Beginning in May 2025, the Trump DOJ began filing motions to terminate Biden-era redlining consent orders early. Five were terminated: Ameris Bank, Patriot Bank, Cadence Bank, Trustmark National Bank, and Trident Mortgage. Southern Regional Bank’s $9 million order was vacated in May 2025.

Then U.S. District Judge Michael M. Baylson rejected the DOJ’s attempt to terminate ESSA Bank’s consent order in July 2025. The court held that “partial satisfaction” hadn’t achieved the order’s remedial purpose — promoting equal access to credit in West Philadelphia. ESSA’s obligations continue for the remaining three years of its order.

Courts are not automatic rubber stamps for the new enforcement posture. Consent orders represent binding commitments, and judges have independent authority to enforce them.

The State Laws That Now Exceed Federal Standards

Three major actions from late 2025 redrew the compliance map.

New Jersey: The Most Comprehensive Disparate Impact Standard in the Country

On December 15, 2025, New Jersey AG Matt Platkin’s Division on Civil Rights finalized regulations under the Law Against Discrimination that explicitly codify disparate impact discrimination across housing, lending, employment, public accommodations, and contracting.

The legal standard: a practice creates disparate impact if it “actually or predictably results in a disproportionately negative effect” on a protected class, unless it is necessary to achieve a substantial, legitimate interest and no less discriminatory alternative exists. Protected bases exceed ECOA’s enumerated categories. The regulations explicitly address AI — algorithmic decision-making can constitute disparate impact discrimination, and institutions must document explainability.

AG Platkin called these rules a direct counterweight to federal rollbacks. The state’s largest financial institutions are subject to both OCC fair lending expectations (disparate treatment only) and NJ LAD (disparate impact, broader bases). That’s not a contradiction — it’s two separate legal regimes operating in parallel.

New York: Unfair and Abusive Acts Now Covered

New York Governor Hochul signed the FAIR Business Practices Act on December 19, 2025 — effective February 17, 2026. The first major update to GBL §349 in 45 years.

The change: New York consumer protection law previously covered only deceptive acts or practices. The FAIR Act adds unfair and abusive — matching CFPB’s UDAAP authority. AG enforcement only (no private right of action for the new categories). Explicit targets: auto lenders, mortgage servicers, student loan servicers, hidden fee practices.

For any institution with significant New York operations: you now face a state equivalent of CFPB UDAAP enforcement with no limitation to whatever the current CFPB Director considers a priority.

California: Expanded DFPI Jurisdiction

California SB 825, effective January 1, 2026, closed the licensed finance lender and broker exemption from the California Consumer Financial Protection Law. DFPI now has UDAAP authority over a significantly expanded universe of lenders and brokers previously outside its reach.

California’s CFPB equivalent is now operating with broader jurisdiction at the same time the federal CFPB is pulling back. California accounts for roughly one-eighth of US mortgage originations and a significant share of auto and personal lending. Compliance programs that treated federal examination as the primary bar need to recalibrate.

21-State Coalition Against the Reg B NPRM

When the CFPB filed its November 2025 NPRM proposing to gut ECOA’s disparate impact protections, 21 state AGs — led by California AG Rob Bonta — filed a joint comment calling the proposals unlawful. The coalition included Massachusetts, New York, Illinois, and others.

If the NPRM finalizes and survives litigation, federal ECOA disparate impact claims are eliminated. FHA disparate impact (Supreme Court precedent, not regulation) survives. State ECOA analogs, NJ LAD, NY GBL §349, CA CCFPL — all survive. The compliance universe doesn’t collapse to zero. It fragments across state lines.

What Still Applies Federally (And Why It Matters More Than You Think)

Disparate treatment — intentional discrimination — remains in federal scope across all regulators. The OCC, FDIC, and Fed continue to examine for disparate treatment, though exam frequency has been extended for well-rated institutions.

Adverse action notice requirements under Regulation B remain unchanged and in full force. Every credit denial, adverse action, or incomplete application must still receive a notice with specific, accurate reasons. The CFPB’s NPRM doesn’t touch this. For institutions using AI in underwriting, this creates an ongoing ECOA explainability obligation that doesn’t go away regardless of what happens with disparate impact theory.

HMDA reporting continues. The data you file annually is public and searchable. Every community organization, fair housing attorney, state AG investigative unit, and future federal administration has access to your application, approval, and denial patterns by census tract — for years.

Rohit Chopra, former CFPB Director, is now advising the Democratic Attorneys General Association’s new Consumer Protection and Affordability Working Group. The infrastructure for coordinated, data-driven state enforcement is being built now, in preparation for the next enforcement cycle.

What Your Program Needs to Do in 2026

The compliance response to federal rollbacks isn’t to roll back your program. It’s to reorient around where enforcement is actually coming from.

Map your state regulatory exposure. For every state where you lend, identify which fair lending standards apply. NJ disparate impact regulations, NY FAIR Act, CA CCFPL, MA UDAP, IL CRA — each requires a separate analysis. The OCC examination scope is no longer your ceiling.

Keep running disparate impact analysis — even if federal examiners stopped. ECOA’s five-year SOL means a gap in your monitoring creates a window of unreviewed statistical patterns. NJ, CA, MA, and NY state law still requires disparate impact analysis. Private plaintiffs using HMDA data don’t care what the OCC’s current priorities are.

AI model governance is now a state enforcement target. The Earnest Operations settlement (Massachusetts) established the precedent. AI underwriting disparate impact under ECOA + state UDAP = regulatory liability. You need a model inventory, periodic validation including fair lending testing, demographic performance monitoring, and explainability documentation. See AI and Fair Lending: UDAAP Risk in Algorithmic Decisioning for the technical compliance requirements.

Clean HMDA data is your first line of defense. Every non-federal actor — state AGs, fair housing organizations, private plaintiffs — uses HMDA as their primary screening tool. Inaccurate HMDA data is an invitation to investigate further, not a shield.

Rebuild your fair lending risk assessment to reflect the current enforcement map. A risk assessment that only analyzes federal examination risk is no longer adequate. Risk rankings for NY, NJ, CA, and MA operations should be substantially higher than a reading of the OCC’s current guidance would suggest.

Check the status of any active consent orders. DOJ is trying to terminate them early; courts are not automatically approving. ESSA Bank’s experience shows consent order obligations can survive the administration change. Know your remaining commitments.

So What?

The federal enforcement void created by the current administration is real, but it’s not protection — it’s exposure accumulating for a future enforcement cycle. The organizations investing in fair lending compliance infrastructure now are the ones that won’t be scrambling when state AG enforcement ramps up further or when the political environment shifts.

State AGs have the legal authority, the technical methodology, the data access, and now the institutional expertise to fill the federal gap. They are doing so. Your fair lending program needs to reflect that reality.

For tracking fair lending MRAs, state exam findings, and remediation plans across multiple regulatory frameworks, the Issues Management Tracker is built for exactly this multi-regulator compliance environment.

Key sources: Massachusetts AG — Earnest Operations settlement | OCC Bulletin 2025-16 | CFPB Reg B NPRM, Federal Register | NJ AG disparate impact regulations | NY FAIR Business Practices Act | DOJ — Colony Ridge settlement | ESSA Bank consent order ruling