The CFPB Gutted Federal Disparate Impact. Now AI-Driven Lenders Have a State Fair Lending Problem.

TL;DR

• The CFPB’s Regulation B final rule, effective July 21, 2026, removed the “effects test” from ECOA — federal disparate impact liability for credit decisions is gone under Reg B
• The same day the CFPB published the rule, NYDFS issued an industry letter reminding creditors that NY Executive Law Section 296-a still requires disparate impact analysis — and at least four other states have analogous laws
• The Fair Housing Act still imposes disparate impact liability on mortgage lenders, independent of Reg B
• CFPB Circular 2026-03 kept adverse action notice requirements for AI models completely intact: the black-box-model excuse doesn’t work, and specific principal reasons for each denial are still required

The Reg B Rewrite Practitioners Weren’t Expecting

On April 22, 2026, the CFPB published a sweeping final rule amending Subpart A of Regulation B — the provision implementing the Equal Credit Opportunity Act. Effective July 21, 2026, the rule removed the “effects test” from Reg B and stated affirmatively that ECOA does not recognize disparate-impact liability.

That’s a significant rollback. The effects test — the principle that a facially neutral policy can violate ECOA if it produces discriminatory outcomes — had been part of Reg B’s interpretation since the 1970s. Successive enforcement actions, consent orders, and DOJ settlements had used it as the basis for challenging algorithmic and statistical underwriting systems that produced disparate results across protected classes.

Under the new rule, ECOA is a disparate-treatment statute only. To violate Reg B at the federal level, a lender’s policy or decision must be intentionally designed or applied as a proxy for a prohibited characteristic. Statistical disparate outcomes, standing alone, are no longer a federal ECOA violation.

For compliance programs that had built substantial infrastructure around testing AI models for disparate impact under ECOA — running demographic analyses, producing disparate impact assessments, maintaining model fairness documentation — the natural question is: do we still need this?

The honest answer: almost certainly yes, for reasons the CFPB’s rule doesn’t change.

The State Fair Lending Patchwork That Immediately Applied

The first thing practitioners needed to understand when the final rule published: the CFPB removed the federal effects test, but the agency has no authority to preempt state fair lending statutes. States set their own fair lending standards, and several of the largest lending markets in the United States have enacted fair lending laws that expressly or by judicial interpretation impose disparate impact liability.

States where disparate impact analysis remains legally required or has been interpreted to apply in the credit context include, at minimum, New York, California, Illinois, Massachusetts, and New Jersey. These five states collectively represent a large share of US credit transactions, and any lender operating in multiple states faces an immediate patchwork compliance problem.

The “we removed the federal requirement” framing obscures the operational reality: if you originate consumer credit in New York and California, you still need disparate impact testing — just under different statutory authority than before July 21.

For fintech lenders without a brick-and-mortar multistate footprint, this creates a compliance question that depends entirely on where your borrowers are located. If you underwrite loans via a mobile app available nationwide, your disparate impact obligations are a function of every state’s fair lending law, not just federal ECOA.

NYDFS Didn’t Wait to Make Its Position Clear

The CFPB published its Reg B final rule on April 22, 2026. The same day, the New York State Department of Financial Services issued an industry letter reminding all entities regulated under the New York Banking Law of their obligations under New York Executive Law Section 296-a.

The letter’s message was direct: “Regulated Entities are reminded that under Section 296-a, covered credit decisions that result in a disparate impact may constitute an unlawful discriminatory practice.” NYDFS explicitly framed the letter in the context of federal changes, serving notice that the state had no intention of treating the CFPB’s rule change as a signal to reduce fair lending scrutiny.

Section 296-a is broader than ECOA in important ways. Its protected characteristics include race, creed, color, national origin, citizenship or immigration status, sexual orientation, gender identity or expression, military status, age, sex, marital status, status as a victim of domestic violence, disability, and familial status. Any AI or algorithmic credit model producing disparate outcomes across any of those characteristics is potentially actionable under New York law, regardless of intent.

For lenders supervised by NYDFS — which includes New York-chartered banks, licensed mortgage bankers, and a significant portion of the fintech lending industry — the practical implication is that disparate impact testing infrastructure is a NYDFS examination expectation, not an optional investment.

The Fair Housing Act Problem for Mortgage Lenders

For lenders originating or brokering residential mortgage loans, the Reg B change creates a specific trap: mortgage lending is subject to the Fair Housing Act in addition to ECOA, and the FHA’s disparate impact standard is unchanged.

The Supreme Court’s 2015 decision in Texas Department of Housing and Community Affairs v. Inclusive Communities Project confirmed that the FHA’s text preserves disparate impact liability. HUD’s regulations implementing the FHA include an effects test, and the DOJ enforces the FHA using disparate impact analysis in fair lending investigations involving mortgage products.

The CFPB’s Reg B rule has no effect on the FHA. HUD did not change its implementing regulations. DOJ did not change its enforcement posture. A mortgage lender that stops running disparate impact analysis because Reg B no longer requires it has created an FHA compliance gap on the same credit decisions.

The overlap means that any AI or ML model used in residential mortgage underwriting, pricing, or approval must still be evaluated for disparate impact — just under FHA authority rather than ECOA. The testing methodology is broadly the same. The documentation expectations are similar. The enforcement risk is real and unchanged.

Lenders that had been running combined ECOA/FHA disparate impact analyses can continue that approach unchanged. The Reg B shift doesn’t simplify mortgage fair lending compliance; it creates a situation where the documentation must now clearly attribute the disparate impact testing to the FHA rather than ECOA, and where legal counsel should confirm which regulatory authority each element of the fair lending program rests on.

Adverse Action Notices: Where AI Explainability Still Has Teeth

Even practitioners focused on the disparate impact question should note what the CFPB did not touch: the adverse action notice requirements in Reg B Section 1002.9.

A credit denial, counteroffer, or adverse action — whether produced by an AI model or a human loan officer — still requires the creditor to provide the applicant with specific, accurate principal reasons for the decision. The rule allows up to four reasons, and CFPB guidance has made clear that those reasons must be the actual reasons, not generic checkboxes selected because they approximate what the model did.

On May 5, 2026 — two weeks after the Reg B rule published — the CFPB issued Circular 2026-03, which specifically addressed AI and machine learning in credit decisions. The Circular is unambiguous: lenders using complex algorithms remain fully responsible for providing specific, accurate reasons for adverse action. A model’s complexity, proprietary nature, or interpretability limitations are not defenses to the obligation. “The algorithm decided” is not an acceptable reason.

The Circular specifies that lenders must understand how their AI models work well enough to translate any adverse decision into specific, accurate principal reasons. For fintechs relying on black-box ML models without SHAP values, LIME explanations, or equivalent interpretability output, this creates an immediate compliance gap — and it existed before the disparate impact change and remains unchanged after it.

This is the compliance area where many AI-driven lenders have the largest gap. The AI risk assessment questionnaire your compliance team needs to work through covers explainability as a first-order risk domain precisely because adverse action notice compliance depends on it.

Special Purpose Credit Programs: A Separate Change With Its Own Compliance Implications

The Reg B final rule also modified the Special Purpose Credit Program (SPCP) framework — a provision that allows creditors to design programs specifically benefiting disadvantaged applicants. The change is significant but separate from the disparate impact removal.

Under the revised rule, for-profit creditors operating an SPCP are now prohibited from using race, color, national origin, or sex as common characteristics when defining program eligibility. This reverses prior CFPB guidance that had permitted race-conscious program design as a tool for addressing documented credit disparities.

For fintechs that had designed or were considering SPCPs as a fair lending affirmative action tool, the change means the program structure must be race-neutral in its eligibility criteria, even if the program’s purpose is to serve communities that have historically experienced lending discrimination. Legal counsel should review any existing or planned SPCP against the new rule before August 1.

What Your Compliance Program Now Has to Navigate

The practical effect of the Reg B final rule on a typical AI-driven lender’s compliance program is not simplification — it’s reorientation.

Before July 21, 2026:

• Federal ECOA/Reg B disparate impact testing: required
• State fair lending disparate impact testing: required where state law applies
• FHA disparate impact testing (mortgage): required
• Adverse action notice: specific reasons, AI model included

After July 21, 2026:

• Federal ECOA/Reg B disparate impact testing: no longer federally required under Reg B
• State fair lending disparate impact testing: required in NY, CA, IL, MA, NJ, and potentially other states — now the primary exposure for most multi-state lenders
• FHA disparate impact testing (mortgage): still fully required, unchanged
• Adverse action notice: specific reasons, AI model included, Circular 2026-03 reaffirmed

The compliance monitoring plan your team maintains needs to be updated to reflect this shift — particularly the test universe for fair lending, which should now explicitly track which tests are being run under federal authority, which under state law, and which under FHA.

For lenders that had centralized their fair lending testing around ECOA/Reg B authority, the immediate work is to re-attribute each testing element to the correct legal authority. State law-based testing should be documented as such, with citation to the specific statute and jurisdiction. FHA-based testing should be separately documented for mortgage products. The overall testing program may look similar — but the legal basis needs to be current.

So What?

The headline read as deregulation: “CFPB Removes Disparate Impact from Fair Lending.” For AI-driven lenders operating in multiple states or in residential mortgage, the operational reality is more complicated.

The federal effects test under ECOA is gone. But the practical testing obligations for a multi-state lender operating in New York, California, or Illinois are materially unchanged. NYDFS told the industry this on the day the rule published. The FHA told the mortgage industry this through the Supreme Court in 2015 and hasn’t changed its position since.

What the Reg B change actually does, for most compliance programs, is shift the legal attribution of fair lending testing from a single federal statute to a patchwork of state laws — plus FHA for mortgage — while keeping adverse action notice requirements fully intact through Circular 2026-03.

The compliance teams that get this wrong are the ones that read “CFPB removed disparate impact” and concluded they could scale back fair lending infrastructure. The ones that get it right are the ones that pulled the relevant state statutes, confirmed FHA exposure for their mortgage portfolio, audited their adverse action notice process for each AI model, and updated their compliance monitoring test universe to reflect where the current legal obligations actually live.

The AI Risk Assessment Template & Guide covers AI model governance, explainability documentation, and adverse action notice compliance for fintech lending teams — including the pre-deployment scorecard and vendor questionnaire your model risk program needs before any AI credit model goes live.