Fair Lending and Bias KRIs for AI Models: Approval Rates, Override Rates, and Disparate Impact Signals

In July 2025, the Massachusetts Attorney General settled with Earnest Operations — a student loan lender — for $2.5 million. The AG’s complaint alleged that Earnest’s AI underwriting models produced unlawful disparate impact on Black, Hispanic, and non-citizen applicants. The core violation: Earnest failed to test its AI models for disparate impact and trained those models on historical human decisions that were themselves arbitrary and biased.

Eleven months later, the CFPB finalized a rule removing disparate-impact liability from ECOA and Regulation B, effective July 21, 2026.

These two facts, read together, describe the current enforcement landscape: federal ECOA disparate impact is narrowing, and state enforcement is not. If your fair lending monitoring program is calibrated only to federal Reg B requirements, you’re monitoring the wrong thing. And if your AI bias program consists of periodic validation without continuous KRI monitoring in between, you’re probably not catching model drift when it happens — you’re finding it after the next scheduled test, or after a complaint, or after a regulator asks.

TL;DR

• Periodic bias testing tells you what the model did. Bias KRIs tell you whether the model’s behavior is changing between validations.
• The CFPB’s July 2026 Reg B rule eliminates federal ECOA disparate impact — but Fair Housing Act, GSE requirements, and 20+ state laws maintain disparate impact obligations. State AGs are actively filling the enforcement gap.
• The Massachusetts AG’s $2.5M settlement with Earnest Operations (July 2025) establishes the enforcement template: failing to test AI models for disparate impact, and training on biased historical decisions, is actionable under state UDAP law even without federal ECOA disparate impact.
• Five KRI types matter most: approval rate gaps, override rate disparities, adverse action reason drift, complaint volume by segment, and validation exception aging.
• Ownership splits across model risk, fair lending compliance, and legal — but the escalation path must produce a single actionable view.

The Monitoring Gap Between Validations

Model risk management requires periodic validation — typically annual for standard models, more frequent for high-risk or rapidly-changing ones. Validation catches bias that was present at a point in time.

But AI models deployed in production environments don’t stay static. Input distributions shift as the applicant pool changes. New data sources get added. The macroeconomic context that the model was trained on evolves. And the model’s behavior can shift — approval rate gaps can widen, adverse action reason patterns can drift — in ways that no quarterly report captures between formal validations.

Continuous bias KRIs fill this gap. They’re not a replacement for validation. They’re the monitoring layer that tells you whether validation findings are still current, whether the model is behaving within the parameters established at validation, and whether an off-cycle review is warranted.

Think of it this way: validation is an audit. KRIs are ongoing surveillance.

The Enforcement Landscape in 2026

The CFPB’s final Regulation B rule, effective July 21, 2026, removes disparate-impact liability from ECOA — meaning lenders can no longer be held liable solely because a neutral lending policy produces statistically different outcomes across protected classes under federal ECOA. The CFPB framed this as a return to ECOA’s original statutory text, which it interpreted as requiring intentional discrimination, not effects-based liability.

What the rule doesn’t change:

• Fair Housing Act maintains disparate impact liability for residential mortgage lending
• GSE contractual requirements (Fannie Mae, Freddie Mac seller/servicer guides) continue to require bias testing for lenders selling loans into the secondary market
• State fair lending laws in multiple states continue to impose disparate impact requirements under state civil rights, UDAP, and consumer protection statutes
• Private litigation continues to be available under Title VII, FHA, and state law

The Massachusetts AG’s enforcement action against Earnest Operations illustrates exactly how this plays out. The AG used state UDAP law — not federal ECOA disparate impact — to bring the claim. The DLA Piper analysis of the action noted that Massachusetts used existing state consumer protection statutes to reach conduct that state-specific fair lending laws might not have covered, creating a broader enforcement template than most institutions expected.

For fintech lenders and banks that have structured their bias monitoring around CFPB Reg B, the shift is real: the obligation to monitor hasn’t disappeared, but the regulatory source has expanded and fragmented across states, courts, and GSE counterparties.

The Five Bias KRIs Worth Tracking

1. Approval Rate Gap by Protected Class Proxy

The core metric. Tracks the difference in credit approval rates between a reference group and protected class groups over a rolling period.

The gap ratio threshold calibration should come from your institution’s own historical approval data, validated through formal fair lending analysis. The thresholds above are illustrative — what matters is the trend, particularly when the gap is widening without a corresponding change in applicant risk profiles.

A widening approval rate gap doesn’t automatically indicate discrimination. It’s a signal that warrants investigation: Has the applicant pool composition changed? Has a model input weight shifted? Did a product change affect which segments apply? The KRI’s job is to generate the question, not answer it. The escalation response should be a structured review, not an assumption in either direction.

2. Override Rate Disparity

Override rate disparity measures whether human overrides of model decisions — approvals of model-denied applicants, or denials of model-approved applicants — are being applied at materially different rates across protected class groups.

This is where fair lending risk frequently hides after a model is technically validated for bias. The model may be compliant; the override process may not be.

Override rate KRIs should be owned jointly by fair lending compliance and first-line business operations. When override disparity is elevated, the investigation needs to go beyond the data: reviewing override reason codes, examining whether documentation requirements are applied consistently, and determining whether informal guidance from managers is affecting override decisions differently across applicant categories.

3. Adverse Action Reason Drift

Adverse action reasons are a documented record of why credit was denied. Under ECOA and Reg B, adverse action notices must provide specific reasons. AI models that produce different adverse action reason distributions across protected class groups — without corresponding differences in credit profile — are flagging a compliance gap.

Adverse action reason drift KRIs track whether the distribution of reasons is shifting over time, and whether it’s shifting differently across applicant groups.

The Earnest Operations case is instructive here. The Debevoise Data Blog analysis noted that Earnest’s models used school rank and Cohort Default Rate as inputs — variables that correlate with race and immigration status but weren’t identified as proxies during the model’s development or monitoring. The settlement explicitly prohibited those variables going forward. Adverse action reason monitoring would have surfaced the school rank variable’s disproportionate use in denials much earlier than a formal bias test.

4. Complaint Volume and Pattern by Segment

Consumer complaints about credit decisions are a lagging indicator of bias — but they’re often the earliest external signal that something is wrong with model outputs.

Complaint KRIs require a connection between your consumer complaint management system and your model monitoring program. If complaints come in through customer service and never reach the team reviewing model outputs, the leading indicator disappears into a separate system. Someone needs to be responsible for routing fair lending complaint signals to model risk.

5. Validation Exception Aging

The last KRI category is about program health: whether known validation exceptions are being remediated on schedule, or whether open exceptions are aging past their committed remediation dates.

A model with open fair lending exceptions from the last validation cycle, with those exceptions aging past their remediation dates, is a program that doesn’t have the controls to match its documentation. That’s exactly what regulators — and state AGs operating under UDAP theories — are looking for.

Ownership and Escalation Architecture

AI bias KRIs span three functions, and that span is where they break down in practice.

Model risk / data science owns the technical metrics: approval rate gaps, override disparity, adverse action drift, validation exception tracking. They have access to the model outputs and can run the analysis.

Fair lending compliance owns the regulatory interpretation: determining whether an amber KRI triggers a fair lending review, whether a filing or disclosure obligation is implicated, and how findings connect to the institution’s CRA or fair lending risk assessment.

Legal owns the materiality threshold: when a KRI pattern is significant enough that it implicates legal risk, litigation exposure, or regulatory notification.

The failure mode is when these three functions see different data on different cadences and nobody has responsibility for producing an integrated view. Build an escalation protocol that specifies: when any bias KRI crosses amber, who is notified, in what timeframe, and who is responsible for the integrated assessment across technical and regulatory dimensions.

See AI and Fair Lending: UDAAP Risk in Algorithmic Decisioning for a foundational treatment of the regulatory theory, and AI Risk KRIs: Metrics for Model Drift, Bias, Hallucination, Complaints, and Human Overrides for how fair lending KRIs fit within a broader AI model monitoring framework.

So What Does This Mean for Your Program?

The CFPB’s Reg B rule change doesn’t reduce the monitoring obligation. It changes who’s watching and what legal theory they’re using. State AGs with UDAP authority, GSE counterparties with contractual audit rights, and private plaintiffs with Fair Housing Act claims are all still in the picture.

The Earnest Operations settlement — $2.5 million, sweeping model governance reforms, prohibited input variables, and ongoing monitoring requirements — was built on a UDAP claim, not an ECOA claim. The investigation didn’t start with a validated bias finding. It started with complaints and external scrutiny of the model’s inputs.

Continuous bias KRIs don’t eliminate fair lending risk. But they generate the documented monitoring record that shows an institution was watching, investigating amber signals, and acting on findings — rather than waiting for a complaint or an examiner to surface a problem the institution should have caught.

That distinction — documented continuous monitoring versus periodic validation only — is increasingly the line between an institution that can explain its AI model’s behavior and one that can’t.

For a statistical methodology on how to test models for disparate impact between formal validations, see Disparate Impact Testing Techniques: Statistical Methods Examiners Actually Accept.

If your team needs pre-built AI bias and fair lending KRIs with thresholds, data source mapping, owner fields, and escalation triggers — alongside 130+ other financial services KRIs across compliance, operational, and cyber risk — the KRI Library (132 Key Risk Indicators) is ready to deploy. Get the KRI Library →