What a Fair Lending Exam Actually Asks For

A fair lending examination is more predictable than it feels, because the procedure examiners follow is published. The Interagency Fair Lending Examination Procedures set out how scope is decided, what documents get requested, how a focal point is chosen, how files are compared, and what an institution's explanation has to establish to resolve a finding. If you know that sequence, you can assemble most of what will be asked for before it is asked for.

This article walks the sequence in order. It is the counterpart to our guide to running a self-assessment, which covers testing yourself. This one covers what happens when someone else does the testing.

The document, and which agencies use it

The procedures were issued in August 2009 by the OCC, the FDIC, the Federal Reserve Board, the Office of Thrift Supervision and the NCUA. The OTS no longer exists, having been folded into other agencies under Dodd-Frank in 2011. The CFPB was not an original signatory because it did not exist in 2009, but it adopted the procedures, and its own ECOA examination procedures say so directly.

The structure is worth knowing, because examiners work through it in order and the appendices are where the operational detail sits:

• Introduction — the legal framework and the three theories of proof
• Part I, Examination Scope Guidelines — eight steps that narrow a whole institution down to a small number of things actually tested
• Part II, Compliance Management Review
• Part III, Examination Procedures — sections A through J, covering data verification, overt evidence, underwriting comparison, pricing, steering, commercial underwriting, redlining, marketing, credit scoring and disparate impact
• Part IV, Obtaining and Evaluating Responses — five steps, and the part most institutions are least prepared for
• Appendices I through VIII — including the compliance management checklist, the sample size tables, the guidance on identifying marginal transactions, potential scoping information, and self-tests

One practical caution on sourcing. The FFIEC has issued reissuance notices for these procedures since 2009, but ffiec.gov blocks automated retrieval, so the text quoted throughout this article is from the August 2009 version as published by the NCUA. If you are relying on specific language for a regulatory position rather than for preparation, confirm against the current version your own examining agency distributes.

What actually starts a fair lending exam

It is worth being careful here, because this question gets answered more confidently than the sources support. No published regulatory document sets out a formal trigger policy that sorts examinations into routine, referral-driven and complaint-driven categories. The interagency procedures begin from the assumption that an examination is already scheduled, and address only how to scope it once it is.

What is documented is the input to scoping. The CFPB's ECOA examination procedures describe scope being informed by preliminary data screens prepared centrally, by findings from prior examinations, and by consultation within the agency. Read alongside Part I of the interagency procedures, the picture is that selection and scoping are driven by a combination of statistical patterns in submitted data, examination history, and complaint records, rather than by any single triggering event.

For preparation purposes the distinction matters less than it seems. Whatever brings examiners in, the scoping process that follows is the same, and it runs on your own submitted data. Which means the most reliable way to anticipate an examination is to run the same screens on that data yourself.

The document request, item by item

There is no publicly published CFPB or FFIEC form titled a fair lending document request list. What exists is Part I, Step One of the interagency procedures, which directs examiners to develop an overview of the institution and lists what they should obtain to do it. That list is, in practice, the document request:

• Underwriting guidelines and lending policies, including any product-specific standards
• Credit scoring system documentation where scoring is used, covering how the model was developed and validated
• Pricing policies, including risk-based pricing models and rate sheets
• Compensation system descriptions, specifically whether compensation is tied to loan production or to loan pricing
• Loan application forms as actually used
• Loan registers, the HMDA LAR where applicable and equivalent registers for non-reportable products
• Records of policy exceptions and overrides
• Consumer complaints alleging discrimination
• Compliance program materials, training manuals and monitoring protocols
• Marketing materials and the criteria used for pre-screened solicitations

Two items on that list account for a disproportionate share of trouble. The first is exceptions and overrides, because many institutions grant them consistently in spirit while recording them inconsistently, and an exception log that cannot show the reason for each exception cannot support the explanation you will later need to give. The second is compensation, because it is the item institutions least expect to be examined for fair lending purposes, and because a compensation structure tied to pricing creates a steering incentive that the procedures specifically direct examiners to look for.

The most useful preparation question is not whether you can produce these documents. It is whether the policies match what the data shows you actually did. Examiners will have both.

How examiners choose the focal point

An examination does not test everything. Part I narrows the institution to a focal point, and the narrowing has three dimensions: which product, which decision within that product, and which prohibited basis.

Part I organizes the narrowing around risk factor lists, grouped by the kind of risk each one signals — overt indications, underwriting, pricing, steering, redlining and marketing. Reading those lists is the single highest-value hour available to anyone preparing for an examination, because they are the criteria being applied to you, written out.

The factors that tend to drive selection are the ones that combine volume with discretion. A product with meaningful application volume, a decision point where a human exercises judgment, and a demographic disparity visible in the raw data will attract attention ahead of a product that lacks any of the three. Discretion is the common thread: broad underwriting latitude, pricing discretion at the loan officer level, and frequent exceptions all raise the risk profile of an otherwise ordinary product.

Redlining scoping works differently, because it is geographic rather than applicant-level. It compares where an institution lends against the areas it could reasonably be expected to serve, and against what other lenders in the same market did. That comparison is available to you before it is run on you, using the same aggregate data, which is what peer benchmarking is for. An institution that knows its own market penetration relative to comparable lenders is not surprised by that part of an examination.

Comparative file review, and what makes a file survive it

Part III, section C sets out the underwriting comparison, and it is the most mechanical part of the examination. It runs roughly as follows.

Examiners draw two samples: denied applicants from the prohibited-basis group under review, and approved applicants from the control group. Sample sizes come from the tables in Appendix IV. They then discard most of both samples, keeping only the marginal transactions — and the reasoning is stated plainly in the procedures, which observe that discrimination is more likely to occur with respect to applicants who are not either clearly qualified or unqualified. A clearly unqualified denial tells you nothing. A clearly qualified approval tells you nothing. The judgment calls are where the information is.

The remaining applicants go onto an applicant profile spreadsheet. Denied applicants are ranked by how well qualified they were with respect to each stated denial reason, which produces a benchmark: the best-qualified applicant denied for that reason. Approved control-group applicants are then compared against that benchmark. An approved applicant who was no better qualified than the benchmark denial is an overlap, and every overlap becomes a question the institution has to answer.

What that means for file preparation is specific. A file survives comparative review when the reason recorded for the decision is the reason the decision was actually made, and when the file contains the evidence for it. Overlaps are not resolved by arguing that the decision was reasonable. They are resolved by showing the distinguishing factor, and a distinguishing factor that was not documented at the time is very hard to establish afterwards.

Three habits make files hold up. Record the actual controlling reason for a denial rather than the most convenient one from a dropdown. Where an exception was granted, record what justified it. Where compensating factors carried an approval, record them, because those approvals are exactly the ones that will be examined as potential overlaps against denials of similarly situated applicants.

The questions that follow a flagged disparity

Part IV governs what happens after something is flagged, and this is where examinations are actually won or lost. The standard the institution has to meet depends on which theory is in play, and the two are not the same test.

For disparate treatment, the question is whether the difference in treatment is fully explained by legitimate nondiscriminatory factors. The procedures are explicit that an explanation which is not credible does not discharge the burden. This is worth reading carefully: it is not enough to offer a permissible reason. The reason has to account for the difference, and it has to be believable given the file.

For disparate impact, the standard is higher and the language is stronger. A facially neutral policy that disproportionately burdens a protected class must be justified by business necessity, and the procedures state that the justification must be manifest and may not be hypothetical or speculative. Intent is not an element. And even a policy supported by a genuine business justification can still violate the law if an alternative policy would serve the same purpose with less discriminatory effect.

Regulation B states the same test in its commentary at 12 CFR Part 1002, Supplement I, comment 6(a)-2: a neutral practice violates ECOA unless it meets a legitimate business need that cannot reasonably be achieved by means that are less disparate in their impact. Part IV of the interagency procedures asks examiners to identify legitimate nondiscriminatory explanations or, for disparate impact, a compelling business justification, and to conclude that a violation exists where neither is established.

The practical implication is that "we have always done it this way" is not a business justification, and neither is a rationale constructed after the disparity surfaced. If a policy produces a disparate outcome, the defensible position is to have already asked whether a less disparate alternative would achieve the same objective, and to have a record of that analysis. That is a self-assessment activity, not an examination activity.

What to have ready before the request arrives

Everything above points at the same conclusion: the examination tests your data and your documentation against each other, and both are fixed by the time anyone arrives. The preparation that helps is preparation done on the ordinary cycle.

• Reconcile policy against practice. Run your own data against your own written guidelines and find the places they diverge. Divergence is not necessarily a violation, but unexplained divergence is the raw material of a finding.
• Keep an exception log that carries reasons. Counts alone cannot support an explanation. Distribute the log across demographic groups and look at it before someone else does.
• Know your own marginal transactions. The applicants near your approval boundary are the population that will be examined. You can identify them yourself with the criteria in Appendix V.
• Run the regression before the examination does. If a disparity survives controls for legitimate credit factors, you want to know it early enough to investigate it as a business question rather than answer it as an examination question. This is what regression analysis is for, and what makes a disparity explainable to an examiner.
• Benchmark your geography. Compare your lending patterns against the market using the same aggregate data available to examiners.
• Document your monitoring. A fair lending compliance program that produces a written record on a schedule demonstrates the management control Part II reviews, and it gives you dated evidence of what you knew and when.

None of this makes an examination pleasant. It does change what the examination is about. An institution that has run the same tests, on the same data, using the same methodology, arrives with answers to the questions Part IV asks rather than assembling them under a deadline. The work is identical either way. The only variable is whether it happens on your schedule.

The statistical methods described here are the ones Comply Fair Lending runs, and they are the methods we have applied to lending data for 39 years. Schedule a demonstration to see the analysis on your own portfolio.