Artificial intelligence is giving credit card issuers new ways to improve underwriting, detect fraud, and assess risk. But the technology’s ability to process enormous amounts of consumer data is also colliding with one of the industry’s oldest challenges: complying with lending laws that strictly limit what information can be used to make credit decisions.
Brian Riley, Director of Credit at Javelin Strategy & Research, examined the challenges at the intersection of AI and regulatory compliance in a new report, Regulatory Issues in Credit Cards: Preparing for the World of AI. As the industry waits forkey questions about AI to be answered, it’s important to understand the current regulatory landscape.
What Isn’t Allowed
Credit cards operate under two broad categories of regulation: consumer protection and prudential controls. Consumer protection rules address issues such as fair lending, while prudential controls focus on matters like capital and liquidity.
The emergence of AI has introduced new challenges that issuers need to consider proactively. Regulations often lag behind developments in the payments industry. The consequences have become apparent in cases such as the recent lawsuits alleging that Zelle was lax in its fraud protections. Because existing regulations didn’t fully address these services, banks ultimately had to spend heavily to retrofit their systems and controls.
Everyone understands that AI models can hallucinate, making them less than fully reliable. But for card issuers, that isn’t the main concern. Credit underwriting is largely an empirical process built around data such as FICO scores and credit history. AI is well suited to these tasks, collecting and analyzing huge swaths of consumer data. The challenge is that it may also collect or rely on information that regulations prohibit lenders from considering.
The Fair Lending Act prohibits lenders from considering factors such as race, sex and national origin when making credit decisions. It also prohibits the use of proxies for those protected characteristics. ZIP codes, for example, may seem like a routine piece of consumer information, but they can create fair lending concerns because of their correlation with protected classes.
These standards have helped make the lending process fairer. It wasn’t all that long ago that the credit card industry openly engaged in discriminatory lending practices.
“The CARD Act was a pivotal piece that brought things up to speed,” said Riley. “The regulations that were put into play were really smart. It is true that if you were a woman, at one point you could not get a credit card on your own without your husband’s signature.”
“But you don’t want to wait for the world to change,” he said. “You don’t want to be in this gray area because you’re overthinking things that can’t be processed. You really need to be in front of them rather than being reactive to it.”
Unharnessed Data
The biggest risk for lenders incorporating AI into their underwriting is uncontrolled data. Lenders know they can’t directly ask for certain protected information on a credit card application, but it can be hard to determine exactly what data an AI model is collecting and weighing—particularly when the issuer relies on a third-party vendor. Using uncontrolled or impermissible data can create problems not only during collections but at the underwriting stage as well.
“My sister ran a credit card program for students at Citi in the mid-80s and she put in a logic that said, I’m going to give an engineering student more credit than I am going to give a philosophy major,” said Riley. “That made the front page of the New York Times, but it’s something you can’t do, and it had all kinds of press problems that had to be worked through.”
“And the same thing goes here,” he said. “It’s not just ZIP code information. Say I’m going into college background—was he a dropout or did he go to Yale? Those are two different things. You can’t really consider that.”
Another concern is how issuers manage their relationships with vendors. An issuer can’t violate fair lending laws and then shift the blame to a vendor that supplied the information. Vendors may play a role in the underwriting process, but regulators will ultimately hold the issuer accountable. If something goes wrong, it won’t be the vender facing the lawsuit—it will be the trillion-dollar bank.
Skirting the Regulations
Another issue complicating the landscape is the rise of alternative credit scoring. Some companies are evaluating applicants using thousands of attributes rather than relying primarily on traditional FICO-based models. AI can identify patterns and correlations that are not explicitly prohibited under the Equal Credit Opportunity Act but were never intended to factor into lending decisions.
“You start looking at things like what time are they accessing the internet?” said Riley. “Were they doing it on the phone? And then you get into things looking at SKU level data in stores. We see a transaction from Walgreens, but was it on the liquor store side of Walgreens or not? Insurance companies have played with that, and you just can’t do that.”
The boundaries have yet to be clearly defined, and they may never satisfy everyone. Should lenders or their vendors be allowed to consider whether an applicant regularly buys cigarettes or gambles? Those are the kinds of questions regulators and the industry are still trying to answer.
“This is uncharted territory,” Riley said. “And in the regulatory scrutiny and the compliance areas, you really have to think of how it’s going to affect the process from stem to stern.”
