Regulation — banking-specific
FCRA (15 USC 1681) — adverse-action notice + 25-month record retention
The Fair Credit Reporting Act is where an AI credit-underwriting decline turns from "credit decision" into a bundle of statutory duties: notify the applicant, disclose the reasons, and keep the underlying decision record for at least 25 months. When the AI cannot explain why, the FCRA notice cannot be defensibly written.
What the statute actually says
"If any person takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the person shall — (A) provide oral, written, or electronic notice of the adverse action to the consumer; (B) provide to the consumer written or electronic disclosure … of the numerical credit score used by such person in taking the adverse action … and (C) provide to the consumer an oral, written, or electronic notice of the consumer's right to obtain a free copy of a consumer report …"
15 USC §1681m(a) — adverse-action notice duty
"A creditor shall retain in original form or a copy thereof … the written or recorded information used in evaluating an application … for 25 months after the date on which the creditor notifies the applicant of the action taken on the application."
12 CFR 1002.12(b) — Regulation B 25-month retention (paired with FCRA)
What this means in plain English
For every AI-driven decline / higher-priced offer, the bank has three tightly-linked duties:
- Notice. Tell the applicant, in writing or electronically, that adverse action was taken.
- Reason. Disclose the specific reasons + the credit score used. A blackbox AI output does not satisfy "specific reasons."
- Retain. Keep the underlying decision record — application data, credit-bureau snapshot at decision-time, model version, score, lane routed — for at least 25 months. When retention rotates with the model, the record is gone before the retention window closes.
What triggers the exposure in the sample
~810 potentially-misrouted B3 applications during the 45-day drift window. Every one of those — if declined or price-upped based on the AI score — needed an FCRA-compliant adverse-action notice at the time, and needs a defensible decision record retained for 25 months from that date. When the drift itself was silent, the specificity of the "specific reasons" disclosure is the load-bearing legal question.
What the $499 Snapshot shows against this rule
- Retained decision record for every audit-period application — the 25-month retention pipeline demonstrated
- Model-version pin + decision hash per application — the "which version made the call" record
- 5-decision counterparty-question rehearsal — proof the retention pipeline can reproduce on request
- Independent-verifier declaration — the retention discipline attested externally, not by the vendor
See the 5-decision reproducibility drill →
$499 Snapshot. 3 business days.
Retention discipline proved on your bank's actual AI credit-underwriting surface — before an FCRA class notice lands.
Buy $499
Snapshot credit applies to Baseline ($2,500) or Enterprise Attestation ($35-55K) upgrade within 30 days.