I spent part of this week trying to cite a rule that does not exist.
It had all the furniture of a real one: a circular number, a date in May, a summary so precisely on point that I read it twice and started writing the paragraph it would anchor. Then I went looking for the document. The Federal Register's full-text search returns nothing, and the Bureau's own running list of circulars ends at Circular 2024-07, dated December 30, 2024. There is no such circular. A search summarizer had produced a fluent, confident answer out of nothing.
I am not telling you this because machines make things up; you knew that. I am telling you because for twenty minutes I could not tell an answer from the appearance of one, and what settled it was a document I could go and read. Hold onto that feeling — it is the subject of this article.
Years ago, in another country, I was turned down for a credit product I had assumed was a formality. The letter came a week later, explaining that the decision reflected the lender's scoring model and internal criteria. I read it once, felt the embarrassment of being sorted by something that has never met me, and filed it in a drawer. In the United States, that letter would have owed me a great deal more. It still does — and that is what vanished underneath fifteen months of headlines.
First, what actually got withdrawn
On May 12, 2025, the Consumer Financial Protection Bureau withdrew dozens of its own guidance documents in a single notice. Two of them are why this article exists: Circular 2022-03, on adverse action notices for credit decisions based on complex algorithms, and Circular 2023-03, on those notices and the Bureau's sample forms.
Read the notice itself, though, and the verbs are narrower than the coverage was. Those documents "should not be enforced or otherwise relied upon by the Bureau while this review is ongoing," it says, and the action "is not necessarily final." The operative words are by the Bureau. Nothing was repealed. An agency took its own interpretive documents off its own enforcement table.
What did the first one say? A creditor, it held, cannot excuse noncompliance on the ground that the technology it uses to evaluate applications is too complicated or opaque to understand — then it shut the escape hatch: "A creditor's lack of understanding of its own methods is therefore not a cognizable defense against liability." That circular still sits on the CFPB's website today, and the page carries no banner saying it was withdrawn.
The Bureau's September 2023 announcement now sits behind an "Archived content" notice, which is where you find the line I would put on a poster. Then-director Rohit Chopra: "Creditors must be able to specifically explain their reasons for denial. There is no special exemption for artificial intelligence."
The part that was never the Bureau's to withdraw
Guidance is an agency explaining what it thinks the law requires. It is not the law. The law is the Equal Credit Opportunity Act, and it is blunt. Section 1691(d)(2): "Each applicant against whom adverse action is taken shall be entitled to a statement of reasons for such action from the creditor." Then 1691(d)(3), which does the work: "A statement of reasons meets the requirements of this section only if it contains the specific reasons for the adverse action taken."
Underneath it sits Regulation B, and section 1002.9 — in force this morning, unamended — anticipated the black-box defense decades before anyone could build a black box:
"The statement of reasons for adverse action ... must be specific and indicate the principal reason(s) for the adverse action. Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant ... failed to achieve a qualifying score on the creditor's credit scoring system are insufficient."
Read that twice. Failed to achieve a qualifying score — insufficient, by the regulation's own words. The answer a modern underwriting model most naturally produces is the one the rule names in advance as not good enough.
The mechanics are friendlier than people realize, too. A denial notice must be in writing and must give you either the specific reasons or a disclosure of your right to request them: you have 60 days from the notification to ask, and the creditor then has 30 days to answer.
Then the Bureau did something real — and stopped one section short
On April 22, 2026, the CFPB published a final rule that took effect on July 21, amending Regulation B on disparate impact, discouragement of applicants and special purpose credit programs, signed by Acting Director Russell Vought. This one is not guidance: it went through notice and comment, and it did real damage.
It strikes the effects test out of the regulation's own text. Revised § 1002.6(a) now reads, in part: "The Act does not provide that the 'effects test' applies for determining whether there is discrimination in violation of the Act." One carve-out survives in the new commentary — criteria that "function as proxies for protected characteristics designed or applied with the intention of advantaging or disadvantaging individuals" are still prohibited — so deliberate proxying remains actionable. But the outcome-based theory is out of Regulation B, over the objection of Senate Democrats who urged the Bureau to rescind the proposal in February.
Now the fact this whole article rests on. Every final rule ends with amendatory instructions — the numbered list telling the Code of Federal Regulations which paragraphs to change. This one revises § 1002.4(b), § 1002.6(a), § 1002.8, § 1002.15 and Supplement I. Section 1002.9 is not on the list. The adverse-action-notice section is untouched: not narrowed, not qualified, not mentioned. The rule's own commentary still treats it as live, instructing a creditor in one scenario to "nevertheless notify the applicant of action taken as required by § 1002.9."
The National Consumer Law Center is no friend of this rule, and the day before it took effect Jeremiah Battle, Jr. and Odette Williamson published a list of what remains untouched: adverse action notices, the protected classes, record retention, appraisals. The same organization made the structural point about the 2025 withdrawal: those were sub-regulatory documents, so "there is no change to the underlying statutes, regulations, or even official interpretations of regulations."
So, the honest summary of fifteen months: the Bureau narrowed who can sue over unequal outcomes, and left alone your right to be told, specifically, why you were refused.
The enforcement did not vanish. It moved.
On the day the federal rule published, New York's financial regulator sent its lenders a letter that reads like a raised eyebrow. Under state law, the Department of Financial Services reminded them, credit decisions that result in a disparate impact "may constitute" an unlawful discriminatory practice. Note the care there — may constitute — and the Department's own line that the letter "does not impose any new requirements." Nothing new was created; nothing was subtracted either.
The states are not only writing letters. In 2025 the Massachusetts attorney general, Andrea Joy Campbell, announced a $2.5 million settlement with a student-loan refinancer over its AI underwriting. The claims were resolved by agreement and never adjudicated: the attorney general alleged that Earnest Operations used models that disproportionately harmed Black and Hispanic applicants, and alleged the company "issued inaccurate adverse-action notices that failed to provide specific reasons for credit denials." The denial letter was not a footnote in that case. It was one of the claims.
One correction to my own assumptions. Fair Housing Act claims are the standard fallback for anything home-related — but HUD has proposed to remove its discriminatory effects regulations and leave those questions to the courts. Proposed, not done: there is no final rule, and on August 10 the department reopened the comment period through October 9, 2026. That door is still open.
The strongest case against everything I have just written
When the AI circular landed, Eric Mogilnicki and David Stein of Covington & Burling wrote in Law360 that it took a position at odds with existing law. Their sharpest point is fair: the Bureau's own official interpretation says a creditor "need not describe how or why a factor adversely affected an applicant," and may write "length of residence" rather than "too short a period of residence." A lawful notice is thinner than a consumer advocate would like.
But look at what the argument concedes on its way past. This is "neither surprising nor illuminating," they write, "since Appendix C to Regulation B has stated for decades" that if the listed reasons "are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed."
For decades. That is industry counsel telling you the circular added nothing new — which is precisely why withdrawing it subtracts nothing. Either it invented a duty or it restated an old one, and the critics picked the second answer in 2023, in writing.
The harder complication is technical rather than legal: can a lender produce a true reason from a modern model? Talia Gillis of Columbia Law School gave the problem its best name. In The Input Fallacy, she argues that fair lending law has traditionally policed discrimination by scrutinizing inputs, and that "when it is no longer possible to scrutinize inputs, outcome analysis provides the only way to evaluate whether a pricing method leads to impermissible disparities." Sit with that timing: the most careful academic account says outcomes are the only workable test once the machine gets complicated enough, and the outcome test is what came out of Regulation B in July. The empirical picture is unsettled, too — FinRegLab, with Stanford's Laura Blattner and Jann Spiess, tested the tools lenders run on these models and reported their capabilities and limitations for adverse action purposes. Not solved, not impossible.
Germany spent the same three years walking the other way
The most instructive contrast is not a legislature. It is a courtroom, and a German credit bureau.
SCHUFA is a private company supplying credit information to clients including banks. In December 2023, on a reference from the Administrative Court of Wiesbaden, the Court of Justice of the European Union held that its score must be regarded as an automated individual decision prohibited in principle by the GDPR. Every hedge matters: in principle, and only "in so far as SCHUFA's clients, such as banks, attribute to it a determining role in the granting of credit." The Court sent the case back to Wiesbaden to decide whether German law contains an exception. Nobody banned credit scoring in Germany.
But the shape of that holding is the mirror image of the American excuse. Here, a lender says: the model decided, so don't ask me. There, the Court said: if you give the score a determining role, the score is the decision — and the law follows it to whoever leans on it.
Fourteen months later the Court answered the follow-up: what must an explanation contain? That case came from Austria, and the facts are comically small — a mobile operator refused a customer a contract worth €10 a month because her credit standing was insufficient. Out of it came an EU-wide holding that she was entitled to an explanation of how the decision was taken: the controller must describe the procedure and principles actually applied, so that she can understand which of her data were used and how. And the line American compliance teams should read twice: "the mere communication of an algorithm does not constitute a sufficiently concise and intelligible explanation."
Europe then wrote the instinct into statute — and flinched. The AI Act treats systems evaluating creditworthiness as high risk and gives an affected person a right to "[c]lear and meaningful explanations of the role of the AI system in the decision-making procedure." But in July 2026 the EU delayed its own high-risk deadline, pushing those obligations to December 2, 2027. The machinery is late everywhere; the case law is not. Those two judgments bind today, and needed no AI Act to do it.
The market moved before the deadline did. On March 17, 2026, SCHUFA reformed its methodology, cutting the criteria behind a consumer score from roughly 250 data attributes to 12 clearly defined factors, published rather than proprietary. Note the limit: the criteria are public, the weighting formula is not. And note how it happened, in PwC Legal's phrasing: "While SCHUFA has characterised its transparency reforms as voluntary, commentators have noted that the CJEU's jurisprudence made greater transparency effectively unavoidable."
Nobody ordered a German company to open its criteria. Three years of litigation risk did — which is the pressure a withdrawn circular releases.
Now run it forward
Underwriting is moving from a model that scores you once toward systems that price you continuously — a limit that drifts with your deposits, a rate that reprices when your sector wobbles. The question is what happens to the letter. A lender running a model nobody in the building can fully account for still owes you a statement of specific reasons within 30 days of your asking. The cheapest way to satisfy that in 2031 is not to make the underwriting model interpretable. It is to buy a second model whose only job is to write the notice — fluent, four reason codes, correctly formatted, plausible, in your inbox before you finish the request form.
You will not be able to tell that letter from a true one. It will have all the furniture: a number, a date, a specific-sounding reason. I read a document like that this week. It took two primary sources to disprove, and it was only about banking law — now imagine it is about your mortgage.
That is why the survival of § 1002.9 matters more than it sounds. The statute does not ask for a plausible reason. It says a statement complies "only if it contains the specific reasons for the adverse action taken" — the actual ones, not a well-formed guess at what the model was doing. And the only method anyone has proposed for testing that at scale is comparing outcomes across many applicants: the tool that just came out of Regulation B.
What the people who study this actually say
The useful thing about this fight is that both ends of the spectrum agree on the narrow point while disagreeing about nearly everything else. The argument that ECOA never contained disparate impact was not invented for this rule. Daniel Press of the Competitive Enterprise Institute made it in a 2018 study — eight years before the Bureau adopted essentially the same reading — arguing that the statute's "language only includes the prohibition of discriminatory treatment, not the discriminatory effect of a certain policy." That study is about the effects test; it does not argue that lenders may skip the reasons, because nobody argues that. The National Consumer Law Center lands in the same spot from the opposite pole: the effects test is gone from Regulation B, and the notices are not.
Where both poles may be too optimistic is the assumption that states will absorb the difference. They are trying. American Banker's Kate Berry reported in January that state attorneys general and banking agencies are stepping into the void left by the CFPB, hiring former Bureau officials — New York recruited a former deputy enforcement director as its top financial cop. But her story carries the sentence I keep returning to, from Joe Sanders, himself a former CFPB senior litigation counsel: "States are absolutely stepping up, but I don't think they can fully fill a breach left by the CFPB without a lot more funding now."
So what does this mean for you?
None of this is legal advice, and I am not your lawyer. It is a checklist, and it takes an afternoon.
Read the letter for a reason, not a tone. If it says you failed to reach a qualifying score, or that the decision reflects internal standards or policies, the regulation calls that insufficient — the text of § 1002.9(b)(2).
If there is no reason at all, start the clock. You have 60 days from the notification to request a statement of specific reasons, and the creditor then has 30 days to provide it. Ask in writing, keep a copy, note the date — then check the reasons you get back. One that is factually wrong about you is a dispute you can win; one that explains nothing is a compliance problem, and it belongs on the record.
Escalate locally, not only to Washington. Your state financial regulator and attorney general have their own authority and are using it — New York has told its lenders state law is unchanged, and Massachusetts settled a case whose allegations included defective denial notices.
If it is home-related, comment while you still can. Fair Housing Act disparate-impact claims remain available in real-estate-related matters, HUD's proposal is not final, and its comment period runs through October 9, 2026. A comment from someone who has received one of these letters is worth more than a law firm's.
Keep the paper. The envelope, the date, the copy of your request. If a system nobody can fully explain made the decision, your record is the only part of it you control.
The lesson, as I see it
A withdrawn circular changes who is watching. It does not change what is required. The whole distance between accepting a denial and contesting one lives in the gap between those sentences.
In February, Connecticut's attorney general published a memorandum on the statutes his office can already use against AI, and put credit on one list with "tenant screenings for rentals, employment decisions, credit risk and loan decisions, insurance claims, and targeted consumer ads." That is the right frame. Credit is not special because lenders are worse than landlords or employers. It is special because the argument has already been had there — where a statute written before anyone had to explain a neural network says that being sorted by a machine does not cost you the right to be told why, and that the machine's opacity is the lender's problem, not yours.
Germany reached a similar place by a harder road. We already had ours, in a section of the Code of Federal Regulations that just survived two rounds of demolition next door.
The only thing that was ever withdrawn was the reminder. So read the letter. If it does not say why, write back inside 60 days and make them say it. The worst outcome is that you get a real answer.
Forward this to whoever in your life got the letter, shrugged and filed it in a drawer — that is the whole ask this week. The HAIA Foundation goes looking for the duty that outlived the guidance, and publishes what it finds over here.