Lending & credit collections AI

Upstart's machine-learning underwriting and pricing model, which uses education and other alternative data, ran for five years under a regulator's no-action letter with a reporting duty, and the regulator published the access results: 27% more applicants approved than a traditional model, at 16% lower average APRs, with near-prime applicants approved at roughly twice the rate. It is the lending family's only regulator-verified service term — and its most detailed public fair-lending record. Four monitorship reports found no close protected-class proxies, but identified approval disparities for Black applicants, flagged a likely-viable less-discriminatory alternative, and ended in a documented impasse over how hard the law requires an organization to search. Underwriting is fully automated, so every governable lever is upstream.

A bank's automated credit-decisioning for a widely used consumer card drew viral allegations of gender bias in credit-line assignment. A state regulator analyzed roughly 400,000 in-state applicants and found no unlawful discrimination on a prohibited basis — the model was cleared on the numbers. The same investigation documented failures of explanation, customer service, and perceived transparency: applicants could not learn why they received the terms they did, front-line staff could not explain the decisions, and the opacity destroyed consumer trust even though the underwriting was found lawful. The cleared-but-faulted case: a statistically clean model paired with a failed duty to explain, which regulators treat as a separate obligation a black box does not discharge by being accurate.

A state attorney general reached a $2.5 million settlement with the student-loan lender Earnest over its AI underwriting — the domain's cleanest failure-then-mandated-governance arc. The model used a cohort-default-rate feature (a school's aggregate default rate priced into an individual's terms) that disparately impacted Black and Hispanic applicants, and an immigration-status rule that automatically denied certain non-citizen applicants, while the organization ran no disparate-impact testing and gave inadequate adverse-action notices. The remedy did not fine-and-close: it mandated the missing program — model governance, disparate-impact testing, documentation, and reporting controls. The enforcement action wrote the governance the deployment had never built.

Kenya's M-Shwari — launched 2012 by the Commercial Bank of Africa (now NCBA) with Safaricom over the M-PESA rails — scores people with no credit file from six months of their phone company's records: a hidden score set before anyone asks to borrow, whose only published test at the margin found a first-loan default difference of 0.007 against a control mean of 0.066, and whose 120-day arrears pipeline writes durable entries into a register the whole market reads. It took three regulators three instruments — a listing floor with a mass delisting, a licensing regime with prior approval over pricing, and data-collection guidance — to put a governed surface under a market defaulting at roughly twice the formal rate and blacklisted at roughly four times it.

A federal consent order found that for seven years employees manually underwriting Citi Retail Services credit-card applications used a last name ending in -ian or -yan, weighted by an address in or around Glendale, California, to mark applicants as fraud risks — and that the bank took corrective action against employees who failed to apply it, that supervisors and trainers instructed staff to keep the basis out of writing and off recorded phone lines, and that the reasons entered into the legally compelled denial notices were pretextual. There is no model anywhere in this record. The discriminating artifact was an authored rule carried in training, supervision, and performance management, which is why none of the usual model-governance instruments had anything to bite on and why the practice was found not by any internal control but by a regulator running regressions across seven years of outcomes. Citi neither admitted nor denied the findings. The order installed a five-year monitoring, statistical-testing, and root-cause-reporting regime around exactly that gap; the same agency terminated it about twenty-three months in, waiving any alleged noncompliance.

A subprime vehicle lender's algorithm estimated, at origination, what share of everything owed it expected to collect — counting not only the scheduled payments but the auction proceeds after repossession, the post-default recoveries, the deficiency judgment, and the garnishment. Regulators alleged that on more than a third of loans nationwide that estimate fell below the amount financed, and that the number priced what the lender paid the dealership rather than what the borrower was charged. This is the atlas's case where the grievance is not that the model is wrong. There is no protected class, no false-positive rate, and no denied applicant: the Score decides no application and sets no interest rate, and the operator publishes quarterly how each year's loans are collecting against what it forecast for them. The dispute is over what the forecast was for, and over a borrower who was never shown it. Nothing here was ever adjudicated: the federal plaintiff was dropped on its own consented motion, the fully briefed motion to dismiss was terminated unruled, and the action was dismissed on a settlement in principle with no findings, no admissions, and no public terms.

A consumer cash-advance app advertises up to $500 in five minutes. A fully automated cash-flow engine the operator calls CashAI reads the member's linked checking account and returns an eligibility verdict and a dollar amount; a partner bank originates the advance as a discretionary overdraft. The United States alleges that in the first fourteen months after the ceiling was advertised, the maximum was offered to a new user 0.002 per cent of the time, that the most common offer was $25, that more than three-quarters of the time no advance was offered at all, and that a monthly subscription was charged whether or not any offer ever came. Dave and its chief executive deny those paragraphs in their entirety, and the court that denied dismissal in full recorded in the same order that the parties dispute how the government computed the figures at all. The governance interest is what the record does NOT contain: nothing anywhere in the pleadings, the briefs, the answer, or the 34-page order mentions an algorithm, a model, or underwriting. The engine is known only from the operator's own investor filings, where it is named, versioned, and described as retrained on an eleven-day cycle. A five-count federal case counts this system's outputs without ever asking how they are produced, and no regulator, court, or auditor has examined it.

Two federal consent orders, four years apart, found that an online lender's own loan-servicing and payment-processing software took money out of consumers' bank accounts without permission — and both orders name executing code as the cause. The 2019 order applied the statutory unfairness test to a software defect and weighed the injury against the cost of debugging software. The 2023 order found the first order violated, set out eleven separately-described defect classes with their date ranges, consumer counts, and remediation figures, and attributed them to a coding error in the internal systems, flaws in the system logic, code that failed to register a consumer's change, and an automatic payment generation system firing on payments already made. One relapse happened because a new lead-routing project launched in 2020 and, in the Bureau's words, no one at Enova had checked whether it would reintroduce the prohibited defect. Enova neither admitted nor denied the findings and calls the matters unintended computer and system errors. Neither order contains a requirement about code review, change control, regression testing, or payment-integrity monitoring. On 2 September 2025 the Bureau terminated the second order about five years early and expressly waived any alleged non-compliance.

For twenty-two days in spring 2022 a credit bureau's legacy scoring platform computed date-relative credit attributes against a frozen calendar and sold the results to lenders. There was no defect in any scoring model, no change to any consumer's credit report, and no automated decision by the bureau at all — which is exactly why this is the atlas's clean counterexample to model-centric governance. Because the report was never wrong there was nothing to dispute, and a dispute channel handling roughly 765,000 contacts a month had no purchase on it. Nobody told the people whose numbers were wrong. Correction ran between companies instead: reissued scores to lenders, and a mandatory resubmission requirement from the two mortgage enterprises that reached loans rather than people. Two regulators closed in January 2025 with instruments aimed entirely at the change-control pipeline, and neither imposed a duty to notify anyone.

This is the lending roster's automation-with-a-warranty case, and the one where the algorithm decides nothing about a person: it reaches into their checking account and moves their own money, under an express undertaking that it would never transfer more than they could afford and would pay the fee if it overdrew them. In August 2022 the Consumer Financial Protection Bureau entered a consent order finding that the company had known since inception that the algorithm could not deliver that promise, that autosaves routinely caused overdrafts, and that of nearly 70,000 members who asked for the promised reimbursement, over 7,200 were refused under quotas the company had written for itself — two per lifetime, nothing if you disconnected the account that had just cost you the fee. All three counts are deception counts. The order requires no change to the algorithm, imposes a 2,700,000-dollar penalty against a redress floor of 68,145 dollars, and the operator's compliance move was to replace the undertaking with a disclaimer. The deployment then grew.

In December 2023 a news organisation ran the public mortgage-disclosure data and reported that Navy Federal Credit Union, the largest credit union in the United States, had approved 77 per cent of white applicants and 48 per cent of Black applicants for 2022 conventional home purchase mortgages — the widest spread among the fifty biggest lenders — and that the gap survived holding more than a dozen variables constant. What followed is a governance loop that ran all the way to the end without answering the question that started it. Three parties examined the lending and each held a different slice of the data: journalists, working from a public file with the applicant credit score removed by rule; the credit union's own commissioned reviewer, a partner at the firm defending it in the resulting class action, who had the complete file and published a single sentence saying the gap falls below one per cent; and the regulator's economists, who had the complete file and the strongest model and published an industry average naming no institution. Congress wrote four times and can compel nothing. A court reopened discovery into the algorithm in February 2026 and the plaintiffs dismissed with prejudice six months later. No court and no regulator has ever found that this credit union discriminated. The gap is still in the 2025 filing.

Oportun Financial Corporation, a Treasury-certified community lender founded to give Latino borrowers with no credit history a first loan, filed more than 47,000 collection suits against borrowers who fell behind in nine Texas counties over four years — on a two-newsroom analysis of 1.45 million court records whose authors call the figure an undercount — and filed tens of thousands more in California, where it accounted for at least 15 per cent of all small-claims filings across one twelve-month window. This is the atlas's case where the governed thing sits DOWNSTREAM of the model. The scoring system is not accused of anything: there is no protected class, no denied applicant, and no adverse-action notice, and the pipeline that produced the volume is documented as a threshold on a delinquency counter and a staffed filing desk rather than as an algorithm choosing defendants. What the record shows is an inclusion premise expanding the approved population, a default-handling apparatus sized by that expansion, and no channel carrying what happened in court back to the model that approved the borrowers. It is also the domain's only case where the effective lever was measurement by somebody with no authority at all. There is no order, no penalty, and no finding: the federal investigation closed with enforcement staff declining to recommend an action, the bank charter application was withdrawn before any decision, and the mission certification was never revoked. What stopped the practice was a reporter running the same public court query the company could have run on itself at any time, and putting the answer to it. The company announced four days later, before either investigation published.

Santander Consumer USA's own models forecast, before the loan was written, that its weakest borrowers would fail at a high rate — and the forecast set the price rather than the answer. This is the atlas's case where the levers are documented and binding: when thirty-four attorneys general settled in May 2020 they did not ask for a better model. They froze the one it had, banded the entire remedy on that frozen score, added an affordability gate the model does not compute, ordered a second model built whose only job is to score confidence in the first one's inputs, took away the discretion to waive dealer documentation, and made every future default re-checked against the gate an automatic debt forgiveness and a request to delete the credit-bureau tradeline. Everything alleged about the operator's knowledge or intent is allegation entered by consent without proof, without adjudication, and without admission. The remedy is a court order and is live.

TransUnion sold an add-on that compared a consumer's first and last name against the U.S. Treasury's terrorist and narcotics sanctions list and nothing else — no date of birth, no middle initial, no Social Security number — then wrote a potential-match alert on the front page of the credit report and, from 2002, redacted it from the copy it sent the consumer. Across more than a decade the courts recorded thousands of false positives and not a single confirmed true match; in one seven-month window in 2011 the product labelled 8,185 people. In TransUnion LLC v. Ramirez the Supreme Court held that only the 1,853 whose reports a business happened to pull inside that window had suffered a concrete harm and could sue, and expressly took no position on whether the product was accurate or whether the statute had been violated as to the other 6,332. Two thousand people were eventually paid; when one of the excluded 6,332 refiled in a state court without a concreteness requirement, the claim was held time-barred.

In March 2022 a news analysis of federal mortgage-disclosure data reported that Wells Fargo had approved 47 per cent of Black homeowners' completed 2020 refinance applications against 72 per cent of white homeowners' — the largest racial gap among major lenders. Four years of litigation followed and ended without anyone deciding whether the underwriting stack had anything to do with it. Both sides' statisticians agreed a disparity exists in the counts and disagreed only about what caused it. The evidence that could have settled that question was split in two: the loan-level record published by rule leaves the applicant credit score out, by rule, so no public analysis can control for the variable the bank says explains the gap; and the 14,000-rule engine and two scorecards behind the decision reached a court file only under a protective order, in a proceeding that stopped at Rule 23 without reaching the merits. Class certification was denied for want of class-wide evidence of robust causality, with the court observing that 1,300-plus data attributes under 14,000 rules made commonality 'not at all obvious'. Seven of eight named plaintiffs settled confidentially and were dismissed with prejudice. No court and no regulator has ever found that this bank discriminated in refinance underwriting, and nothing in the public record changed about how the engine decides.