Eight stages, and a legal obligation that attaches to the last one. Trace the decision end to end and it becomes clear why explainability is an architecture problem, not a model problem.
The reason codes required at stage eight must relate to and accurately describe the factors actually considered at stages four to six. That is a lineage requirement, not a modelling one.
Most descriptions of automated underwriting stop at the model. That is the least interesting part. The model produces a number, and a number is not a decision. What turns it into a decision, and what makes that decision defensible, is the seven stages around it and the record they leave behind.
Stage one: intake
Channel capture, identity fields, consent, product and amount. This stage matters legally for one reason: the clock. Under Regulation B, notice of adverse action is due within thirty days after receipt of a completed application. It is not thirty days from first contact, and incomplete applications are separately provided for. Systems that timestamp first touch rather than completion are measuring the wrong event.
Stage two: identity and fraud
Document verification, sanctions and politically exposed person screening, address and date-of-birth matching, beneficial ownership for entity applicants, and on the fraud side device fingerprinting, geolocation consistency, application velocity and session behaviour. Synthetic identity detection sits here and works differently from the rest, looking for the absence of a coherent history rather than the presence of an adverse one.
One legal note that is easy to miss: the EU AI Act's high-risk classification for creditworthiness carries an express exception for AI systems used for the purpose of detecting financial fraud. The fraud models and the credit models in the same institution therefore sit in different compliance positions.
Stage three: data acquisition
Bureau file, tradelines, delinquencies, public records, score and inquiries. Open banking transaction data for income verification and affordability. Alternative data including rental, utility, telco and payroll records. Where data comes from a source other than the applicant or the lender's own files, Fair Credit Reporting Act duties attach alongside the equal credit opportunity ones, and the two regimes have different notice mechanics.
On open banking scale, the most useful independent series is Open Banking Limited's UK data, which reported 15.16 million users in July 2025, described as nearly one in three UK adults, growing 34 per cent year on year. Two cautions travel with that figure. OBL's own footnote states the reporting represents user connections with reporting brands rather than individual users. And OBL does not break adoption out by lending or affordability assessment, so any figure you see for open banking use specifically in underwriting is almost certainly a vendor estimate.
Stage four: feature generation
Debt-to-income, disposable income after committed spend, income stability and volatility, utilisation trend, arrears recency and severity, and from transaction data things like rolling income medians, essential against discretionary spend, and days in negative balance.
This is the stage that determines whether the last stage is possible. A versioned feature store with point-in-time correctness and lineage back to the source field is the compliance artefact, because the reasons given for a decline must relate to and accurately describe the factors actually considered or scored. You cannot describe a factor you cannot trace.
Stage five: scoring
In practice not one model but several scored in parallel: probability of default and loss, affordability, and fraud, combined by policy rather than by arithmetic. Model families run from scorecards and regularised regression through gradient-boosted trees to learned representations of transaction sequences.
Reason-code generation is a deliverable of this stage and should be validated as one. Producing a ranked list of reasons is easy. Producing a ranked list that is accurate about what the model actually did is the hard part, and the Prudential Regulation Authority's model risk roundtable in late 2025 made the point sharply: attribution techniques such as SHAP, LIME and partial dependence plots are likely to mislead regarding the importance of different features where features are correlated. In credit data, features are correlated.
Stage six: policy rules and the decision engine
Hard knockouts for capacity, jurisdiction, sanctions and eligibility. Regulatory caps. Fraud-hold routing. Then score-band cutoffs, affordability floors, referral queues and overrides under dual control, with champion and challenger routing where the lender is testing. Every decision should persist its inputs, the model version, the policy version, the outcome and the reason codes, because a supervisor's question is always reconstructive: why did this application, on this date, receive this answer.
Stage seven: price and limit
Expected loss plus funding, capital and operating cost, mapped to a rate and fee grid, with limits derived from affordability capacity and exposure appetite. A counteroffer is not a lesser decline, it is a distinct regulated outcome with its own timing rule: ninety days where the applicant does not expressly accept or use it. Risk-based pricing triggers a separate notice regime again.
Stage eight: adverse action, where the architecture is tested
Regulation B, at 12 CFR 1002.9(b)(2), is unusually blunt. The statement of reasons must be specific and indicate the principal reasons for the adverse action, and statements that the action was based on the creditor's internal standards or policies, or that the applicant failed to achieve a qualifying score on the creditor's credit scoring system, are insufficient.
The official interpretation closes the other obvious escape route: disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons.
The circulars were withdrawn. The obligation was not.
Two Consumer Financial Protection Bureau circulars addressed this directly. Circular 2022-03, on adverse action notification in connection with credit decisions based on complex algorithms, and Circular 2023-03, on adverse action notification requirements and the proper use of the Bureau's sample forms. Circular 2022-03 stated that ECOA and Regulation B do not permit creditors to use complex algorithms when doing so means they cannot provide specific and accurate reasons, and that a creditor's lack of understanding of its own methods is not a cognisable defence.
Both were withdrawn. A Bureau rule published on 12 May 2025 withdrew all seventeen circulars then in existence, along with a large volume of other guidance, stating that the withdrawn material should not be enforced or otherwise relied upon while the review is ongoing.
Withdrawing a circular removes a non-binding statement of enforcement approach. It does not amend 15 U.S.C. 1691(d) or 12 CFR 1002.9. The duty to give specific, accurate principal reasons is black-letter regulation, enforceable by the agencies, by state attorneys general and by private plaintiffs.
There is a trap here for anyone checking. Both circular pages remain live on the Bureau's website with no withdrawal banner. The website is not the authority. The Federal Register notice is. And the case law the circulars rested on is untouched by their withdrawal.
The EU date moved, and it moved in your favour
Annex III point 5(b) of the AI Act classifies as high-risk AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with the fraud-detection exception noted above. Those obligations were originally to apply from 2 August 2026.
They now apply from 2 December 2027. Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the Annex III high-risk obligations, with Annex I product-embedded systems moving to 2 August 2028. This is enacted law, not a proposal, though anyone relying on it should confirm the new dates against the operative article of the amending regulation rather than a summary page, and check whether Annex III has been renumbered.
One provision is worth knowing for anyone already inside a prudential regime. Article 17(4) treats the quality management system obligation as satisfied by compliance with internal governance rules under Union financial services law, with three exceptions that are not substitutable: the Article 9 risk management system, Article 72 post-market monitoring and Article 73 serious incident reporting. Those three you build regardless.
The design consequence
Read end to end, the pattern is that the legal obligation attaches at stage eight and can only be met by decisions taken at stages four to six. You cannot bolt explainability onto the end of a stack that did not preserve lineage, and post-hoc attribution over correlated features is not a substitute for knowing what the model used. The teams that find this easy built the record first and chose the model second.
This is reporting on regulation as it stood at the date of publication. It is not legal or compliance advice, and obligations differ by jurisdiction and change. Take qualified advice on your own circumstances.
References
Every figure and legal citation in this article is drawn from the sources below. Where an instrument is proposed rather than in force we say so in the text.
US Code of Federal Regulations, 12 CFR 1002.9, Regulation B, notifications. https://www.ecfr.gov/current/title-12/chapter-X/part-1002/section-1002.9
Consumer Financial Protection Bureau, Circular 2022-03, adverse action notification requirements in connection with credit decisions based on complex algorithms, 87 FR 35864, 26 May 2022, since withdrawn. https://www.federalregister.gov/documents/2022/06/14/2022-12730/consumer-financial-protection-circular-2022-03-adverse-action-notification-requirements-in-connection
Consumer Financial Protection Bureau, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084, published 12 May 2025. https://www.federalregister.gov/documents/2025/05/12/2025-08286/interpretive-rules-policy-statements-and-advisory-opinions-withdrawal
European Union, Regulation (EU) 2026/1744, the Digital Omnibus on AI, 8 July 2026, in force 27 July 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
European Commission, AI Act policy page, application dates, updated 27 July 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
European Union, Regulation (EU) 2024/1689, the AI Act, Annex III point 5(b). https://artificialintelligenceact.eu/annex/3/
Prudential Regulation Authority, PRA holds model risk management roundtable on AI and machine learning, published 24 November 2025. https://www.bankofengland.co.uk/prudential-regulation/publication/2025/november/pra-holds-model-risk-management-roundtable-on-ai
Open Banking Limited, Open banking user numbers, July 2025 data, press release, see news and insights index, 1 September 2025. https://www.openbanking.org.uk/news-and-insights/
How we work. This article was researched and written by the Financy editorial team. We do not republish press releases. Every number and legal citation is checked against a primary source, which is named and linked above. Where an instrument is proposed rather than in force, we say so. Corrections are made openly on the article itself, never by silent edit. If you believe something here is wrong, write to info@financyhub.com and tell us what and why.
Filed under Lending & Credit · Get The Weekly Brief