The federal rule changed. Your fair lending program shouldn’t.

On April 22, 2026, the CFPB published its final amendments to Regulation B (Federal Register Docket 2026-07804), effective July 21, 2026. The headline writes itself: ECOA is now a disparate-treatment-only statute at the federal level. The effects test is gone. BISG regressions are no longer a federal examination priority.

What the headline misses: the practical compliance burden for most lenders — especially those operating in New Jersey, Massachusetts, California, New York, or Illinois — has shifted more than it has shrunk. State enforcement is accelerating. The AI/ML documentation requirements have gotten harder, not easier. And if you’re a mortgage lender, you’re operating in genuine legal uncertainty until HUD finalizes its own rulemaking.

Here is what the rule actually changed, what didn’t move, and where you should be spending your compliance budget.

What the Rule Actually Changed

The final rule makes three substantive amendments to Reg B.

§ 1002.6(a) — The effects test is deleted. All “effects test” language has been removed from the regulation text and from Supplement I commentary. ECOA now prohibits intentional discrimination only. The CFPB’s position is that the statute never required effects testing — a view contested for decades and likely to be challenged in litigation — but as of July 21, it is the operative federal standard.

§ 1002.4(b) — The discouragement prohibition is narrowed. The prior rule prohibited any act or practice that discouraged applicants on a prohibited basis. The amended rule limits coverage to oral statements, written text, or visual images. What falls out of coverage: branch siting decisions, marketing footprint, geographic absence from communities of color. The rule also adds an intent standard: the statement must cause a reasonable person to believe the creditor would deny an application based on a prohibited characteristic.

§ 1002.8(b) — Special Purpose Credit Programs restructured. For-profit creditors may no longer use race, color, national origin, or sex as eligibility criteria in SPCPs. The CFPB draws on Students for Fair Admissions (2023) as support — though applying that higher-education ruling to ECOA credit programs is a contested regulatory interpretation that will almost certainly be litigated. Individual-level evidence is now required to establish that each program participant wouldn’t otherwise qualify. There is no grandfathering. Programs must be restructured or wound down by July 21.

That last point is operationally brutal for CDFIs, credit unions, and mission-driven lenders that built SPCPs around demographic eligibility criteria in explicit reliance on prior guidance. Programs that took years to develop — some with hundreds of active participants — have roughly 90 days to restructure or close. The rule is silent on what happens to currently enrolled participants. If you run one of these programs, that question needs an answer from counsel now.

There is also no transition period for disparate impact testing programs already in the examination pipeline. If you are currently in an exam cycle with an open fair lending matter involving statistical disparity analysis, that exam continues under the old framework until it closes.

Disparate Treatment, FHA, and HMDA: All Still Live

The rule eliminated federal disparate impact liability. It did not eliminate fair lending risk.

Disparate treatment remains fully intact. The CFPB, OCC, FDIC, and DOJ all retain full authority to pursue intentional discrimination claims. Comparative file review, mystery shopping, and exception analysis remain live examination tools.

HMDA data collection and reporting are unaffected. HMDA data is public. Plaintiff’s counsel, advocacy organizations, and state AGs run disparity analyses on it regularly. The fact that you are no longer required to run those analyses internally does not make the underlying data disappear.

Adverse action notice requirements are unchanged. There is no algorithmic exception. If your model denies an application, the stated reasons must accurately reflect the actual model logic. Without aggregate disparity monitoring to surface systemic patterns, individual-level notice accuracy becomes more prominent as an examination target.

The Fair Housing Act is alive and uncertain. HUD proposed rescinding its disparate impact rule in January 2026 (Federal Register 2026-00590), but that rescission has not been finalized. Texas Department of Housing and Community Affairs v. Inclusive Communities Project (2015) survives as Supreme Court precedent regardless of HUD rulemaking. Private FHA plaintiffs can bring disparate impact claims without any rulemaking authority. For mortgage lenders: FHA exposure is live, uncertain, and unresolved.

Redlining enforcement is fully preserved. Redlining has historically been prosecuted as intentional discrimination. The legal theory underlying the DOJ and CFPB redlining consent orders of the last five years is primarily disparate treatment. That enforcement posture is intact.

Where the Risk Actually Lives: State Law

Twenty-one state AGs signed a joint comment letter opposing this rule. They are not bound by it. State AGs have publicly signaled coordination on enforcement, and HMDA data provides the shared evidentiary foundation for multi-state actions.

New Jersey is the most consequential development. AG Platkin finalized LAD disparate impact regulations on December 15, 2025. The regulations use a three-part burden shift: plaintiff establishes a statistically significant disparity; the creditor must demonstrate substantial legitimate nondiscriminatory business necessity; the plaintiff can prevail by showing a less discriminatory alternative existed. The regulations explicitly cover “automated decision-making tools” in lending and require AI explainability documentation and model governance exceeding any current federal requirement.

Massachusetts finalized revised disparate impact regulations in December 2025. A less discriminatory alternative can support liability even if not equally effective — a lower bar than NJ and lower than what CFPB guidance required. The $2.5M Earnest Operations settlement (Massachusetts AG, July 2025) is the operating template: findings included a cohort default rate metric creating disparate impact on Black and Hispanic applicants, an immigration status knockout rule creating disparate impact on national origin, and no fair lending testing having been conducted at all. Required remediation: full model inventory, annual fair lending testing of all algorithmic models, trigger-event testing protocols, and four-year retention of account-level underwriting data.

California, New York, and Illinois each have state civil rights statutes interpreted to support disparate impact in credit transactions. These are not theoretical exposures.

If your institution has meaningful loan volume in any of these five states, you are subject to state-level disparate impact requirements that are now more stringent than federal law — and those requirements are not going away.

The AI/ML Model Implications

Under the prior federal framework, the standard fair lending model risk workflow was well-established. You ran BISG (Bayesian Improved Surname Geocoding): the Census surname list provides a prior probability distribution across racial/ethnic categories, updated using block-group-level Census demographic data via Bayes’ theorem — not simple averaging or concatenation. The result is a posterior probability distribution for each applicant. Use fractional probabilities throughout; threshold classification systematically underestimates disparities for smaller demographic groups. BIFSG adds first name as an additional updating signal, meaningfully improving accuracy for Asian and Hispanic subgroups where surnames alone are less predictive.

You ran outcome regressions weighted by those probabilities, controlled for legitimate underwriting variables, and flagged odds ratios above 1.5x for review and above 2.0x as elevated risk. Those thresholds are common industry governance benchmarks — not codified in any regulatory examination guidance — but represent widely-used internal risk flagging standards. You ran marginal effects analysis and integrated SHAP or other feature attribution methods into model validation.

At the federal level, none of that is now required under Reg B. Here is what the shift means for model risk teams.

Proxy discrimination is still actionable. Reg B commentary retains that facially neutral criteria can be actionable where they are “intentionally designed or applied as proxies” for a prohibited characteristic. Intentionality is now load-bearing. Your model development artifacts are now evidence: git commits, developer notes, feature importance logs, validation report conceptual soundness sections. The question is no longer just “what is the statistical disparity” — it is “why was this variable chosen, and by whom, and what alternatives were considered.” Document your rationale. Developers’ Slack channels are not the right place for feature selection discussions.

Adverse action notice accuracy is now a primary, not secondary, risk. If your stated denial reasons don’t correspond to actual SHAP values or feature importance outputs, you have a problem independent of disparate impact doctrine — one that got more visible when aggregate testing stopped.

UDAAP remains a latent risk. The CFPB retains authority to pursue discriminatory practices as unfair, deceptive, or abusive. The current administration is unlikely to exercise that aggressively, but future administrations have used it and the theory is available. Your documentation posture should assume it could be revived.

Don’t Kill the Testing Program

State law makes it mandatory anyway. If you have material volume in MA, NJ, CA, NY, or IL, you are choosing whether to run disparate impact analysis proactively or reactively in response to an enforcement inquiry. Running it proactively is the better posture.

FHA exposure is unresolved for mortgage lenders. HUD’s proposed rescission is not final, Inclusive Communities survives, and private mortgage plaintiffs have standing. Any mortgage lender that stops disparate impact analysis on the basis of the Reg B amendment is making a bet on legal outcomes not yet determined.

HMDA data is public and plaintiff’s counsel is watching. If your institution has a known HMDA disparity and no internal fair lending testing, no LDA documentation, and no remediation program, your litigation posture in a private lawsuit is materially worse than if you had documented the disparity and responded to it.

Investor and secondary market obligations haven’t changed. GSE selling guide provisions and private label securitization reps and warranties require fair lending compliance. Those contractual obligations are not modified by a CFPB rulemaking.

The EU AI Act creates the infrastructure anyway — for institutions with EU market exposure. The EU AI Act classifies credit scoring as high-risk AI under Annex III. The compliance deadline is August 2, 2026. Requirements include continuous risk management documentation, demographic bias assessment, conformity assessment, and human oversight capability. SMEs face reduced procedural obligations but the same substantive requirements. Penalties reach €15M or 3% of worldwide annual turnover. If your models are deployed in any EU jurisdiction, you’re building the demographic bias testing infrastructure for EU compliance anyway — the marginal cost of running it domestically is low.

The rule creates a divergence: the US federal standard says don’t test, the EU standard says you must. If you’re running shared models in both jurisdictions, “we only test for EU” is probably not a defensible answer in a Massachusetts enforcement action.

This rule also faces litigation risk and future administrations can reverse it. Practitioners who killed their BISG testing programs on the basis of the federal headline will spend the next eighteen months rebuilding them — starting with the first MA or NJ enforcement inquiry.

The Documentation Argument

The most practical implication of this rule is not about testing. It is about documentation priorities.

Under the effects-test regime, examination readiness centered on statistical outputs: disparity ratios, regression tables, LDA analysis, monitoring reports. Examiners wanted to see that you had found the disparities and explained them.

Under the current federal standard — and especially under state-level intent-sensitive frameworks — examiners and plaintiff’s counsel will be asking why each feature is in your model, who made that decision, and what alternatives were considered. They will look at exception logs and run comparative file review.

Build four things:

Feature selection rationale documentation. For every variable in every credit model, a written record of why it was included, what alternatives were considered, and what the outcome would have been with those alternatives — the primary defense against a proxy discrimination allegation.

Exception tracking at the transaction level. Policy exceptions in underwriting and pricing, with reason, decision-maker, and outcome. Exception rate analysis by demographic group should be a standard quarterly output.

Model governance records that survive personnel changes. Developer notes, validation reports, and selection rationale that don’t live only in individual engineers’ heads. SR 26-2 (which superseded SR 11-7 in April 2026, carrying forward the same core validation and governance requirements) remains in full effect.

State-specific examination readiness. The NJ LAD regulations, the MA fair lending framework, and the standard federal exam are three different documentation asks. If you decide not to maintain full disparate impact testing, document that decision — an undocumented choice not to test is itself a problem in an enforcement context.

Practitioner Checklist

Immediate (Before July 21, 2026)

• Audit all active SPCPs for compliance with revised § 1002.8(b). Programs using race, color, national origin, or sex as eligibility criteria must be restructured or wound down. Determine what happens to currently enrolled participants before communicating program changes.
• Build a model inventory. Before assessing state-law explainability requirements, you need to know which models are in scope.
• Map your loan portfolio by state. Flag any material volume in NJ, MA, CA, NY, or IL.
• Review discouragement policies under revised § 1002.4(b). State analog provisions may maintain broader coverage.
• Do not terminate ongoing fair lending examinations mid-cycle.
• Confirm adverse action notice accuracy for all AI/ML models. SHAP outputs should be traceable to stated denial reasons.
• Assess EU AI Act compliance timeline. High-risk AI system requirements take effect August 2, 2026.

Short-Term (60–180 Days)

• Build feature selection rationale documentation for all production credit models.
• Implement transaction-level exception tracking with reason codes, decision-maker identity, and outcomes.
• Evaluate whether to maintain BISG/BIFSG testing and document the decision either way. Decision framework: (a) material state-regulated portfolio, (b) public HMDA disparity exposure, (c) EU-deployed models, (d) GSE seller/servicer obligations.
• Establish four-year account-level underwriting data retention policy.
• Develop state-specific examination readiness files for NJ, MA, and any state with active regulatory monitoring.
• Brief your credit committee and board risk committee on FHA uncertainty. Do not treat HUD’s proposed rescission as final.
• Review model validation framework for NJ LAD AI explainability requirements.

The Reg B amendment is a real change. The effects test at the federal level is gone, and examination priorities will shift accordingly. But the fair lending compliance ecosystem is a layered system of federal law, state law, private litigation, and contractual obligation — and only one of those layers changed on April 22. Practitioners who killed their BISG testing programs on the basis of the federal headline will spend the next eighteen months rebuilding them.