One Big Idea

A credit model can pass every fairness test and still cost you the money. What you owe the applicant you just refused is not a data-science deliverable — it is an operating model, and the rung that looks most generous to the customer is the one that manufactures the grievance.

Two weeks ago this letter asked whether you can govern a model you cannot open — a question you answer to your supervisor. This week the creditor changes. The question is what you owe the person your model just refused. In the United States that duty sits in statute rather than in guidance. In Vietnam the duty is different in kind — and it took effect in January, while everyone was reading about Brussels.

In March 2021, New York's financial regulator finished an investigation into the Apple Card, underwritten by Goldman Sachs, and ran regression analysis across what its report calls nearly 400,000 New York applicants. It did not find evidence of unlawful disparate treatment, and it did not find evidence of disparate impact. On the statistics, the model was cleared. The same report criticised something else: when customers rang to ask why their limit was lower, the bank's own agents could not explain the decision, and account holders had to wait six months to appeal credit terms — a waiting period the bank eliminated after the November 2019 media scrutiny. In October 2024 the Consumer Financial Protection Bureau ordered Apple and Goldman Sachs to pay over 89 million dollars over servicing and dispute-handling failures. A sound model, a failed operating model, and a bill three and a half years later — not for the model, and not for the explanation, but for what happened after the customer picked up the phone.

The Insight · Neither old defence ever held

The instinct when a model denies someone is to reach for complexity or for a checklist. Neither has ever worked. In the United States the Equal Credit Opportunity Act and Regulation B require a creditor taking adverse action to give the specific principal reasons, and Regulation B's own commentary requires those reasons to describe the factors the model actually scored. "Too complex to explain" is not an engineering constraint; it is a compliance finding. If the driver was the type of merchant someone shops at, "purchasing history" is not a reason, it is a euphemism.

The Consumer Financial Protection Bureau said both things directly, in Circular 2022-03 and Circular 2023-03 — and then withdrew that guidance effective 12 May 2025 without touching the statute or the regulation underneath it. Neither circular is the current Bureau position, and neither should be cited as one. The duty is untouched. That is the whole reason to build against a statute: a statute does not get withdrawn by notice.

Most banks fail here the same way: they test the model for bias, clear it, and never check whether the reason for a denial survives the trip to the person answering the phone.

The duty does not scale down as the model scales up. R1 and R2 are dead, R3 is the floor, R4 is the trap, R5 is the mandate: five rungs read as a legal-obligation gradient, not a capability curve.

Framework of the Week · The Adverse-Action Explainability Ladder

The framework is The Adverse-Action Explainability Ladder — five rungs of what a bank owes an applicant it refuses, and the useful property is that it does not reward climbing:

  • R1 · Opaque score — a number and no reasons. On this framework's reading of the duty, dead: a statement of specific reasons is required whatever the technology.
  • R2 · Generic reason codes — the canned checklist that survived decades of scorecards. Dead for AI models the moment behavioural data enters, because the reasons disclosed have to be this applicant's actual principal reasons.
  • R3 · Specific, accurate principal reasons — the true drivers for this applicant. The floor, and a model-selection constraint rather than a reporting feature: the word that decides which models you may deploy is accurate.
  • R4 · Counterfactual or actionable recourse — what would have changed the outcome. The trap: valid in theory, invalidated by retraining, and human-mediated only.
  • R5 · Human-reviewable, auditable, contestable — a human, a record, an appeal. The mandate.

Read the verdict column again, and read it as an argument rather than as settled law. R1 and R2 are not early stages of a journey — on this framework's reading of the duty they are indefensible for AI models. R3 is not an aspiration; it is where deployment is permitted to begin. And the rung that looks most generous is the one to avoid automating.

There is also a rung nobody draws, and the Apple Card case shows it matters most: R3.5, the delivery test. A reason that lives in your model-risk pipeline but never renders on the frontline screen satisfies R3 on paper and still produces the failure — the DFS record makes the point better than the framework can, because at the Department's request the bank could identify the factors behind each complainant's decision. The reasons existed and were producible for a regulator, and not for the customer on the phone. You can test it in an afternoon: pull 10 recent denials and ask an agent to explain each one from their own screen.

The full ladder, with the verdict column, the delivery test and the 5-question diagnostic drawn out, lives in the Frameworks library.

Use Case · Why the fourth rung is a trap

You tell an applicant that clearing 2,000 dollars of debt would flip the decision. Useful advice; it feels like financial inclusion. Then the model is retrained, as model-risk discipline effectively requires, and the decision boundary moves. Peer-reviewed work on recourse invalidation shows counterfactuals already issued stop holding once that happens. The applicant does exactly what your letter said, reapplies, and is denied again — and you have manufactured a grievance with your own letter as the evidence.

Two details make this an unforced error rather than merely unwise. The regulation never asked for it: the Official Interpretations to Regulation B provide that a creditor need not describe how or why a factor adversely affected an applicant, so counterfactual recourse is a service decision, not a disclosure duty. And robust methods that survive retraining exist in the literature but are computationally expensive and rare in production. Until they are cheap and stable, counterfactuals belong in a loan officer's hands as a conversation tool — particularly in SME and commercial lending — and not in a retail app as prescriptive advice.

Risk Note · The Vietnam duty most banks miss

Do not import the European justification. In Europe the top rung has a clean statutory home: Article 14 of the AI Act requires human oversight of a high-risk system, and creditworthiness evaluation of natural persons is high-risk at Annex III. But those Chapter III obligations were deferred by Regulation (EU) 2026/1744, the Digital Omnibus on AI, so anyone telling you they already apply to your credit model is wrong — and a programme justified on the wrong provision does not survive its first legal review.

You do not need the European one. Vietnam already imposes an algorithmic-explanation duty of its own, in force since 1 January 2026, and it sits in the implementing decree rather than in the Personal Data Protection Law: Decree 356/2025/NĐ-CP, at Article 10(3), requires a controller to notify the data subject of automated processing of their personal data, to explain the algorithm's operating principles and its effects on their rights and legitimate interests, and to offer them a right not to take part — with a further duty to account to the subject at Article 10(5)(b). On explanation, Vietnam is ahead of where most banks assume it is.

What it does not give is a right to demand that a human re-decide. Keep that distinction explicit, because it is where board papers go wrong: your customer can require you to explain the algorithm and can step out of the automated processing; they cannot require a human to underwrite them again. Build on that, and on what the Law itself grants — the rights to object to, to restrict and to delete processing, and the right to withdraw consent — plus the duty it puts on you regardless of any of this: the Article 21(1) data-protection impact assessment, one original filed with the specialised authority within 60 days of first processing. That duty is unconditional. There is no profiling trigger and no automated-decision trigger to wait for.

A customer who objects, withdraws the consent the processing rests on, or asks how the algorithm reached them has to be answered by something — and an automated line with no human tier behind it has nothing to answer with. Build the lane in 2026 on Vietnam's own terms, and check the enacted text with your own counsel before the justification goes into a board paper.

Complexity is not an excuse.

One question for your next credit committee, and do not accept a model-performance answer to it: for the last 1,000 denials, can you say why — to the person you denied, in words that reach them, with a human who can be asked to look again?

Latest Video

This week's briefing — Your model was cleared. You still got fined. — argues the ladder end to end with the evidence in 8 minutes 24 seconds, and lands on the delivery test you can run on Monday: pull 10 recent denials, ask the agent on the phone to explain each one from their own screen, and see whether the reason your model-risk pipeline produced ever arrived.

Watch: youtu.be/RseibsKBuBY

The full deep-dive — the two wrong reactions, all five rungs with the verdict column, R3 as a model-selection constraint, the trap, and the Vietnam road with its sources and caveats — is in The Adverse-Action Explainability Ladder: What a Bank Owes an Applicant It Rejects.

The free five-page playbook in the Frameworks library turns it into a scored read of your own stack.

Reply and tell me which rung your denial letters actually reach — most teams name R3 by reflex, then find the reason never rendered on the screen of the agent answering the phone. I read every response. Forward this to a banking executive whose fairness testing came back clean.

Was this forwarded to you? Subscribe to The AI Architect Letter — free, every Saturday.

Minh Tran · AI Business Architect · LinkedIn · Workshops & advisory: aibusinessarchitect.ai