Small Business Overrides, Vendor Models, and a High-Fee Overdraft Program
Riverside Bank ($6.5 billion assets) offers small business lines of credit and auto loans. An internal review finds that in three majority-minority census tracts, the small business denial rate is 44%, compared with 23% elsewhere in the assessment area. The bank uses a proprietary credit score with a minimum cutoff of 700; 61% of applicants in the three tracts score below 700. Loan officers may approve exceptions up to $150,000, but there is no written exception guidance, no tracking, and no second-review requirement. A fintech partner refers auto loan applicants and uses a model with zip code and educational attainment as variables. Separately, the bank charges $35 per overdraft item, posts transactions high-to-low, and adds a $5 extended overdraft fee after five days. Eight percent of customers generate 63% of overdraft revenue. The compliance officer must present a risk assessment and remediation plan to the board before the next examination.
1. Distinguish disparate treatment from disparate impact in the small business and auto lending findings, and identify the data and controls needed to test each.
Read the worked answer
Disparate treatment is unequal treatment of similarly situated applicants because of a protected characteristic. The untracked exception authority up to $150,000 is a classic risk indicator: without written guidance, second review, or override tracking, loan officers can approve some applicants and deny others inconsistently. Testing should compare exception and override rates by race, ethnicity, sex, census tract, loan officer, and application channel, and should include matched-pair file reviews.
Disparate impact arises from a neutral policy that disproportionately excludes a protected group without being necessary to a legitimate business purpose, or when a less discriminatory alternative exists. The 700 cutoff and the vendor's use of zip code and educational attainment are candidates. Testing should use regression or stratified analysis, file reviews, and alternative-model validation. The bank needs application, decision, score, exception, officer, census tract, revenue, and proxy data such as Bayesian Improved Surname Geocoding where lawful. For the auto partner, the bank needs vendor oversight, model documentation, fair lending testing, and a less discriminatory alternative analysis.
2. Assess the overdraft program under UDAAP principles and propose specific changes.
Read the worked answer
High-to-low posting maximizes the number of overdraft items and fees by debiting the largest transactions first. A $35 per-item fee plus a $5 extended fee after five days, combined with the fact that 8% of customers generate 63% of overdraft revenue, creates a concentrated injury on financially vulnerable customers. Under UDAAP principles, that pattern raises unfairness risk because the injury may not be reasonably avoidable and may not be outweighed by benefits; unclear disclosures also raise deception risk.
Specific changes include: stop high-to-low posting, lower or eliminate per-item and extended fees, provide real-time balance alerts and a grace period, offer a small-dollar credit alternative, require affirmative opt-in for overdraft coverage where applicable, refund fees for first-time or de minimis errors, and monitor complaints and fee concentration. The board should approve a fee-risk appetite and receive monthly data on fee revenue by customer segment. The bank should also consider remediation for customers whose fees were driven by posting order.
3. What board-level governance and monitoring should accompany the remediation?
Read the worked answer
The board should adopt a fair lending policy that covers small business and indirect auto lending, a written exception policy with second review and tracking, vendor oversight standards for the fintech partner, and a complaint-management program. It should set risk appetite metrics: denial-rate gaps, override-rate gaps, pricing disparities, overdraft fee concentration, complaint volume, and vendor model changes. Internal audit should test the exception process and the auto model independently.
The board should also authorize a lookback and redress where discrimination or unfair fees are found, and should require management to communicate remediation to the regulator. Training for loan officers and underwriters should cover fair lending and UDAAP, with completion tracked. Monitoring should be continuous, not annual, and should escalate red flags to the board risk committee. The board minutes should record the risk assessment, the approved remediation plan, and the metrics that will determine whether the plan is working.