Vendor Credit-Limit Model: Fair-Lending Review and Conditional Approval
A bank's model risk committee is reviewing a third-party model that recommends credit-limit increases for 2.1 million cardholders. The vendor provides only an aggregate validation report; feature engineering is undisclosed. The bank's fair-lending test shows a disparate impact ratio of 0.78 for one protected group at the proposed cutoff, below the bank's 0.80 review threshold. Model documentation lacks adverse-action reason codes and has no monitored drift limits. The vendor says the model was validated 14 months ago and that retraining is on an annual cycle. The business wants to launch in six weeks for the holiday season; compliance requires a documented approval or rejection before launch. The bank plans to use the model as a champion with an internal override queue staffed by 12 analysts. The committee has authority to approve with conditions, defer, or reject.
1. What approval decision should the committee make, and what evidence would change it?
Read the worked answer
I would not approve unconditional launch. The disparate impact ratio of 0.78 is below the bank's 0.80 review threshold and triggers fair-lending review; the vendor's aggregate report and undisclosed feature engineering prevent independent validation. Lack of adverse-action reason codes is a compliance defect for credit decisions. Options are reject, approve with conditions, or approve for a limited pilot. A conditional approval could require obtaining model documentation and a feature list under the vendor contract; independent validation including segment-level performance and reason-code generation; mitigation of the cutoff or a documented override policy followed by re-testing impact; and drift limits plus annual validation. The six-week timeline is tight but not a reason to skip controls. If the vendor cannot provide feature-level explainability, use a challenger or reject for this use case. Evidence that would change the decision: a feature-level explanation, a fair-lending result above 0.80 at the operating cutoff with confidence intervals, and validated reason codes.
2. If the committee approves with conditions, what operating controls should be required before launch?
Read the worked answer
Require a model risk tier of high because the model affects credit access. Controls: the 12-analyst override queue needs capacity modeling, QA sampling, and documented override reasons; adverse-action notices must be accurate and timely; approval rates by segment must be monitored; fair-lending testing at the operating cutoff must run before launch and quarterly, plus after any change; vendor management must include right-to-audit, validation reports, and notification of retraining. Change control should cover cutoff changes and retraining. Reason-code stability should be tested. The committee should name an accountable owner, set an expiry date for the conditional approval, and require a go/no-go review with actual pilot results.
3. Design the ongoing monitoring package for this model.
Read the worked answer
Monitor input drift, score distribution, approval rate, override rate, delinquency by score band, disparate impact ratio, and reason-code stability. Set tolerances tied to the validation baseline and escalate on two consecutive breaches. Because labels are delayed, track early delinquency and override patterns as leading indicators. Require vendor notification before retraining and revalidate before adoption. Report monthly to the model risk committee and immediately for fair-lending breaches. The package should distinguish model performance from operational execution; a stable model with a failing override queue is still a governance incident.