Vendor Scorecard and Missing Adverse Action Reasons
LendBridge, a fintech lender, uses a vendor score called ScoreNu for small-business credit decisions. ScoreNu is a proprietary gradient-boosting model; the contract provides only a score and four generic reason codes, such as 'credit history.' LendBridge combines ScoreNu with ten internal features, but the vendor score carries roughly 65% of decision weight. A regulator's exam asks LendBridge to show that adverse action notices state the specific principal reasons for denial. The vendor refuses to disclose feature-level documentation, citing intellectual property, and LendBridge cannot reproduce the score in-house. LendBridge has 45 days to respond and 8,000 denied applications from the past year. The vendor is rated 'critical' under the fintech's third-party policy because credit decisions depend on it. The fintech's board wants to keep the vendor and avoid disruption.
1. Assess the third-party risk and regulatory exposure.
Read the worked answer
ScoreNu is a critical third-party dependency: it drives 65% of decision weight, cannot be reproduced, and lacks feature-level documentation. Under U.S. adverse action rules (ECOA/Regulation B), a denial notice must give specific principal reasons, not generic labels. Four generic reason codes may not be specific enough, and they may not reflect the combined LendBridge model, which includes ten internal features.
The exposure is both credit- and vendor-related: inability to explain denials, weak third-party oversight, and potential fair-lending risk if reason codes are inaccurate. The board's preference to avoid disruption does not reduce the risk. The 45-day response requires triage: identify which denials relied mainly on ScoreNu, test whether vendor reason codes are accurate and specific for those applicants, and prepare a remediation plan.
2. What options does LendBridge have, and which path should it take?
Read the worked answer
Options include:
- renegotiate for documentation and audit rights;
- combine vendor reason codes with internal feature reasons and validate them;
- replace the vendor or build a challenger;
- reduce reliance on ScoreNu in decisioning.
The immediate path should be to combine vendor reason codes with reasons from LendBridge's own features, test accuracy on a sample of denied applications, and issue specific reasons where valid. In parallel, negotiate contract amendments for model documentation, reason-code mapping, audit rights, and change notification.
If the vendor will not provide enough, initiate a challenger or replacement and set a hard exit timeline. Do not simply pass through generic codes. Reason codes must be accurate enough that a denied applicant can understand the principal reasons; if accuracy testing fails, escalate and consider suspending vendor-driven denials until remediation.
3. Recommend contractual and ongoing third-party controls.
Read the worked answer
Contract controls should include:
- audit and examination rights;
- model documentation and validation reports;
- adverse action reason-code mapping and accuracy testing;
- change notification and revalidation triggers;
- service levels and incident response;
- data ownership and permission to use outputs for compliance;
- termination assistance and an exit plan.
Ongoing controls should include annual due diligence, performance monitoring by segment, concentration-risk review, fourth-party risk assessment, and a documented fallback model. The vendor should be treated as critical, with board-level reporting and a tested exit plan. If the vendor remains opaque, the control environment is not adequate for a credit decision of this importance.