Regulon — NY-AB-773 · NY AB 773 (Automated Lending Decision Tools)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

The Superintendent of the Department of Financial Services has exclusive enforcement authority, including investigatory power, the power to compel attendance and testimony under oath, and the power to compel production of books, records, accounts, and documents. No private right of action is created. Enforcement is agency-initiated.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

The bill does not specify monetary penalties, statutory damages, or private remedies. The Superintendent may direct a covered entity to cease use of a discriminatory automated lending decision-making tool and may require additional reporting. Remedies are administrative in nature.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Banking Law § 103-a(1)

Definitions

(1)(a) "Automated lending decision-making tool" means any software that uses algorithms, computational models, or artificial intelligence techniques, or a combination thereof, to materially automate or replace human decision-making regarding lending decisions that impact natural persons. "Automated lending decision-making tool" shall not include any software used primarily for basic computerized processes, such as calculators, spellcheck tools, autocorrect functions, spreadsheets, electronic communications, or any tool that relates only to internal management affairs such as ordering office supplies or processing payments, and that do not materially impact any lending decisions relating to natural persons.

(1)(b) "Lending decision" means any determination made by a covered entity or its agent, whether automated, manual or a combination thereof, that affects the approval, denial, offer, counteroffer, or modification of the terms or conditions of a loan or credit application, including decisions regarding creditworthiness, loan amounts, interest rates, collateral requirements, repayment, or any other material term, and any determination that considers any factor that results or may result in "adverse action" as such term is defined in the federal Fair Credit Reporting Act 15 U.S.C. 1681a(k).

(1)(c) "Covered entity" means any banking organization, foreign banking corporation licensed by the superintendent to transact business in this state pursuant to article five of this chapter, interstate branch authorized by the superintendent to transact business in this state pursuant to article five-C of this chapter, and licensed lender. Covered entity shall not include any national bank, federal savings bank, federal savings and loan association, federal credit union, federal trust company or foreign banking corporation organized under the laws of the United States.

(1)(d) "Material change" means any modification to an automated lending decision-making tool which directly impacts the tool's outputs.

This subdivision establishes the four defined terms that govern the scope of the bill. Automated lending decision-making tool is defined broadly to cover any software using algorithms, computational models, or AI techniques that materially automates or replaces human lending decisions affecting natural persons, but excludes basic office tools. Covered entity captures state-chartered banking organizations, state-licensed foreign banking corporations, superintendent-authorized interstate branches, and licensed lenders — but explicitly carves out all federally chartered institutions. Lending decision encompasses the full lifecycle of loan determinations including approval, denial, counteroffer, and modification, and incorporates the federal Fair Credit Reporting Act definition of adverse action. Material change is any modification that directly impacts tool outputs, serving as the trigger for mandatory re-assessment under subdivision 2.

Banking Law § 103-a(2)

Impact assessment and public disclosure requirements

Deployer

(2) 1 No less than annually, each covered entity that uses automated lending decision-making tools shall conduct an impact assessment substantially completed and bearing the signature of one or more individuals responsible for meaningful human review for the lawful application and use of such automated lending decision-making tools. An impact assessment shall be conducted prior to any material change to any automated lending decision-making tool that may change the outcome or effect of such tool. An impact assessment final report summarizing the conclusions of the initial impact assessment shall be posted on such covered entity's website prior to the implementation and use of such automated lending decision-making tool and updated on the entity's website following each subsequent assessment. Such impact assessment final report shall include: (a) a description of the objectives of the automated lending decision-making tool; (b) an evaluation of the ability of the automated lending decision-making tool to achieve its stated objectives; (c) a description and evaluation of the objectives and development of the automated lending decision-making tool including: (i) a summary of the underlying algorithms, computational modes, and artificial intelligence tools that are used within the automated lending decision-making tool; and (ii) the design and training data used to develop the automated lending decision-making tool process; (d) testing for: (i) accuracy, fairness, bias and discrimination, and an assessment of whether the use of the automated lending decision-making tool produces discriminatory results on the basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, lawful source of income, age, or disability and, outlines mitigations for any identified performance differences in outcomes across relevant groups impacted by such use; (ii) any cybersecurity vulnerabilities and privacy risks resulting from the deployment and use of the automated lending decision-making tool, and the development or existence of safeguards to mitigate the risks; (iii) any public health or safety risks resulting from the deployment and use of the automated lending decision-making tool; and (iv) any reasonably foreseeable misuse of the automated lending decision-making tool and the development or existence of safeguards against such misuse; (e) the extent to which the deployment and use of the automated lending decision-making tool requires input of sensitive and personal data, how that data is used and stored, and any control users may have over their data; and (f) the notification mechanism or procedure, if any, by which individuals impacted by the utilization of the automated lending decision-making tool may be notified of the use of such automated lending decision-making tool and of the individual's personal data, and informed of their rights and options relating to such use.

This subdivision imposes the bill's central compliance obligation: covered entities using automated lending decision-making tools must conduct impact assessments at least annually and prior to any material change. Each assessment must be signed by one or more individuals responsible for meaningful human review. A summary report must be posted on the covered entity's website before initial deployment and updated after each subsequent assessment. The required content is extensive — spanning tool objectives, algorithm descriptions, training data, bias and discrimination testing across a long list of protected characteristics, cybersecurity and privacy risks, public health and safety risks, foreseeable misuse scenarios, sensitive data handling practices, and user notification procedures.

The bias testing requirement is notably detailed, requiring evaluation of discriminatory results on the basis of actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, lawful source of income, age, or disability, along with documented mitigations for any identified performance differences.

Compliance actions 1 item

Covered entities must conduct an impact assessment of each automated lending decision-making tool at least annually and prior to any material change, signed by an individual responsible for meaningful human review. The assessment must include bias and discrimination testing across enumerated protected characteristics, algorithm and training data descriptions, cybersecurity and privacy risk evaluation, misuse scenario analysis, and sensitive data handling practices. A summary report must be posted on the covered entity's website before initial deployment and updated after each subsequent assessment.

H-02.1

Banking Law § 103-a(3)

Record retention and regulatory production

Deployer

(3) 2 In addition to the powers conferred to the superintendent in subdivision six of this section, a covered entity shall retain the full impact assessment and summary for a period of seven years and shall, upon notice by the superintendent, provide such full assessment and summary to the department within seven days.

This subdivision requires covered entities to retain the full impact assessment and its summary for seven years and to produce the complete assessment and summary to the Department of Financial Services within seven days upon notice from the Superintendent. The seven-year retention period is notably longer than the typical two-to-five-year range seen in comparable AI legislation, reflecting banking regulatory norms.

Compliance actions 1 item

Covered entities must retain the full impact assessment and summary for seven years and must produce them to the Department of Financial Services within seven days upon notice from the Superintendent.

G-01.3

Banking Law § 103-a(4)

Mandatory discrimination reporting and cessation

Deployer

(4) 3 Notwithstanding the provisions of this article or any other law, if an impact assessment finds that the automated lending decision-making tool produces discriminatory or biased outcomes, such covered entity shall, within thirty days of such findings, report such findings to the department. Upon such report being received by the department, the department shall direct such covered entity to cease any utilization, application, or function of such automated lending decision-making tool, and of any information produced using such tool.

This subdivision creates an affirmative reporting obligation and a mandatory cessation remedy when an impact assessment finds discriminatory or biased outcomes. Within thirty days of such a finding, the covered entity must report the finding to the Department. Upon receiving the report, the Department is directed — not merely empowered — to order the covered entity to cease all utilization, application, or function of the tool and of any information produced using the tool. The mandatory nature of the cessation order is notable: once discriminatory outcomes are found and reported, the Department has no discretion to permit continued use.

Compliance actions 1 item

Covered entities must report to the Department of Financial Services within 30 days if an impact assessment finds that an automated lending decision-making tool produces discriminatory or biased outcomes. Upon receipt of the report, the Department will direct the covered entity to cease all use of the tool and of any information produced by it.

R-01.3

Banking Law § 103-a(5)

Applicant notification, disclosure, and appeal rights

Deployer

(5)(a)–(b) 4 Any covered entity that uses an automated lending decision-making tool to screen applicants for a loan shall notify each such applicant of the following: (i) That an automated lending decision-making tool will be used in connection with the assessment or evaluation of such applicant; (ii) The criteria that such automated lending decision-making tool will use in the assessment of such applicant; (iii) Information about the type of data collected for such automated lending decision-making tool, the source of such data, and the covered entity's data retention policy; and (iv) If an application for a loan is denied through use of the automated lending decision-making tool, to the extent practicable, the reason for such denial. (b) The notice required by paragraph (a), with the exception of the information required in subparagraph (iv) of such paragraph, of this subdivision shall be made no less than twenty-four hours before the use of such automated lending decision-making tool. The notice required by subparagraph (iv) of such paragraph (a) shall be made within twenty-four hours after such denial.

(5)(c) 5 If an application for a loan is denied based on personal information that is incorrect, the applicant, upon receipt of the notice required by subparagraph (iv) of paragraph (a) of this subdivision, shall have thirty days to correct such information and appeal such denial.

This subdivision establishes individual-facing transparency and due process requirements. Covered entities must notify each loan applicant — at least 24 hours before the automated tool is used — that an automated lending decision-making tool will be used, what criteria it will apply, what data types will be collected, data sources, and the entity's data retention policy. If the application is denied, the entity must provide the reason for denial within 24 hours after denial, to the extent practicable. Applicants denied based on incorrect personal information have 30 days to correct the information and appeal the denial.

The pre-use notification timing requirement — 24 hours in advance — is notable and may create operational challenges for entities processing loan applications in real time or near-real time.

Compliance actions 2 items

Covered entities must notify each loan applicant at least 24 hours before using an automated lending decision-making tool that (1) an automated tool will be used in their assessment, (2) the criteria the tool will apply, (3) the types and sources of data collected and the entity's data retention policy, and (4) within 24 hours after any denial, to the extent practicable, the reason for the denial.

H-01.1

Covered entities must allow applicants whose loan applications were denied based on incorrect personal information to correct the information and appeal the denial within 30 days of receiving the denial notice.

H-01.5

Banking Law § 103-a(6)

Superintendent investigatory powers

Deployer

(6) 6 The superintendent shall have the power to make such investigations as the superintendent deems necessary to determine whether any covered entity has violated any of the provisions of this section. To the extent necessary therefor, the superintendent may require the attendance of and examine any person under oath, and shall have the power to compel the production of all relevant books, records, accounts, and documents. The superintendent shall have the power to make such examinations of the books, records, accounts and documents used in the business of any covered entity as the superintendent deems necessary to determine whether any such covered entity has violated any of the provisions of this section, or to secure information lawfully required by the superintendent.

This subdivision grants the Superintendent broad investigatory and examination authority to determine whether any covered entity has violated the section's provisions. The Superintendent may require attendance and testimony under oath, compel the production of relevant books, records, accounts, and documents, and conduct examinations of business records. This is the primary enforcement mechanism — the bill creates no private right of action.

Compliance actions 1 item

Covered entities must comply with investigations by the Superintendent, including producing all relevant books, records, accounts, and documents upon demand and making individuals available for examination under oath.

R-02.2

Banking Law § 103-a(7)

Enhanced reporting for discriminatory outcomes

Deployer

(7) 7 Notwithstanding the provisions of subdivision two of this section, the superintendent may, upon a finding that a covered entity has deployed an automated lending decision-making tool which produced discriminatory or biased outcomes, require, in accordance with the rules and regulations promulgated by the superintendent, (a) additional annual reports, (b) annual reports with additional information, (c) a combination of paragraphs (a) and (b) of this subdivision, and/or (d) that such covered entity provide any and all additional reports to the department directly.

This subdivision grants the Superintendent discretionary authority to impose enhanced reporting requirements on a covered entity found to have deployed an automated lending decision-making tool producing discriminatory or biased outcomes. The Superintendent may require additional annual reports, reports with additional information, both, or direct submission of all additional reports to the Department. This is a conditional, superintendent-triggered obligation distinct from the mandatory 30-day discrimination reporting in subdivision 4.

Compliance actions 1 item

Covered entities found by the Superintendent to have deployed automated lending decision-making tools producing discriminatory or biased outcomes must comply with any enhanced reporting requirements the Superintendent imposes, which may include additional annual reports, reports with additional information, or direct submission of all reports to the Department.

R-02.1

Banking Law § 103-a(8)

Severability

(8) The provisions of this section shall be severable, and if any phrase, clause, sentence, or provision is declared to be invalid, or is preempted by federal law or regulation, the validity of the remainder of this section shall not be affected thereby. If any provision of this section, or its application to any person or circumstance, is held to be invalid or preempted by federal law, the remainder of this section and its application to other persons or circumstances shall not be affected and shall continue in full force and effect to the maximum extent permitted by law.

This subdivision is a standard severability clause providing that if any provision is declared invalid or preempted by federal law, the remainder of the section continues in full force and effect. The explicit reference to federal preemption reflects the bill's awareness that federal banking regulation may limit the reach of certain provisions to state-chartered entities.

§ 2

Effective date

This act shall take effect on the ninetieth day after it shall have become a law.

The act takes effect on the ninetieth day after it becomes law. No specific calendar date is set because the bill has not yet been enacted.

Human Oversight Decision review · appeal pathways

3 items

H-02.1