UDAAP (Unfair, Deceptive, or Abusive Acts and Practices) — Regulatory Reference

UDAAP — codified in Dodd-Frank Sections 1031 and 1036 — prohibits financial institutions from engaging in unfair, deceptive, or abusive acts or practices. For AI agents, this means every automated decision that affects a consumer (credit denial, account action, offer eligibility) must be explainable, traceable, and free from practices that would cause substantial consumer harm. The CFPB's 2023 guidance on AI/ML credit decisions specifically requires that adverse action notices identify the actual reasons a model denied credit — not generic proxies. Firms must document which agents accessed which data and why a specific outcome was reached. Without an agent-level audit trail, satisfying this requirement is operationally difficult at scale.

UDAAP applies any time an AI agent produces or influences a consumer-facing outcome at a CFPB-supervised institution — banks, credit unions, mortgage servicers, auto lenders, student loan servicers, and nonbank financial companies. Parallel UDAP authority under FTC Act Section 5 extends similar obligations to non-CFPB-supervised entities. In practice, UDAAP exposure is triggered when an agent accesses customer data to make or contribute to a decision on credit, pricing, account management, or collections. The 2022 CFPB guidance extended UDAAP to cover discriminatory outcomes even absent intent, which means AI-driven decisions using proxy variables for protected classes fall squarely in scope.

The CFPB's 2023 guidance clarifies that the adverse action notice requirements under ECOA and FCRA apply fully to AI and ML models. Notices must state the specific principal reasons for denial — not generic statements like 'insufficient credit history' when the actual model factors are more granular. For AI agents operating across multiple data sources, this means the institution must be able to reconstruct exactly which data inputs influenced the decision, which model version was used, and under which policy the agent was operating at the time of the decision. Firms that cannot trace a denial back to a specific agent action and data access point face regulatory risk on each affected adverse action.

AutoPIL addresses UDAAP compliance at the agent layer in two ways. First, its pre-retrieval policy enforcement blocks AI agents from consuming data categories — such as protected class proxies — that would create UDAAP or fair lending risk before that data enters the agent's context window. Second, every evaluation decision is written to a tamper-evident audit log that records which agent acted, which policy governed it, which data source was accessed or denied, and the exact policy version in effect at that moment. This produces the evidentiary record needed to support adverse action notices and demonstrate to CFPB examiners that documented fairness controls were enforced at runtime — not just described in policy documents.

CFPB enforcement under UDAAP has no fixed penalty cap — civil money penalties can reach $25,000 per day for violations and $1 million per day for reckless or knowing violations, plus restitution to harmed consumers. The CFPB's 2022 policy statement explicitly stated that discriminatory conduct can itself constitute an unfair act or practice, expanding UDAAP exposure beyond its traditional scope. Supervisory exams increasingly focus on whether firms can produce model documentation and transaction-level evidence linking AI outputs to compliant inputs. Firms unable to demonstrate runtime controls — not just policies on paper — face heightened examination findings and consent order risk, particularly as CFPB and state regulators coordinate AI-focused supervisory sweeps in 2026.