During the years leading to the Financial Crisis of 2008 and its fallout, I was uniquely positioned to observe (and in some cases, respond to) the unfolding of the many challenges that the crisis presented. At the height of this tumultuous period, I was serving as the Chief Counsel, and later as the Acting Director, of the Office of Thrift Supervision (OTS). Additionally, I served as a board member of the Federal Deposit Insurance Corporation (FDIC) and NeighborWorks America, as well as a member of the Federal Financial Institutions Examination Council (FFIEC). Prior to that time, I had also dedicated much of my career to government finance and the financial services sector, serving as a senior career employee focusing on financial institutions and financial matters with the U.S. Treasury Department. Since I left government, I have been working for financial services companies including those that rely on data and analytics to assess consumer and small business creditworthiness.

Having just passed the one year anniversary of my departure from government service, and having entered into private practice as a partner in Venable LLP’s Financial Services Group, I have now had time to reflect upon the confluence of factors that may have contributed (perhaps unwittingly) to this financial maelstrom. Among such factors that I observed as a former financial regulator was the risk to regulators, lenders, consumers, and the economy as a whole, presented by a financial system that has come to over-rely on third-party credit scores provided by a single entity and the limitations inherent in that system. Credit scores have become integral to the consumer financial marketplace in this country, often serving a gatekeeping function and critical factor in whether lenders, acting under guidelines and regulations issued by themselves and their financial regulators, extend loans and other forms of consumer credit (e.g., mortgages, student loans, auto loans, credit cards) and what the terms of such credit might include. The well-being of the U.S. economy very much depends on the ability of consumers to spend, (which is in turn tied to their access to and cost of consumer credit), and the ability of lenders to lend in a safe and sound manner.

Such a system in which one entity has become ensconced as the dominant provider of third-party credit scores developed organically with the expansion in recent decades of the consumer credit markets in the United States. This expansion was aided by the development of cost-saving credit-scoring models that were designed to evaluate credit risk mechanically, establish loan prices, and manage consumers’ credit accounts. In the twentieth century, such models were produced in the early days almost entirely by one entity, and that entity became synonymous with the term “credit score,” much like how the term “Xerox®” has improperly become interchangeable with the term “copy” in everyday parlance. While a few other entities have provided third-party credit scores over the years, one entity has become by far the dominant provider of such scores, and is the beneficiary of the unintentional endorsement by regulators described in Section II of this Paper.

For purposes of this Paper, I have adopted the definition of “operational risk,” as stated by my former colleague from the FDIC Board of Directors, Comptroller of the Currency Thomas Curry who explains that “operational risk” involves the “risk of loss due to failures of people, processes, systems, and external events.” Operational risks for lenders and those they serve are created when any system relies on one entity to provide a key component to function, and this risk is particularly pronounced in the consumer credit marketplace. For example, lenders would be prevented from extending mortgages if the one dominant entity that provides the credit scores (which through historical practice and/or policy are required by underwriting guidelines to be provided by such entity) ceased to offer those credit scores. Perhaps more subtly, though no less of a concern, an operational risk would exist if a credit score model itself were flawed or otherwise could be improved to more accurately quantify the risk posed by prospective or current borrowers.

This Paper addresses operational risks posed by the overdependence on a singular legacy third-party credit scoring provider as well as steps we can take as we move forward out of the Financial Crisis to put this country on stronger financial footing, including by opening the consumer credit markets to non-legacy entities for the provision of third- party credit scores designed to offer more nuanced and increased credit risk predictability. Credit scores remain vital for consumers in the United States to achieve the American Dream, whether that dream is owning their own home, attending college, starting their own business, or having access to a car of their own to get to and from work.

This country has always welcomed competition in the marketplace, and diversity in the third-party credit score industry where credit score models must pass a rigorous validation process should be no exception. Acceptance of such diversity can help reduce operational risks presented by an entrenched system dominated by a single provider, encourage innovation and technological leaps and incentivize providers of credit scores to improve their statistically- derived models (including by competing to have their models score more of the population and thereby allowing for greater predictability in consumers’ credit riskiness) to cover all eligible consumers who wish to partake in the U.S. consumer financial markets and help bring our nation back to a state of economic prosperity.

The Issue: Operational Risks Posed by Reliance on a Single Third-Party Credit Scoring Provider

The U.S. consumer credit market heavily relies on one entity that has historically provided the  third-party credit scores  that are integral  to consumer credit extension decisions. We owe it to ourselves to look beneath the surface to examine whether a de facto single-provider legacy system set in place in the previous century best serves the consumer financial market needs of the twenty-first century. If we do so, it does not take much digging to realize that over-reliance on any single legacy third-party credit score system presents significant operational risks to financial regulators, the consumer lending industry, consumers, and the U.S. economy as a whole.

Risks to Financial Regulators


The financial regulators have been tasked with overseeing the many participants in the consumer credit space that use  the  legacy  third- party credit score system to extend credit to consumers. Their oversight capabilities, however, have been greatly hampered by the fact that the dominant legacy provider of such scores has been less than transparent on the workings of its models. The underwriting process for both mortgages and non-mortgages has become largely mechanical, relying significantly (though not exclusively) on such third-party credit scores.1 While any entity would naturally be disinclined to disclose its business model (e.g., think of a chef’s refusal to reveal the ingredients in his secret sauce), transparency to the legacy credit score system may still be improved without unveiling the exact proprietary algorithms used in the models. For instance, providers of third-party credit scores could provide more robust explanations of the factors that they considered when developing their credit score models as well as evidence that their models are functioning as intended. Indeed, some non-legacy entities have already begun to offer such insights into their credit score models.


In this post-Financial Crisis period, financial regulators can no longer politically afford to take shortcuts in their oversight duties. They may trust the dominant legacy provider’s system (or perhaps they have never really questioned it), but they also must have a means to verify how the system functions. In the financial sector, we have seen all too recently what can happen if a lack of transparency combined with “regulatory capture” or what may be viewed as complacency impedes thorough oversight. One example includes the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which resulted in the creation of the Consumer Financial Protection Bureau (CFPB).2 Another example is the Libor rate manipulation scandal, which has significantly tarnished the reputations of once-respected institutions and the entity that administered Libor.

Risks to the Lending Industry


Lenders of consumer credit are expected to conduct due diligence on the entities and their products with which they work in order to reduce risks. Such a concept in certain areas of the financial sector has been coined as “KYC” or “Know Your Customer.” In the consumer credit context where credit score models are used, I refer to this notion as “KYM” or “Know Your Model.” The underpinnings of KYM have been articulated in the Federal Reserve’s and the Office of the Comptroller of the Currency’s Supervisory Guidance on Model Risk Management.3 The term “model” here refers to “a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical  theories,  techniques, and assumptions to process input data into quantitative estimates” as well as to “quantitative approaches whose inputs are partially or wholly qualitative or based on expert judgment.”4 Such guidance sets forth key components of an effective model risk management framework, which includes: robust model development, implementation and use; effective validation; and governance, policies, and controls. These steps are designed to address “model risk,” which inevitably occurs when models are used because a model may have errors or produce inaccurate outputs or have a misunderstanding about its limitations and assumptions.5 Lenders are effectively prevented from complying with KYM to reduce model risk in the legacy third-party credit score system context because the legacy provider offers insufficient transparency to verify that the models are designed or are performing as expected or as otherwise represented by the legacy provider.


The fact that third-party credit scores currently are provided essentially by one dominant legacy entity (because of historical practice or custom, and various regulations and guidelines) presents significant risks to the lenders that use them. Should the dominant legacy entity withhold or be unable to provide the third-party credit scores, lenders would be faced with the decision of ceasing to extend consumer credit or extending such credit without considering key data about the consumers’ credit risk (assuming that the appropriate underwriting guidelines would even consider such an action; at a minimum such extensions of credit would not qualify for purchase by Fannie Mae or Freddie Mac).


The lack of transparency that obstructs model risk management and the dearth of historically-accepted alternative sources of third-party credit scores (particularly in the mortgage context) pose serious safety and soundness concerns to lenders (as well as to their financial regulators). Lenders that do not have access to or a transparent understanding of the credit scoring models they use are at great risk of being operated in an unsafe and unsound manner. If they do not, or cannot, consider the credit scores, they are at risk of operating without the information they need to satisfy a variety of laws, regulations, and generally accepted best practices. If the lenders choose to operate in this manner, they may face compliance and legal risks including reputation risk, civil money penalties, restitution or reimbursement, reduced franchise value, limited business opportunities, lessened expansion potential, and lack of contract enforceability.

Risks to Consumers


Consumers’ access to mainstream credit sources and the terms of such credit depend heavily on their credit scores that are generated under the legacy third-party credit score system.6 Consumers who would otherwise be eligible for credit have been shut out of loans for homes, school, cars, and small business start-ups due to limitations of this system, which has found millions of consumers to be “unscoreable.”7 When consumers are deemed to be “unscoreable,” they are denied access to the banking system and become part of the “underserved” or “unbanked” or “underbanked”population.8 This credit-underserved population includes, among others, immigrants with little credit history from their home countries as well as young adults with no credit history who would like to begin utilizing credit.9 With reduced options, this population often turns to other sources of credit that are typically offered on less-favorable terms (e.g., payday lenders, car title lenders, loan sharks, pawnbrokers, retirement savings, cash advances from employers or credit cards).

Ironically, this “unscoreable” population also includes millions of retirees who are typically averse to credit use but who may later find themselves in need of credit.10 Such retirees may have been scoreable at one point under the legacy system and belong to the “prime” population, but having paid off their debt obligations, they may no longer have the active “trade lines” that are prerequisites for legacy models to produce credit scores.11 Without such credit scores, these typically low-risk consumers face limited access to mainstream consumer credit sources. With the retirement of the “baby boomer” generation, this issue will present itself with increasing frequency.


Consumers who are currently scoreable under the legacy credit score system also face a risk that their access to affordable credit from mainstream sources  may be  cut  off. As  presently  constructed, the consumer credit markets heavily depend on the third-party credit scores that are derived from the approximately three billion credit reports issued annually.12 Should the one entity that provides virtually all of these credit scores under the legacy system suddenly become unwilling or unable to provide them, millions of consumers seeking to apply for credit would lose access to the mainstream credit sources that rely on such credit scores as key determinants in whether consumers may receive credit.


The Consumer Financial Protection Bureau (CFPB) has made it its mission to mandate more consumer education, increase transparency, and promote  inclusive lending  practices to  protect consumers  and provide equal access to credit.13 The structure of the legacy third-party credit system, in my opinion, frustrates these goals. When consumers are denied access to credit, pursuant to the law they are presented with adverse action codes along with descriptions that are intended to explain to the average consumer why they were denied credit. These codes and accompanying explanations from legacy providers, however, are quite cryptic to the average consumer. When consumers do not understand why they were denied credit, we lose an opportunity to educate them about the steps they can take to improve their credit standing. Legacy providers could improve the situation by providing easy-to-understand adverse action codes.

Risks to the U.S. Economy

Much of the U.S. economy depends on consumer spending. When consumers are denied access to affordable credit, however, their spending power is restricted and their reduced participation is felt by many in the marketplace. Without sufficient access to credit, consumers forgo or scale back home purchases, higher education degrees, car purchases, retail purchases, and small business endeavors. Businesses, in turn, suffer with a decreased customer base. We live in a symbiotic economy where the health of one sector impacts the entire economy. Operational risks to the financial regulators, lenders, and consumers thus present risks to the overall health of the U.S. economy.

The Solution: Acceptance of Greater Diversity in the Provision of Third-Party Credit Scores

The legacy third-party credit score system has greatly facilitated the provision of consumer credit to many, but we should aim to do better. We would also be irresponsible to continue to over-rely on a legacy system dominated by a single provider. In the twenty-first century, we possess the tools to develop and promote a new third-party credit score system that builds on traditional models and enhances them by allowing for greater diversity in the provision of third-party credit scores. Such competition would encourage innovation in credit score models by various entities, which would in turn benefit the country by helping millions more consumers gain access to the affordable credit they need to more fully participate in contributing to the U.S. economy.

Open the Consumer Credit Markets to Non-Legacy Providers of Third-Party Credit Scores to Provide Innovative and Transparent Credit Score Models

Greater diversity and acceptance of such non-legacy models in the marketplace would foster innovation and competition in the consumer credit marketplace.


The introduction and acceptance of new third-party credit score models by non-legacy entities that have a greater capacity than the legacy system to be inclusive of those consumers who have traditionally been excluded from the system would significantly aid those underserved consumers in receiving a valid credit score that is a prerequisite for affordable credit from mainstream sources.14 Estimates of the credit-underserved population in this country have ranged from 35 million to 70 million consumers.15 Recent advancements by non-legacy entities have found that as many as 30 to 35 million consumers who are categorized as “unscoreable” under traditional credit score models would be “scoreable” under non-legacy models.16


Acceptance of non-legacy models that consider traditional data at a more granular level or expand the range of data considered in producing third- party credit scores would also decrease credit risks by painting a more nuanced and comprehensive picture of a potential borrower.17

For instance, the legacy system has traditionally considered mortgages and student loans at the macro level. By distinguishing among mortgage-related products (e.g., first mortgages, home equity lines of credit (HELOC), home equity loans) and differentiating among types of installment loans (e.g., separating out student loans from other installment loans), credit score models may offer improved insight into a consumer’s credit riskiness at a micro level.18

Likewise, many lenders equate the lack of a credit score under the legacy system with a high credit risk. However, many “unscoreable” consumers diligently fulfill recurring payment obligations (e.g., rent payments, telephone payments, utility payments) that traditionally have not been considered by legacy credit score models. Studies have shown that when such nontraditional data is considered, many of those who would otherwise be unscoreable under the legacy system actually present little risk to lenders.19


Operational risk would also be reduced by the expansion of the third- party credit system to include credit scores provided by non-legacy entities. When more than one entity may provide the credit score that is required by lenders, the impact on the consumer credit market will be muted if a single entity suddenly becomes unwilling or unable to provide such credit scores. At the same time, competition inspires entities to improve the quality and the range of their offerings to stand out among their peers. Lenders, regulators, and consumers, in turn, benefit from the improved products. Competing on model transparency is among the ways that third-party credit score providers may compete, which would also help reduce operational risk.

Current Barriers to Acceptance of Diversity among Providers of Third-Party Credit Scores

If studies predating the Financial Crisis have already called for the expansion of the third-party credit score system to include non-legacy providers whose models consider more granular or nontraditional data, and if non-legacy entities have already begun to develop such credit score models, the question naturally becomes why does the legacy third- party credit score system persist? The answer lies in tradition as well as laws and guidelines that unintentionally codify the legacy system to the exclusion of new entrants in the third-party credit score system.


When third-party credit score models were first introduced in the twentieth century, one entity provided virtually all such scores, as is often the case with a nascent industry. Over time, that entity became synonymous with the term “credit score,” just as “Xerox®” has (improperly) become interchangeable with the term “copy,” and the word “Kleenex®” is frequently used by consumers, albeit improperly, to refer to “facial tissue.” References to this one legacy third-party credit scoring entity thus became pervasive in the consumer credit marketplace as third-party credit scores became integral to the largely automated underwriting process.


As financial regulators and lenders became familiar and comfortable with what would become the legacy third-party credit score system, explicit and implicit references to the dominant legacy provider (rather than to the term “credit score”) began to appear in regulations and guidelines, thereby creating in my opinion unintentional “brand endorsement” of the single-provider legacy system.20

For instance, Fannie Mae’s and Freddie Mac’s Seller-Servicer Guidelines explicitly require mortgage originators to use credit scores produced by the dominant legacy entity.21 These guidelines effectively prevent non- legacy entities from providing credit scores for use by lenders conducting underwriting for conforming mortgages.

More subtly, in another example, the Consumer Financial Protection Bureau’s (CFPB) “Ability to Repay” or “QM” regulation contains a safe harbor provision stating that certain loans will be eligible for the safe harbor if they meet the underwriting requirements of, and are eligible for purchase by, Fannie Mae or Freddie Mac, which as explained above, require use of the dominant legacy provider’s third-party credit scores.22 Building on this unintentional brand endorsement, the Office of the Comptroller of the Currency (OCC), Federal Reserve, Federal Deposit Insurance Corporation (FDIC), Federal Housing Finance Agency (FHFA), U.S. Securities and Exchange Commission (SEC), and Department of Housing and Urban Development (HUD) recently released their updated “Credit Risk Retention” or “QRM” proposed rule, which attempts to ensure that creditors may choose from among different credit score providers.23 Nonetheless, the proposed rule unintentionally endorses the legacy system by cross-referencing the Consumer Financial Protection Bureau’s (CFPB) QM regulation, which as previously addressed, requires use of the dominant entity’s legacy credit scores.

Brand endorsement of this dominant legacy provider is thus pervasive in the guidelines and regulations of the financial regulators, which in turn presents a significant barrier to accepted use of third-party credit scores from both other legacy and non-legacy entities.

Actions Financial Regulators May Take to Welcome Non-Legacy Providers of Third-Party Credit Scores

The financial regulators may address the unintentional brand endorsement by taking several steps to welcome non-legacy providers of third-party credit scores into the consumer credit marketplace. Such actions include removing all references to the dominant legacy provider— whether those are explicit or implicit—in their regulations, guidance, and pronouncements. By providing the legal grounds for additional entities to enter the third-party credit score marketplace, the regulators will give the lenders the permission they need to choose from a diverse set of credit score models.

Why the Time Is Ripe for an Improvement in the Third-Party Credit Score System

Having just experienced the worst financial crisis in recent memory, the time is now ripe for us to bring millions of “unscoreable” consumers into the consumer credit mainstream by diversifying the third-party credit score system. In the aftermath of the Financial Crisis , the Dodd- Frank Wall-Street Reform and Consumer Protection Act was passed, and many of the regulations required under such law are now being issued and will soon come into effect if they have not already. As a result, both regulators and lenders are already in the mindset to revisit and modify legacy practices.


We live in a democracy where we strive for equality for all, including equal access to credit on fair and affordable terms. In the twentieth century, a third-party credit score system was born that helped enable millions of Americans to pursue their dreams of home ownership, higher education, and greater mobility with their own automobiles. Despite these advancements, millions were unable to partake in the progress because they were deemed to be “unscoreable” under the legacy third- party credit score system. Now in the twenty-first century, we can honor our past by building on prior successes and improving credit scoring to allow for greater diversity in the provision of third-party credit scores that often serve a gatekeeping function to access affordable credit. In so doing, we will raise the economic well-being of our nation as a whole.