Run any Skill in Manus with one click

fair-lending-test-plan

Stars0

Forks0

UpdatedMay 9, 2026 at 06:00

Drafts a fair-lending test plan covering scope, products, decision points (marketing, underwriting, pricing, steering, servicing, loss mitigation), planned test types (redlining, comparative file review, statistical regression on underwriting and pricing, marketing distribution, steering), demographic-proxy methodology, less-discriminatory-alternative search where AI or ML models drive credit decisions, data and evidence asks, controls hypothesis, owners, and committee approval gate. The plan is the operationalization of the annual fair-lending risk assessment and the artifact a fair-lending committee approves before any test is run. Best for: - Annual fair-lending risk-assessment refresh where the test plan is the operationalization of the assessment. - Pre-exam fair-lending readiness where a regulator has signaled focus on a specific product, MSA, or decision point. - Targeted plan after complaint themes (chain to `complaint-theme-analysis`) or adverse-action review (chain to `adverse-action-review`) surfa

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

anotb

anotb/second-line-financial-services

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Compliance OfficersBusiness and Financial Operations Occupations·SOC 13-1041

File Explorer

13 files

SKILL.md

readonly

More from this repository

same repository

fintech-partner-controls

anotb/second-line-financial-services

Drafts the fintech-side controls evidence pack a sponsor bank's third-party risk function expects in its file: control inventory mapped to Reg E error-resolution timing, NACHA Operating Rules obligations the program operator owes upstream, FBO subledger reconciliation, sponsor-bank reporting cadence, customer-facing disclosure adherence (Reg E §1005.7-§1005.11, Reg DD), money-transmitter / MSB BSA posture where applicable, contract-clause adherence evidence under the program agreement, and a 12-month incident-history summary. Output is a Word memo plus an Excel control inventory, review-ready for the fintech's own second line and for production to the sponsor bank's TPRM team or to a state-MTL examiner. Best for: - A fintech, neobank, BaaS program, or wallet operator preparing or refreshing its self-evidence pack for a sponsor-bank annual review, sponsor-bank-led audit, or state-MTL exam. - Compliance has been asked to self-evidence Reg E §1005.11 error-resolution timing (10 / 45 / 90-day clocks), NACHA retu

2026-05-090

agentic-ai-controls

anotb/second-line-financial-services

Reviews and proposes controls for an agentic AI use case (an AI system that selects actions, calls tools, reads or writes systems of record, or operates with autonomy beyond single-turn generation) in a regulated financial-services firm. Output names the agent's scope and authority statement, the architecture and tool inventory with permissions and blast radius, the identity and authorisation posture, the human oversight points with effective oversight evidence, the prompt-injection-via-tool-output and tool-misuse threat assessment, the kill-switch and rollback procedures with drill evidence, the logging and audit posture, the incident response with regulator-notification triggers, the residual risk with accepted owners, and the recommended owner actions. Designed for second-line review of agents that book actions in real systems, not chat-only assistants. Best for: - A first-line owner has built or is building an agentic system that calls tools, reads from systems of record, or executes actions, and second-

2026-05-090

ai-risk-tiering

anotb/second-line-financial-services

Assigns a defensible risk tier (tier-1 through tier-4) to an AI or model use case using a multi-factor rubric, and books the tier alongside the named gates and validation depth it triggers. The tier is the routing decision that drives validation depth, monitoring frequency, committee path, and vendor-diligence depth for the rest of model risk and AI governance. Best for: - An intake record exists and second-line needs to set the tier before sequencing validation, monitoring, or committee work. - A periodic re-tiering exercise on the AI inventory after a change in scope, autonomy, customer exposure, vendor, or supervisory posture. - A sponsor has proposed a tier and second-line needs to challenge or concur with reasoning that an examiner can read. Not the right tool when: - The use case has not been intaked yet. Route to `ai-use-case-intake` first; the tier decision is decided against an intake record version. - The question is whether the use case is high-risk under the EU AI Act specifically. Route to `ai-

2026-05-090

ai-use-case-intake

anotb/second-line-financial-services

Turns a first-line AI or model use case description into a structured intake record at the front of the AI governance pipeline. Captures purpose, intended users, data sources, vendor and foundation-model dependencies, autonomy level, decision impact, regulatory exposure flags, proposed review gates, and the open questions a tier reviewer needs answered. The intake is the routing artifact downstream skills consume: ai-risk-tiering reads it to score the rubric, ai-act-triage reads it to scope Annex III overlap, model-card-builder reads it for system and data sections, validation-plan reads it to scope work, and the AI inventory of record consumes the structured object. Best for: - A first-line owner has proposed an AI use case and second-line needs the intake on file before tier, AI Act triage, or any downstream artifact is scoped. - An AI inventory refresh requires consistent intake metadata across in-flight, in-production, and decommissioned use cases. - A vendor-supplied AI tool is moving from POC to limite

2026-05-090

board-ai-risk-pack

anotb/second-line-financial-services

Drafts the AI risk committee pack the AI Governance Lead carries into the meeting: AI inventory state with heat map by tier, top AI risks with trajectory, recent AI incidents and near-misses, foundation-model vendor concentration, model performance trends, GenAI program status, AI governance maturity posture, and the decisions the committee owes this cycle. The pack is the firm's standing instrument for AI-specific board oversight, alongside (not inside) the enterprise risk committee pack. Best for: - Standing AI risk committee meeting (often quarterly) where the AI Governance Lead, CRO, and head of model risk need a curated view of AI posture rather than the full inventory dump. - The AI section of a board risk committee at firms without a standalone AI committee, when the board wants AI-specific framing rather than a heat-map row inside the enterprise pack. - Board education session on AI governance: tier mix, top risks, foundation-model exposure, GenAI program status, and the decisions in flight. - Regula

2026-05-090

genai-pre-prod-review

anotb/second-line-financial-services

Pre-production gate review for a GenAI use case before initial release or material expansion. Pulls together the upstream artifacts (intake, tier, model card, validation-plan results, prompt-injection review where applicable, RAG evaluation review where applicable, vendor evidence review where applicable) and produces a recommended decision (go, go-with-conditions, hold, no-go) with reasoning, named blocking and tracking conditions, owners, and source trace. The artifact a senior risk officer or AI risk committee secretary signs into the gate meeting. Best for: - A GenAI use case is at the pre-prod gate and the second-line function needs the gate-review memo with a clear recommendation. - A material expansion of an existing GenAI deployment (new user population, new tool, new corpus, new geography) needs a re-gate. - A regulator pre-meet, examiner request, or supervisory motion is asking for the gate package on a named GenAI use case. - A recurring revalidation cycle has triggered a gate moment and the commi

2026-05-090

name	fair-lending-test-plan
description	Drafts a fair-lending test plan covering scope, products, decision points (marketing, underwriting, pricing, steering, servicing, loss mitigation), planned test types (redlining, comparative file review, statistical regression on underwriting and pricing, marketing distribution, steering), demographic-proxy methodology, less-discriminatory-alternative search where AI or ML models drive credit decisions, data and evidence asks, controls hypothesis, owners, and committee approval gate. The plan is the operationalization of the annual fair-lending risk assessment and the artifact a fair-lending committee approves before any test is run. Best for: - Annual fair-lending risk-assessment refresh where the test plan is the operationalization of the assessment. - Pre-exam fair-lending readiness where a regulator has signaled focus on a specific product, MSA, or decision point. - Targeted plan after complaint themes (chain to `complaint-theme-analysis`) or adverse-action review (chain to `adverse-action-review`) surface a fair-lending red flag. - Bringing an AI or ML decisioning model into the fair-lending testing perimeter, including a less-discriminatory-alternative search. Not the right tool when: - The team needs the regression or comparative file review run, not the plan. This skill produces the plan; analytics runs the tests. - The question is the adverse-action notice itself (use `adverse-action-review`). - The question is Section 1071 small-business reporting readiness (use `section1071-readiness`). - A final fair-lending determination is required. The plan is reviewed and approved by counsel and the fair-lending committee; the determination follows the test, not the plan.
argument-hint	[risk-assessment ref, complaint-theme output, adverse-action review output, scope statement, model inventory pointer, or exam-readiness brief]

Fair-lending test plan

A fair-lending test plan is what the second-line fair-lending team produces so the fair-lending committee, the CCO, and (where directing) outside counsel can approve a year of testing before the first regression runs. It sets the products in scope, the decision points covered, the test types planned, the demographic-proxy method per test, the data and evidence asks, the owners and reviewers, and the named approval gate. The plan is the operationalization of the annual risk assessment; without an approved plan, the test is freelance work.

The skill serves both lenses. A 1.5-line fair-lending analyst inside the business uses it to consolidate the plan as it stands today; a 2-line independent fair-lending reviewer or fair-lending statistician uses the same skill to challenge what was drafted and to surface the test specifications that aren't there yet. The seam between the two is the source-trace block, the open-questions list, and the LDA-search posture for any AI or ML model in the perimeter.

The plan is a draft until the fair-lending committee approves it. Approval is the gate; this skill stops short of running tests, finalizing fair-lending determinations, approving credit decisions, finalizing adverse-action notices, or any customer-facing action.

Ask yourself first

Most of what the plan needs is on the table by the time someone reaches for this skill. A few things to settle before drafting:

What triggered the plan. Annual risk-assessment refresh, complaint-theme escalation, adverse-action-review red flag, regulator signal, model deployment into the credit-decisioning path, or a prior testing finding. Trigger drives scope and which upstream artifact the plan consumes.
Who approves the plan. Fair-lending committee is typical; the CCO, head of fair lending, and outside counsel often co-sponsor. Approver drives audience, format, and the privilege posture.
What products and decision points are in scope. Mortgage, indirect auto, credit card, unsecured installment, small-business, HELOC, and servicing each have their own data and proxy patterns. Decision points cover marketing, underwriting, pricing, steering, servicing, and loss mitigation; not every plan covers all.
Whether any AI or ML model drives a credit decision in scope. The answer flips on the LDA-search block and adds a model-feature review for race- or ethnicity-correlated proxies. The LDA-search expectation rests on Reg B §1002.6(a) effects-test framing and disparate-impact case law, not on the withdrawn CFPB Circulars 2022-03 and 2023-03; the underlying second-line discipline survives the bureau's interpretive shift.
What the source posture is. Public-only, public-plus-firm-policy, public-plus-firm-policy-plus-evidence, or connector-aware. Source posture sets what the plan can ask for and what carries [evidence needed].

When scope is supplied, the skill consumes it for institution, persona, source posture, sector overlay set, and cross-cutting overlay set. Otherwise it asks the practitioner the few facts it needs and defaults to public posture if the practitioner declines, noting in the plan that scope was not formalized.

How the plan gets built

The plan has the same spine across products and triggers. A senior practitioner walks it roughly in the order below, but the conversation surfaces sections in whatever order the upstream artifacts and the in-scope inventory arrive; the structured record sorts itself.

Risk-assessment summary. What the underlying risk assessment said, which complaint themes, prior testing findings, regulator focal items, and exam-cycle posture feed this plan. Pull from the risk-assessment record, the complaint-theme-analysis output, and the adverse-action-review output where those exist. The summary anchors why each test in the plan exists.

Scope. Products, decision points, period, geographies, channels, and explicit exclusions. Servicing and loss mitigation are decision points where complaints often originate; if they're out of scope, name them out. Channels (branch, digital, broker, marketplace, partner-of-record) drive the redlining and steering tests.

Test perimeter and AI / ML model inventory in scope. List every model in the credit decisioning path: model id, version, decision use (underwriting score, pricing tier, marketing pre-screen, fraud-deny, adverse-action reason coding), AI/ML flag, in-house or vendor, current validation status, model-card pointer. The inventory feeds the LDA-search list and the model-feature review.

Test types planned. Each in-scope test gets its own specification block. The standard set:

Redlining test. Peer or comparator selection (HMDA peer aggregate for mortgage; market peer for non-HMDA), MSA or assessment-area scoping, marketing distribution by census-tract demographic, branch and loan-officer distribution, application-volume disparity, origination-volume disparity, and the data anchor (HMDA LAR, §1071 register where operative). Public DOJ Combatting Redlining Initiative consent orders set the comparator-set construction patterns the plan follows.
Comparative file review. Matched-pair design, sampling frame, sample size, exception-coding scheme, override-review approach. Match variables (credit indicia, DTI, LTV, alternative-data feature buckets where the model uses them) are listed; the matching field set is what the second-line reviewer challenges.
Statistical regression on underwriting decisions. Model specification, named controls (creditworthiness variables, capacity variables, collateral variables for secured products), demographic-proxy method, software, statistical-significance threshold, and the population frame. For mortgage, the proxy is HMDA self-reported demographics; for non-mortgage consumer credit, BISG; for §1071-covered small-business, the §1071 self-reported demographics once operative.
Statistical regression on pricing. Rate-spread analysis (mortgage), margin or markup analysis, fee analysis. Same proxy and threshold framing.
Marketing distribution test. Channel, geography, audience targeting, and a dark-pattern check on digital-channel acquisition. Cross-reference marketing-claim-review for content-side disparities.
Steering test. Product placement (where multiple products are available), loan-officer incentive design, and AUS-result-vs-actual-product-placed disparities.
Servicing and loss mitigation review. Where in scope; cross-reference complaint themes for outcome disparities in workout, modification, and default-resolution decisions.
Less-discriminatory-alternative search. Required for any AI/ML model in the underwriting, pricing, or marketing pre-screen path. The search documents the alternatives considered, the disparate-impact metric used to compare, the business-necessity framing for the candidate selected, and the residual disparity. The discipline rests on Reg B §1002.6(a) effects-test framing and HUD's discriminatory-effects standard at 24 CFR §100.500; the LDA expectation predates and outlasts the now-withdrawn CFPB Circulars 2022-03 and 2023-03.

Each test specification names: test_id, test_type, decision_point, hypothesis, method, demographic_proxy_method, sample_size where applicable, data_required[] (field, system of record, owner, gap flag), statistical_threshold, lda_required boolean, owner (first line), reviewer (second line), due_date, and escalation_path. A regression with no model spec is not a plan; a comparative file review with no matching variables is not a plan.

Demographic-proxy methodology. Per-test field is mandatory because defaulting to BISG everywhere ignores HMDA self-reported demographics, which are stronger evidence for mortgage. Plan documents which proxy applies per test, the proxy-uncertainty handling, and the limits of the method (BISG accuracy varies by geography and surname distribution; the CFPB methodology paper documents the limits).

Less-discriminatory-alternative testing plan. Where any in-scope decision is AI/ML, the LDA block lists the alternatives to be tested, the disparate-impact metric, the business-necessity framing, and the residual-disparity benchmark. The block cites Reg B §1002.6(a), HUD's discriminatory-effects framework under 24 CFR §100.500 (for dwelling-secured credit), and the April 2023 Joint Statement (still operative across DOJ Civil Rights, FTC, EEOC; CFPB posture narrowed). The withdrawn CFPB Circulars 2022-03 / 2023-03 are preserved in references/source-anchors.md as historical context.

Controls hypothesis and named first-line controls being relied on. What controls in the first line the plan assumes are working: marketing-channel monitoring, underwriting-policy-exception logging, pricing-discretion limits, model-monitoring KRIs. The hypothesis is that the controls operate as designed; the test is partly a test of the controls.

Test owners, reviewers, escalation path, and committee approval gate. First-line owner per test, second-line reviewer per test, named escalation forum (fair-lending committee, model risk committee for AI/ML models, AI risk committee where one exists), and the committee approval gate the plan must clear before any test runs.

Reporting plan. Test-result memo template, fair-lending committee deck shape, regulator-ready summary template if a regulator request is anticipated. The plan does not draft these; it names the templates the test results will land in.

Open questions and assumptions. Privilege posture is mandatory because fair-lending testing memos can attract attorney-client and attorney-work-product privilege; the legal_privilege_posture field is filled (attorney-client-privileged, attorney-work-product, not-privileged, or posture-pending-counsel). Open questions for counsel and the committee land here. Assumptions list the facts being treated as fixed.

Source trace and confidence. Every material claim in the plan cites a source from references/source-anchors.md (or the relevant overlay) by file path. Vendor and firm-internal evidence carry separate confidence labels; do not collapse them into one line.

AI / ML overlay

When any in-scope decision involves an AI or ML model, the AI overlay fires inside the named sections rather than as a separate document:

Test perimeter: the model is named in the inventory with version, decision use, validation status, and model-card pointer (consume model-card-builder output where present).
Test types: the LDA-search test is mandatory; a model-feature review for protected-class-correlated proxies is added under the regression-on-underwriting block; a Reg B §1002.6 effects-test framing on the feature list is documented.
Adverse-action posture: the AAN sample's specificity test runs against Reg B §1002.9 and the Staff Commentary directly (the CFPB AI circulars that previously framed this are withdrawn); the plan references but does not duplicate adverse-action-review.
Source anchors: Reg B §1002.6(a), HUD 24 CFR §100.500 (dwelling-secured), the April 2023 Joint Statement, and HUD FHEO algorithmic-underwriting guidance from references/source-anchors.md. The withdrawn CFPB circulars are preserved as historical context.

The overlay is mandatory once triggered. Missing the LDA-search block on a plan that has an AI/ML model in scope is what the second-line reviewer or the fair-lending statistician flags first when the plan lands for committee.

Sector overlays

When the scope names a sector, load the matching references/sector-overlays/<sector>.md:

Banking — depository specifics: HMDA-reportable mortgage and HELOC, indirect auto, credit card, deposit overdraft fairness, CRA assessment-area overlap.
Capital markets — securities-based lending fair-lending scope (limited but in-scope where retail); private-banking and wealth-credit boundary; not principally a fair-lending bucket but the perimeter is named.
Payments-fintech — sponsor-bank model: where fair-lending duty sits between bank and fintech-of-record per the program agreement; BNPL fair-lending under ECOA / Reg B as applied to the product structure (the May 2024 CFPB BNPL Interpretive Rule was nullified by Pub. L. 119-11 (May 9, 2025); historical only.); merchant cash advance fair-lending boundary; data-only-decisioning models with no traditional credit data.
Insurance — life and health insurance fair-lending boundary (state-DOI unfair-discrimination, not ECOA / FHA); flag the scope boundary so reviewers do not over-extend ECOA into insurance.

Cross-cutting overlays

Conduct overlay loads where the plan crosses UDAAP themes (marketing distribution, dark patterns, steering); cross-reference udaap-risk-review. Privacy overlay is not primary on this skill (privacy questions sit on adverse-action-review and on the analytics workflow that runs the tests). Climate is not applicable.

Quality bar

Holds across every plan: every material claim cites a source from references/source-anchors.md (or a loaded overlay) by file path; unsupported claims are marked [evidence needed]; section references that cannot be confirmed get [verify section] in the source-anchors file (not in the plan body); source evidence, management assertions, public-source obligations, generated inferences, and open legal or compliance questions stay distinguishable; no named institutions appear in narrative unless they are public defendants in a finalized enforcement action with a published consent order; the plan stops at draft and the fair-lending committee approves before any test runs; per-test demographic-proxy field is filled (no default-to-BISG-without-justification); LDA-search block is present whenever an AI/ML model is in scope; legal_privilege_posture is filled; committee_approval_gate is named.

Adaptation

Plan depth and length scale to the trigger and the in-scope inventory. An annual refresh covering one product reads short; a refresh after a regulator signal covering mortgage, indirect auto, and an AI pre-screen reads longer. Audience drives shape: fair-lending committee deck reads structured; outside-counsel direction memo reads denser; statistician working draft reads in test-spec vocabulary. The sector overlay set drives which references/sector-overlays/<sector>.md is loaded; a sponsor-bank fintech program may load two. Source posture (public-only through connector-aware) drives the data-required asks; a public-only plan flags the data fields that would be needed but are not yet accessible.

Pointers

references/source-anchors.md — citations and excerpts for the named anchors.
references/sector-overlays/banking.md, insurance.md, capital-markets.md, payments-fintech.md — sector-specific framing loaded per scope.
references/cross-cutting/conduct.md — UDAAP overlap, loaded where marketing distribution, steering, or dark-pattern themes are in scope.
references/firm-overlay.md — firm-installed taxonomy, named committees, fair-lending statistician roster, system-of-record paths (consumed when present).
templates/default-output.md — plan template.
schemas/fair-lending-test-plan.schema.json — structured-output contract.
examples/mortgage-redlining-test.md, examples/algorithmic-underwriting-test.md — public-source-derived worked examples.

Output

Two artifacts: the plan in templates/default-output.md shape and a structured record conforming to schemas/fair-lending-test-plan.schema.json. The fair-lending committee approves the plan; counsel sets privilege posture; downstream consumers (the analytics workflow that runs the tests, the test-result memo template, the regulator-ready summary template) read the structured record. The schema is the cross-skill contract; additive changes only. Add fields, do not rename or repurpose them. A breaking change is a versioned migration with the downstream consumers told in advance.