For years, fair lending management centered on a relatively straightforward goal: demonstrate that the institution did not discriminate. Examiners looked for disparities and asked whether relevant, nondiscriminatory factors explained them.
Over the years that expectation changed. It became insufficient merely to show an absence of discrimination; institutions were increasingly expected to show they were managing the risk of potential discrimination.
This shift lowered the bar for what could be characterized as a pattern or practice and created a practical burden of “proving a negative.” It also made residual risk the central concept driving examination scope and intensity.
Residual risk is the product of two factors: inherent risk and the strength of controls. Inherent risk is the risk that exists before considering any controls—driven by product complexity, decentralized operations, growth, third-party reliance, regulatory complexity, and market demographics.
Controls are the policies, procedures, monitoring systems, training, board oversight, and independent reviews that mitigate that risk. Examiners focus resources where residual risk remains elevated. Strong controls around a high-inherent-risk product can result in limited additional work; weak controls around a moderate-risk product can expand the review.
The practical implication is that data and documentation carry more weight than verbal explanations. Large banks should expect statistical analysis during the exam cycle. Disparities without clear, quantified policy and tracking invite deeper scrutiny.
At the same time, the environment has seen a correction after the 2021–2024 spike in sustained pressure. Examinations may be more amenable in the near term if an institution has maintained its program, but relaxing efforts creates latent risk that can surface under a different examination posture later.
Effective risk management therefore requires institutions to know the story their data tells, quantify inherent risk by product and activity, document the controls that address it, and continuously narrow the residual-risk gap.
That is the work that compliance and the business lines should be doing in conjunction, and will shape both examination outcomes and consumer-protection outcomes.