US banks denied services over reputation concerns: can they prove why?

The report and the dispute

On 14 January 2025, the Office of the Comptroller of the Currency published a report on account denials at the nine largest US banks between 2022 and 2024 ^[1]. It found that some customers were denied services over concerns about reputation risk. Banking experts quoted by Compliance Week believe the timing and framing suggest political motivations, and they note that reputation risk is a real concern for banks.

The dispute isn't new. When a bank refuses or ends a relationship, the customer often wants to know why. When the decision involves screening, risk scores or automated checks, the question becomes sharper: what did the system flag, and who looked at it?

A question that applies everywhere

In the EU, rules on automated decisions about people have been in place since the GDPR took effect in 2018. Article 22 says people have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on them, unless certain conditions are met ^[2]. When automation is used, the person must be given the right to human intervention, to express their view and to contest the decision.

For high-risk AI systems—which include credit assessments of individuals—Article 12 of the AI Act requires automatic logging of events over the system's lifetime, from 2 December 2027 ^[3]. The rule says what to log. It doesn't say how to protect the logs or prove they haven't been edited.

That's where the difficulty lies. A refusal is a short conversation. The question comes months later, when the customer disputes the grounds and asks what information the decision was based on. At that point, the record is what counts.

Like receipts: nobody cares until there's a dispute

Think of receipts in your wallet. You keep them because one day the card charge might not match what you remember, or the warranty might matter. Logs work the same way. When everything goes smoothly, they sit unread. When something is questioned, they're the first thing anyone asks for.

The trouble is that logs are kept by the people who could also change them. A customer who disputes a decision will ask what the screening showed at the time. If the log has been edited—even accidentally—it's harder to rely on.

What this means for you

If your organisation makes decisions about people, here are three questions to ask now:

• Could you show, six months from now, what information a decision was based on and which version of your risk model was running?
• If a customer disputes a refusal, do you have a record you can stand behind, or only a log that someone with the right access could have quietly edited?
• When the high-risk logging requirements apply from December 2027, will your logs be ready to be questioned?

Reputation risk is a real concern for banks. The question isn't whether they should screen for it, but whether they can later show what the decision rested on.

How a digital witness fits this case

Here, the thing to seal is each screening decision as it's written: the customer reference, the model version, the risk indicators that were flagged, the score and the name of the reviewer who looked at it. Sealing takes a fingerprint of the record, not the record itself, so the decision never leaves your systems.

If the decision is challenged a year later, anyone you share the record with can check that it's exactly what was written on the day. Change a single character in the log and the fingerprint won't match.

That's what WitniumChain does. Internal audit, supervisors and, if it comes to it, a court can verify the record independently. The witness doesn't show that the decision was fair or that the grounds were reasonable. It shows that the record hasn't changed since it was sealed.

Your system sends the fingerprint through the REST API, the SDK or the MCP server, and gets a witness ID back. The first 2,000 witnesses a month are free.

How it would work

1. When a screening decision is written to the log, your system calculates a fingerprint and seals it.
2. Months later, when the customer disputes the refusal, you calculate the fingerprint again.
3. If it matches, the record is unchanged. If it doesn't, something has been altered since sealing, and that shows.

What to watch

In the EU, the high-risk requirements in Annex III of the AI Act—including automatic logging for credit assessments of individuals—apply from 2 December 2027. The rule requires logs; proving they hold up as evidence is a separate question, and one to settle early.

---

This article is written with AI assistance and reviewed and published by people. It is sealed with WitniumChain.