By anotb
Consumer compliance and fair lending skills for fair-lending testing, adverse action review, UDAAP risk review, Section 1071 readiness, complaint themes, and marketing claim review.
Reviews a population of adverse-action notices and the underlying credit decisions field-by-field — timing, content, specificity of cited reasons, traceability of those reasons back to the model and data, FCRA risk-score disclosure overlay, and disparate-impact red flags. Produces a Word memo for the consumer compliance second-line, the fair-lending lead, model risk, and counsel; flags non-compliant notices and AI / complex-model accuracy gaps; recommends action without finalizing any customer-facing change. Best for: - Consumer compliance second-line sampling adverse-action notices on a credit product, testing the population against the notification rule's timing and content obligations. - Model risk or fair-lending review of a credit decision model (including AI / ML scorecards) where adverse-action reasons are produced from feature contributions and the reviewer needs to test that the cited reasons are the principal reasons supported by the model. - Triage of consent-order remediation or supervisory finding around adverse-action notice deficiencies, where the population needs to be re-tested against the operative rule and the firm's remediation plan. Not the right tool when: - The question is the underwriting model's predictive performance or stability rather than its adverse-action reason generation (use `ai-governance-model-risk/validation-plan`). - The question is the pricing tier or ability-to-repay calculation rather than the notice content (use `compliance-testing` for product-level review). - The reviewer needs a final fair-lending determination or a credit decision; this skill surfaces red flags and recommends action for human decision, it does not approve, deny, or finalize.
Drafts a Section 1071 small-business lending data readiness assessment under the CFPB's revised final rule (May 1, 2026; effective June 30, 2026; compliance date January 1, 2028). Covers covered-financial-institution determination against the 1,000-covered-transactions threshold, covered-application and covered-credit-transaction scoping, the 12 CFR 1002.107 data-point inventory, applicant-demographic data-collection mechanics, the 12 CFR 1002.108 firewall design, recordkeeping under 12 CFR 1002.110, and reporting-and-filing readiness against the CFPB Filing Instructions Guide. Produces a readiness matrix per data point and a narrative gap memo for the named accountable executive. Best for: - Pre-compliance-date readiness check for a covered financial institution against the January 1, 2028 compliance date (now a single compliance date for all CFIs at or above the 1,000-transaction threshold; the prior tier-based schedule is superseded). - Threshold-determination work for a firm sitting at or near the 1,000 covered-credit-transactions floor in each of the two preceding calendar years. - Annual operating-state readiness refresh post-go-live, against the firm's first or subsequent submission cycle. - Vendor or loan-origination-system readiness assessment where 1071 data capture is vendor-supplied (the firm remains the covered financial institution; the vendor is the data-collection agent). Not the right tool when: - The question is HMDA / Reg C readiness (different rule, different population — refer the reviewer to a HMDA-specific routine). - The question is fair-lending testing on the originated 1071 portfolio (use `fair-lending-test-plan`; the 1071 dataset feeds fair-lending testing once it exists). - The question is the adverse-action notice for a small-business application (use `adverse-action-review`; Reg B 1002.9 applies). - The question is the firm's overall consumer compliance management system (use `risk-compliance-core` or `compliance-testing`).
Drafts a second-line UDAAP review memo for a product, feature, fee, disclosure or customer-experience flow, marketing motion, complaint pattern, or enforcement theme. Element-by-element analysis under Dodd-Frank §1031 (unfairness, deception, abusiveness) and §1036; consumer-harm hypothesis with population and magnitude; AI / algorithmic-discrimination tie-in where automated systems are in path; severity rating with rubric; conduct-risk implications; recommended remediation; cross-references to complaint, marketing, adverse-action, and fair-lending review. The memo surfaces UDAAP risk for human decision; it does not finalize a UDAAP determination, take down a live product, execute consumer redress, or issue any customer-facing action. Best for: - Pre-launch UDAAP review of a new product, feature, fee structure, or disclosure flow before a product or risk committee approves launch. - Targeted review after a complaint cluster (chain to `complaint-theme-analysis`), a regulator inquiry, or a peer enforcement action signals potential exposure on an analogous fact pattern in the firm's footprint. - Annual UDAAP risk-assessment refresh by product line, including overdraft, deposit-fee, card, mortgage-servicing, auto add-on, BNPL, instant-funding, and subscription-style fee mechanics. - Post-incident root-cause review where consumer harm has been alleged through complaints, social signals, employee escalations, or regulator engagement. - Annual review of an AI-driven personalization, pricing, or communication surface where the bureau's existing UDAAP authority reaches the algorithmic outcome. Not the right tool when: - The question is fair-lending under ECOA, the FHA, or §1071 (use `fair-lending-test-plan`; UDAAP and fair-lending overlap on themes such as steering and marketing distribution but are distinct legal frameworks). - The question is the adverse-action notice itself (use `adverse-action-review`; UDAAP touches AAN content where reasons obscure the actual decision logic, but the AAN-specific Reg B §1002.9 review lives next door). - The question is asset-level marketing-claim substantiation on a single creative or piece of copy (use `marketing-claim-review`; this skill addresses UDAAP at the product, fee, flow, or theme level, not the asset level). - The question is whether to file a complaint-theme escalation memo to the conduct or consumer-outcome committee (use `complaint-theme-analysis`; that skill produces the theme; this one tests a theme against the UDAAP elements). - A final UDAAP determination, a launch decision, a takedown, or a consumer-redress program is required. The memo is the input to the decision; the decision is reserved for the CCO, conduct-risk lead, head of consumer compliance, fair-lending committee, conduct committee, product committee, and counsel.
Aggregates and themes a population of consumer complaints (CFPB Complaint Database extracts, internal complaint-management records, app-store reviews, social signals, state-AG referrals, employee escalations) into named themes with severity, root-cause hypotheses, regulatory exposure mapping, and trended movements. Produces two artifacts: an Excel theme-aggregation matrix and a Word memo with the narrative analysis. Themes (not individual complaints) are the unit of analysis. The skill surfaces signal for the consumer compliance committee, the conduct committee, and the cross-skill chain into UDAAP, fair-lending, and adverse-action review; it does not finalise UDAAP determinations, fair-lending findings, or actions on individual complaints. Best for: - Quarterly or monthly complaint-themes pack to the consumer compliance committee, conduct committee, or risk committee. - Pre-exam preparation: re-running the firm's last 12 to 24 months of CFPB Complaint Database public data (and the firm-internal channels) against the current product set to triangulate likely examiner focus areas. - Triage after a regulator inquiry or a peer enforcement action on a specific product, to scope the population and trend at the firm. - Input to `udaap-risk-review` or `fair-lending-test-plan` when a theme suggests a specific product, fee, flow, or geographic concentration warrants element-by-element or finding-grade analysis. - Annual conduct-risk surveillance pack where complaint themes are the canonical signal feeding the conduct framework. Not the right tool when: - The question is one specific complaint disposition (use the firm's complaint case-management workflow). - The question is whether one marketing claim is misleading (use `marketing-claim-review`). - The question is statistical fair-lending testing on outcomes data (use `fair-lending-test-plan`; this skill flags, that skill finds). - The question is element-by-element UDAAP analysis on a specific product, fee, or flow (use `udaap-risk-review`; this skill themes the population, that skill tests the elements). - The question is the firm's overall CMS or compliance-program quality (use the broader compliance-testing or risk-compliance-core skills).
Drafts a fair-lending test plan covering scope, products, decision points (marketing, underwriting, pricing, steering, servicing, loss mitigation), planned test types (redlining, comparative file review, statistical regression on underwriting and pricing, marketing distribution, steering), demographic-proxy methodology, less-discriminatory-alternative search where AI or ML models drive credit decisions, data and evidence asks, controls hypothesis, owners, and committee approval gate. The plan is the operationalization of the annual fair-lending risk assessment and the artifact a fair-lending committee approves before any test is run. Best for: - Annual fair-lending risk-assessment refresh where the test plan is the operationalization of the assessment. - Pre-exam fair-lending readiness where a regulator has signaled focus on a specific product, MSA, or decision point. - Targeted plan after complaint themes (chain to `complaint-theme-analysis`) or adverse-action review (chain to `adverse-action-review`) surface a fair-lending red flag. - Bringing an AI or ML decisioning model into the fair-lending testing perimeter, including a less-discriminatory-alternative search. Not the right tool when: - The team needs the regression or comparative file review run, not the plan. This skill produces the plan; analytics runs the tests. - The question is the adverse-action notice itself (use `adverse-action-review`). - The question is Section 1071 small-business reporting readiness (use `section1071-readiness`). - A final fair-lending determination is required. The plan is reviewed and approved by counsel and the fair-lending committee; the determination follows the test, not the plan.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Plugins for second-line and 1.5-line financial-services work. Skills cover what risk and compliance teams (and the advisory practitioners who support them) actually produce: scoping a review, mapping obligations, building a control matrix, drafting a model card, writing up an issue, building a vendor-diligence pack, packaging a risk-committee read, working a SAR / no-SAR file, prepping for a supervisory cycle, and so on. Skills are grounded in regulatory and standards material, with sector context (banking, capital markets, insurance, payments / fintech) loaded conditionally from the scoping record.
Built primarily for Claude (and Claude Code), but the skill files follow the open SKILL.md format and can be loaded into other agentic systems that support it: GPT, Gemini, in-house open-weights deployments, or anything else that reads agent skills. The skills are markdown plus optional schemas; the format is the standard, the work product is what travels.
The repo extends Anthropic's published financial-services plugin family. Where Anthropic's plugins cover the cross-industry first-line baseline (financial analysis, banking deal work, equity research, PE, wealth, fund admin, ops), these go deeper into US second-line and 1.5-line work and US supervisory expectations.
Second-line and 1.5-line practitioners inside regulated firms: model-risk leads (MRMO), AI governance leads, third-party risk managers (TPRM), BSA / AML officers, sanctions officers, compliance heads (CCO), fair-lending and UDAAP review teams, controls testing and internal audit teams, risk reporting and CRO-office teams, regulatory-affairs and regulatory-change teams, operational-resilience leads, fund-board secretaries, disclosure committees.
And the advisory and consulting teams running the same work for those firms.
If you work in 1.5L, 2L, or adjacent functions, the skills let Claude (or other agentic systems supporting the SKILL.md format) draft alongside you, like a colleague who knows the work and defers to your judgement on the call.
references/sector-overlays/<sector>.md inside the relevant capability skill, loaded conditionally from the scoping record.references/source-anchors.md with the regulatory and standards citations they lean on. US-deep, with EU as overlay and UK as see-also.The skill set is public-source-derived and anonymous, with no firm-specific policy baked in.
Standalone agent plugins (one-shot reviewers that orchestrate related skills end-to-end) are not in this release. The next iteration adds a maker / checker loop with genuine context-isolated subagent forking, primary-plus-critic two-agent shape, and plugin dependencies in place of bundled-skill copies. See ROADMAP.md for the target shape.
| Plugin | What it covers |
|---|---|
risk-compliance-core | Scoping, obligation mapping, control matrices, evidence binders, issue write-ups, human-review gates, policy-gap reviews. |
regulatory-change-management | Regulatory impact assessment, rule-to-obligation extraction, policy diffs, implementation plans, exam briefs. |
ai-governance-model-risk | AI use-case intake, AI risk tiering, EU AI Act triage, model cards, validation plans, agentic-AI controls, board AI-risk pack, GenAI deep-dive (prompt injection, RAG eval, pre-prod review, LLM vendor evidence). |
third-party-operational-resilience | Vendor diligence, criticality, contract-gap review, exit plans, concentration, DORA register, severe-but-plausible resilience testing. |
compliance-testing | Test plans, control sampling, evidence requests, exception analysis, workpapers, QA review. |
risk-reporting | Risk committee packs, BCBS 239 self-assessment, KRI commentary, SEC cyber-disclosure readiness, attestation packs, management responses to MRA / MRIA / audit findings. |
financial-crime-governance | CDD review, EDD escalation packs, SAR-decision QA, AML model monitoring, sanctions-screening QA, negative-news triage. |
consumer-compliance-fair-lending | Adverse-action review, fair-lending test plans, UDAAP risk review, Section 1071 readiness, complaint-theme analysis, marketing-claim review. |
npx claudepluginhub anotb/second-line-financial-services --plugin consumer-compliance-fair-lendingAnalyze RFPs, develop proposals, apply strategic frameworks, and build implementation plans. Create executive deliverables for strategy, operations, and transformation engagements.
Regulatory change management skills for impact assessment, obligation extraction, policy diffing, implementation planning, and exam brief preparation.
AI governance and model risk skills for AI intake, risk tiering, model cards, validation planning, agentic controls, EU AI Act triage, AI vendor review, and board risk packs.
Third-party risk and operational resilience skills for vendor diligence, criticality assessment, DORA registers, contract gaps, exit plans, resilience testing, and concentration risk.
Core GRC workflow skills for obligation mapping, control matrices, evidence binders, issue write-ups, human-review gates, and policy gap reviews.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use
Tools to maintain and improve CLAUDE.md files - audit quality, capture session learnings, and keep project memory current.
Develop, test, build, and deploy Godot 4.x games with Claude Code. Includes GdUnit4 testing, web/desktop exports, CI/CD pipelines, and deployment to Vercel/GitHub Pages/itch.io.
A growing collection of Claude-compatible academic workflow bundles. Covers scientific figures, manuscript writing and polishing, reviewer assessment, citation retrieval, data availability, paper reading, literature search, response letters, paper-to-PPTX conversion, and evidence-grounded Chinese invention patent drafting. Rules are organized as reusable skill folders with explicit workflows and quality checks.
Create new skills, improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, or benchmark skill performance with variance analysis.