Adverse Action Notices: When They’re Due and What They Must Say

Adverse action notices look like a solved problem. Pick the model form, fill in the reasons, send it. Then an exam or a sponsor bank review pulls a sample and finds notices sent on day 34, reasons that don’t match the underwriting model, and credit score sections left blank.

Two laws drive these notices. One is the Equal Credit Opportunity Act, through Regulation B (opens in a new tab). The other is the Fair Credit Reporting Act (opens in a new tab). They overlap without matching. The triggers differ, the content differs, and one law’s disclosure doesn’t satisfy the other’s.

This reference covers the triggers, deadlines, content, and failure points. It’s for lending compliance at banks and credit unions, fintech lenders, and the sponsor bank teams that oversee partner lending programs.

What counts as adverse action?

Under 12 CFR 1002.2(c) (opens in a new tab), adverse action has three parts. It’s a refusal to grant credit in substantially the amount or on substantially the terms requested, unless the applicant accepts or uses a counteroffer. It’s a termination or unfavorable change to an account that doesn’t affect all or substantially all of a class of accounts. And it’s a refusal to increase a line when the customer applied for the increase.

Reg B carves out several actions. Steps taken because of default, delinquency, or inactivity on the account aren’t adverse action. Neither is a refusal because the law prohibits the credit, or because the creditor doesn’t offer the product requested. Most point-of-sale declines are excluded too.

The FCRA starts from the same definition and adds to it. 15 U.S.C. 1681a(k) (opens in a new tab) also covers any action in connection with an application, or a transaction the consumer started, that is adverse to the consumer’s interests. That gap catches programs out. A counteroffer the applicant accepts isn’t adverse action under Reg B, but if a consumer report drove the worse terms, it can still require an FCRA notice.

When is each notice due?

The table lays out the common situations, the rule under each law, and where programs slip. Reg B sets most of the deadlines. The FCRA sets no fixed day count, and Reg B’s sample forms C-1 through C-5 combine both sets of disclosures.

Situation	Reg B (ECOA)	FCRA	Watch for
Denial of a completed application	Within 30 days of the completed application, with specific reasons or the right to request them	Score disclosure, CRA contact, and rights notices, if a consumer report was used	Clock starts at a complete file, not at the decision
Incomplete application	Within 30 days, either a decision notice or a notice of incompleteness listing what’s missing and a deadline	Applies only if a report figured in the decision	“Incomplete” can’t be the reason if the file had enough to decide
Counteroffer	Within 30 days; adverse action notice within 90 days if not accepted or used	Can be adverse action even if accepted, when a report drove the terms	A combined notice (Form C-4) avoids a second mailing
Line decrease or closure	Within 30 days, unless class-wide or tied to default, delinquency, or inactivity	Notice if the action relied on a consumer report	Confirm account review actions get notices
Information from a non-CRA source	Specific reasons still required	Disclose the right to ask what the information was; answer requests made within 60 days	Classify each data vendor as CRA or non-CRA
Application through a third party (fintech, dealer, broker)	Each denying creditor notifies, directly or through the third party; the notice names each creditor	Same duties for the user of the report	The notice names the brand but not the bank
Business credit, revenue of $1 million or less	30-day rules apply; action may be stated orally; reasons disclosure may come at application	Check if an owner’s consumer report was used	Startup business applications follow these rules
Business credit, revenue over $1 million	Notice within a reasonable time; written reasons if requested within 60 days	Check if an owner’s consumer report was used	Trade credit follows these rules too
Creditor with 150 or fewer applications last year	Oral notification satisfies the rule, including reasons	Score disclosure must still be written or electronic	Keep a record of each oral notice

Sources: 12 CFR 1002.2(c) and 1002.9, and the official interpretations in Supplement I to Part 1002; 15 U.S.C. 1681a(k) and 1681m.

What the notice has to say

A Reg B notice must be in writing, except for the small-volume and business credit rules. It states the action taken, the creditor’s name and address, the ECOA anti-discrimination notice, and the name and address of the federal agency that administers ECOA compliance for that creditor. It then gives either the specific reasons or the applicant’s right to request them within 60 days.

The reasons must be specific and name the principal reasons for the action. Section 1002.9(b)(2) says that citing internal standards or policies, or a failure to reach a qualifying score, is insufficient. The official interpretations (opens in a new tab) add that the reasons “must relate to and accurately describe the factors actually considered or scored by a creditor.” More than four reasons is not likely to help the applicant.

The FCRA notice under 1681m(a) (opens in a new tab) covers different ground. If a consumer report figured in the decision, the creditor discloses the credit score it used. It also gives the range of possible scores, the key factors that hurt the score, the date of the score, and who provided it. The notice also includes the consumer reporting agency’s contact information, a statement that the agency didn’t make the decision, and the consumer’s rights to a free report within 60 days and to dispute its accuracy.

The two sets of disclosures don’t substitute for each other. The commentary is direct. It says, “Disclosing the key factors that adversely affected the consumer’s credit score does not satisfy the ECOA requirement to disclose specific reasons.” A notice that lists only score factors has a Reg B problem.

Where notice programs break

The most common failure is reason codes that fall out of step with the model. A lender retrains its underwriting model, adds attributes, or changes cutoffs, and nobody updates the mapping that turns model output into notice reasons. The notices still look complete. They just describe a model that no longer exists.

On May 12, 2025, the CFPB withdrew its circulars (opens in a new tab) on adverse action for complex algorithms (2022-03) and on use of the sample forms (2023-03). Some programs read that as relief. It isn’t. Section 1002.9(b)(2) and the commentary still require reasons that describe the factors actually scored, whatever kind of model produced the decision.

The second failure is the clock. The 30 days run from a completed application, and a completed application is one with all the information the creditor normally considers. Programs that measure from the underwriting decision, or that let files sit in a document queue, miss the deadline without noticing.

The third is the bank-fintech handoff. When a fintech sends notices for the bank, the notice still has to give the creditor’s name and address. In a program where the bank is the lender of record, that’s the bank, and a notice showing only the app’s brand fails the test.

When a notice goes through a third party, the commentary says the creditor isn’t liable for the third party’s error if it supplied accurate, timely information and keeps reasonable procedures. For the bank, that defense rests on its oversight file. It belongs on the regulatory map a sponsor bank expects, and in the due diligence answers the fintech gives.

The fourth is data sources. A lender that uses bank account data, employment verification, or other vendor data has to decide whether each vendor is a consumer reporting agency. The answer changes the notice. Picture a fintech that adds a cash-flow data vendor, keeps its old template, and never adds either the CRA disclosures or the non-CRA right-to-request language.

Last, account management. In many programs, credit line reviews and closures run in a servicing system that gets tested less often than origination. Those actions trigger the same 30-day rule unless they fall in an exception. Notice failures also show up in fair lending reviews, since reasons are the record of how the decision was made, as covered in Reg B Dropped Disparate Impact. Fair Lending Programs Shouldn’t.

How to put it in place

1. Build a notice map from every decision point. List every place the program declines, counteroffers, cuts a line, or closes an account, including servicing and account review. Assign each one a template, a clock, and a system owner. The Lending Compliance Kit includes an adverse action procedure with adverse action, incomplete application, and counteroffer notices. The CCO or lending compliance officer owns the map, and the evidence is a dated version approved by compliance.
2. Tie reason codes to the model, and recheck them at every model change. Credit risk keeps a mapping from each model factor to a notice reason, versioned with the model. Compliance signs off before any model release goes live. The evidence is the mapping document, the change log, and the sign-off for each release.
3. Test notices on a fixed schedule. Second-line compliance pulls a sample of each action type at least quarterly and runs it against the checklist below. In bank-fintech programs, the sponsor bank’s oversight team reviews the results. The evidence is the testing workpapers and issue tracker entries for each exception, with root cause and fix.

Use this checklist for each sampled file.

• Sample covers declines, incomplete files, counteroffers, line decreases, and closures.
• Each notice went out within 30 days, or 90 days for an unaccepted counteroffer.
• The notice names the legal creditor, its address, and its ECOA enforcement agency.
• Each reason matches a factor in the file’s decision record or reason-code output.
• No reason reads “internal standards,” “policy,” or “did not meet our score.”
• Files with more than four reasons are flagged for review.
• Score disclosures and CRA rights notices are complete wherever a consumer report was used.
• Where a non-CRA source was used, the right-to-request disclosure appears.
• Copies of notices and statements of reasons are kept for 25 months (12 months for business credit).

12 CFR 1002.12(b) (opens in a new tab) requires keeping the notice and statement of reasons for 25 months after notice to a consumer applicant, or 12 months for business credit.

An adverse action notice is often the only explanation an applicant ever gets. It is also the first document an examiner reads to see whether a decision matched the stated reasons.

Programs that test the reasons, not just the mailing date, find the mismatch while it’s still a fix instead of a finding.

Sources

• 12 CFR 1002.9, Notifications | eCFR (current) (opens in a new tab)
• 12 CFR 1002.2, Definitions | eCFR (current) (opens in a new tab)
• Supplement I to Part 1002, Official Interpretations | eCFR (current) (opens in a new tab)
• 12 CFR 1002.12, Record retention | eCFR (current) (opens in a new tab)
• 15 U.S.C. 1681m, Requirements on users of consumer reports | govinfo (2024 edition) (opens in a new tab)
• 15 U.S.C. 1681a, Definitions; rules of construction | govinfo (2024 edition) (opens in a new tab)
• Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084 | CFPB (May 12, 2025) (opens in a new tab)