The adverse action notice requirements come from two statutes at once. Regulation B, which implements the Equal Credit Opportunity Act, requires a written notice containing five things: a statement of the action taken, the creditor's name and address, the ECOA notice itself, the name and address of the federal agency that supervises the creditor, and either the specific principal reasons for the decision or a disclosure of the applicant's right to ask for them. The Fair Credit Reporting Act adds four more whenever a consumer report was used: the credit score and its context, the consumer reporting agency's contact details, a statement that the agency did not make the decision, and notice of the right to a free report and to dispute. Botminds' Adverse Action Notice Automation drafts each notice as the decision is made and checks every one of those parts, along with the lender's own state and house content, before a compliance analyst releases it.
The examples on this page come from the working prototype running on sample lending data: a fictional lender, fictional applicants and a fictional personal loan model. The rules, the quotations and the research figures come from the regulators and the statutes, linked where they appear.
The scale behind the obligation
16.1%
of US consumers who applied for any kind of credit in the twelve months to June 2026 were rejected at least once
30days
from a completed application to the notice, under Regulation B
25months
the notice and the reasons behind it must be kept for consumer credit
What must an adverse action notice include? The five parts Regulation B names
Section 1002.9(a)(2) is unusually blunt for a disclosure rule. A notice given when adverse action is taken "shall be in writing and shall contain a statement of the action taken; the name and address of the creditor; a statement of the provisions of section 701(a) of the Act; the name and address of the Federal agency that administers compliance with respect to the creditor; and either: (i) A statement of specific reasons for the action taken; or (ii) A disclosure of the applicant's right to a statement of specific reasons within 30 days, if the statement is requested within 60 days of the creditor's notification" (12 CFR 1002.9).
Four of the five are facts about the lender and the decision, and they are the parts a template gets right by construction. The fifth is the one that fails. A lender that takes the second option, the right-to-request route, buys itself nothing but delay: it must still name the person or office from which the statement can be obtained, and it must still produce specific reasons when asked, within 30 days. Almost every consumer lender takes the first option and prints the reasons on the letter, which means the reasons are generated for every decline, not only for the applicants who write back.
The ECOA notice in the third item is a fixed paragraph. Regulation B sets out wording the creditor's notice must be "substantially similar" to, naming the prohibited bases — race, colour, religion, national origin, sex, marital status, age, income from a public assistance programme, and the good-faith exercise of a right under the Consumer Credit Protection Act — and leaving a slot for the supervising agency from Appendix A. A creditor may add to it, for instance a reference to a state statute or to the fact that age may be considered in certain scoring systems, without losing compliance.
Every part of the letter, and the rule that puts it there
| On the letter | Which rule | What satisfies it |
|---|---|---|
| The action taken | 12 CFR 1002.9(a)(2) | Any words that describe the action; the regulation does not require the phrase "adverse action". |
| The creditor’s name and address | 12 CFR 1002.9(a)(2) | The creditor that took the action. Where several creditors were involved, each that declined must be named. |
| The ECOA notice | 12 CFR 1002.9(b)(1) | Wording substantially similar to the paragraph the regulation prints, listing the prohibited bases. |
| The supervising federal agency | 12 CFR 1002.9(a)(2) and appendix A | Name and address of the agency for that creditor, which differs by charter and by size. |
| The specific principal reasons — or the right to ask | 12 CFR 1002.9(a)(2)(i) or (ii) | Reasons that are specific and principal; or a disclosure naming the office to ask, with 30 and 60-day periods. |
| The credit score used, its range, date and key factors | 15 U.S.C. 1681m(a)(2), 1681g(f) | Required only when a consumer report was used and a score was used in the decision. |
| The consumer reporting agency’s name, address and telephone number | 15 U.S.C. 1681m(a)(3)(A) | Including a toll-free number for a nationwide agency. |
| A statement that the agency did not decide | 15 U.S.C. 1681m(a)(3)(B) | And that it cannot give the consumer the specific reasons for the action. |
| The free report and the dispute right | 15 U.S.C. 1681m(a)(4) | A free report within 60 days under section 1681j, and the right to dispute under section 1681i. |
What two federal acts require an adverse action notice, and which part each writes
ECOA and the FCRA are often described as overlapping. They are not: they answer different questions about the same decision. ECOA asks why the creditor said no, and makes the creditor say so in its own words. The FCRA asks what outside information the creditor used, and makes the creditor point the consumer at the source so it can be checked and corrected.
That difference has a consequence most compliance findings turn on. The Official Interpretations state it directly: "Disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit" (comment 9(b)(2)-9). The same comment makes the converse point: telling the applicant that a credit report was obtained and used, which the FCRA requires, does not satisfy ECOA either. A letter can carry a perfectly correct score disclosure with four key factors and still have no lawful statement of reasons on it.
The two sets of words also come from different places inside the lender. The FCRA key factors come from the bureau with the score; the ECOA reasons come from the lender's own decision — its model, its policy rules, its underwriter. Where those two lists disagree, both can still be right, because they describe different things. Reconciling them by hand is where letters go wrong, and how a model's reason codes become the sentences on a letter is the part of the work this series spends most time on.
The statement of reasons for adverse action must be specific and indicate the principal reason(s) for the adverse action. Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient.
12 CFR 1002.9(b)(2)
What the FCRA adds when a credit report was used
Section 1681m(a) attaches to any person who takes adverse action "based in whole or in part on any information contained in a consumer report". That is broader than ECOA in two ways. It reaches beyond creditors — employers, landlords and insurers owe their own versions — and it is triggered by use of the report, not by the credit decision as such.
Where a numerical score from the report was used, the lender must disclose the score itself, the range of possible scores under the model that produced it, the date it was created, the name of the entity that supplied it, and the key factors that adversely affected it. Those key factors are defined as "all relevant elements or reasons adversely affecting the credit score of the particular individual, listed in the order of their importance based on their effect on the credit score", generally capped at four — and five when the number of inquiries on the report is one of them.
Two practical traps follow. The first is the affiliate case: where the information came from a person other than a consumer reporting agency, or from an affiliate otherwise than as a consumer report, the duty is the section 1681m(b) disclosure instead, which turns on the consumer's written request within 60 days. The second is the no-score case: a lender that pulled a report but used no score owes the report-related disclosures without the score block, and a template that prints an empty score panel on those letters is producing a defective notice on every one.
Which decisions count as adverse action, and which do not
Before any content question comes the coverage question, and it is the one most often answered by habit. Regulation B defines adverse action as a refusal to grant credit in substantially the amount or on substantially the terms requested, unless the creditor counteroffers and the applicant uses or accepts the credit; a termination of an account or an unfavourable change in terms that does not affect substantially all of a class of accounts; or a refusal to increase credit available to an applicant who asked for an increase (12 CFR 1002.2(c)).
A decline is not the only adverse action, and not every decline is one
Adverse action — a notice is owed: Refusing the amount or substantially the terms applied for, unless a counteroffer is made and the applicant accepts or uses it.
Not adverse action — no ECOA notice: Terms the applicant expressly agreed to; a refusal because the creditor does not offer that type of credit or credit plan at all.
Adverse action — a notice is owed: Terminating an account, or an unfavourable change in terms that does not hit substantially all of a class of accounts.
Not adverse action — no ECOA notice: Action taken in connection with inactivity, default or delinquency on that account.
Adverse action — a notice is owed: Refusing an application, made under the creditor’s procedures, to increase the credit available.
Not adverse action — no ECOA notice: Declining a transaction at point of sale because a card is expired, reported lost, over the limit, or suspected fraud.
Adverse action — a notice is owed: Evaluating information, deciding not to approve, and telling the consumer so — that is an application, and a notice is owed.
Not adverse action — no ECOA notice: Giving loan terms and explaining how to apply, without evaluating the consumer and declining.
Adverse action — a notice is owed: A refusal for a reason within the creditor’s discretion, however technical.
Not adverse action — no ECOA notice: A refusal because applicable law prohibits the creditor from extending the credit requested.
The counteroffer line is the one that generates the most unnoticed exposure, because it is the only branch where doing nothing creates an obligation three months later; the 90-day counteroffer clock takes that case on its own. The prequalification line is the one that surprises front-line staff: whether a request became an application "depends on how the creditor responds to the consumer, not on what the consumer says or asks".
In writing, retainable, and the exception for very small lenders
The ECOA notice must be in writing. Regulation B's general disclosure rule adds that it must be "clear and conspicuous" and "in a form the applicant may retain", and permits electronic delivery subject to the consumer consent provisions of the E-SIGN Act. A notice that exists only as a screen the applicant cannot keep does not satisfy the rule, and a notice e-mailed without E-SIGN consent on file is not an electronic disclosure but a missing one.
There is one real exception and it is narrower than its reputation. For "a creditor that did not receive more than 150 applications during the preceding calendar year, the requirements of this section (including statements of specific reasons) are satisfied by oral notifications". Business credit has its own tiering — a written statement of reasons only on request, for applicants above $1 million in gross revenues — but for consumer credit, 150 applications a year is the whole of it.
What has to be kept afterwards is the other half of the obligation. For 25 months after notifying an applicant of action taken or of incompleteness, the creditor must retain the application, the information used to evaluate it, a copy of the notification of action taken, a copy of the statement of specific reasons, and any written allegation of a violation (12 CFR 1002.12(b)). Business credit is 12 months. The period extends while the creditor has actual notice of an investigation or enforcement proceeding.
Adverse Action Notice Automation: the letter, with each part checked beside it
The examiner's checklist, item by item
The most useful description of the requirements is not the regulation but the checklist examiners carry. The CFPB's ECOA narrative and examination procedures, revised in July 2026, work through consumer credit notification as a series of yes-or-no questions: whether the creditor notified within 30 days of a completed application; within 30 days of adverse action on an incomplete application, unless a conforming notice of incompleteness went out; within 30 days of adverse action on an existing account; and within 90 days of a counteroffer the applicant neither accepted nor used. Then, separately, whether the notice was in writing, capable of being retained, and contained each of the five items (CFPB, ECOA examination procedures, July 2026).
Running the same questions over a sample of your own letters, before anyone else does, is the cheapest compliance testing available. It also exposes the gap between a template that is correct and a programme that is correct: the template settles items (a) to (d), and only the reasons and the clocks can move.
Nine questions to ask of one notice before it leaves
- Is the action stated in words the applicant will understand?
The regulation does not require the term "adverse action"; it requires that the action taken be stated.
- Is the creditor named, with an address?
Where an application went to several creditors, each one that declined owes its own notice, or must be named in a joint one.
- Is the ECOA paragraph substantially similar to the regulation’s?
Additions are permitted. Omissions and paraphrases that drop a prohibited basis are not.
- Is the supervising federal agency the right one for this charter?
Appendix A assigns it by charter type and, for banks, by size; an agency name goes stale after a charter change.
- Are the reasons specific, and are they the principal ones?
A qualifying-score statement or a reference to internal standards is insufficient on its own terms.
- Do the reasons describe factors the decision actually used?
The reasons must relate to and accurately describe the factors actually considered or scored.
- If a report was used, is the FCRA block complete and current?
Score, range, date, supplier, key factors, the agency’s contact details, the no-decision statement, the free report and the dispute right.
- Is the notice retainable, and was consent on file if it went electronically?
E-SIGN consent is part of the disclosure, not part of the mailing preference.
- Is the date it was sent recorded against the right clock?
The clock runs from the completed application, not from the credit decision.
Why a notice with every part can still fail
Two letters can carry all nine components and only one of them comply, because the fifth ECOA item is not a field but a claim about the decision. The Official Interpretations require that the reasons "relate to and accurately describe the factors actually considered or scored by a creditor", and where the decision came from a scoring system, that the reasons "relate only to those factors actually scored in the system", with no principal reason left out.
That is why a sample-form phrase can be a violation even though it appears in the regulation's own appendix. Appendix C is explicit about it: "If the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed." Its worked example is a lender that considers only bank references and disregards finance company references: its statement of reasons "should disclose 'insufficient bank references,' not 'insufficient credit references.'"
In practice the drift is rarely deliberate. A reason-code map written for one version of a scoring model keeps printing its old sentences after the model is replaced, and every letter that uses the changed code carries a reason the model never scored. Nothing on the letter looks wrong. The failure is only visible by tracing the words back to the factor, which is the job the next guide in this series describes.
How Adverse Action Notice Automation checks the parts before a notice is released
In the working prototype the fictional lender's letter is checked against fourteen rules at once — the ECOA items, the FCRA items, an Ohio statement and the lender's own house standards — and the result is shown beside the letter rather than in a report afterwards. On the sample decline, the letter lands on 12 of 14 while two Regulation B checks fail: specific principal reasons, and reasons drawn only from factors the model actually scored. Both fail for the same cause, a second reason reading "insufficient credit" where the model scored length of credit history.
Six agents do the mechanical parts. One reads the decision as it is made, including the completed-application date that starts the clock. One ranks the factors and failed policy rules and picks the principal reasons. One compares the words for each reason code against the model documentation for the version that decided, and holds the notice when they disagree. One checks the FCRA block when a report was used. One writes the letter from the approved template for the product, action and state. One keeps the 30- and 90-day clocks, builds the daily batch and confirms delivery. None of them sends a letter: the compliance analyst approves each notice and signs the batch.
Adverse Action Notice Automation: the same letter at 14 of 14
The clocks matter as much as the content, because a complete notice sent on day 34 is still a violation; when the 30-day clock really starts works through the dating problem that produces most late notices. To see the checks, the reasons and the clocks on one screen, start from Adverse Action Notice Automation.
Questions people ask
What two federal acts require an adverse action notice?
The Equal Credit Opportunity Act, implemented by Regulation B, and the Fair Credit Reporting Act. ECOA requires the statement of the action, the ECOA paragraph, the supervising agency and the specific principal reasons. The FCRA requires disclosures about the consumer report used, including the score and its key factors, the reporting agency's contact details and the consumer's rights to a free report and to dispute. Satisfying one does not satisfy the other.
Does an adverse action notice have to be in writing?
For consumer credit, yes. Regulation B requires the notice to be in writing, clear and conspicuous and in a form the applicant may retain, and permits electronic delivery only subject to the E-SIGN Act's consumer consent provisions. The one exception is a creditor that received no more than 150 applications in the preceding calendar year, which may notify orally, including the statement of reasons. Business credit has separate, lighter rules that vary with the applicant's gross revenues.
When is an adverse action notice required?
When the creditor refuses the credit in substantially the amount or on substantially the terms applied for, terminates an account or changes its terms unfavourably in a way that does not affect substantially all of a class of accounts, or refuses a requested increase in available credit. It is not required for a change the applicant agreed to, for action connected with delinquency or default on that account, for most point-of-sale refusals, or where the law prohibits the creditor from extending the credit requested.
How long should an adverse action notice be kept?
Twenty-five months from the date the applicant was notified, for consumer credit, together with the application, the information used to evaluate it and the statement of specific reasons. For business credit the period is generally 12 months. If the creditor has actual notice that it is under investigation or subject to an enforcement proceeding, it must keep the material beyond those periods until the matter is resolved.
Does an adverse action notice affect your credit score?
No. The notice is a letter about a decision that has already been made; it is not reported to the consumer reporting agencies and has no effect on a score. What may show on a report is the inquiry the lender made when it pulled the file. The notice is useful to the applicant for the opposite reason: it names the factors that drove the decision and points at the report behind it, which is how an error gets found and disputed.
Can a lender just send the applicant a right to request the reasons?
Yes, as the alternative in section 1002.9(a)(2)(ii), but it is rarely worth it. The notice must then name the person or office the applicant can ask, the applicant has 60 days to ask, and the creditor has 30 days to answer with the same specific principal reasons it would otherwise have printed. The work of producing accurate reasons does not go away; it is deferred, and split across two deadlines instead of one.