The adverse action notice timing requirements look simple and are routinely missed. Regulation B gives a creditor 30 days after receiving a completed application to notify the applicant of approval, counteroffer or adverse action; 30 days after adverse action on an incomplete application, unless a conforming notice of incompleteness went out instead; 30 days after adverse action on an existing account; and 90 days after a counteroffer the applicant has neither accepted nor used. The trap is not the number of days. It is the start date: the clock runs from the completed application, not from the credit decision, so a file that sat in manual review for three weeks arrives at compliance with a week left. Adverse Action Notice Automation dates every clock from the completed application as the decision record is read, and sorts the queue by days remaining rather than by when the decision landed.
The figures below come from the working prototype on a fictional lender's sample data; the rules and quotations come from Regulation B, its Official Interpretations and the CFPB's examination procedures.
Four numbers that decide whether a notice is late
30days
from a completed application, for approval, counteroffer or adverse action
90days
after a counteroffer the applicant does not expressly accept or use
150
applications a year below which a creditor may notify orally
25months
the notice, the application and the reasons must be kept, for consumer credit
How many days do you have to send an adverse action notice?
Thirty, in the ordinary case, running from receipt of a completed application. The statute says the same thing in older words: a creditor shall notify the applicant of its action "within thirty days … after receipt of a completed application for credit". There is no grace period, no tolling for internal queues and no distinction between a decision made on day 3 and one made on day 29.
Two situations change the deadline rather than extending it. A counteroffer moves the obligation to 90 days from the counteroffer, unless the applicant accepts or uses the credit in the meantime. And an incomplete application can be answered with a notice of incompleteness within 30 days instead of a decision, which stops the clock while the applicant is given a reasonable period to supply what is missing. The CFPB's examination procedures summarise both as the only circumstances in which "the creditor need not comply with the 30-day notification rule" (CFPB, ECOA examination procedures, July 2026).
A creditor shall notify an applicant of action taken within: 30 days after receiving a completed application concerning the creditor's approval of, counteroffer to, or adverse action on the application.
12 CFR 1002.9(a)(1)
When does the 30-day clock start? The completed application, not the decision
Regulation B defines a completed application as "an application in connection with which a creditor has received all the information that the creditor regularly obtains and considers in evaluating applications for the amount and type of credit requested (including, but not limited to, credit reports, any additional information requested from the applicant, and any approvals or reports by governmental agencies or other persons that are necessary to guarantee, insure, or provide security for the credit or collateral)" (12 CFR 1002.2(f)).
Read that definition carefully and the start date is not a status in a loan origination system at all. It is the moment the lender held everything it normally uses, judged against the lender's own habits for that product and amount. Comment 9(a)(1)-1 puts it plainly: "Once a creditor has obtained all the information it normally considers in making a credit decision, the application is complete and the creditor has 30 days in which to notify the applicant of the credit decision."
Two consequences follow, and both are uncomfortable for operations. First, a lender cannot postpone completeness by choosing not to pull a report: the same definition carries a diligence duty — "The creditor shall exercise reasonable diligence in obtaining such information" — and comment 2(f)-6 spells it out, that the creditor "should request information from third parties, such as a credit report, promptly after receiving the application". Second, the date is auditable from the file. An examiner can read which documents the lender habitually uses for that product, find the day the last of them arrived, and compare it with the date on the letter.
Dating the completed application on one file
- List what this product actually uses
Not the application form’s field list: the items the credit policy and the underwriters really consider for this amount and type.
- Find the arrival date of each
Application, bureau report, income documents, valuations, guarantees, government approvals, anything needed to secure the credit.
- Take the latest of them
That is the day the file was complete, whatever status the system shows.
- Check the diligence gap
If the lender waited a week to order the report, the delay is the lender’s, and the conduct is the thing an examiner reads.
- Compare with the decision date
Days between completeness and decision are days the compliance team never gets back.
- Compare with the notification date
Notification occurs on delivery or mailing to the last known address, not on approval of the letter.
- Record the reasoning, not just the date
The next reviewer needs to see which item was last and why it counted.
The four clocks in section 1002.9(a)(1)
Most programmes instrument one clock and assume it covers the rest. It does not: the four sub-paragraphs start on different events, and only the first one begins with an application at all.
Four deadlines, four different starting events
| Clock | Starts on | Ends in | What the notice has to say |
|---|---|---|---|
| Action on an application | Receipt of the completed application | 30 days | Approval, counteroffer, or adverse action with the full notice content. |
| Adverse action on an incomplete application | Receipt of the incomplete application | 30 days | Either adverse action in writing, or a conforming notice of incompleteness instead. |
| Adverse action on an existing account | The action — termination, or an unfavourable change in terms | 30 days | Written notice with the usual content; the account holder is the applicant here. |
| Silence after a counteroffer | The day the counteroffer is made | 90 days | Adverse action on the terms originally sought, unless a combined notice already went out. |
| Approved, never collected | The day of application | 30 days | Nothing. The creditor may treat the application as withdrawn where the parties expected the applicant to inquire. |
The counteroffer clock deserves its own treatment, because it is the only one that a lender can start without meaning to and finish without doing anything; what the 90 days actually require works through the acceptance and combined-notice rules in detail.
The incomplete-application branch, and what it does to the clock
Where an application is incomplete about matters the applicant can supply, Regulation B offers a choice: notify of action taken, or notify of incompleteness. The second route requires a written notice "specifying the information needed, designating a reasonable period of time for the applicant to provide the information, and informing the applicant that failure to provide the information requested will result in no further consideration being given to the application". Send that, and the creditor "shall have no further obligation under this section if the applicant fails to respond within the designated time period".
Two comments stop that route being a general-purpose pause button. Comment 9(a)(1)-3 allows a denial for incompleteness only "when an application is incomplete regarding information that the applicant can provide and the creditor lacks sufficient data for a credit decision". Comment 9(a)(1)-4 closes the loophole from the other side: where the file is missing information but there is enough to decide, the creditor may decide, and then "missing information or 'incomplete application' cannot be given as the reason for the denial". A lender that declines a thin file and writes "incomplete application" on the letter has usually chosen the wrong one of those two paths.
What notification occurs means, and the day that counts
The deadline is not the day the analyst approves the letter, nor the day a print vendor confirms the job. Comment 9-3 fixes it: "Notification occurs when a creditor delivers or mails a notice to the applicant's last known address or, in the case of an oral notification, when the creditor communicates the credit decision to the applicant."
For a mail batch that means the handover to the postal stream, which is why a daily cut-off matters more than it looks: a notice approved at 16:30 against a 16:00 batch is a notice sent tomorrow. For electronic delivery it means delivery to the address on file, with E-SIGN consent in place, and a bounce is not delivery. Returned mail does not re-open the clock — the obligation was met on mailing — but a lender that knows the address was wrong and does nothing has a different problem, which is why re-sending to the address on the bureau report is worth building in.
Where the days go between a decision and its notice
- Pull the decision and its codes2.5
- Codes into words3.0
- Check Reg B, FCRA, state2.0
- Fix reasons, re-draft1.5
- Release and mail batch2.4
- Agents0.9
- Release1.2
The shape of that chart is the argument for automating the middle, not the ends. Reading a decision and turning codes into words are mechanical and are where two thirds of the elapsed time sits; approval and the mail run are deliberately human and physical, and they do not compress. A programme that shaves the checking steps and leaves the start date mis-recorded has moved the median without moving the risk.
What happens if an adverse action notice is late
A late notice is a violation of section 1002.9 on its own, whatever the letter says. ECOA's civil liability provision allows actual damages, and punitive damages "in an amount not greater than $10,000" for an individual claim, with class recovery capped at "the lesser of $500,000 or 1 per centum of the net worth of the creditor" (15 U.S.C. 1691e(b)). In setting the amount a court is directed to weigh, among other things, "the frequency and persistence of failures of compliance by the creditor, the resources of the creditor, the number of persons adversely affected, and the extent to which the creditor's failure of compliance was intentional".
Those four factors describe a systemic failure rather than a slip, and that is how a timing problem usually presents: not one late letter, but a queue that routinely runs hot because the clock was started on the decision date. Supervisory consequences arrive first and cost more in practice — findings, a corrective action plan, and a look-back over the affected population.
One day's notices, by days left on the clock
How long the notice and the reasons behind it must be kept
Twenty-five months, for consumer credit, from the date the applicant was notified of action taken or of incompleteness. What must be kept is more than the letter: the application itself, any information obtained to monitor compliance, "any other written or recorded information used in evaluating the application", a copy of the notification of action taken, a copy of the statement of specific reasons, and any written allegation by the applicant of a violation (12 CFR 1002.12(b)(1)).
Business credit is generally 12 months rather than 25, which is a difference worth encoding in the retention rule rather than defaulting everything to the longer figure and calling it conservative. And the clock stops being a clock entirely once the creditor "has actual notice that it is under investigation or is subject to an enforcement proceeding": the material must be kept until the matter is resolved.
The practical test is not whether the letter survives but whether the decision can be reconstructed from it — the model version, the factors, the applicant's own values, the policy rules, the dates. A programme that keeps PDFs keeps evidence of what was said; a programme that keeps the trace keeps evidence of whether it was true. That distinction is the subject of tracing each reason back to the factor that produced it.
Adverse Action Notice Automation: the queue, sorted by days left
Keeping 1,846 clocks at once
At any moment the fictional lender in the prototype has 1,846 open clocks across personal loans, auto, credit cards and home equity lines — 30-day clocks on applications and existing accounts, 90-day clocks on counteroffers that have gone quiet. One agent keeps all of them: it dates each from the completed application, escalates at five days left, builds the daily batch, confirms delivery, re-sends returned mail to the address on the bureau report, and keeps the material for 25 months.
The reporting that matters is small. Notices due by day for the next 30 days. Open counteroffers against their 90-day clocks. Delivery results, including returns. Median days from decision to notice, which in the sample data is 2.1 against 11.4 before. And the only number anyone outside compliance remembers: how many went out late, which in the prototype's year to date is none. What the notice must carry decides whether a letter is right; the clock decides whether it counts.
Adverse Action Notice Automation: every clock in one view
Questions people ask
When does the 30-day clock start, the application or the decision?
Neither, exactly. It starts when the creditor has received all the information it regularly obtains and considers for that amount and type of credit — the completed application. That is often before the decision and after the application form arrives. Because the definition refers to the creditor's own practice, the start date has to be derived from what the file actually needed, and the creditor must use reasonable diligence to obtain the missing pieces promptly.
Does the clock pause while a file is in manual review?
No. Nothing in section 1002.9 tolls the 30 days for internal queues, exception handling or second signatures. The only lawful pause is the incompleteness route, which requires a written notice specifying what is needed and a reasonable period to supply it, and which is available only where information the applicant can provide is genuinely missing.
What counts as sending the notice?
Delivery or mailing to the applicant's last known address, or, for an oral notification where one is permitted, communicating the decision. Approval of the draft is not notification, and neither is a print vendor's confirmation the next morning. For electronic delivery, consent under the E-SIGN Act has to be on file before the notice is sent that way.
What are the penalties for a late adverse action notice?
ECOA allows actual damages and punitive damages up to $10,000 in an individual action, with class recovery limited to the lesser of $500,000 or one per cent of the creditor's net worth. In deciding the amount a court weighs how frequent and persistent the failures were, how many people were affected and whether the non-compliance was intentional. In supervision the practical consequence usually arrives earlier, as a finding and a look-back over the affected population.
How long must an adverse action notice be kept?
Twenty-five months for consumer credit, from the date of notification, together with the application, the information used to evaluate it, the statement of specific reasons and any written allegation of a violation. Business credit is generally 12 months. Both periods extend while the creditor has actual notice of an investigation or enforcement proceeding.
Can a small lender give the notice orally?
Only a very small one. A creditor that did not receive more than 150 applications in the preceding calendar year may satisfy section 1002.9, including the statement of specific reasons, by oral notification. Above that threshold the consumer notice must be in writing and retainable. Business credit has its own rules, which vary with the applicant's gross revenues rather than with the creditor's volume.