The most common Reg B violations on adverse action notices are not exotic. Examiners work from a list of yes-or-no questions, and the answers that come back wrong fall into four kinds: the notice went late; a required component was missing; the reasons were present but not specific, or did not describe what actually decided; or the lender could not produce the evidence that any of it happened. The first three are findings about one letter. The fourth is a finding about the programme, and it is the one that turns a sample into a population — because a reason that is wrong on one letter is wrong on every letter the same code and model version produced. Botminds' Adverse Action Notice Automation traces each reason back to the factor or rule that decided, re-traces a monthly sample from scratch, and when a reason is wrong finds every letter already sent with it.
The examples on this page come from the working prototype running on sample lending data: a fictional lender, fictional applicants and a fictional model. The rules, the statute and the examination items come from the regulators, linked where they appear.
How far back a wrong reason reaches
5years
the limitation period on an ECOA action, from the date of the occurrence of the violation
1year
the further window an applicant gets after an agency or Attorney General proceeding begins
931
applicants behind 946 sent letters in the prototype’s sample data, after one code changed meaning
How examiners test adverse action notices, item by item
The CFPB's examination procedures turn Regulation B into a worksheet, and the notification module is short enough to run on yourself. The examiner is instructed first to "obtain and review policies and procedures, training materials, a sample of loan files, and audits pertaining to notifications", expressly including those for "prequalification and preapproval processes, incomplete applications, counteroffers, loan modifications, and those that apply when there are third parties or multiple creditors" — and then to "conduct loan officer interviews to determine whether they show an understanding of the regulatory requirements and that policies and procedures are consistently applied" (CFPB, ECOA examination procedures, July 2026).
That opening paragraph is worth more attention than the items that follow it, because it describes the shape of the enquiry. The sample of files is only half of it. The other half is whether the written procedure and the people match, and a lender whose letters are correct because one analyst knows which phrases to avoid has a procedure that does not exist. The items then run through the four clocks, the five content elements, business credit, incomplete applications, loan modifications, third-party notices and the retention periods, each with a yes, a no and a space headed "basis of conclusion".
Seven questions to run on your own notice programme before an examiner does
- Can you produce the written procedure, and does it cover the awkward cases?
Prequalification, preapproval, incomplete applications, counteroffers, loan modifications, third-party and multi-creditor notices — the list the examination opens with.
- Would a loan officer describe the rule the way the procedure does?
Interviews are part of the module. Consistency between the document and the desk is itself an item.
- Are the clocks measured from the right events, on real files?
Completed application for the 30 days, the counteroffer for the 90 — not the decision date, which is the figure most systems hold.
- Do the reasons on a sample describe what actually decided?
Traced from the decision back to the factor or failed rule, not forward from the code map, which is the artefact under suspicion.
- Is a loan modification decline treated as adverse action?
Examination item 47 asks it directly: a declined modification for a consumer who is not delinquent or in default owes a notice.
- Can you retrieve one notice, its reasons and its delivery within the retention period?
Items 54 to 56 test retrieval, not storage. A system that cannot regenerate the notice has not retained it.
- Do you know what you would do on the day a finding lands?
The scope of the population, who decides on corrected notices, and what the applicants are told — decided in advance, not during.
The findings that recur: timing, content, specificity, records
Late. The duty attaches to the action, not to the paperwork, and the 30 days run from the completed application. A notice that is perfect and goes on day 34 is a violation of section 1002.9 on its own terms; the dating problem that produces most late notices takes that apart.
Incomplete. One of the five ECOA components missing — the supervising federal agency after a charter change is a typical case — or the ECOA paragraph paraphrased in a way that drops a prohibited basis. These are template failures, which means they are systematic: a wrong agency address is wrong on every letter of that product until someone edits the template.
Not specific. Reasons that are present, readable and insufficient. Section 1002.9(b)(2) rules out two formulations by name — internal standards or policies, and failure to achieve a qualifying score — and the Official Interpretations require the reasons to describe the factors actually considered or scored. A sample-form phrase standing in for a factor the model never scored lands here, and it is the finding that does not show on the page.
Not evidenced. The lender cannot produce the application, the information used to evaluate it, the notice or the statement of reasons for a file inside the retention period. Regulation B allows a computerised system to hold the pieces rather than a paper copy, but only where it "can regenerate all pertinent information in a timely manner for examination or other purposes". Regeneration is the test; storage is not.
Four findings, the rule behind each, and what actually fixes it
| The finding | The rule | The fix that holds |
|---|---|---|
| Notice sent after the deadline | 12 CFR 1002.9(a)(1)(i)–(iv) | Start the clock at the completed application in the system of record, and escalate on days left rather than on stage. |
| A required component missing or stale | 12 CFR 1002.9(a)(2) and (b)(1) | Check the components on every letter against the rule, not once against the template; re-check after any charter or address change. |
| Reasons present but not specific | 12 CFR 1002.9(b)(2) | Remove the two named formulations from every template and from the code map, and test for them on sent letters. |
| Reasons do not describe what decided | Comments 9(b)(2)-2 and -4 | Trace each reason from the decision to the factor or failed rule, and hold any notice whose words disagree with the model documentation for the version that decided. |
| Reasons lifted from the score’s key factors | Comment 9(b)(2)-9 | Keep the two lists separate on the letter and in the data behind it. |
| Incompleteness given as the reason on a decided file | Comment 9(a)(1)-4 | Branch on whether a decision was made, not on whether documents were outstanding. |
| Counteroffer with no notice at 90 days | 12 CFR 1002.9(a)(1)(iv) | Open a second clock when the counteroffer goes out, and close it only on evidence of acceptance or use. |
| Cannot produce the file or the notice | 12 CFR 1002.12(b)(1) and comment 12(b)-1 | Test retrieval on a sample: pull one application end to end and see what comes back. |
What a wrong reason costs under 15 U.S.C. 1691e
Section 1691e prices non-compliance in five ways, and the punitive cap is the one everybody quotes and the least interesting. Actual damages come first, available to "the aggrieved applicant" acting individually or as a member of a class. Equitable and declaratory relief sits in subsection (c), where a court may grant "such equitable and declaratory relief as is necessary to enforce the requirements imposed under this subchapter" — which in a notice case means an order about how letters are produced, not a cheque. Subsection (d) adds costs and "a reasonable attorney's fee as determined by the court" to any successful action, which is what makes a small individual claim worth bringing at all.
Then there is the enforcement route, which does not involve an applicant. Subsection (g) requires the Bureau, the OCC, the FDIC, the Federal Reserve and the NCUA to refer a matter to the Attorney General where the agency "has reason to believe that 1 or more creditors has engaged in a pattern or practice of discouraging or denying applications for credit in violation of section 1691(a)", and permits referral for other violations of that section. On referral the Attorney General may seek "actual and punitive damages and injunctive relief". A systematically wrong reason is, by construction, a pattern.
The exposure window is set by subsection (f), and it is longer than most remediation plans assume: five years from the occurrence of the violation, with a further year for affected applicants from the commencement of an agency proceeding or an Attorney General action started inside those five years. A code map that changed meaning three years ago is still inside it.
The inadvertent-error defence, and how narrow it is
Regulation B does contain a forgiveness provision, and it is worth knowing exactly where it stops. Section 1002.16(c) states that "a creditor's failure to comply with § 1002.6(b)(6), § 1002.9, § 1002.10, § 1002.12 or § 1002.13 is not a violation if it results from an inadvertent error", and requires that "on discovering an error under §§ 1002.9 and 1002.10, the creditor shall correct it as soon as possible" (12 CFR 1002.16(c)).
The examination narrative defines the term, and the definition is the whole of the matter: "'Inadvertent errors' include mechanical, electronic, and clerical errors that the creditor can show (1) were not intentional and (2) occurred despite the fact that the creditor maintains procedures reasonably adapted to avoid such errors." Three conditions, all of which must hold. A transposed address or a letter that failed to print is a mechanical error. A reason-code map that was never checked against a new model version is not: it is the absence of a procedure reasonably adapted to avoid the error, which is the condition the defence itself requires. The defence protects the lender that had a control and suffered a fault, not the lender that had no control.
Section 1691e(e) offers a separate safe harbour for an act "done in good faith in conformity with any official rule, regulation, or interpretation thereof by the Bureau", and it survives even if the rule is later amended, rescinded or held invalid. That is real protection for following the regulation. It is not protection for following a sample form into a reason the model never scored, because Appendix C itself instructs the opposite — a point the guide on templates and sample forms works through.
How a reason-accuracy sample should be drawn and traced
Most monthly testing reads the letter against the code map and the template. That tests whether the production line ran, not whether its output is true, and it cannot detect the one failure that matters, because the map is the artefact under suspicion. A reason-accuracy sample has to run the other way: start from the decision, work out what the principal reasons should have been from the factors and failed rules actually recorded, and compare that to the words the applicant received.
Four design choices decide whether the sample is worth running. Draw it across products and decision types rather than only from the largest product, because a code map is usually per model and the small products have their own. Draw it after release, on letters the applicant actually got. Trace it independently of the map. And record the finding against the code and the model version rather than against the letter, so a finding is a key into the population rather than an anecdote.
Reason accuracy by month, on a sample of sixty sent letters
Why a reason-accuracy trace is not a privileged self-test
Lenders occasionally assume that testing their own letters is protected, because Regulation B has a self-test privilege. It does, at section 1002.15, and it almost certainly does not cover this. The privilege applies to "the report or results of a self-test that a creditor voluntarily conducts", where a self-test is a programme, practice or study that is designed to determine the extent or effectiveness of compliance and "creates data or factual information that is not available and cannot be derived from loan or application files or other records related to credit transactions" (12 CFR 1002.15(b)(1)).
A reason-accuracy trace is derived from the loan files. That is the point of it. So the second limb fails, and section 1002.15(b)(3)(ii) makes the exclusion explicit for good measure: the privilege does not apply to "loan and application files or other business records related to credit transactions, and information derived from such files and records, even if the information has been aggregated, summarized, or reorganized to facilitate analysis". Matched-pair testing with trained applicants creates data that is not in the files and can qualify; a trace of what your own letters said cannot.
Two kinds of self-examination, and only one of them is privileged
A self-test under section 1002.15: Data that is not available and cannot be derived from the loan or application files — matched-pair testing is the standard example.
A reason-accuracy trace: An analysis derived entirely from the files: the decision, the factors, the letter.
A self-test under section 1002.15: The report, results, workpapers, analysis and conclusions — yes, while the conditions hold.
A reason-accuracy trace: No. Section 1002.15(b)(3)(ii) excludes information derived from the files even when aggregated or summarised.
A self-test under section 1002.15: Appropriate corrective action, required where the test shows a violation was more likely than not.
A reason-accuracy trace: None available; but corrective action is still what the finding demands.
A self-test under section 1002.15: That a test was done, its methodology, its scope, the period it covered and the dates.
A reason-accuracy trace: Everything.
A self-test under section 1002.15: Voluntary disclosure of any part, use as a defence, or inability to produce the retained information about the test.
A reason-accuracy trace: Not applicable.
A self-test under section 1002.15: Worth running, and worth structuring deliberately so the privilege attaches.
A reason-accuracy trace: Run it anyway. It finds the thing no privileged test would.
From a sample finding to the whole population
Three letters out of sixty is a 5 per cent finding if you treat the sample as an estimate. It is not an estimate. All three carried the same reason code on the same model version, which means the sample did not measure a rate — it caught an instance of a defect that applies deterministically to every letter the code produced. The honest response is not to extrapolate but to enumerate: run the code and version against everything sent, and count.
In the prototype's sample data that scan returns 946 sent letters between 1 September and 9 October, covering 931 distinct applicants because some applied twice, split 611 by e-delivery and 335 by first-class mail. No credit decision changes on review: the model scored what it scored, the decisions stand, and only the words describing them were wrong. That distinction decides what the remediation can and cannot say.
From one finding to a decision about 946 letters
Agent
Re-trace the sampleSixty sent notices traced again from the decision rather than from the code map, each reason matched to the factor or failed rule behind it.
Never: draws its conclusion from the map it is testing
Agent
Identify the defectRecords the finding against the reason code and the model version, not against the letter, so it becomes a key into the population.
Agent
Scan the populationFinds every sent letter that carried the same code on the same version, with applicants, dates and delivery channels.
Never: estimates from the sample
Agent
Hold and re-wordHolds every notice still in the queue on that code, and drafts a corrected notice for each letter already sent.
Never: sends a letter, or changes the map on its own
A person decides
The compliance officer decidesReviews the population, the draft corrections and what each applicant would be told, and decides whether the corrected notices go.
Never: has the decision made for them
Adverse Action Notice Automation: the monthly sample, and the population behind a finding
Keeping the evidence, and keeping it longer under investigation
Remediation runs on records, and the retention rule has a clause most policies omit. The baseline is 25 months for consumer credit from the date the applicant was notified, covering the application, the information used to evaluate it, a copy of the notification and a copy of the statement of specific reasons. But section 1002.12(b)(4) extends it: a creditor "shall retain the information beyond 25 months … if the creditor has actual notice that it is under investigation or is subject to an enforcement proceeding for an alleged violation", and must keep it "until final disposition of the matter, unless an earlier time is allowed by order of the agency or court" (12 CFR 1002.12(b)(4)).
Two practical consequences follow. A retention policy expressed as a single number cannot implement that clause; it needs a hold that the compliance officer can apply to a population. And a corrected notice creates a second letter about the same decision, with its own retention period — in the prototype's sample data both letters are kept for 25 months, which is the right answer and not the automatic one.
What a remediation plan should contain, and who signs it
A remediation plan that an examiner can read is short and answers six things. What the defect was, stated as a rule and a code rather than as a narrative. How far it extended, enumerated rather than estimated. What changed so it cannot recur — in a reason-code case, a check that the map matches the model version and a requirement that two named roles approve a map change. What the affected applicants are told, and in what form. What is being kept, and for how long. And who decided.
The content of a corrected notice is a judgement call with a defensible shape. In the prototype, each corrected notice repeats the decision, gives the right reasons, and says that the earlier letter did not state one reason specifically — it does not pretend the first letter was never sent, and it does not reopen a decision that has not changed. Whether those letters go is the compliance officer's call, which is how it should be: a corrected notice reaches an applicant who may have moved on, and weighing that is not a machine's work.
Adverse Action Notice Automation: one applicant's file, assembled for the question asked about it
A programme that can answer that question for any file, on any day, converts an examination from an excavation into a read. To see the testing, the population scan and the look-up on one screen, start from Adverse Action Notice Automation.
Questions people ask
What are the most common Reg B violations on adverse action notices?
They fall into four kinds: a notice sent after the 30- or 90-day deadline; a missing or stale required component, such as the supervising federal agency; reasons that are present but not specific or that do not describe the factors actually considered or scored; and an inability to produce the file, the notice or the statement of reasons inside the retention period. The first two are visible on the letter. The third is visible only by tracing the words back to the decision, which is why it survives routine review.
What are the penalties for an ECOA violation?
Actual damages to the aggrieved applicant, punitive damages capped at $10,000 in an individual action and at the lesser of $500,000 or 1 per cent of the creditor's net worth in a class action, equitable and declaratory relief, and the costs and a reasonable attorney's fee on any successful action. Separately, an enforcement agency that believes a creditor has engaged in a pattern or practice of denying applications in violation of section 1691(a) must refer the matter to the Attorney General, who may seek actual and punitive damages and injunctive relief.
What happens if you send an adverse action notice with the wrong reason?
It is a violation of section 1002.9 whether or not anybody complains, and it is rarely one letter: a reason that is wrong because a code map no longer matches the model is wrong on every letter the code produced. The inadvertent-error provision at section 1002.16(c) will usually not help, because it requires the lender to show the error occurred despite procedures reasonably adapted to avoid it — and an unchecked map is the absence of such a procedure rather than a fault in one.
Do you have to send corrected notices?
Regulation B requires an error under section 1002.9 to be corrected "as soon as possible" once discovered, but it does not prescribe a corrected notice to every affected applicant, and a lender has to decide what correction means in its case. The defensible version repeats the decision, gives the right reasons and says plainly that the earlier letter did not state a reason specifically. It is a compliance officer's decision, not an automatic one, and it should be recorded as a decision.
What is a reason-accuracy sample, and how is it drawn?
A sample of notices already sent, re-traced from the credit decision rather than from the code map, to test whether the reasons an applicant received describe what actually decided. Draw it across products and decision types rather than only the largest product, trace each reason independently of the map, and record every finding against the reason code and the model version — so a finding becomes a key into the population rather than a rate to extrapolate.
What is the statute of limitations for an ECOA claim?
Five years from the date of the occurrence of the violation, under 15 U.S.C. 1691e(f). Where an agency enforcement proceeding or an Attorney General civil action commences within those five years, an applicant who was a victim of the discrimination at issue may bring an action up to one year after that proceeding began. Record retention is a separate period — 25 months for consumer credit, extended until final disposition where the creditor has actual notice of an investigation.