Three FCRA notices can arise from one credit report, and which you owe turns on what you did with it. Decline the application and section 1681m(a) requires an adverse action notice with the score block. Approve it on terms materially less favourable than the best you offer a substantial proportion of consumers, and 12 CFR part 1022 subpart H requires a risk-based pricing notice instead. Take one of the credit score exceptions in section 1022.74(d), (e) or (f) — as most lenders do — and you give every applicant a credit score disclosure and no risk-based pricing notice at all. The one thing you never owe is two of them for the same extension of credit. Botminds' Adverse Action Notice Automation checks the score, range, date, supplier and key factors on the declines, and will not release a letter whose score block is incomplete or stale.
The examples on this page come from the working prototype running on sample lending data: a fictional lender, a fictional bureau and fictional applicants. The statutes and rules are linked where they appear.
Four numbers the FCRA fixes, and one it does not
4or 5
key factors on a score disclosure — five only when the number of inquiries is one of them
60days
in which the consumer may claim a free report from the agency named on the notice
40/60
the cutoff-score proxy: a notice to everyone below the point where 40% score higher
1notice
per grant or extension of credit — never a risk-based pricing notice and an adverse action notice both
What the FCRA requires when a credit report is used
Section 1681m(a) attaches to "any person" who takes adverse action "based in whole or in part on any information contained in a consumer report". Four duties follow: notice of the adverse action; written or electronic disclosure of the numerical credit score, where a score was used; the name, address and telephone number of the consumer reporting agency, with a statement that the agency "did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken"; and notice of the consumer's right to a free report under section 1681j and to dispute under section 1681i (15 U.S.C. 1681m(a)).
Two features of that section catch lenders who think of it as the ECOA letter's second half. It reaches people who are not creditors at all — an employer, a landlord or an insurer acting on a report owes its own version — and it is triggered by use of the report rather than by a credit decision. And it has a sibling. Where the adverse information came from somewhere other than a consumer reporting agency, section 1681m(b) applies instead, and its duty is reactive: the user must "disclose the nature of the information to the consumer" on the consumer's written request received within sixty days of learning of the adverse action.
Three notices about one credit report, and what makes each one due
You declined, or worsened existing terms: Adverse action notice under section 1681m(a), alongside the ECOA notice.
You approved, on worse terms than your best: Risk-based pricing notice under 12 CFR 1022.72(a) — unless an exception applies.
You declined, or worsened existing terms: Adverse action based in whole or in part on information in a consumer report.
You approved, on worse terms than your best: Material terms materially less favourable than the most favourable terms available to a substantial proportion of consumers.
You declined, or worsened existing terms: The decision itself.
You approved, on worse terms than your best: A comparison the lender has to construct — directly, or by the credit score proxy or tiered-pricing methods.
You declined, or worsened existing terms: With the notice of action taken.
You approved, on worse terms than your best: Before consummation for closed-end credit, but no earlier than the approval being communicated.
You declined, or worsened existing terms: None for the score block, where a score was used in the decision.
You approved, on worse terms than your best: Five, including the one every lender uses: give a credit score disclosure to every applicant instead.
You declined, or worsened existing terms: Specific principal reasons, from ECOA — not the key factors.
You approved, on worse terms than your best: None. A risk-based pricing notice carries no reasons at all.
Credit score disclosure: score, range, date, factors, and the bureau's lines
Where a numerical score from the report was used in the decision, the adverse action notice must carry six things about it: the score, the range of possible scores under the model that produced it, the key factors that adversely affected it, the date the score was created, the name of the person or entity that supplied it, and — on the sample forms — the explanation that a score is a number reflecting the information in the report and can change as the report changes.
Each of the six has its own failure mode, and none of them looks like an error on the page. A range printed as the model's marketing range rather than the range actually used. A creation date taken from the day the letter was drafted rather than the day the score was generated, which drifts whenever a file sits in review. A supplier named as the bureau when the score came from a different modeller. And the commonest: a template that prints an empty score panel on every letter where no score was used, producing a defective disclosure on exactly the applicants who had no score to disclose.
Eight checks on the score block of one declined applicant
- Is the score the one used in this decision?
Where several scores were obtained and one was used, it is that score. Where an average was used, any one of them may be disclosed.
- Is the range the range of the model that produced it?
Not the range of a different version, and not a generic 300–850 printed on every letter.
- Is the creation date the date the score was created?
Not the date of the decision and not the date of the letter. On a file held in review these can be weeks apart.
- Is the supplier named correctly?
The consumer reporting agency "or other person that provided the credit score" — which is not always the bureau whose report it sits on.
- Are the key factors the ones the score model reported?
In the order of their importance, as the statute defines them — not the lender’s own reasons rewritten.
- Is the count right: four, or five with inquiries?
Five is permitted only where the number of inquiries on the report is itself one of the key factors.
- Is the agency’s contact block complete?
Name, address and telephone number, toll-free for a nationwide agency, with the statement that the agency did not decide.
- Are the 60-day free report and the dispute right both stated?
Sections 1681j and 1681i. Dropping the dispute right is the quietest of these failures and the one that matters most to the applicant.
What are key factors, and why four or five?
The term is statutory and narrower than it sounds. Key factors are "all relevant elements or reasons adversely affecting the credit score of the particular individual, listed in the order of their importance based on their effect on the credit score" (15 U.S.C. 1681g(f)(2)(B)). They belong to the score model, not to the lender: they describe what pushed a number down, in that model's own ranking, and they are supplied with the score.
The cap comes from the same section and is repeated in the risk-based pricing rule: "all of the key factors that adversely affected the credit score, which shall not exceed four key factors, except that if one of the key factors is the number of enquiries made with respect to the consumer report, the number of key factors shall not exceed five" (12 CFR 1022.73(a)(1)(ix)(D)). That is the whole origin of the familiar "four, or five with inquiries". It is a cap on what the bureau reports about a score. It is not, and has never been, a cap on how many principal reasons Regulation B allows on a letter — Regulation B sets no number at all, and only observes that more than four is unlikely to help the applicant.
Risk-based pricing notices: when a price, not a denial, triggers a notice
Subpart H exists for the applicant nobody writes to: the one who was approved, on terms worse than the lender's best, because of a credit report. The general rule catches a person who both uses a consumer report in connection with an extension of consumer credit and, based in whole or in part on that report, provides credit "on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers from or through that person".
The hard part is not the notice, which carries no reasons and is largely boilerplate. It is deciding who gets one. A lender may compare material terms directly, consumer against consumer, for a specific type of credit product — the rule names student loans, unsecured and secured cards, new and used car loans, and fixed and variable-rate mortgages as examples. Or it may use the credit score proxy method: find the "cutoff score" at which roughly 40 per cent of the consumers it extends credit to score higher and 60 per cent score lower, and notify everyone below it. Either way the determination is a piece of analysis the lender has to be able to reproduce, refresh and defend — which is why the exceptions matter so much.
Where the FCRA notices land across one lender's consumer book
The credit score exception notices, and why most lenders use them
Section 1022.74 lists the ways out, and three of them replace the risk-based pricing notice with a disclosure given to everyone. For credit secured by one to four units of residential real property, paragraph (d) pairs the section 609(g) disclosure with a credit score explanation and a distribution of scores "in the form of a bar graph containing a minimum of six bars", and model form H-3 is deemed to comply. For everything else, paragraph (e) does the same job with model form H-4. And paragraph (f) covers the applicant for whom the agency returned no score at all: a notice that a score was not available from the named agency, "generally due to insufficient information regarding the consumer's credit history", with model form H-5.
The trade is straightforward. The exception costs a disclosure to every applicant for the product and buys the removal of the cutoff analysis, the per-applicant comparison, the refresh of the sampling and the argument with an examiner about whether the cutoff was right. For a lender that already generates a score disclosure on declines, generating one on approvals too is a smaller change than maintaining a defensible 40/60 determination across every product. Two conditions come with paragraph (f) and are easy to miss: the lender must regularly obtain scores and give disclosures under (d) or (e), and it must not have obtained a score from another agency for that consumer.
Which notice fits which case, and the rule that settles it
| The case | What you owe | Where it says so |
|---|---|---|
| Declined, a report was used, a score was used | Adverse action notice with the full score block | 15 U.S.C. 1681m(a)(2) and (a)(3) |
| Declined, a report was used, no score was used | Adverse action notice without a score block — not an empty one | 15 U.S.C. 1681m(a)(2), read against (a)(3) |
| Declined on information from a non-agency source | The section 1681m(b) disclosure, on written request within 60 days | 15 U.S.C. 1681m(b) |
| Declined on affiliate information that is not a consumer report | The section 615(b) disclosure | Appendix C to Regulation B, paragraph 2 |
| Approved on terms worse than your best, no exception taken | Risk-based pricing notice | 12 CFR 1022.72(a) and 1022.73(a)(1) |
| Approved, mortgage product, exception taken | Credit score disclosure with the section 609(g) disclosure — form H-3 | 12 CFR 1022.74(d) |
| Approved, any other product, exception taken | Credit score disclosure — form H-4 | 12 CFR 1022.74(e) |
| Approved, the agency returned no score | The score-not-available notice — form H-5 | 12 CFR 1022.74(f) |
| Applicant asked for specific terms and got exactly those terms | Nothing under subpart H | 12 CFR 1022.74(a) |
| An existing account reviewed on a report, terms worsened | Account review risk-based pricing notice | 12 CFR 1022.72(d) and 1022.73(a)(2) |
Key factors are not principal reasons
This is where a correct score block becomes an incorrect letter. The two lists are written by different authors about different things: the key factors come from the score model and rank what depressed a number; the principal reasons come from the lender's own decision and state why it said no. They often look similar, and they are not interchangeable.
Disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit.
Official Interpretations, comment 9(b)(2)-9
The practical consequence is a letter with two lists on it, and a discipline about which is which. A decline driven by a policy rule — a debt-to-income limit, a knockout on a recent bankruptcy — may carry a lawful score block whose key factors say nothing about that rule at all, and that is correct: the score block describes the score, the reasons describe the decision. What is not correct is lifting the four key factors into the reasons field because they were to hand, which is the single most common way a complete-looking letter turns out to have no lawful statement of reasons on it. How a model's reason codes become the sentences on a letter is where that discipline is actually enforced.
What to do when no score was used, or the report came from an affiliate
Two cases sit outside the ordinary flow and both are usually handled by a template that does not know about them. The no-score case first: where a report was obtained and used but no score was used in the decision, the score-related disclosures are not owed. The report-related ones still are — the agency's contact details, the statement that it did not decide, the free report and the dispute right. A notice that prints an empty score, a blank range and no key factors is worse than one that omits the block, because it tells the applicant something untrue about how the decision was made.
The affiliate case is narrower and better defined than its reputation. Appendix C to Regulation B sets out the division: the section 615(a) disclosure is required "when adverse action is taken against a consumer based on information from a consumer reporting agency", and the section 615(b) disclosure "when adverse action is taken based on information from an outside source other than a consumer reporting agency". It adds the affiliate rule directly: a creditor "must provide the section 615(b) disclosure if the creditor obtained information from an affiliate other than information in a consumer report or other than information concerning the affiliate's own transactions or experiences with the consumer", and may satisfy the duty for affiliate-sourced consumer report information with either disclosure (Appendix C, paragraph 2).
Checking both notices on one letter
In the working prototype the FCRA block is one of the things checked beside the letter rather than in a report afterwards, and it is checked against the decision rather than against the template. On the sample decline the applicant's score, its range, its date and four key factors — inquiries among them — are matched against what the bureau supplied for that application, and the agency's contact block, the 60-day free report and the dispute right are each confirmed present. One of the six agents does nothing else, and its stated limit is the count: inquiries are listed whenever they are a key factor, so the fifth factor appears when the rule allows it and never otherwise.
Adverse Action Notice Automation: the FCRA block checked against the decision, not the template
The settings behind it are the lender's, not ours. The number of principal reasons, the reading grade, the retention period and the testing sample are all configurable, and one of them is the place this guide's distinction is most often lost: the limit on principal reasons offers "up to 5 when inquiries are a factor". That option exists because lenders ask for it, and it is worth being exact about what it is — a house rule that mirrors the FCRA's key-factor cap, not a Regulation B requirement. Regulation B caps nothing.
Adverse Action Notice Automation: the content rules as settings
Getting the two sides of the letter right is a content problem on the FCRA side and a traceability problem on the ECOA side, and the clocks run over both: the full list of what the letter must carry sets out the nine components together. To see the score block, the reasons and the clock on one screen, start from Adverse Action Notice Automation.
Questions people ask
What is the difference between a risk-based pricing notice and a credit score disclosure?
A risk-based pricing notice goes to a consumer you approved on terms materially less favourable than the best you offer a substantial proportion of consumers, because of a credit report; it carries no reasons and no score. A credit score disclosure is the exception notice you may give instead, under 12 CFR 1022.74(d) or (e) — and because it goes to every applicant for the product rather than only those below a cutoff, it removes the comparison exercise entirely. Most lenders take the exception for that reason.
Do you need both an adverse action notice and a risk-based pricing notice?
No. Section 1022.74(b) states that a person is not required to provide a risk-based pricing notice if it provides an adverse action notice under section 615(a) of the FCRA, and section 1022.75(a) allows a consumer no more than one notice per grant or extension of credit. The two are alternatives decided by the outcome: a decline draws the adverse action notice, an approval on worse terms draws the pricing notice or its exception.
How many key factors go on a credit score disclosure?
No more than four, except that where the number of inquiries made with respect to the consumer report is itself one of the key factors, up to five may be listed. They must be the factors the score model reported as adversely affecting that individual's score, in order of their importance. The cap belongs to the FCRA and to the score; it is not a limit on how many principal reasons Regulation B permits on the same letter.
What if no credit score was used?
Then the score-related disclosures are not owed, while the report-related ones still are: the agency's name, address and telephone number, the statement that it did not make the decision and cannot give the reasons, the right to a free report within 60 days and the right to dispute. A template that prints an empty score, a blank range and no key factors on those letters is producing a defective notice on every one of them, and the defect is invisible on the page.
Who is covered by the FCRA adverse action rules?
Any person who takes adverse action based in whole or in part on information in a consumer report — which is wider than creditors. Employers, landlords and insurers owe their own versions of the section 1681m duties. Subpart H is narrower: it applies to a person who both uses a consumer report in connection with consumer credit and prices it off that report, and expressly excludes a purchaser or assignee of the resulting contract.
Why are inquiries sometimes a fifth key factor?
Because the statute and the rule both carve them out by name. The cap of four is lifted to five, and only to five, "if one of the key factors is the number of enquiries made with respect to the consumer report" — neither section 1681g(f) nor section 1022.73 gives a reason for the carve-out, so no explanation should be offered to an applicant. The operative consequence is simple: a five-factor block is lawful only when an inquiry count is one of the five, and a template that always prints five is wrong on most letters.