WorkflowConsumer Loans & Cards

The complete guide · October 2026

Adverse action notices, explained.

When a lender turns down a credit application, offers less than was asked, or cuts an existing line, federal law says it must tell the applicant in writing, usually within 30 days, and give the real reasons. That letter is the adverse action notice. The hard part is the reasons: they must name the factors that actually decided, even when a scoring model made the call.

This guide is for anyone who writes, checks, signs or pays for these letters: consumer compliance analysts and officers, underwriting and credit operations, credit risk model owners, correspondence teams, internal audit, and leaders deciding whether to automate the work. No background needed.

See one case, screen by screen →
Watch with transcript →
A quick example · fictional

Imagine you are a consumer compliance analyst, and your signature releases the decline letters Bramblewood Bank sends from Columbus, Ohio. The bank holds $14.6 billion in assets and mails or e-delivers about 14,300 of these letters a month.

It is Monday, October 12, 2026. Dana Whitlock of Dayton asked for a $24,000 personal loan over 60 months. Her application was complete on Tuesday, September 15 at 10:04 am, once her pay stubs were verified. Her file then went to an underwriter for a second look, and on Friday, October 9 the underwriter declined it. Her notice is due Thursday, October 15: three days left.

Two things decided it. Her monthly debt payments, with the new loan, would take 46.2% of her monthly income ($2,389 of $5,170) against the bank's 43% limit, and the bank's scoring model gave her 588 against a cutoff of 620. The model's biggest single factor was the age of her oldest account: 11 months, costing her 41 points. The draft letter, filled from a table that turns model codes into sentences, gives that reason as two words.

Draft letter · reason 2
Words
"Insufficient credit"
From
Code table, previous model
Applies to
Too little credit information
Model documentation · code R14
Measures
Length of credit history
Dana's value
Oldest account 11 months
Effect
−41 points, largest factor
"Insufficient credit""Length of credit history: oldest account 11 months"the factor the model scored.

The new model version, live since September 1, redefined code R14; the table that turns codes into words was never updated. The same two words sit on 214 letters waiting in this week's queue and on 946 that already went out.

Checking each reason against the factor the model actually scored catches the wrong words before Dana's letter goes out, and finds every other letter that carries them.

Adverse action notice automation guide
Part A · Understand it

What an adverse action notice is, and what the law asks of it

The clocks, the contents, the specific-reasons rule, credit scores and risk-based pricing, reasons from scoring models, the 2025 and 2026 changes, the common failures and the volumes, explained without selling anything. If you are new to consumer lending compliance, start here.

01 · In plain words

Why a lender that says no owes the applicant a letter

Every day, lenders say no. A bank declines a personal loan, a card issuer approves a $2,000 line when the applicant asked for $8,000, an auto lender offers a higher rate than the one on the application, a lender cuts the limit on a card someone has carried for years. Each of those is what the law calls adverse action, and each one owes the applicant a letter.

The rule comes from the Equal Credit Opportunity Act (ECOA), passed in 1974 to stop credit discrimination. In 1976 Congress added a duty to explain: within 30 days of a completed application the lender must say what it decided, and a person turned down is entitled to "a statement of reasons", which counts "only if it contains the specific reasons for the adverse action taken".1

The idea is simple. A person who knows why can fix the problem, apply elsewhere, or spot a decision that looks like discrimination. The Consumer Financial Protection Bureau (CFPB) writes the detailed rules in Regulation B, and an official commentary printed with the regulation explains how to apply them.2,3

A second law adds a second layer. When a credit report played any part in the decision, the Fair Credit Reporting Act (FCRA) requires the letter to name the credit bureau, say that the bureau did not make the decision, give the credit score that was used with its range and the key factors that lowered it, and tell the person they can get a free copy of the report within 60 days and dispute anything wrong.4,5 Most lenders send one letter that does both jobs.

Meeting the deadline takes discipline. Getting the reasons right is harder. Modern lenders decide with scoring models that weigh dozens or hundreds of inputs. The model emits codes, a table turns each code into a sentence, and a template prints the letter. When the model changes and the table does not, the letter states a reason the model never used, on every letter it touches, and nobody notices until a sample test or an examiner does.

The life of one declined application, in five steps

  1. The applicant appliesDana Whitlock asks for $24,000 online on a Monday night and uploads her pay stubs.
  2. The application becomes completeTuesday at 10:04 am the stubs are verified. The bank has everything it normally needs, so the 30-day clock starts.
  3. The decision is madeThe score is under the cutoff, the debt-to-income limit fails, a referral to underwriting ends in a decline on day 24.
  4. The notice is written and sentReasons chosen, turned into words, checked, printed or e-delivered by day 30. This is where "Insufficient credit" is caught, or mailed.
  5. The record is kept and testedThe letter, the reasons and the information used are kept 25 months; samples are re-checked; examiners ask for them.

Step 4 is the subject of this guide. The people, the bank and the figures in this example are fictional.

Early clocks, edited sample forms and withdrawn AI guidance: what surprises lenders

The clock starts before the decision

The 30 days run from the day the application is complete, when the lender "has obtained all the information it normally considers".3 A manual review that takes three weeks eats three weeks of the notice's time.

The official sample form needs editing

Regulation B's own instructions say a lender "will not satisfy the notice requirement by simply checking the closest identifiable factor listed" on its sample checklist.6 The checklist is a starting point to edit.

A credit score's key factors are a separate list

The FCRA key factors explain the bureau's score. The ECOA reasons explain the lender's decision. Giving the first in place of the second does not satisfy the ECOA, the official commentary says.3

The AI guidance was withdrawn; the rule it explained still stands

On May 12, 2025 the CFPB withdrew its two circulars (short guidance notes) on reasons from complex models.7 The regulation those circulars quoted, that reasons must be specific and must be the factors actually scored, still stands.2,3

Adverse action, principal reasons, reason codes and key factors

Adverse action

A denial, a counteroffer the applicant does not take, a cut or unfavorable change to an existing account, or a refused increase.

Principal reasons

The factors that actually decided the outcome, stated specifically. The commentary suggests no more than four.

Reason code

A short code a scoring model returns for each factor that lowered an applicant's score, such as "R14".

Key factors

Up to four (five with inquiries) items the credit bureau lists as lowering its own credit score.

Thirteen terms are defined in the one-page summary.

02 · What counts

Which credit decisions count as adverse action, and which owe no notice

In shortA plain denial is obvious. Less obvious: a counteroffer the applicant does not take, a cut to an existing account that does not hit a whole class of accounts, and a refused increase all count. Actions on delinquent accounts, point-of-sale declines, and refusals because the lender does not offer the product or the law forbids it do not.

Regulation B defines adverse action in three parts.8 The first is "a refusal to grant credit in substantially the amount or on substantially the terms requested in an application", unless the lender makes a counteroffer and the applicant "uses or expressly accepts the credit offered". The second is "a termination of an account or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor's accounts". The third is a refusal to increase the credit available after the applicant asked for an increase.

The same section lists what is excluded: a change the applicant agreed to; any action "taken in connection with inactivity, default, or delinquency as to that account"; a decline at the point of sale (with exceptions); a refusal because the law forbids the credit; and a refusal because the lender "does not offer the type of credit or credit plan requested".8 When an action falls in both lists, the exclusion wins.

A counteroffer and a line cut owe a notice as surely as a denial does

Which situations owe what, under Regulation B and the FCRA

NoIf a report was usedYes
ECOA noticeFCRA 615(a) noticeRisk-based pricing noticeApplication deniedYesIf a report was usedNoCounteroffer the applicant does not takeYesIf a report was usedNoCounteroffer accepted, worse terms than most getNoNoIf a report was usedApproved as asked, on the best termsNoNoNoLine cut on one account, not the whole classYesIf a report was usedNoLine cut because the account is delinquentNoNoNoRefused increase the customer asked forYesIf a report was usedNoProduct the lender does not offerNoNoNo

Our reading of the sources 2,8,4,9 · "If a report was used" means the FCRA notice is owed when the decision rested in whole or part on a consumer report. A lender that sends a 615(a) notice need not also send a risk-based pricing notice.

Show the numbers
ECOA noticeFCRA 615(a) noticeRisk-based pricing notice
Application deniedYesIf a report was usedNo
Counteroffer the applicant does not takeYesIf a report was usedNo
Counteroffer accepted, worse terms than most getNoNoIf a report was used
Approved as asked, on the best termsNoNoNo
Line cut on one account, not the whole classYesIf a report was usedNo
Line cut because the account is delinquentNoNoNo
Refused increase the customer asked forYesIf a report was usedNo
Product the lender does not offerNoNoNo

The counteroffer: one letter or two

A counteroffer is an approval on different terms: a smaller amount, a higher rate, a shorter term, a co-signer. If the applicant takes it, there was no adverse action. If not, the lender owes a notice within 90 days of the counteroffer.2

The commentary lets the lender send one combined letter: "A creditor that gives the applicant a combined counteroffer and adverse action notice that complies with § 1002.9(a)(2) need not send a second adverse action notice if the applicant does not accept the counteroffer." Appendix C's Form C-4 is the sample.3,6 A combined letter closes the 90-day clock the day the offer goes out.

Line decreases and closed accounts for existing customers

A line decrease, a closed account or a worse rate on one customer's account, decided on that customer's behavior, is adverse action with its own 30-day clock.2 A change applied to a whole class of accounts, such as a repricing of every card in a portfolio, is not. In 2022 the CFPB issued an advisory opinion stressing that ECOA protects people after they receive credit; that opinion was on the May 2025 withdrawal list,7 but the regulation's definition and its 30-day rule for existing accounts are unchanged.2,8

Business credit is in scope too. ECOA covers business applicants. For a business with gross revenues of $1 million or less, the notice of action can be oral or written, with either the reasons or a statement of the right to ask for them. Above $1 million, or for trade credit and factoring, the lender must notify "within a reasonable time" and give written reasons if the applicant asks in writing within 60 days. A lender "may rely on the applicant's assertion about the revenue size of the business".2,3
03 · The rules and their dates

ECOA and FCRA notice rules since 1976, and the guidance and enforcement shifts of 2025–2026

Status as of October 2026

In shortThe core rules have barely moved in decades: ECOA's specific-reasons duty (1976), Regulation B's notice section, the FCRA notice (expanded in 2003 and 2010). What changed recently is the guidance and the enforcement around them: the CFPB withdrew its circulars on reasons from complex models in May 2025, two bank regulators stopped examining for disparate impact (a neutral-looking practice that falls harder on a protected group, whatever the intent), and in July 2026 a CFPB rule took that "effects test" out of Regulation B. The notice duties themselves are unchanged.

The notice duty is old; the 2025–2026 changes are about guidance and enforcement around it
  1. Mar 1976Reasons become a right

    ECOA amended: a statement of reasons counts only if it gives the specific reasons.

  2. Jul 2011Scores on the letter

    Credit score, range, date and key factors added to adverse action notices; sample forms revised.

  3. Jun 2022Circular 2022-03

    CFPB: complex models are no excuse for missing specific reasons.

  4. Sep 2023Circular 2023-03

    CFPB: the sample checklist is no safe harbor when its reasons are inaccurate.

  5. May 12, 2025Both circulars withdrawn

    Among 67 CFPB guidance documents; Regulation B's text unchanged.

  6. Jul–Aug 2025Disparate impact out of OCC and FDIC exams

    Both still examine for disparate treatment.

  7. Jul 21, 2026Regulation B rule takes effect

    Effects test removed; discouragement narrowed; notice section untouched.

Source 1,10,11,12,7,13,14,15,16

Show the numbers
WhenWhat
Mar 1976Reasons become a right
Jul 2011Scores on the letter
Jun 2022Circular 2022-03
Sep 2023Circular 2023-03
May 12, 2025Both circulars withdrawn
Jul–Aug 2025Disparate impact out of OCC and FDIC exams
Jul 21, 2026Regulation B rule takes effect
Jan 1, 2027Colorado's automated-decision law
TextWhat it asks of a noticeStatus
ECOA, 15 U.S.C. 1691(d)Notice within 30 days of a completed application; reasons count "only if" specific.1In force since 1976
Regulation B, 12 CFR 1002.9The clocks, the contents, specific reasons, incomplete applications, business credit, multiple applicants and creditors.2Unchanged by the 2026 rule15
Official InterpretationsHow many reasons, which factors, scoring and judgmental systems, automatic denials.3In force
Appendix C sample formsTen sample letters; edit the checklist to your real factors.6In force
FCRA 615(a), 609(f)Bureau contact, score and key factors, free report and dispute rights.4,5In force
Regulation V, 12 CFR 1022.72–.75Risk-based pricing notice or a credit score disclosure when terms are worse than most get.9In force
CFPB ECOA exam proceduresA yes-or-no worksheet for every notice element; inadvertent-error test.17July 2026 edition
Circulars 2022-03 and 2023-03Reasons from complex models must be specific and accurate.11,12Withdrawn May 12, 20257
Regulation B final rule, 91 FR 21620No disparate-impact liability under ECOA; narrower discouragement; limits on special purpose programs.15Effective July 21, 2026; lawsuit pending18

What the 2025 withdrawal changed, and what stayed in the regulation

The CFPB's May 12, 2025 notice withdrew 67 guidance documents, including both circulars, and said the withdrawal "is not necessarily final" and that it "will deprioritize enforcement" of the withdrawn guidance while it reviews it.7 The circulars were short. Their force came from quoting the regulation: Circular 2022-03 said a creditor's "lack of understanding of its own methods is therefore not a cognizable defense",11 and Circular 2023-03 said a creditor using the sample checklist must still give the actual reason, giving the example that a denial driven by an applicant's profession is poorly explained as "insufficient projected income".12

The sentences the circulars rested on are in the regulation and its commentary today.

Withdrawn May 12, 2025
  • Circular 2022-03: reasons from complex models.11
  • Circular 2023-03: the sample checklist and inaccurate reasons.12
  • The 2022 advisory opinion on existing accounts.7
Still in Regulation B and its commentary
  • Reasons "must be specific and indicate the principal reason(s)".2
  • They "must relate to and accurately describe the factors actually considered or scored".3
  • With a scoring system, "no factor that was a principal reason for adverse action may be excluded".3
  • Ticking the "closest identifiable factor" on the sample checklist does not comply.6

A lender that relied on the circulars' withdrawal to relax its reason selection would be relying on nothing.

Fair lending exams, as of October 2026

The OCC told examiners on July 14, 2025 to stop examining for disparate impact; it still runs fair lending risk assessments and risk-based examinations and acts on evidence of disparate treatment, meaning an applicant treated differently because of a protected trait such as race, sex or age.13 The FDIC said on August 29, 2025 that it would evaluate discrimination "only through evidence of disparate treatment".14

The CFPB's own rule, effective July 21, 2026, says ECOA does not authorize disparate-impact liability, and its July 2026 exam procedures drop the interagency steps that reference it.15,17 A suit challenging the rule, National Fair Housing Alliance v. CFPB, is pending, with no injunction sought.18 None of this touches the notice section: the CFPB's July 2026 procedures still walk the examiner through every notice element.17

The CFPB itself is smaller: Congress cut its funding cap in July 2025, its supervisory events halved, and it brought one new public enforcement action in 18 months.19 State attorneys general enforce ECOA and their own consumer protection laws too, and Massachusetts did so against a student lender in July 2025.20

04 · The clocks

The 30-day and 90-day clocks: when each one starts and what stops it

In shortThirty days after a completed application, thirty days after action on an incomplete application or an existing account, ninety days after a counteroffer the applicant does not take. "Complete" means the lender has what it normally considers. Days are calendar days. A referral to manual review does not pause anything.

SituationDeadlineRule
Completed application: approval, counteroffer or adverse action30 days after receiving it1002.9(a)(1)(i)2
Adverse action on an incomplete application30 days after taking the action (or a notice of incompleteness)1002.9(a)(1)(ii), (c)2
Adverse action on an existing account30 days after taking the action1002.9(a)(1)(iii)2
Counteroffer not accepted or used90 days after the counteroffer1002.9(a)(1)(iv)2
Business with revenues over $1 millionA reasonable time; written reasons if asked within 60 days1002.9(a)(3)(ii)2
Applicant asks for reasons after a right-to-reasons noticeReasons within 30 days of the request, made within 60 days1002.9(a)(2)(ii)2,17

Dana's clock, day by day

Underwriting used 24 of Dana's 30 days, leaving six for the notice
  1. Mon, Sep 14Applies online

    $24,000 personal loan, 60 months; e-delivery consent given.

  2. Tue, Sep 15Application complete

    Pay stubs verified at 10:04 am. Day 0 of 30.

  3. Wed, Sep 16Referred

    Score below cutoff and a 9% income variance send the file to an underwriter.

  4. Fri, Oct 9Declined

    Day 24. Underwriter confirms the decline.

  5. Mon, Oct 12Notice drafted

    Day 27. Reason 2 is caught; three days left.

Fictional example from this guide

Show the numbers
WhenWhat
Mon, Sep 14Applies online
Tue, Sep 15Application complete
Wed, Sep 16Referred
Fri, Oct 9Declined
Mon, Oct 12Notice drafted
Thu, Oct 15Due

The commentary sets the start: "Once a creditor has obtained all the information it normally considers in making a credit decision, the application is complete and the creditor has 30 days in which to notify the applicant of the credit decision."3 A lender that dates its clock from the decision, or from the day the file leaves underwriting, will send late notices on exactly the files that took longest, which are the files most likely to be declines.

Adverse action notice violations were among the Federal Reserve's top-cited compliance violations in 2023, and a common one was the late notice; at some banks, staff believed a phone call was enough.21

Monday, October 12, 2026 is Columbus Day, a Federal Reserve holiday.22 Regulation B counts calendar days, so Dana's due date does not move. A letter handed to a print vendor that day and mailed on the next postal day still goes inside the clock.

Incomplete applications: decide or ask, within 30 days

When an application is missing something the applicant can provide, the lender has two choices within 30 days. It can deny, giving "incomplete" as the reason, or it can send a notice of incompleteness that names the missing information, sets "a reasonable period of time" to supply it, and says the application will not be considered further without it (Form C-6 is the sample).2,3,6

If the missing item does not stop a decision, the lender must decide on what it has, and "incomplete application" "cannot be given as the reason for the denial".3 A lender may ask by phone first, but if the gap is still open, the written notice is owed inside the 30 days.3

Mortgage files closed as incomplete rose to about 10 for every 100 loans made in 2025

Mortgage applications closed for incompleteness per 100 loans originated, all HMDA reporters

7.72019
9.32021
9.42023
9.42024
10.22025

Source 23 · Our arithmetic from HMDA counts: 695,006 closed for incompleteness and 6,827,891 originated in 2025. Each closed file ended with a notice of incompleteness or an adverse action notice.

Show the numbers
PeriodValue
20197.7
20219.3
20239.4
20249.4
202510.2
05 · What goes in the letter

Adverse action notice requirements: the eleven items a consumer decline letter carries when a credit report was used

In shortRegulation B asks for five: the action taken, the lender's name and address, the ECOA anti-discrimination statement, the lender's federal agency, and the specific reasons (or the right to ask for them). The FCRA adds six when a credit report was used: the bureau's contact, that it did not decide, the score with its range, date and key factors, and the rights to a free report and to dispute. Some states add their own statements.

Regulation B · 1002.9(a)(2)
  1. A statement of the action taken.
  2. The creditor's name and address.
  3. The ECOA statement: "The Federal Equal Credit Opportunity Act prohibits creditors from discriminating against credit applicants…", listing the protected bases.
  4. The name and address of the federal agency that supervises the creditor.
  5. The specific principal reasons, or a notice of the right to them within 60 days with a contact.2
FCRA · section 615(a), 609(f)
  1. The bureau's name, address and telephone number (toll-free for a nationwide bureau).
  2. That the bureau "did not make the decision" and cannot give the reasons.
  3. The credit score used and its range.
  4. The key factors that lowered it: up to four, and inquiries "without regard to" that limit.5
  5. The date the score was created and who provided it.
  6. The right to a free report within 60 days and to dispute inaccurate information.4
Six of the eleven elements on Dana's letter come from the credit report

Elements of a consumer decline notice, by the law that requires them

Regulation BFCRA
Elements on the letter56

Our reading of the sources 2,4,5 · Count of elements as listed above; state statements, where required, come on top.

Show the numbers
Regulation BFCRA
Elements on the letter56

The agency is whichever regulator supervises the lender for ECOA. Bramblewood Bank in the example has over $10 billion of assets, so its letters name the CFPB; a smaller bank names its prudential regulator. A charter change or growth past $10 billion changes the agency on every template at once.

The FCRA content applies whenever the decision rested "in whole or in part" on a consumer report, even if the score was a minor factor: "The credit score does not have to be the primary reason adverse action is taken," the Federal Reserve's compliance staff wrote after the 2022 exam cycle, when FCRA 615(a) failures were among its most cited.24 Information from an outside source other than a bureau triggers a different FCRA paragraph, 615(b), which Form C-1 also covers.6

Two lists, two purposes. The bureau's key factors explain the bureau's score. The lender's principal reasons explain the lender's decision. The commentary is explicit: "Disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons."3 Dana's letter carries both: four reasons from the bank, four key factors from the bureau, and they overlap only partly.

Paper or electronic delivery of a decline notice

The notice must be in writing, though a lender that received 150 or fewer applications in the preceding calendar year may give it orally. A lender may deliver it electronically only with consent that meets the E-SIGN Act: the applicant "has affirmatively consented", after disclosures about paper copies and withdrawal, in a way that "reasonably demonstrates" access to the electronic form.25 Lenders keep the consent with the record, and send by mail when there is none.

06 · Specific reasons

What "specific principal reasons" means, rule by rule, with the words examiners accept

In shortThe reasons must be the factors that actually decided, named specifically. "Internal standards" and "did not meet our score" are banned by name. More than four reasons is "not likely to be helpful". With a scoring model, only scored factors may appear and no principal one may be left out. A failed knockout rule is always disclosed. The sample checklist must be edited to the lender's real factors.

RuleWhat it saysWhat it means for a letter
1002.9(b)(2)"must be specific and indicate the principal reason(s)"; internal standards or a failed qualifying score are "insufficient"2"Did not meet our credit standards" fails.
Comment 9(b)(2)-1No set number; "more than four reasons is not likely to be helpful"3Four is the custom; the law sets no ceiling.
Comment -2Reasons "must relate to and accurately describe the factors actually considered or scored"3The words must match the factor.
Comment -3Need not say how or why: "length of residence" is enough3Name the factor; no essay needed.
Comment -4With a scoring system, only factors "actually scored"; none of the principal ones left out; disclose even "age of automobile"3The model decides what the reasons are.
Comment -5Any method; two examples compare the applicant's factor scores with averages3Write down your selection method.
Comment -6, -7Judgmental: factors actually reviewed; combined: reasons from the part the applicant failed, both parts after a gray-band referral3Underwriter overrides need recorded reasons.
Comment -8An automatic-denial factor: "the creditor must disclose that specific factor"3A knockout rule is always a reason.
Appendix C, instruction 4"Closest identifiable factor" fails; "insufficient bank references", not "insufficient credit references"6Edit the checklist to your factors.

Dana's reasons, worked through

Dana's file was scored, failed a policy rule, and then went to an underwriter. Under comment 9(b)(2)-7, a file that lands in a gray band (the score range where the system sends the file to a person) and is then declined by that person takes its reasons "from both components of the system".3 The policy rule, debt-to-income after the loan, is a hard limit, and comment -8 says such a factor must be disclosed. The model's own factors rank the rest.

Length of credit history cost Dana more points than any other factor

Points each model factor took off Dana's score of 588 (cutoff 620)

R14 · Length of credit history: oldest account 11 months41 points
R03 · Revolving utilization: 87% of $7,00033 points
R22 · Credit inquiries in the last 90 days: 518 points
R09 · Time with current employer: 7 months11 points
R31 · Installment accounts in good standing: 16 points

Fictional example from this guide · The failed debt-to-income rule (46.2% against 43%) is reason 1; the top three model factors are reasons 2 to 4.

Show the numbers
Model factorPoints lost
R14 · Length of credit history: oldest account 11 months41 points
R03 · Revolving utilization: 87% of $7,00033 points
R22 · Credit inquiries in the last 90 days: 518 points
R09 · Time with current employer: 7 months11 points
R31 · Installment accounts in good standing: 16 points

So the four principal reasons are the failed debt-to-income rule, then R14, R03 and R22. R09 and R31 lowered the score too, but by less. The lender's selection method, which comment -5 lets it choose, decides where the line falls; what matters is that the method is written down and applied the same way every time.

Vague words and specific words

What decidedVague wordingSpecific wording
Age of oldest account, 11 months"Insufficient credit""Length of credit history: oldest account 11 months"
Debt-to-income limit"Did not meet our lending criteria""Your monthly debt payments, including this loan, would be 46% of your monthly income. Our limit is 43%."
Bank references only"Insufficient credit references""Insufficient bank references"6
Applicant's profession, in a model"Insufficient projected income"The profession-related factor itself12
Score under the cutoff"Credit score too low"The scored factors that pulled it under2,3

"Insufficient credit" does not appear on the sample checklist in Form C-1. Its nearest boxes are "Insufficient number of credit references provided", "Limited credit experience" and "No credit file", each a different factor.6

07 · Reason codes and models

Adverse action reason codes: where the words on the letter drift from the model's decision

In shortA scoring model returns reason codes; a mapping table turns each code into words; a template prints them. Each of the three links can break. The most fragile is the table, because models are retrained and re-versioned and a code can change meaning. Explanation methods for machine-learning models approximate the model, and different methods can disagree about which factors drove the same decision.

A reason passes through five steps between the model and the applicant
  1. 1Model scores

    Each input's effect on this applicant's score is measured against a reference group.

    Credit risk modelAt decision
  2. 2Reasons ranked

    Failed policy rules first, then the factors that cost the most points, up to the lender's limit.

    Selection method (comment -5)At decision
  3. 3Codes become words

    A mapping table, one sentence per code, approved for one model version.

    Model owner and complianceWhen the model changes
  4. 4Letter assembled

    Template by product, action and state; bureau content added.

    Notice generationDays 1 to 30
  5. 5Tested

    Samples re-traced; findings fixed across every letter with the same code.

    Compliance testingMonthly

Our reading of the sources 3,26

Show the numbers
StepWhat happensWhoTime
Model scoresEach input's effect on this applicant's score is measured against a reference group.Credit risk modelAt decision
Reasons rankedFailed policy rules first, then the factors that cost the most points, up to the lender's limit.Selection method (comment -5)At decision
Codes become wordsA mapping table, one sentence per code, approved for one model version.Model owner and complianceWhen the model changes
Letter assembledTemplate by product, action and state; bureau content added.Notice generationDays 1 to 30
TestedSamples re-traced; findings fixed across every letter with the same code.Compliance testingMonthly

Where the table breaks

Dana's bank retrained its personal loan model and released version 7 on September 1. Its documentation, filed on October 9 to the model inventory (the bank's register of every model it uses), defines code R14 as "length of credit history (age of oldest account, months)". In version 6, R14 meant too little credit information; that meaning moved to a new code, R38. The mapping table in use, version 6.3, still prints R14 as "Insufficient credit".

From September 1 to October 9, 946 letters went out with those words for a factor the new model measures differently, and 214 more sat in the week's queue.

This is the failure the commentary describes: a reason that does not "accurately describe the factors actually considered or scored".3 It is systematic, so every letter the same code and version produced carries it. It is also invisible on the page: "Insufficient credit" reads as a plausible reason to anyone who does not know what R14 now measures.

A stale mapping table repeats its error on the most letters and is the hardest to see

Where reason errors come from, placed by how often they repeat and how hard they are to spot on the letter

How hard to spot on the letter →
Hidden, rare
Hidden, often
Visible, rare
Visible, often
Stale mapChecklist boxNo override reasonMissing knockoutKey factorsWrong agency
How many letters one cause touches →

Our reading of the sources 3,6,12,27,21 · Causes that are hidden and repeat often need testing against the decision; visible ones that repeat are fixed in the template.

Show the numbers
ItemHow many letters one cause touches (0–1)How hard to spot on the letter (0–1)
Stale map0.760.76
Checklist box0.620.52
No override reason0.140.72
Missing knockout0.200.20
Key factors0.740.29
Wrong agency0.700.12

Choosing reasons from a machine-learning model

Comment 9(b)(2)-5, written for points-based scorecards, gives two ways to pick reasons: compare the applicant's score on each factor with the average score of applicants "whose total score was at or slightly above the minimum passing score", or with the average of all applicants, and take the factors that fall furthest below.3

Modern attribution methods, the techniques that estimate how much each input moved one applicant's score, do something similar: they estimate each input's contribution against a background population. The choice of that background is the part that maps onto the comment, and it should be documented with the model.

Attribution methods are estimates. A 2022 study of six explanation methods across four datasets found that leading methods "often disagree in terms of the explanations they output", and that practitioners "often employ ad hoc heuristics when resolving such disagreements".26 For a lender, disagreement means two defensible methods could print different top-four reasons for the same applicant. Comparing two methods' top factors on a sample is a cheap test, and a persistent disagreement rate is a finding to explain.

Models also have hundreds of engineered inputs that a letter cannot name. Grouping them into factors a person can understand, and deciding that "months since oldest trade opened" and "average age of accounts" both report as "length of credit history", is a modeling decision. It changes which reasons appear, so it belongs in the model documentation and its validation, with the mapping table versioned to match.

1

Name the reference group

Write down the population each applicant is compared against, as comment -5's two examples do, and keep it with the model.

2

Run a second method

Compare two explanation methods' top four factors on a sample, and explain any steady disagreement.

3

Version the grouping

Record which inputs report as which factor, and change the mapping table with each model version.

SR 26-2 and the models that pick decline reasons

On April 17, 2026 the Federal Reserve, OCC and FDIC replaced SR 11-7, the long-standing model risk guidance, with new guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026). A credit scoring model is a model under it. Generative AI models, and AI that acts on its own, "are not within the scope of this guidance", and the bank's own governance should guide controls for them.28,29 The notice rules apply whatever the technology: Regulation B has no exemption for complex models, which is why the 2022 circular's point outlived the circular.2,11

States are adding their own duties. Colorado's SB26-189, signed May 14, 2026, covers automated decisions about "financial or lending services": after an adverse outcome, a plain-language description of the automated system's role within 30 days, and human review and reconsideration on request, with the attorney general's rules due by January 1, 2027.16

08 · Scores and pricing notices

Credit score disclosure and risk-based pricing notices: which letter goes to whom

In shortA declined applicant whose report was used gets the FCRA content inside the adverse action notice. An approved applicant who got worse terms than most because of a credit report gets a risk-based pricing notice, or a credit score disclosure in its place. A proper adverse action notice satisfies the risk-based pricing duty. Thin-file applicants, who may have no score, need their own handling.

The risk-based pricing rule covers credit granted "on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers", based in whole or part on a consumer report.9 Lenders rarely compare each borrower one by one; Regulation V, the CFPB's rule under the FCRA, offers shortcuts.

Under the credit score proxy method, a lender finds the score at which about 40% of its borrowers score higher and 60% lower, and sends the notice to everyone below it. Under the tiered pricing method, with four or fewer tiers, everyone outside the top tier gets one.9

ExceptionWho it coversRule
Applied for specific terms and got themUnless the lender set the terms after pulling the report1022.74(a)9
An adverse action notice was givenCounteroffers and other actions with a 615(a) notice1022.74(b)9
Prescreened firm offersCredit offered from a prescreened list1022.74(c)9
Credit score disclosure to everyoneMortgage (d) and other credit (e)1022.74(d), (e)9
No score availableA notice saying no score was available1022.74(f)9

Applicants with thin files

Dana is new to credit: her oldest account is 11 months old. People like her are common. The CFPB's corrected estimate, published in June 2025, puts 2.7% of adults with no credit record at all in December 2020 (7.0 million people) and 87.5% with a scored record.30 The rest have a record too thin or stale to score.

About one adult in eight had no credit record or no score in 2020

US adults by credit record, December 2020

Scored record: 87.5%Record but no score: 9.8%No credit record: 2.7%
87.5%scored
  • Scored record87.5%
  • Record but no score9.8%
  • No credit record2.7%

Source 30 · "Record but no score" is our arithmetic: 100% less the scored and credit-invisible shares the CFPB publishes.

Show the numbers
PartValue
Scored record87.5%
Record but no score9.8%
No credit record2.7%

For an unscored applicant the letter still owes the ECOA reasons ("No credit file" and "Limited credit experience" are both on the sample checklist), and the FCRA notice still applies if a report was used, even an empty one. A lender's templates need a path for "no score available" as well as for a score.

State law adds little here: in October 2025 the CFPB issued an interpretive rule saying the FCRA "generally preempts State laws that touch on broad areas of credit reporting", replacing a 2022 rule withdrawn in May 2025.31 State statements on the ECOA side of the letter, where a state requires them, are a separate matter for counsel.

09 · What goes wrong

Late letters, vague reasons and missing scores: what examiners and enforcers have found

In shortExaminers keep finding late notices, missing credit score content and vague reasons. Enforcement cases show the scale: one fintech lender sent more than 71,800 notices whose reasons were inaccurate. A wrong reason built into a table or template repeats on every letter it touches, which turns one error into a population finding.

What the Federal Reserve's examiners cite

The Federal Reserve's compliance staff publish the violations they cite most, and write AAN for adverse action notice. For 2023, adverse action notice violations were "among the Federal Reserve's top-cited compliance violations", and "a common violation was failing to provide an AAN within 30 days after receiving a completed application".21

Staff at some banks believed a phone call satisfied the rule. The root causes were "inadequate oversight by management and a lack of appropriate employee training" and "weaknesses in the monitoring and audit functions".21 For 2022, the FCRA list included "Not providing an AAN when taking adverse action based, in whole or in part, on information in a consumer report".24

Two adverse action enforcement cases

Inaccurate reasons outnumbered late notices almost ten to one at one lender

Adverse action failures the CFPB alleged against LendUp, 2021

Notices that did not accurately describe the main reasons71,800 notices
Applicants who got no notice within 30 days7,400 notices

Source 27

Show the numbers
Alleged failureCount
Notices that did not accurately describe the main reasons71,800 notices
Applicants who got no notice within 30 days7,400 notices

CFPB v. LendUp (2021). The CFPB alleged that the online lender "failed to provide adverse-action notices within the 30 days required by ECOA for over 7,400 loan applicants" and issued "over 71,800 adverse-action notices that failed to accurately describe the main reasons" for denials.27 The proposed settlement filed in December 2021 barred it from making new loans, with a $100,000 civil penalty "based on LendUp's demonstrated inability to pay".32

Massachusetts and Earnest (2025). On July 10, 2025 the Massachusetts attorney general announced a $2.5 million settlement with a student lender, alleging among other things "inaccurate and non-specific adverse action notices", a knockout rule that denied applicants without at least a green card, and an underwriting variable with disparate outcomes. The lender agreed to AI governance, model testing and an inventory of its models.20 A state enforcer acted where the federal agencies were stepping back.

The common failures, and why they happen

FailureWhy it happensThe rule
Notice after day 30Clock dated from the decision; referrals run long; a phone call taken as notice1002.9(a)(1)2,21
Reason is the nearest checklist boxSample form used uneditedAppendix C, instr. 46
Reason the model no longer scoresMapping table not versioned with the modelComments -2, -43
Bureau key factors given as the reasonsOne list reused for both jobsComment -93
Underwriter decline with no recorded reasonOverride fields optionalComments -6, -73
Counteroffer treated as an approvalNo 90-day clock for offers not taken1002.2(c), 9(a)(1)(iv)2,8
Line cut with no noticeAccount management outside the notice process1002.9(a)(1)(iii)2
Score, range or key factors missingBureau data not mapped to the templateFCRA 615(a)4,24
Record not kept 25 monthsLetters stored, inputs and reasons not1002.12(b)33

The inadvertent-error defense is narrow

Regulation B forgives "an inadvertent error", such as a "clerical mistake, calculation error, computer malfunction, and printing error", if the lender corrects it "as soon as possible". It adds: "An error of legal judgment is not an inadvertent error under the regulation."34 The CFPB's exam procedures require that the error "occurred despite the fact that the creditor maintains procedures reasonably adapted to avoid such errors".17 A mapping table never checked against a new model version is the absence of such a procedure.

Private suits can claim actual damages and punitive damages up to $10,000 per person, or in a class the lesser of $500,000 or 1% of the lender's net worth, within five years.35

10 · The volumes

How many credit applications end in a notice: denial rates and volumes in 2025 and 2026

In shortNo one publishes a national count of adverse action notices. Two series frame the scale: about one credit applicant in six was rejected in the twelve months to June 2026, by the New York Fed's survey, and mortgage lenders alone denied 2.1 million applications and closed 695,000 as incomplete in 2025. A lender's own number is in its origination system.

16.1%

of credit applicants were rejected in the twelve months to June 2026, down from 23.1% a year earlier.36

New York Fed, SCE Credit Access Survey
2.1M

mortgage applications were denied in 2025, against 6.8 million loans originated.23

HMDA, all reporters, 2025
526K

home purchase applications were denied in 2024, about one in six.37

St. Louis Fed Review, May 2026
Mortgage denials and incomplete files rose for a second year, to 2.8 million in 2025

Mortgage applications denied or closed for incompleteness, millions, all HMDA reporters

3.26 M2019
4.36 M2021
2.57 M2023
2.69 M2024
2.81 M2025

Source 23 · Denied plus closed for incompleteness: 2,115,090 + 695,006 in 2025. Mortgages are only part of consumer credit; cards, auto and personal loans add many more notices.

Show the numbers
PeriodValue
20193.26 M
20214.36 M
20232.57 M
20242.69 M
20252.81 M

The denial share in mortgage lending is high. In 2025, 2,115,090 applications were denied and 6,827,891 originated, so about 24 of every 100 applications that ended in an origination or a denial were denials (our arithmetic).23 The St. Louis Fed's review of more than 30 million home purchase applications from 2018 to 2024 found denial rates rose from 12.2% to 15.7% during the 2022–2023 tightening, and traced the rise to debt-to-income limits as rates climbed.37 Dana's decline turned on the same kind of rule.

Volumes outside mortgage lending are larger and less visible. A bank with a card program, indirect auto and digital personal loans can send tens of thousands of notices a month; the fictional bank in this guide sends about 14,300. The numbers that matter for a program are its own: notices a month by product and action, the share that are counteroffers and line decreases, and the days from completed application to notice.

What nobody publishes. There is no public figure for the number of adverse action notices sent each year in the United States, the share whose reasons are inaccurate, the minutes each one takes, or the cost of a remediation mailing. Vendor figures come without a dataset. Measure your own.
11 · How teams do it today

How lenders produce adverse action notices today: who touches each letter, and where the days go

In shortUnderwriting decides, credit risk owns the model and its reason codes, compliance owns the words and the testing, and a correspondence team or print vendor sends the letters. Most of the 30 days goes to the decision itself. The notice step is short, but it sits at the end of the clock and inherits every delay before it.

Underwriting, model owner, compliance and print: who touches a notice

UW

Underwriting operations

Decides referrals and overrides; records the reasons for a judgmental decline.

Cares about: deciding on day 24 without blowing the notice deadline.
MO

Credit risk model owner

Builds and versions scoring models, documents what each reason code measures, signs off the mapping table.

Cares about: knowing every letter a code change will touch.
CA

Consumer compliance analyst

Owns templates by product, action and state, checks content, releases batches, runs the monthly sample.

Cares about: every sentence on the letter being true.
CO

Compliance officer

Owns exam findings and remediation; decides whether corrected letters go out.

Cares about: a wrong reason repeating across every letter of a model version.
CR

Correspondence and print

Runs the print vendor and e-delivery, handles returned mail, keeps proof of sending.

Cares about: knowing by afternoon what goes in tonight's mail.

A notice crosses four teams; the last has the least time

A notice crosses four teams, and the last one has the least time
  1. 1Decision recorded

    Score, policy rules, any underwriter override and its reason.

    UnderwritingDays 0 to 24
  2. 2Reasons pulled

    Reason codes and failed rules exported from the decision engine.

    Operations or IT1 to 3 days
  3. 3Words and template

    Codes mapped to sentences; product, action and state template chosen.

    Compliance1 to 3 days
  4. 4Checked

    Content, bureau data, agency, consent for e-delivery.

    Compliance1 to 2 days
  5. 5Released and sent

    Batch signed; print vendor or e-delivery.

    Correspondence1 to 2 days
  6. 6Tested

    Monthly sample re-traced; findings fixed.

    Compliance testingMonthly

Illustrative · replace with your own numbers · Durations are a sketch of a manual process, not measurements; time your own.

Show the numbers
StepWhat happensWhoTime
Decision recordedScore, policy rules, any underwriter override and its reason.UnderwritingDays 0 to 24
Reasons pulledReason codes and failed rules exported from the decision engine.Operations or IT1 to 3 days
Words and templateCodes mapped to sentences; product, action and state template chosen.Compliance1 to 3 days
CheckedContent, bureau data, agency, consent for e-delivery.Compliance1 to 2 days
Released and sentBatch signed; print vendor or e-delivery.Correspondence1 to 2 days
TestedMonthly sample re-traced; findings fixed.Compliance testingMonthly

Codes into words, then release: where the post-decision days go

Turning codes into words and waiting for release take most of the post-decision days

Days from decision to notice in a manual process, by step

Pulling the decision and codesCodes into wordsChecking contentFixing and re-draftingWaiting for release and mail
By hand, 11.4 days2.5321.52.4

Illustrative · replace with your own numbers · An estimate built on the example in this guide; no public source measures it. Time ten of your own notices from decision to sending.

Show the numbers
Pulling the decision and codesCodes into wordsChecking contentFixing and re-draftingWaiting for release and mail
By hand, 11.4 days2.5321.52.4

Origination templates, composition tools or reason tracing

Inside the decision system

Templates in the origination system

Reason codes flow straight to a letter template. Fast and cheap. The weak point is the mapping table, usually edited by hand and rarely versioned with the model.

Document platform

A composition tool and a print vendor

Templates by product and state, managed by compliance, fed by an export. Good control of wording; reasons arrive as codes with no link back to the model documentation.

Software that traces

Reason tracing and checking

Tools that read the decision, check each reason against the model version and the rules, keep the clocks and the evidence. They differ on whether every sentence carries its factor and on who can change the map.

Whatever the tooling, the lender owns the letter. The reasons are its reasons, chosen by its method, and an outsourced print run does not move the duty.

Part B · See it working

Botminds Adverse Action Notice Automation across a bank's personal loan, auto, card and home equity declines

Part A described the work without naming a product. This part shows how Botminds does it, at a fictional $14.6 billion bank in Columbus, Ohio that sends about 14,300 notices a month across personal loans, auto, cards and home equity lines. Every applicant, person, model, number and letter in the screens is sample data.

12 · One letter, start to finish

Dana Whitlock's decline letter: one stale reason caught, the mapping table corrected and 1,785 notices released on time

In shortThis is the example from the top of the page, inside the product. Six agents read the decision, trace each reason to the factor or rule behind it and check the letter against 14 rules. Elise Dunmore, the compliance analyst, rewrites the one reason that fails, proposes a corrected mapping table that the model owner and the compliance officer approve, and releases 1,785 notices, every one inside its clock.

1

She opens on the letter itself

On Monday morning, Elise's start screen is Dana's notice, set as the letter Dana will receive, with the 30-day clock above it: day 27 of 30, due Thursday, October 15. Beside each reason, a note traces it to its factor, Dana's own value and the points it cost. Beside the letter, 14 rules from Regulation B, the FCRA and the bank's house and state rules tick as the letter is checked, and stop at 12 of 14.

Reason 2 reads "Insufficient credit", underlined. Its note says the mapping table in use, version 6.3, prints those words for code R14, while model version 7 scored R14 as length of credit history: oldest account 11 months, minus 41 points.

The notice composer. The letter as Dana will read it, each reason's trace in the margin, and the rules beside it. The screen calls "Insufficient credit" a sample-form phrase; Regulation B's Form C-1 actually lists "Limited credit experience" and "Insufficient number of credit references provided", which are different factors again. The row "No more than four reasons" is the bank's setting: the commentary says more than four "is not likely to be helpful".
2

The decision was read in under eight seconds

The decision reader took application PL-2609-48213: Personal Loan Score version 7 at 588 against a cutoff of 620, policy rule CP-4.2 failed at 46.2% debt-to-income against 43%, and the clock started at the completed application on September 15. The reason tracer ranked one policy rule and five model factors and picked four principal reasons: CP-4.2, R14, R03 and R22.

The reason-map checker compared each code's words with the model's documentation for version 7 and stopped on R14. The bureau disclosure checker read the credit report used: score 641, range 300 to 850, four key factors with inquiries among them.

The full decision. The clock, the score and cutoff, the failed policy rule, the agents' run step by step, and the drafted letter beside it.
3

One click rewrites the reason from the factor

Elise presses Rewrite from the factor. "Insufficient credit" is replaced by "Length of credit history: oldest account 11 months". The note turns green: accurate, specific, reading grade 5.2. The two Regulation B rules that failed, specific principal reasons and only factors actually scored, pass. The letter now meets 14 of 14.

The words come from the factor the model scored and Dana's own value, so the reason says what she can do about it: wait, as her history lengthens.

Reason rewritten from the factor. Reason 2 now names the factor and Dana's value, and the rule panel reads 14 of 14.
4

The table is fixed once, with two approvals

The same words sit on 213 more held letters and on 946 already sent between September 1 and October 9. Elise opens R14 in the reason-code map and proposes version 7.1, whose wording fills in each applicant's own months. Jun Park approves as model owner and Wendell Okafor as compliance officer. The 214 held notices are rewritten and checked again; none is left on hold.

For the 946 sent letters, a corrected notice is drafted for each. Whether they go is Wendell's decision.

Mapping table version 7.1, approved. The code's meaning from the model documentation, the old and new words, the letters affected, and the proposal with both approvals.
5

She signs the batch

The day's batch holds 1,785 notices: the 1,571 that passed every check plus the 214 rewritten. Every reason is traced to its factor or rule, every notice is inside its clock, the earliest due on Tuesday, October 13. Elise signs; 1,142 go by e-delivery to applicants with E-SIGN consent on file and 643 go to the print vendor for first-class mail.

October 12 is Columbus Day. The letters handed to the print vendor that evening are mailed on the next postal day, Tuesday, October 13: on or before every due date in the batch, since a written notice counts as given when it is mailed.3

The batch, released. The notices by product and model, the nine checks on every notice, the analyst's signature and the trail of who did what.

The solution's design targets: every notice out within 30 days, and four of four reasons on every letter traced to the factor or rule that decided. They are targets, to be measured on your own declines.

13 · Every screen

The notice clock queue, the reason-code map before the fix, Dana's score disclosure and the monthly accuracy test

In shortOne letter is the story. These screens show the rest: every notice on its clock, the reason-code map before the fix, what drove Dana's decision and the reason trace, the score disclosure on her letter, the monthly accuracy test, a look-up for any past decision, the clock report and the settings.

Notices due. Every decline, counteroffer, incomplete file and line decrease waiting for its notice, sorted by days left on its clock, which starts at the completed application.
The reason-code map before the fix. 47 of 48 codes match the model documentation. R14's words, carried over from version 6, no longer describe what it measures; the panel's "sample-form phrase" label is the product's wording.
What drove the decision. The failed policy rule and the five model factors with the points each cost; the top three factors and the rule become the reasons.
Score disclosure and the ripple. The FCRA paragraph with score, range, date and key factors, then the ECOA statement and the template's Ohio paragraph (sample state text; confirm your own state's wording with counsel), and the count of other letters carrying the old words.
The reason trace. Each sentence on the letter beside the rule or factor it came from, Dana's value, its effect and the table that supplied the words.
Reason-accuracy testing. The monthly sample traced again from the decision, the trend by month, and remediation for every letter that carried the wrong words.
Decision look-up. Why any past application was decided as it was: model version, reasons and their codes, the letter, when it arrived and how long the record is kept, here answering a complaint.
The clock report. Notices due each day for the next 30, open counteroffers on their 90-day clocks and delivery results. The "2.1 days, was 11.4" tile is the solution's sample data; treat it as a target to measure.
Your notice rules. Clocks, escalation, batch times, reasons per letter, the map-version lock, reading level and who approves a map change, versioned on the audit trail.

Select any screen to open it larger. The bank, applicants, people, models and figures are fictional; the credit bureau shown is invented.

The queue that morning

Most of the 1,846 open notices were ready; one code held 214

Decisions waiting for a notice at Bramblewood Bank, Monday morning

Drafted, every check passed: 1,571Held on the R14 wording: 214Open counteroffers, 90-day clock: 37Need a person: 16Incomplete applications: 8
1,846open
  • Drafted, every check passed1,571
  • Held on the R14 wording214
  • Open counteroffers, 90-day clock37
  • Need a person16
  • Incomplete applications8

Fictional example from this guide

Show the numbers
PartValue
Drafted, every check passed1,571
Held on the R14 wording214
Open counteroffers, 90-day clock37
Need a person16
Incomplete applications8
The September sample found 57 of 60 letters accurate; all three misses were R14
57 of 60

sampled September letters whose reasons matched the factors scored, traced again from the decision

Fictional example from this guide

Show the numbers
MeasureValue
sampled September letters whose reasons matched the factors scored, traced again from the decision95 of 100
14 · Agents, and who signs

The compliance analyst releases every notice; a reason-code mapping change needs the model owner and the compliance officer

In shortEach agent has one job and limits it does not cross. None of them changes a decision, changes the mapping table or sends a letter. The analyst releases each notice and each batch; a mapping change needs the model owner and the compliance officer; corrected letters go only on the compliance officer's decision.

AgentIts jobWhat it never does
Decision readerReads each decision record: product, action, model version, score, cutoff, policy rules and the completed-application dateTreats a referral or decision date as the start of the clock
Reason tracerRanks the factors and failed rules that drove the decision and picks the principal reasons, each tracedGives a reason the decision did not score; drops a failed knockout rule
Reason-map checkerChecks each code's words against the model documentation for the version that decided; holds mismatchesChanges the map
Bureau disclosure checkerChecks score, range, date, key factors, bureau contact, free report and dispute rightsOmits inquiries when they are a key factor
Notice writerWrites the letter from the approved template for product, action and state, in plain wordsSends a letter
Clock keeperKeeps the 30- and 90-day clocks, batches, delivery, returned mail and the 25-month recordLets a notice pass its due date silently

The analyst releases; two people change reason wording

1

The analyst releases

Every notice and every batch carries the compliance analyst's signature, with its meaning and time recorded.

2

Two people change the words

A new mapping table version needs the model owner and the compliance officer, both recorded before it is used.

3

The officer decides corrections

Corrected letters for notices already sent go only on the compliance officer's decision.

The batch Elise signed

Personal loans were the largest share of the 1,785-notice batch

Notices in the October 12 batch, by product

Personal loan · Personal Loan Score v7, map v7.1812 notices
Auto · Auto Score v4, map v4.2431 notices
Credit card · Card Score v9, map v9.0389 notices
Home equity line · policy rules153 notices

Fictional example from this guide

Show the numbers
ProductNotices
Personal loan · Personal Loan Score v7, map v7.1812 notices
Auto · Auto Score v4, map v4.2431 notices
Credit card · Card Score v9, map v9.0389 notices
Home equity line · policy rules153 notices
15 · What goes in and out

What notice software reads from decision records and model documentation, and the reason trace it keeps for every decline

In shortIt reads the decision records your systems already produce, the model documentation already in your inventory, the credit report used and your approved templates, and leaves behind a checked notice for every decline, counteroffer and line decrease, a trace of every reason, a clock report and a sampling record. Your systems of record stay where they are.

From the decision

  • The decision record and model reason codes
  • Failed policy rules and underwriter overrides
  • The completed-application date
  • The credit report and score used

From the bank

  • Model documentation by version
  • Reason-code maps by model version
  • Notice templates by product, action and state
  • Clock targets, escalation and approvers
Agents read, trace and check Every reason to its factor or rule, every letter against the rules, every notice on its clock
The analyst releases each batch
Every reason traced to the decision

Outputs

  • Adverse action and counteroffer notices with specific reasons
  • A reason-to-factor trace for each decision
  • A clock report of notices due and sent
  • Reason-accuracy samples and remediation lists
  • The 25-month record for each decision

What changes for the team

  • Letters to review, with each reason's proof beside it
  • Model changes checked before the first letter
  • Every letter like a wrong one found at once

Origination, decision engine, model inventory and print vendor it links

Loan origination systemDecision records and completed dates
Decision engineReason codes and policy rule results
Model inventoryDocumentation and maps by version
Credit bureau feedsScore, range, date, key factors
Document compositionApproved templates by state
E-delivery and print vendorBatches out, delivery and returns back
Records and archiveThe 25-month record
Identity and accessRoles, approvers, separation of duties

For each, check whether it has an API, a file feed, or only screens, and who owns it.

Your decision engine, templates and print vendors keep their jobs

Your decision engine

Keeps deciding. Its reason codes and rule results are read as they are produced; no decision is changed.

Your model inventory

Stays the home of model documentation. Each code's words are checked against the documented meaning for the version that decided.

Your templates

Kept as approved, by product, action and state, including the state statements your counsel requires.

Your print and e-delivery vendors

Receive the signed batch as today, and return delivery and returned-mail results.

Your testing program

Gets samples traced to the decision, and a list of every letter like any letter found wrong.

Your examiners

Get any decision's inputs, model version, reasons, letter and delivery for the full retention period.

Part C · Are you ready to automate?

When automated reason tracing pays off for an adverse action notice program

You write, check or answer for the letters your lender sends when it says no. This part is written for you: what wrong and late notices cost, what tracing every reason could return, whether your team is ready, and what to ask any vendor of notice software, including us.

16 · What wrong notices cost

What a late or wrongly worded decline letter costs you: penalties, remediation and exam time

In shortStart from your own costs. Three published figures help: the damages the law allows, one enforcement case that alleged inaccurate reasons on 71,800 notices, and a compliance wage that prices the hours. Nobody publishes how often notices carry the wrong reason, so the number that matters most is the one your own sample produces.

$500K

or 1% of net worth, whichever is less: the cap on punitive damages in an ECOA class action, on top of actual damages and fees, for five years after the violation.35

15 U.S.C. 1691e
71,800

notices that "failed to accurately describe the main reasons", as alleged against one online lender in 2021.27

CFPB v. LendUp
$55/hr

a compliance officer's median pay, $38.81 an hour in 2025, loaded for benefits at the 70% wage share of employer costs.38,39

O*NET and BLS · our arithmetic
Most of the days between decision and notice are hand-offs a traced, checked draft can remove

Days from decision to notice, by step: a manual process against the solution's design target

By hand (estimate)Traced and checked on arrival (design target)
Pulling the decision and codes2.5 days0.1 days
Codes into words3 days0.2 days
Checking content2 days0.3 days
Fixing and re-drafting1.5 days0.3 days
Waiting for release and mail2.4 days1.2 days

Illustrative · replace with your own numbers · 11.4 days by hand and 2.1 with automation are estimates modelled on the example; neither is a measurement. Time ten of your own notices.

Show the numbers
By hand (estimate)Traced and checked on arrival (design target)
Pulling the decision and codes2.5 days0.1 days
Codes into words3 days0.2 days
Checking content2 days0.3 days
Fixing and re-drafting1.5 days0.3 days
Waiting for release and mail2.4 days1.2 days

Late notices, vague reasons and remediation: finding your own counts

CostWhere it hidesHow to find your number in a week
Late noticesReferrals that run long; clocks dated from the decisionFor last month's declines, days from completed application to notice; count any over 30
Wrong or vague reasonsMapping tables not versioned with the model; checklist boxesRe-trace 30 sent letters to the model output and documentation; count mismatches
RemediationCorrected letters, file reviews, print and postageYour last remediation: letters, hours and vendor invoice
Analyst timeExports, template fixes, batch checks, sample testingAsk the desk to log minutes per batch and per sample for a week
Exam and audit timePulling the application, inputs, reasons and letter for each sampled fileTime to assemble ten files for a mock exam request
Complaints"No one told me why"; reasons the applicant does not recognizeComplaints last quarter that mention a decline reason

A pattern finding, a fixable applicant, a delayed model release

The pattern findingA wrong reason on one letter is wrong on every letter the same code and version produced; examiners treat it as a program failure.
The applicant who could have fixed itA person told "insufficient credit" does not learn that time alone will fix an 11-month history.
The model release that waitsWhen nobody can say which letters a code change touches, model owners delay improvements.
The state law you meet nextNew explanation duties for automated decisions, such as Colorado's from 2027, build on the same evidence.
Trust in the letterThe letter is the only part of the decision the applicant ever sees.
17 · Your return

Compliance minutes per notice and corrected letters avoided: the payoff from tracing every reason

In shortPut in your own numbers. The calculator starts from a published compliance wage and asks you for the rest: how many notices you send, the minutes each takes now and after, how often a reason turns out wrong, what a corrected letter costs, and what the tool costs a year. Every default marked illustrative is an assumption to replace.

Six returns from tracing reasons before release

Accuracy

Reasons traced before release

Each reason is checked against the factor the model scored and its documentation, so wrong words stop at the draft.

notices × wrong-reason rate × cost of a corrected letter
Clock

Every notice on its clock

Clocks from the completed application, counteroffer clocks at 90 days, escalation before the deadline.

late notices a year, before and after
Analyst time

Letters to review, not to build

Drafts arrive with reasons traced and rules checked; the analyst works the exceptions.

notices × minutes saved ÷ 60 × hourly cost
Model changes

The reach of a code change, counted

A new model version is checked against the mapping table before its first letter goes out.

letters held instead of remediated after each release
Testing

Samples traced from scratch

The monthly sample re-traces each letter to the decision, and a finding finds every letter like it.

testing hours a month, before and after
Exams

Any decision explained on request

Inputs, model version, reasons, letter and delivery for any file inside the 25 months.

hours to assemble an exam sample

Compliance minutes and corrected letters across your yearly notices

Only the hourly cost is built from published figures: the O*NET median wage for compliance officers, $38.81 an hour in 2025, divided by the 70% wage share of employer costs.38,39 Every input marked illustrative is an assumption.

Your volume
Minutes per notice
Wrong reasons
Your cost
Illustrative yearly value
Notice handling today, valued$0
Staff time released, valued$0
Letters a year with a wrong reason0
Corrections avoided if caught before sending$0
After your yearly cost$0

Formulas, per year:
Handling today = notices × minutes today ÷ 60 × hourly cost
Time released = notices × (minutes today − minutes with tracing) ÷ 60 × hourly cost
Wrong-reason letters = notices × wrong-reason rate
Corrections avoided = wrong-reason letters × cost of a corrected letter
After your cost = time released + corrections avoided − yearly cost

The default volume is the fictional bank's, about 14,300 notices a month. Not counted: penalties and damages avoided, exam hours, faster model releases and complaints. If your notices are already generated end to end with no staff minutes, set both minute inputs to the time your desk spends on checks and exceptions; the case then rests on accuracy.

Minutes saved per notice decide how many notices pay for the tool

Notices a year to cover $150,000 of yearly cost from staff time alone, at $55 an hour

Saves 3 minutes a notice54,545 notices
Saves 1 minute a notice163,636 notices
Saves 30 seconds a notice327,273 notices

Illustrative · replace with your own numbers · Break-even = yearly cost ÷ (minutes saved ÷ 60 × hourly cost). Corrections avoided lower these figures.

Show the numbers
Minutes savedNotices a year
Saves 3 minutes a notice54,545 notices
Saves 1 minute a notice163,636 notices
Saves 30 seconds a notice327,273 notices

A lender sending 170,000 notices a year clears the first two lines on time alone. A credit union sending 3,000 does not, and should buy for accuracy and evidence, or not at all.

Start here18 · Readiness check

How ready your adverse action program is for reason tracing: clocks, mapping tables, overrides, testing and templates

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

1
Volume

How many adverse action notices, including counteroffers and line decreases, do you send a month?

Why it mattersVolume turns minutes and error rates into money, and a wrong reason scales with it.
A strong answer"About 14,000, split by product and action, from the origination system."
2
The clock

Does every notice's clock start at the completed application, with counteroffers on their own 90-day clock?

Why it mattersA clock dated from the decision makes the slowest files late; late notices are a common exam finding.3,21
A strong answer"The completed-application date is a field in the decision record, and the queue sorts by days left."
3
Mapping table

Is the table that turns reason codes into words versioned with each model, and approved by the model owner and compliance?

Why it mattersA code that changes meaning puts the wrong reason on every letter it touches.3
A strong answer"One table per model version, two approvers, and the documentation section for each code."
4
Selection method

Is your method for choosing principal reasons from each model written down and validated?

Why it mattersComment 9(b)(2)-5 accepts any method that works like its two examples; you need to say which, and show it.3
A strong answer"Documented in each model's file, with the reference population and a test of stability."
5
Overrides

When an underwriter declines a referred file, is the reason recorded in a field the letter can use?

Why it mattersA judgmental decline takes its reasons from what the person reviewed; a gray-band decline from both parts.3
A strong answer"A required reason list on every override, mapped to letter wording."
6
Testing

Does your monthly testing re-trace sampled letters to the model output and documentation, or check them against the template?

Why it mattersTesting against the template cannot find a template that is wrong.
A strong answer"Sixty letters a month, each traced to the decision record and the code's documented meaning."
7
Templates

Do you have approved templates for every product, action and state: denial, counteroffer, incompleteness, line decrease, business credit?

Why it mattersEach action has its own content and clock; a missing template becomes a hand-written letter.2,6
A strong answer"An inventory of templates, owners and review dates, including state statements."
8
Governance

Do you have a path to approve AI in compliance work: vendor due diligence, model risk's view, named sign-off and an audit trail?

Why it mattersThe 2026 model guidance leaves generative AI to your own governance, and the letter stays your responsibility.28
A strong answer"Vendor management and model risk have a route for AI tools, and every release has a named signer."
9
Vision · for reflection

If an examiner picked ten declines from last quarter tomorrow, what would have to be true for you to show, for each reason on each letter, the factor that produced it and the model version that scored it?

Why it mattersYour answer lists the gaps. Each gap is a job to fix: clocks, the table, overrides, testing or records.
A strong answerA short, specific list, for example: "completed dates in the record, one approved table per model version, required override reasons."

A notice program's score: fix the clock, pilot one model, or roll out

0–6

Explore

Fix the foundations first: date every clock from the completed application, put the mapping table under version control with two approvers, and require a reason on every override. Then re-trace a sample of 30 letters.

7–11

Ready to pilot

Pilot on one product and one model: trace every letter in parallel for five weeks, with your analysts releasing every batch. Compare wrong-reason findings, days to notice and staff minutes with your current process.

12–16

Ready to implement

Plan every product, model, template and state: the decision feeds, the model inventory, the print and e-delivery vendors, the approval roles, and the evidence an examiner will ask for.

19 · Questions for any vendor

What to ask an adverse action notice vendor about traced reasons, wording control, model changes and evidence

In shortAsk every vendor the same questions, us included. The answers show whether each reason is traced to the decision or only to a template, who controls the words, how model changes are caught, and what evidence you keep.

AskA good answerA warning sign
Where does each reason on a letter come from?The model output or failed rule for that decision, with its code, value and effect"From the reason code field"
How do you know the words match what the code measures?Compared with the model documentation for the version that decided"The client maintains the table"
What happens when a new model version goes live?The table is checked before the first letter; mismatches hold the noticesFound at the next monthly test
Who can change the mapping table?Named roles, two approvals, versionedAny administrator
How are underwriter overrides handled?Reasons required and traced to what was reviewedOverrides use the score reasons
When does the clock start?The completed-application date, from the decision recordThe decision date
Do you handle counteroffers, incompleteness, line decreases and business credit?Each with its own template, content and clockDenials only
How is FCRA content checked?Score, range, date, key factors with inquiries, bureau contact, rights, from the report usedA fixed paragraph
Can the tool send a letter on its own?No; a named person releases every notice and batchFully automatic sending
When a reason is found wrong, what happens to letters already sent?Every letter with that code and version found; corrections drafted for the officer's decision"Re-test next month"
What record do we keep?Inputs, model version, reasons, trace, letter, delivery, for at least 25 monthsThe PDF only
How would we measure it on our own declines?A parallel run with planted errors and a baselineA demo on sample data only
Where does AI generate text, and how is it checked?Generated words checked against the factor and reading level; a person approvesFree text on the letter
What do your contract and due diligence pack cover?Security, data residency, audit rights, subcontractors, exit"Standard terms"
20 · How to start

Trace a past month of decline letters first: a ten-week notice pilot on one product and one scoring model

In shortMeasure first, then trace a past month of letters to find out what your real error rate is, then run in parallel on live declines, then decide with three numbers. None of these steps commits you to a vendor.

  1. Pull a baseline: last month's declines for one product, with completed-application dates, decision dates and notice dates.
  2. Re-trace 60 sent letters to the decision record and the code documentation for the model version that decided.
  3. Gather the inputs: the mapping tables by version, the model documentation, templates by state, and an approval path to share decision data.
  4. Run in parallel on live declines for five weeks, with your analysts releasing every batch from the current process.
  5. Decide with three numbers: wrong-reason findings caught before release, days from completed application to notice, and staff minutes per batch.
A ten-week pilot ends with a decision on three numbers
Your teamVendor
Baseline clock and re-trace 60 letters
Collect tables, documentation, templates
Load decision feed, tables and templates
Trace last month's letters blind
Parallel run on live declines
Score findings, clock and minutes; decide
Week 0246810

Illustrative · replace with your own numbers

Show the numbers
ActivityFromTo
Baseline clock and re-trace 60 letters02
Collect tables, documentation, templates03
Load decision feed, tables and templates14
Trace last month's letters blind34
Parallel run on live declines49
Score findings, clock and minutes; decide910

Wrong reasons found, planted errors caught and days to notice

MeasureHowWhy
Wrong-reason findingsReasons that do not match the factor scored, found before release, against your re-traceThe failure that does not show on the page
Planted errors caughtCopies with a stale table entry, a missing knockout rule, a dropped inquiry factorRare errors have to be planted to be counted
Days to noticeCompleted application to sending, median and worstThe clock examiners test first
False holdsNotices held that needed no changeA tool that holds everything finds everything
Staff minutesLogged per batch and per sampleThe cost case rests on it
The full working-session questions: 15 questions in five groups

Bring compliance, underwriting operations, credit risk modeling, model risk, correspondence, IT and vendor management into one room. Each question says why it matters and what a strong answer and a warning sign look like.

A

Notices by product and action, declining models and state statements

A1

How many notices a month, by product and by action: denial, counteroffer, incompleteness, line decrease?

Why it mattersEach action has its own clock and template.
Strong answer · warning sign
Counts by product and action.
One total, nobody sure of the mix.
A2

Which models and policy rules produce declines, and how often does each model change?

Why it mattersEach release can change a code's meaning.
Strong answer · warning sign
A model inventory with release dates.
"Risk handles that."
A3

Which states need their own statements on our letters?

Why it mattersState text is part of the template.
Strong answer · warning sign
A list kept by legal.
Copied from an old letter.
B

The mapping table and the method for picking reasons

B1

Who owns the mapping table, and when was each entry last checked against the documentation?

Why it mattersThe table is the most fragile link.
Strong answer · warning sign
An owner and a date per version.
No one can say.
B2

What is our method for picking principal reasons, and is it in each model's documentation?

Why it mattersComment 9(b)(2)-5 asks for a method like its examples.
Strong answer · warning sign
Written and validated.
"The vendor's default."
B3

Do any sample-form checklist phrases still appear as reasons, unedited?

Why it mattersThe closest box is not compliant.
Strong answer · warning sign
Checklist replaced by our factors.
Form C-1 as shipped.
C

Clocks and delivery

C1

Where is the completed-application date recorded, and does every system use it?

Why it mattersIt starts the clock.
Strong answer · warning sign
One field, everywhere.
Each team counts differently.
C2

How do we track open counteroffers to their 90 days?

Why it mattersOffers not taken are adverse action.
Strong answer · warning sign
Combined notice at the offer.
No tracking.
C3

How is E-SIGN consent recorded and checked before e-delivery?

Why it mattersWithout consent, the letter goes by mail.
Strong answer · warning sign
Consent on the record, checked per letter.
Assumed for online applicants.
D

Testing and remediation

D1

What did our last three monthly samples and our last exam find on notices?

Why it mattersFindings show where the process breaks.
Strong answer · warning sign
Findings by type, with root causes.
"Clean" every month.
D2

When we found a wrong reason last, how did we find every other letter like it?

Why it mattersA wrong reason is a population.
Strong answer · warning sign
A query by code and model version.
We fixed the one letter.
D3

Could we produce the application, inputs, reasons and letter for any file from 24 months ago?

Why it mattersRetention is 25 months.
Strong answer · warning sign
Yes, in minutes.
The letter only.
E

Batch signers, model risk and decision data leaving the bank

E1

Who signs each batch, and what does the signature mean?

Why it mattersA named release is your control.
Strong answer · warning sign
A role and a recorded meaning.
The print run just goes.
E2

Does model risk treat the reason selection as part of the model?

Why it mattersFeature grouping changes the reasons.
Strong answer · warning sign
In scope of validation.
Outside everyone's scope.
E3

What does vendor management need before decision data can leave our systems?

Why it mattersIt sets the pilot's start date.
Strong answer · warning sign
A known checklist and timeline.
Nobody has asked.
21 · Frequently asked questions

Adverse action notice timing, reasons, credit scores and AI models: the questions lenders search

In shortThe questions lenders and compliance teams search for most, each answered on its own.

What is an adverse action notice?

An adverse action notice is the written notice a lender must send when it denies credit, makes a counteroffer the applicant does not accept, refuses a requested increase, or cuts or worsens an existing account. Under Regulation B it states the action, the lender's name and address, the ECOA anti-discrimination statement, the lender's federal agency, and the specific principal reasons or the right to ask for them. When a credit report was used, the FCRA adds the bureau's contact, the credit score and key factors, and the rights to a free report and to dispute.

How long does a lender have to send an adverse action notice?

Thirty days after receiving a completed application, thirty days after taking adverse action on an incomplete application or an existing account, and ninety days after a counteroffer the applicant does not accept or use (12 CFR 1002.9(a)(1)). An application is complete once the lender has all the information it normally considers, so time spent in manual review counts against the 30 days.

How many reasons must an adverse action notice give?

Regulation B sets no fixed number. It requires the principal reasons, stated specifically, and the official commentary says more than four reasons "is not likely to be helpful". With a scoring system no principal reason may be left out, and a failed automatic-denial rule must always be disclosed.

Can a lender use the Appendix C sample forms as an adverse action notice template?

Yes, as a starting point. Appendix C's own instructions say the sample checklist should be edited to the factors the lender actually uses, and that a lender "will not satisfy the notice requirement by simply checking the closest identifiable factor listed". Using a form's wording for a factor the lender did not use, or a broader version of one it did, is the common error.

Do lenders using AI or machine learning models still have to give specific reasons?

Yes. Regulation B requires specific principal reasons whatever the technology, and its commentary says the reasons must accurately describe the factors actually scored. The CFPB withdrew its circulars on complex models (2022-03 and 2023-03) on May 12, 2025, but the regulation they explained did not change. The lender must be able to say which factors drove each decision.

Is a counteroffer an adverse action?

A counteroffer becomes adverse action if the applicant does not accept or use it, and the lender then owes a notice within 90 days of the counteroffer. A lender can send one combined counteroffer and adverse action notice when it makes the offer (Form C-4), and then needs no second notice if the applicant says no.

What must a lender do with an incomplete credit application?

Within 30 days it must either decide, which may mean denying for incompleteness, or send a written notice of incompleteness naming the missing information, giving a reasonable time to supply it, and saying the application will not be considered further without it. If the missing item does not prevent a decision, the lender must decide on what it has and cannot give "incomplete application" as the reason.

Do adverse action notice rules apply to business loans?

Yes, with lighter rules. For businesses with gross revenues of $1 million or less, the notice may be oral or written and may give the reasons or the right to request them. For larger businesses, trade credit and factoring, the lender must notify within a reasonable time and give written reasons if asked in writing within 60 days.

What credit score information goes on an adverse action notice?

When a credit score from a consumer report was used, the FCRA requires the score, its range, the date it was created, who provided it, and the key factors that lowered it: up to four, plus inquiries if they are a key factor. The bureau's name, address and phone number, a statement that it did not make the decision, and the rights to a free report within 60 days and to dispute must also appear.

What is the difference between a risk-based pricing notice and an adverse action notice?

An adverse action notice goes to someone declined or offered less than requested. A risk-based pricing notice goes to someone approved on terms materially worse than most of the lender's customers get, because of a credit report. A lender that sends an FCRA adverse action notice does not also owe a risk-based pricing notice, and many lenders meet the pricing rule by sending every applicant a credit score disclosure.

Can an adverse action notice be sent by email?

Yes, if the applicant has given consent that meets the E-SIGN Act: affirmative consent after disclosures about paper copies and withdrawing consent, given in a way that shows the person can access the electronic form. Without that consent the notice goes by mail.

How long must adverse action records be kept?

Regulation B requires lenders to keep the application, the information used to evaluate it, the notice and any statement of reasons for 25 months after notifying the applicant, or 12 months for business credit. Lenders must keep records longer if they have notice of an investigation or enforcement action.

What are the penalties for adverse action notice violations?

Under ECOA an applicant can recover actual damages, punitive damages up to $10,000, and attorney's fees; in a class action punitive damages are capped at the lesser of $500,000 or 1% of the lender's net worth. Suits can be brought within five years. Regulators can also order remediation, and state attorneys general bring their own cases.

What is an adverse action reason code?

A reason code is a short code that a credit scoring model returns for each factor that lowered an applicant's score, such as "R14" for length of credit history. A mapping table turns each code into the sentence printed on the letter. When a model version changes what a code measures and the table is not updated, every letter using that code states the wrong reason.

22 · One-page summary

Adverse action notice duties and the 2026 rules in brief, with the key terms

Print this page

In shortThe whole guide on one screen: the duties, the rules as of October 2026, the readiness bands and the terms.

The duties
  1. Start the clock at the completed application: 30 days; 90 after a counteroffer not taken.
  2. Give the specific principal reasons: the factors actually scored or reviewed, four at most by custom.
  3. Disclose any failed knockout rule; take reasons from both parts after a gray-band referral.
  4. Add the FCRA content when a report was used: bureau, score, range, date, key factors, rights.
  5. Keep the mapping table versioned with the model; edit the sample checklist to your factors.
  6. Keep everything 25 months; re-trace a sample monthly; find every letter like a wrong one.

Readiness: score 0–2 on eight questions: 0–6 explore · 7–11 pilot · 12–16 implement.

As of October 2026: CFPB Circulars 2022-03 and 2023-03 withdrawn May 12, 2025; Regulation B's notice section unchanged · Regulation B rule removing disparate impact effective July 21, 2026, challenged in court · OCC and FDIC exam for disparate treatment only since 2025 · SR 26-2 model guidance April 17, 2026 · Colorado SB26-189 duties from January 1, 2027.

13 terms
Adverse action
Denial, counteroffer not taken, refused increase, or a cut or worse terms on one account.
Completed application
When the lender has what it normally considers; the clock starts.
Principal reasons
The factors that actually decided, stated specifically.
Counteroffer
An approval on other terms; a notice is owed if not taken.
Notice of incompleteness
A written request for missing information with a deadline.
Reason code
A model's code for a factor that lowered the score.
Mapping table
Code-to-sentence table for one model version.
Knockout rule
A rule that denies automatically; always disclosed.
Key factors
The bureau's list of what lowered its score: four, five with inquiries.
Risk-based pricing notice
Notice of worse terms than most get, because of a report.
ECOA statement
The anti-discrimination paragraph every notice carries.
Appendix C
Regulation B's ten sample notices; edit the checklist.
E-SIGN consent
The consent needed to send the notice electronically.
23 · Sources

Sources

Accessed October 2026. Regulatory status statements are as of October 2026.

  1. 15 U.S.C. 1691 (ECOA §701). law.cornell.edu
  2. 12 CFR 1002.9, Notifications (Regulation B), CFR 2026 edition via GovInfo. ecfr.gov
  3. Supplement I to Part 1002, Official Interpretations, comments 9(a)(1), 9(a)(3), 9(b)(2). ecfr.gov
  4. 15 U.S.C. 1681m (FCRA §615). law.cornell.edu
  5. 15 U.S.C. 1681g(f) (FCRA §609(f)). law.cornell.edu
  6. Appendix C to Part 1002, Sample Notification Forms. ecfr.gov
  7. CFPB, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084, May 12, 2025. federalregister.gov
  8. 12 CFR 1002.2(c), Adverse action. ecfr.gov
  9. 12 CFR 1022.72–1022.75 (Regulation V, risk-based pricing). ecfr.gov
  10. Federal Reserve, Equal Credit Opportunity / Fair Credit Reporting final rule (credit score disclosure), 76 FR 41590, July 15, 2011. federalregister.gov
  11. CFPB, Circular 2022-03, 87 FR 35864, June 14, 2022. federalregister.gov
  12. CFPB, Circular 2023-03, 89 FR 27361, April 17, 2024 (released September 19, 2023). federalregister.gov
  13. OCC Bulletin 2025-16, July 14, 2025. occ.gov
  14. FDIC FIL-41-2025, August 29, 2025. fdic.gov
  15. CFPB, Equal Credit Opportunity Act (Regulation B), final rule, 91 FR 21620, April 22, 2026, effective July 21, 2026. federalregister.gov
  16. Colorado General Assembly, SB26-189. leg.colorado.gov
  17. CFPB, ECOA examination procedures, July 2026. files.consumerfinance.gov
  18. Ballard Spahr, Consumer Finance Monitor, August 10, 2026 (NFHA v. CFPB). consumerfinancemonitor.com
  19. CRS, IF10031, "The Consumer Financial Protection Bureau (CFPB)", updated August 28, 2026. everycrsreport.com
  20. Kelley Drye, Ad Law Access, "State AGs, and Mark Twain, Hold Companies Accountable for AI Use", July 14, 2025. kelleydrye.com
  21. Federal Reserve, Consumer Compliance Outlook, Fourth Issue 2024, top violations in 2023 under ECOA. consumercomplianceoutlook.org
  22. Federal Reserve, holiday schedules. federalreserve.gov
  23. FFIEC/CFPB HMDA Data Browser, nationwide aggregations 2019–2025 (queried October 31, 2026). ffiec.cfpb.gov
  24. Federal Reserve, Consumer Compliance Outlook, Fourth Issue 2023, top violations in 2022 under the FCRA. consumercomplianceoutlook.org
  25. 15 U.S.C. 7001 (E-SIGN). law.cornell.edu
  26. Krishna et al., "The Disagreement Problem in Explainable Machine Learning", arXiv 2202.01602, February 3, 2022. arxiv.org
  27. CFPB, "CFPB Sues LendUp Loans…", September 8, 2021. consumerfinance.gov
  28. Federal Reserve, SR 26-2, April 17, 2026. federalreserve.gov
  29. OCC Bulletin 2026-13, April 17, 2026. occ.gov
  30. CFPB, Technical Correction and Update to the CFPB's Credit Invisibles Estimate, June 2025. files.consumerfinance.gov
  31. CFPB, Fair Credit Reporting Act; Preemption of State Laws, 90 FR 48710, October 28, 2025. federalregister.gov
  32. CFPB, "CFPB Shutters Lending by VC-Backed Fintech…", December 21, 2021. consumerfinance.gov
  33. 12 CFR 1002.12(b), Preservation of records. ecfr.gov
  34. 12 CFR 1002.16(c) and comment 16(c)-1. ecfr.gov
  35. 15 U.S.C. 1691e, Civil liability. law.cornell.edu
  36. Federal Reserve Bank of New York, SCE Credit Access Survey, June 2026. newyorkfed.org
  37. García and Garriga, "The Determinants of Mortgage Denial", Federal Reserve Bank of St. Louis Review, May 22, 2026. stlouisfed.org
  38. O*NET OnLine, Compliance Officers 13-1041.00, median wages 2025. onetonline.org
  39. BLS, Employer Costs for Employee Compensation, June 2026. bls.gov
Next step

See it on your own declines.

Explore the solution, or bring a sample of your own decisions, reason codes and notice templates, and we will trace every reason on every letter with you.

botminds.ai The complete guide to adverse action notices · October 2026. Bramblewood Bank, Fernwick Credit Reporting, Personal Loan Score, every applicant, every person and every figure in the example and the screens are fictional. Regulatory status is as of October 2026; this guide gives general information and is no substitute for legal advice. Check the sources before relying on it.