Adverse Action Notices (ECOA & FCRA): Common Errors and Compliance Rules

Brad Stumpe

Adverse action notices have strict requirements under ECOA (Regulation B) and FCRA, including timing, documentation and disclosure rules that must be followed when taking negative credit actions.

Even small mistakes in how these requirements are applied can create compliance risk, especially related to timing, incomplete applications and required disclosures.

Adverse Action Notice Requirements (Quick Reference):

  • Required when a credit application is denied, countered or otherwise negatively impacted – Governed primarily by ECOA (Regulation B) and FCRA Section 615
  • Must include specific reasons for denial OR notice of right to request them
  • Strict timing requirements (generally within 30 days of a completed application)

What Is an Adverse Action Notice?

An adverse action notice is a required disclosure under ECOA (Regulation B) and FCRA that lenders must provide when denying or negatively changing credit. Under the Equal Credit Opportunity Act (ECOA) and Regulation B, creditors must provide applicants with the specific reasons for the decision or inform them of their right to request those reasons.

If the decision is based on information obtained from a consumer reporting agency, additional disclosure requirements apply under Section 615 of the Fair Credit Reporting Act (FCRA).

What Must Be Included in an Adverse Action Notice?

An adverse action notice must include:

  • A statement of the action taken
  • Specific reasons for denial OR the applicant’s right to request them
  • The name and address of the creditor
  • ECOA anti-discrimination language
  • Consumer reporting agency details (if the decision was based on a credit report)

Common Adverse Action Notice Errors (ECOA & FCRA)

The Anders Banking and Financial Institutions team hosted a webinar, Steer Clear of These Common Errors in Adverse Action and Loan Servicing. Partner and compliance and loan review practice leader Brad Stumpe, CPA, CRCM and compliance manager Sadie Carrera, CRCM shared actionable tips to help reduce adverse action errors as well as minimize loan servicing errors.

The most common issues with adverse action notices aren’t always obvious — but they can have outsized impact on compliance and audit outcomes.

Co-Applicant Not Receiving Required Notice

A common error is the co-applicant not receiving the adverse action notice when they should. Regulation B generally requires that an adverse action notice be provided to each applicant. However, if two applicants apply jointly and designate one applicant to receive notices, the creditor may send the notice to that designated applicant. Under the FCRA, an adverse action notice must be provided to any consumer against whom adverse action is taken based on information in their consumer report. This means that if information from the co-applicant’s consumer report contributed to the decision, the co-applicant must also receive an adverse action notice.

These types of errors often stem from process gaps rather than misunderstanding the regulations — making them easy to overlook without consistent controls. Strengthening internal processes and controls is often where institutions see the biggest improvement in compliance outcomes.

Missing Adverse Action Timing Requirements (30-Day Rule)

When does the 30-day clock start ticking? It starts when you receive a completed application. Defining what constitutes a completed application is crucial. Some institutions may not clearly define what constitutes a completed application, while others may have policies that are not applied consistently. You must document when you receive a complete application to help track the 30-day period.

Regulation B requires creditors to exercise reasonable diligence in obtaining information necessary to complete an application. However, the timing expectations are not unlimited and depend on the circumstances of the credit request. For instance, if an applicant’s credit history is borderline but could be salvaged by a strong loan-to-value (LTV) ratio, it makes sense to wait for the appraisal. If the credit history was so poor that it would result in a denial regardless of the LTV, holding the adverse action notice for more than 30 days is more difficult to justify.

Handling Incomplete Applications Correctly

If an application remains incomplete because the applicant has not provided requested information, the creditor may issue an adverse action notice after 30 days from the date the application was received. It might say, “We are denying this request because of an incomplete application.” This effectively closes the credit request, just like denying the application due to poor credit history or low LTV.

Alternatively, you can send a notice of incompleteness, which keeps the credit request open beyond 30 days. This must be in writing and include specific required elements. Sample form C6 in Appendix C of Regulation B provides an example. If the applicant doesn’t provide the requested information by the specified time, you have no further obligations. The notice of incompleteness should include:

  • A list of the specific information needed.
  • A reasonable period of time for the applicant to provide the missing information (often 30 days)
  • A statement that failure to provide the requested information will result in no further consideration of the application

There is no “Option 3” to do nothing and continue waiting for the applicant to provide the data.

How Counteroffers Trigger Adverse Action Requirements

How should an unaccepted counteroffer be treated? In most cases, it must ultimately be treated as a denial of the original request. For example, if an applicant asks for a $100,000 loan and your institution approves a loan for $75,000, but he doesn’t accept it, you’ve essentially denied his $100,000 request.

There are two options with counteroffers:

  1. Send a combined counteroffer and adverse action notice: If the applicant doesn’t accept this offer, there’s nothing more you have to do. Model form C4 from Appendix C of Regulation B provides an example. The notice must include:
    • Standard adverse action notice for the original request
    • Terms of the counteroffer
    • The date by which the counteroffer must be accepted
    • How the applicant can accept the counteroffer
  2. Make a counteroffer without denying the original request: If accepted, no further actions are required other than closing the loan. If the counteroffer is rejected, send a normal adverse action notice within 90 days of making it.

Choosing the Right Reason for Denial

The adverse action notice must clearly explain the specific reasons for the credit decision — and inconsistencies here are a common source of regulatory risk. Ensure the reasons for denial match the file. When adding the reason for denial in the adverse action notice, keep the following in mind:

  • More than four reasons are not considered helpful to the applicant. Pick the four primary reasons.
  • Lack of collateral should not be the reason for denying an application for unsecured credit. Specify why they don’t qualify for unsecured credit.
  • Simply stating “insufficient credit score” may not be sufficiently specific. The notice should provide meaningful reasons the applicant can understand.
  • The “other” box should have guidelines and parameters to avoid inappropriate, insufficient, or discriminatory reasons.

FCRA Disclosure Requirements for Consumer Reports

There are differences in who should receive an adverse action notice under ECOA and FCRA. Both rules work together regarding the content of adverse action notices. Disclosure of the consumer reporting agency used in the decision is required under FCRA Section 615 when the adverse action is based on information from a consumer report.

  • When information from a CRA was used to deny the credit request, list the original source of the consumer report and ensure contact information is correct.
  • For credit score information, list the CRA that provided the credit score and include the four factors that most adversely impacted the credit score. This can be different from the CRA that provided the consumer report.

Be sure you’re using current and accurate information for the federal agency that administers compliance with Reg B for your institution. This can be found in Appendix A to Regulation B.

Commercial Denials

If the applicant’s gross annual revenues (GAR) are $1 million or less, the rules are similar to those for consumer credit and many institutions apply procedures similar to consumer credit requests for ease of compliance. Reg B states that the statement of action taken may be given orally or in writing. If allowing for oral notification, document the conversation since you’re still subject to timing and record retention rules.

If you opt to disclose the business applicant’s right to a statement of specific reasons at the time of application rather than providing an adverse action notice when applicable, it is important to include the name, address and phone number of the person or office at your institution that can provide the specific reasons, along with the correct federal agency to contact if they believe they’ve been discriminated against. Ensure that any notice is in a form the applicant can keep.

Even small gaps in adverse action notice processes can lead to regulatory findings during exams or audits. For financial institutions, reviewing timing, documentation and disclosure practices regularly is critical to reducing compliance risk.

Anders Banking and Financial Institution team works directly with banks and lenders to evaluate adverse action procedures, identify control gaps and support ongoing compliance with ECOA and FCRA requirements.

Request a Meeting

View all Blog Posts

Our firm provides this information for general educational guidance only and does not constitute the provision of legal advice, tax advice, accounting services, investment advice, or professional consulting of any kind. The information provided herein should not be used as a substitute for consultation with professional tax, accounting, legal, or other competent advisers. Before making any decision or taking any action, you should consult a professional adviser who has been provided with all pertinent facts relevant to your particular situation. Podcasts posted by Anders are not intended to be used and cannot be used by any individual or business, for the purpose of avoiding accuracy-related penalties that may be imposed on the taxpayer. The information is provided "as is," with no assurance or guarantee of completeness, accuracy, or timeliness of the information, and without warranty of any kind, express or implied, including but not limited to warranties of performance, merchantability, and fitness for a particular purpose. Please note that some content may be generated using artificial intelligence and is intended for educational and informational purposes only. In no way does listening, reading, emailing or interacting on social media with our content establish a professional relationship.