An adverse action notice is a legally mandated written notification that a lender must provide to a credit applicant or existing borrower when it takes an adverse action, defined as denying credit, offering materially less favorable terms, or revoking existing credit, based wholly or partly on information obtained from a consumer report or on any other basis covered by the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA). The notice must disclose the specific reasons for the action, inform the applicant of their right to obtain a free credit report, provide contact information for the consumer reporting agency used, and include regulatory disclosures required by Regulation B. Failure to provide timely, complete adverse action notices exposes lenders to regulatory sanctions, class action liability, and CFPB enforcement actions.
Introduction to Adverse Action Notice
The adverse action notice requirement is one of the most fundamental borrower protections in consumer credit law, reflecting Congress determination that applicants denied credit deserve to understand why. Without disclosure of denial reasons, applicants could not correct errors in their credit files, could not understand how lenders evaluated their applications, and could not detect discriminatory treatment. The ECOA implemented by Regulation B and the FCRA work in tandem: ECOA requires disclosure of the reasons for an adverse action on any credit application, while FCRA adds specific requirements when consumer reports were used in the decision. The CFPB Regulation B contains the detailed requirements for ECOA adverse action compliance, including model forms that lenders can use to satisfy the disclosure obligation efficiently and defensibly.
From a compliance perspective, adverse action notice failures are among the most commonly cited findings in CFPB examinations and state regulatory examinations. Common problems include notices that list generic or vague reasons rather than the specific factors that most significantly affected the credit decision; notices delivered outside the required timeframes; notices that omit required credit score disclosures; and notices not provided at all when a creditor takes adverse action on an existing account. The FTC FCRA resources outline the penalties for violations including individual and class action liability, CFPB enforcement actions with civil money penalties, and required remediation programs that can be extraordinarily expensive for lenders of all sizes.
How Adverse Action Notice Works
Under ECOA and Regulation B, a lender must provide an adverse action notice within 30 days of receiving a completed credit application when it takes adverse action on that application. If the lender makes a counteroffer, offering credit on different terms than requested, and the applicant does not accept within 90 days, the lender must provide an adverse action notice at that point. For existing credit accounts, adverse action notices are required when a lender unfavorably changes credit terms, reduces a credit limit, suspends an account, or closes an account based on information in a consumer report or a protected characteristic. The notice must state the specific reasons for adverse action, with Regulation B model notices listing up to four reasons drawn from a standardized reason code list.
When a consumer report was used in the credit decision, FCRA adds additional requirements. The adverse action notice must include the name, address, and phone number of the consumer reporting agency; a statement that the CRA did not make the adverse decision; and the applicant right to obtain a free copy of the report within 60 days. If a credit score was used in the decision, the notice must disclose the score, the range of possible scores, the key factors that adversely affected the score, the date the score was created, and the name of the entity that created the model. These credit score disclosure requirements were added by the Dodd-Frank Act and are frequently the source of adverse action notice deficiencies identified in examinations.
The timing and delivery requirements depend on application type. For electronic applications, the lender can satisfy notice requirements via email if the applicant has consented to electronic disclosure. Many lenders use automated systems to generate adverse action notices at the time of a denial decision, ensuring the notice is produced and delivered immediately rather than relying on manual processes that create timing and accuracy risk at scale.
Example
An online consumer installment lender receives an application for a $3,000 personal loan. The automated underwriting system generates a denial based on three factors: a FICO score of 548 below the lender 580 minimum, a debt-to-income ratio of 52 percent above the 45 percent maximum, and two accounts currently 60 or more days past due. Within seconds of the denial decision, the lender LMS generates an adverse action notice disclosing these three specific reasons using Regulation B model language, includes the FICO score of 548, the score range of 300 to 850, the four key factors that adversely affected the score, the date of the score, and the contact information for the credit bureau from which the report was obtained. The notice is delivered via email within 2 minutes of the denial, with the entire process logged in the audit trail with timestamps. The applicant reviews the notice, disputes an incorrect delinquency on their credit report, and successfully reapplies six months later after the error is corrected, demonstrating that proper adverse action disclosure directly enables fair credit outcomes.
Compliance Requirements
The adverse action notice compliance framework involves four overlapping regulatory regimes: Regulation B under ECOA, the Fair Credit Reporting Act, the risk-based pricing rule implemented jointly by the CFPB and FTC, and applicable state laws. Lenders must maintain a mapping between their internal denial reason codes and the standardized reason code descriptions required by Regulation B. They must ensure that the reasons disclosed are the actual principal reasons for the adverse action, not generic placeholders. For lenders using third-party automated underwriting systems or credit models, they must understand what factors the model outputs and how to translate those outputs into compliant adverse action reason codes that are meaningful and specific to each applicant scenario, not simply boilerplate language applied uniformly to all denials.
Bottom Line
Adverse action notice compliance is not optional, and manual notice generation introduces unacceptable timing and accuracy risk at any origination volume. Vergent LMS supports automated generation of Regulation Z and TILA-compliant disclosures and adverse action documentation through its loan origination system, with a full role-based audit trail capturing every decision, disclosure, and delivery timestamp, giving lenders the defensible compliance record that regulators and examiners expect.
