When a lender denies credit, two laws can require an adverse action notice: the Equal Credit Opportunity Act (ECOA), implemented by Regulation B, and the Fair Credit Reporting Act (FCRA). They have overlapping but distinct triggers, timing, and content requirements, and a single denial often requires satisfying both. Under Regulation B, a creditor generally must notify an applicant of adverse action within 30 days of receiving a completed application, with specific reasons for the decision. Getting the trigger, timing, or content wrong is a frequent fair lending and consumer compliance finding.
Key Takeaways:
- ECOA/Reg B requires an adverse action notice with specific reasons within 30 days of a completed application
- FCRA requires an adverse action notice when a decision is based in whole or in part on information in a consumer report
- A single credit denial frequently triggers both ECOA and FCRA notice obligations, which can be combined into one notice
- The ECOA notice must state specific principal reasons for the denial, not vague generalities
- The FCRA notice must disclose the consumer reporting agency used and the consumer's right to a free report and to dispute
What Counts as Adverse Action
Under ECOA/Regulation B, adverse action includes a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested. There are nuances: a counteroffer that the applicant accepts is generally not adverse action, while a counteroffer the applicant does not accept can be.
Under FCRA, adverse action is broader and includes a denial or change in the terms of credit, insurance, employment, or other transactions, when the action is based at least in part on a consumer report. FCRA's definition reaches beyond credit into insurance and employment contexts.
The practical point: when you deny a credit application after pulling a credit report, you are usually in both regimes at once. You need an ECOA notice with reasons and an FCRA notice with the report disclosures, which the rules let you combine into a single document.
ECOA/Regulation B Requirements
Regulation B, at 12 CFR § 1002.9, governs the ECOA notice.
Timing. For most applications, the creditor must notify the applicant of action taken within 30 days after receiving a completed application. Different timing applies in some situations, such as 30 days after taking adverse action on an incomplete application or an existing account, and 90 days for certain counteroffers not accepted.
Content. The ECOA notice must include:
- A statement of the action taken
- The name and address of the creditor
- The ECOA anti-discrimination notice
- The name and address of the federal agency that administers compliance for the creditor
- Either a statement of specific reasons for the adverse action, or a disclosure of the applicant's right to request the specific reasons within 30 days
The specific-reasons requirement is critical. "You did not meet our credit standards" is not a specific reason. Acceptable reasons identify the actual basis: insufficient income for the amount requested, delinquent credit obligations, length of employment, and so on. Vague or inaccurate reasons are a common finding and a fair lending risk because they obscure whether the decision was made on permissible factors. This connects to the fair lending obligations in our fair lending laws for community banks.
FCRA Requirements
When the adverse action is based in whole or in part on a consumer report, FCRA, at 15 U.S.C. § 1681m, adds its own notice obligations. The FCRA adverse action notice must disclose:
- That adverse action was taken based on the consumer report
- The name, address, and phone number of the consumer reporting agency that provided the report
- A statement that the agency did not make the decision and cannot explain the reasons
- The consumer's right to obtain a free copy of the report from the agency within 60 days
- The consumer's right to dispute the accuracy or completeness of the report
- If a credit score was used, the score, the range, key factors that adversely affected it, and related disclosures
FCRA timing is tied to when the adverse action is taken rather than a fixed 30-day count from a completed application, so coordinate the two regimes carefully when combining notices. The relationship between credit pulls and the decisions that flow from them is why permissible purpose documentation and adverse action handling belong in the same workflow.
Combining ECOA and FCRA Notices
Because most credit denials based on a report trigger both laws, lenders typically issue a single combined adverse action notice that satisfies ECOA and FCRA together. A compliant combined notice includes:
- The action taken and creditor information (ECOA)
- The ECOA anti-discrimination statement and administering agency (ECOA)
- Specific reasons for the decision, or the right to request them (ECOA)
- The consumer reporting agency disclosure and consumer rights to a free report and dispute (FCRA)
- Credit score disclosures where a score was used (FCRA)
The combined approach is efficient but raises the stakes: a single template error propagates across every denial. This is why high-volume lenders, especially fintechs, automate notice generation and content, a discipline we cover in the fintech compliance automation guide.
Where Lenders Get Cited
Adverse action findings cluster around a predictable set of failures:
- Vague reasons. Generic denial language that doesn't state the specific principal reasons, which is both an ECOA violation and a fair lending concern.
- Missing FCRA disclosures. Notices that omit the credit reporting agency information or the consumer's right to a free report and dispute.
- Timing misses. Notices sent outside the 30-day ECOA window after a completed application.
- Inconsistent triggers. Failing to recognize that a counteroffer not accepted, or a change in terms, is adverse action requiring notice.
- Score disclosure errors. Omitting required credit score information when a score was used in the decision.
- No evidence trail. Inability to show, for a given denial, that the correct notice with correct content went out on time.
The last point is the underlying problem. Even a well-designed notice template produces findings if you cannot prove, for each denial, that the right notice was delivered within the deadline.
Adverse action compliance is a content-plus-timing problem repeated on every denial. See how Canarie ties credit decisions to compliant, evidenced adverse action notices →
Frequently Asked Questions
When is an adverse action notice required?
Under ECOA, a notice is required when a creditor denies or revokes credit, changes terms, or refuses credit in the amount or terms requested. Under FCRA, a notice is required when an adverse action is based in whole or in part on a consumer report. A single credit denial after pulling a report usually triggers both.
How long does a lender have to send an adverse action notice?
Under Regulation B, a creditor generally must notify the applicant within 30 days of receiving a completed application. Different timing applies to incomplete applications, existing accounts, and counteroffers. FCRA timing is tied to when the adverse action is taken, so combined notices must satisfy both schedules.
What must an adverse action notice include?
The ECOA portion must state the action taken, creditor information, the anti-discrimination notice, the administering agency, and either specific reasons or the right to request them. The FCRA portion must disclose the consumer reporting agency, the consumer's right to a free report and to dispute, and credit score information when a score was used.
Can ECOA and FCRA adverse action notices be combined?
Yes. Because most credit denials based on a consumer report trigger both laws, lenders commonly issue a single combined notice that satisfies ECOA and FCRA together. The combined notice must contain all required content from both regimes, so template accuracy is essential.
What are acceptable reasons on an adverse action notice?
Reasons must be specific and accurate, such as insufficient income for the amount requested, delinquent credit obligations, or insufficient length of employment. Vague statements like "did not meet credit standards" are not acceptable under Regulation B and create fair lending risk by obscuring the actual basis for the decision.
Make Every Denial Defensible
Adverse action is one of the most repeated compliance actions a lender performs, and one of the most cited when it goes wrong. The exposure is rarely a single bad notice; it is a template or timing flaw multiplied across thousands of denials, with no evidence trail to prove what went out.
Canarie ties each credit decision to a compliant adverse action notice, enforces the required ECOA and FCRA content, tracks the timing, and captures the evidence that the right notice was delivered on time.