Adverse Action Notices: A Working Guide to ECOA and Regulation B
A generic decline letter is one of the most common, and most avoidable, sources of regulatory exposure in lending.
Every creditor that declines, counters, or unfavorably changes a credit account has a legal notice obligation, under the Equal Credit Opportunity Act (ECOA) as implemented by Regulation B, and often under the Fair Credit Reporting Act (FCRA) as well if a consumer report was involved. This is a working reference, not legal advice. Confirm your actual notice templates with counsel.
When a notice is required, and how fast
| Trigger | Deadline | Notes |
|---|---|---|
| Completed application, denied or countered | 30 days from receipt | Consumer and small business credit follow the same clock |
| Incomplete application | 30 days, unless an incompleteness notice was already sent | An incompleteness notice under 1002.9(c) can reset this obligation |
| Adverse action on an existing account | 30 days from the action | Applies to limit cuts, rate increases, and closures too, not just new applications |
| Counteroffer not accepted | 90 days from the counteroffer | Only if the applicant doesn't expressly accept or use the credit offered |
| Business credit, revenue over $1M | Reasonable time, oral or written | The strict 30-day, written-notice rule relaxes above this revenue threshold |
What the notice actually has to say
The core requirement is specificity. Regulation B is explicit that "the applicant failed to achieve a qualifying score" or a reference to unspecified "internal standards" does not satisfy the rule. The reasons given must relate to and accurately describe the factors actually considered. A common best practice, not a strict legal cap, is to list no more than four principal reasons, since piling on more tends to obscure rather than clarify the real basis for the decision.
Where AI and scoring models change nothing about the obligation
The CFPB's 2023 guidance, reaffirmed in a 2024 Federal Register notice, is direct on this point: using a complex or opaque credit model does not let a creditor fall back on the generic checklist of sample reasons in Regulation B's own appendix if those reasons don't specifically and accurately reflect what the model actually weighed. If your underwriting uses a scoring model, alternative data, or machine learning, someone still has to be able to map a decline back to the real, specific factors, not a plausible-sounding generic reason.
ECOA versus FCRA: two overlapping, separate obligations
If a decision was based even in part on a consumer report, the FCRA layers on additional required content: the name and address of the reporting agency, a statement that the agency didn't make the decision and can't explain it, and notice of the applicant's right to a free report and to dispute its accuracy. Many lenders send a single combined notice covering both ECOA and FCRA requirements at once. That's permitted, but it means the combined notice has to satisfy both sets of rules, not just one.
Where lenders actually get caught out
Examiner commentary from 2025 points to the same handful of recurring errors: reasons that don't match what's actually in the file, unmodified use of the sample-form checklist without adapting it to the real underwriting logic, and treating a declined prequalification or soft inquiry as exempt from notice requirements when it should have been treated as a full application under Regulation B's own interpretation.
Want a one-page PDF version of this table to keep on hand? Drop your email and it'll be sent your way, along with updates whenever the CFPB or examiners issue new guidance.