An ECOA adverse action is a denial, termination, unfavorable change in terms, or refusal to increase credit, and it triggers two parallel disclosure duties: specific principal reasons under ECOA and Regulation B, plus consumer reporting agency and free-report disclosures under FCRA §615(a) when a consumer report was used. Notify within 30 days. Applicants then have 60 days to request reasons, and creditors have 30 days to answer.
TL;DR:
- If an applicant declines or ignores a counteroffer, the original refusal becomes adverse action, and notice duties arise within 90 days.
- When a consumer report informs a decision, the notice must name the reporting agency, explain its noninvolvement, and describe free report and dispute rights.
- If the creditor used a credit score, the written disclosure must show the score, date, agency, and key factors in a separate block.
- Specific principal reasons must match factors actually considered; complex models require case level explanations, human review, and records linking reasons to file evidence.
- Applicants have 60 days to request unstated reasons, and creditors have 30 days to respond; free reports also require requests within 60 days.
Table of Contents
- 1. What counts as an adverse action under ECOA and Regulation B
- 2. When a creditor must notify: 30, 60, and 90 day rules
- 3. What an adverse action notice must include
- 4. How to produce specific reasons that comply with Regulation B
- 5. Adverse action notices when you use algorithms, machine learning, or AI
- 6. What consumers should do after receiving an adverse action notice
- 7. A compliance checklist and recordkeeping quick reference
- 8. Where mortgage teams actually slip on adverse action
- 9. How we help brokers keep adverse action workflows documented
- FAQ
- Sources
1. What counts as an adverse action under ECOA and Regulation B
Regulation B defines adverse action broadly, and the FTC's advisory opinion on adverse action notes that the FCRA definition in credit contexts mirrors ECOA's. In mortgage lending, most of what you will see falls into a handful of patterns:
- A refusal to grant credit in substantially the amount or on the terms requested, unless the applicant accepts a counteroffer.
- A termination of an account or an unfavorable change in its terms that does not affect an entire class of accounts.
- A refusal to increase the amount of credit available when the applicant has asked for it and meets the creditor's standards.
Some actions fall outside the definition. A change the applicant agreed to is not adverse action. Neither is an action tied solely to delinquency or default on an existing account. The same goes for a refusal to extend a type of credit the creditor does not offer, or one the law prohibits it from offering.
Counteroffers are where teams slip most often. Say a borrower applies for one loan term and you offer a different term instead. If the borrower accepts, no adverse action occurred. If the borrower declines or simply never takes up the offer, the original refusal becomes an adverse action and the notice clock matters. The same logic holds for a different loan amount, a different product, or a higher rate than the one requested.
Mortgage brokers should treat the definition as a trigger list for workflow, not a legal footnote. A file that stalls, gets restructured, or ends without a funded loan can be an adverse action even when no one ever typed the word "denied." If your pipeline has a status like "withdrawn" that really means "we could not approve what they asked for," review it. The label does not change the legal analysis; the substance of what happened does.
Edge cases deserve a written decision rule: a borrower who walks away after a counteroffer, a file closed for missing documents, a rate lock that expires after a pricing change. Settle each one once, document it, and train processors and loan originators to apply it the same way every time.
2. When a creditor must notify: 30, 60, and 90 day rules
Timing is the part auditors check first, because it is the easiest to prove or disprove from a file. Regulation B, 12 CFR 1002.9, sets the rules, and CFPB Circular 2023-03 restates the core timing structure: notify within 30 days after a completed application, and either provide specific reasons or disclose the right to request them within 60 days, with a 30-day response period once the applicant asks.
Here is how the clocks run in practice:
- 30 days after a completed application: the creditor must notify the applicant of action taken, whether approval, counteroffer, or adverse action.
- 30 days after adverse action on an existing account: the same window applies when you terminate an account or change its terms unfavorably.
- 30 days after adverse action on an incomplete application: the creditor may send a notice of adverse action, or a notice of incompleteness that gives the applicant a reasonable period to supply the missing information. If the applicant does not respond, the creditor's duty depends on which notice it chose.
- 90 days after a counteroffer: when a creditor notifies an applicant of a counteroffer and the applicant does not accept or use the credit offered, the 90-day period governs when adverse action notice duties come due.
- 60 days to request, 30 days to respond: if the notice tells the applicant they may request the reasons, the applicant has 60 days to ask, and the creditor then has 30 days to provide an oral or written statement of specific reasons.
A practical point: a "completed application" is defined by the creditor's own procedures and by what information it normally considers. If your intake process lets files sit in a gray zone, you cannot show when the 30 days began. Many shops fix this by stamping the completion date in the loan system the moment the last required item arrives.
For mortgage brokers there is an extra wrinkle. When a broker takes the application and a lender makes the credit decision, the parties need a clear agreement on who sends the notice and how quickly information passes between them. Our overview of mortgage regulatory compliance for brokers covers how to split those responsibilities so no file falls between two desks.
3. What an adverse action notice must include
The notice has two layers. ECOA and Regulation B set the first layer. FCRA adds the second when a consumer report or credit score played a role in the decision. Both layers can live in one document, but each must be complete.
The ECOA layer. A compliant notice contains these elements:
- A statement of the action taken.
- The creditor's name and address.
- The ECOA notice language, which says that federal law prohibits discrimination on the basis of the listed characteristics and names the federal agency that administers compliance for that creditor.
- Either a statement of the specific reasons for the action, or a disclosure of the applicant's right to request those reasons within 60 days, with the name, address, and phone number of the person or office to contact.
The FCRA layer. When the decision rested in whole or in part on a consumer report, FCRA Section 615(a) requires the notice to identify the consumer reporting agency, state that the agency did not make the decision and cannot explain the reasons, and tell the applicant about the right to a free report if requested within 60 days, along with the right to dispute inaccurate information. The FTC lays this out for creditors in its guidance on adverse action and risk-based pricing notices. That agency contact detail needs to be accurate: name, address, and a toll-free number for nationwide agencies.
The credit score layer. When a credit score was used in the decision, the notice must disclose more. Under the CFPB's Regulation B section 1002.9 resource:
In plain terms, you cannot bury a score inside a paragraph of boilerplate. Give it its own block, in writing, with every required element visible.
If you are weighing how score disclosures interact with pricing-based notices, our explainer on risk-based pricing notices for U.S. lenders walks through where the two regimes overlap and where they do not.
Common mistakes in this section are mundane. Notices go out with a stale agency address. The ECOA language lists the wrong enforcement agency for the creditor type. A score appears without its date. A reason box is checked, but the notice never explains the right to request reasons because someone assumed reasons were already stated. Each of these is a template problem, which is good news: fix the template once, and every file benefits.
4. How to produce specific reasons that comply with Regulation B
The legal standard is accuracy. CFPB Circular 2022-03 explains that the Official Interpretation to Regulation B requires specific principal reasons that relate to and accurately describe the factors actually considered or scored. Vague internal-policy statements fail that test. So goes picking an unmodified sample checklist reason that does not describe what happened in the file.
That last point trips up experienced teams. The CFPB's sample notices are illustrative. They include model language and checklist reasons, but where a checklist item does not reflect your principal reasons, you must modify the form or use the "other" field. Checking the nearest box and moving on is noncompliant, however convenient it feels at 5 p.m. on the last day of the month.
What works in practice:
- Map scoring categories to consumer-facing reasons. If your underwriting scorecard weighs debt-to-income, credit history, and reserves, write plain-language reasons for each category and link them to the scorecard in a controlled document.
- Lead with principal reasons. A short, accurate list serves the applicant better than a long list that dilutes the real drivers.
- Keep a log of how each reason was derived. Reviewers should be able to trace a reason on a notice back to the file.
- Build templates for the common denials, and give underwriters a clear path to override them when the file does not fit the template.
Pro Tip: Preserve an internal decision record for every adverse action: scorecard outputs or feature weights, any surrogate explanation, and a short human-review summary that ties the disclosed reasons to the evidence.
If you can hand an examiner that record along with the notice, the conversation shifts from "prove you were accurate" to "walk me through your process," which is a far better place to stand.
5. Adverse action notices when you use algorithms, machine learning, or AI
The CFPB has taken a technology-neutral position, and it is firm. In Circular 2022-03, the agency states that ECOA and Regulation B require creditors to provide specific principal reasons whether they used simple underwriting or complex, non-interpretable algorithms. Not being able to interpret a black-box model is not a defense.
That does not mean every model must be fully transparent. An earlier CFPB blog on AI and ML adverse action notices notes that the Official Interpretation permits disclosing the factors themselves without explaining the mechanics of how a factor affected creditworthiness. That flexibility can help when a model finds relationships that do not look intuitive. Note the source's date: it predates the circular, so treat the circular as the controlling statement of agency expectations.
Creditors relying on complex models have several practical routes to consumer-facing reasons:
- Feature importance analysis to identify which inputs most affected a particular decision.
- Surrogate models that approximate the complex model with something explainable, used to support the explanation of individual outcomes.
- Human-in-the-loop review, where an analyst confirms that the reasons produced by the tooling match the file.
- Translating proxies into understandable reasons. If the model leans on a variable that is a stand-in for something else, the notice must describe the real factor in language the applicant can understand, and the creditor must be sure the description is accurate.
Regulators also expect paperwork. Modify the sample forms where they do not fit, document the mapping from model inputs to disclosed reasons, and keep audit-ready evidence that the mapping was applied in the case at hand. For brokers who use vendor-supplied decision engines, add vendor oversight: ask how the vendor generates reasons, ask for the mapping, and keep a copy.
6. What consumers should do after receiving an adverse action notice
An adverse action notice is not the end of the road. It starts a short window in which you have rights, and you should use them. In order:
- Read the notice closely. Note the date, the action taken, the reasons or the right-to-request language, and the name of any consumer reporting agency.
- Request the specific reasons if they were not given. You have 60 days to ask, and the creditor then has 30 days to respond with an oral or written statement. Ask in writing so you have a record.
- Request your free report from the agency named in the notice, also within 60 days, and review it line by line.
- Dispute inaccuracies directly with the agency and with the company that furnished the data.
- Ask for your credit score disclosure if a score was used, and check that the date and key factors make sense.
- Talk to a HUD-approved housing counselor if the denial involved a mortgage. The CFPB's guidance for denied mortgage applicants recommends asking the lender for an explanation and points to counselors as a resource.
- Consider reapplying or shopping other lenders once errors are fixed or the underlying issue is addressed.
- File a complaint with the CFPB if you suspect the decision was discriminatory.
Keep copies of everything you send and receive. If a dispute drags on, your own paper trail is the strongest evidence you have.
7. A compliance checklist and recordkeeping quick reference
Use this as a final pass before a notice goes out, and as a test list when you review a sample of closed files.
- Timing: notice sent within 30 days; request window of 60 days stated; response to a request for reasons within 30 days; counteroffer handled under the 90-day rule.
- ECOA content: action stated, creditor name and address, ECOA notice language with the correct agency, specific principal reasons or right-to-request text.
- FCRA content: agency name, address, and phone; statement that the agency did not make the decision; free-report and dispute rights.
- Score details: score, date, agency, and key factors in a separate written disclosure when a score was used.
- Records: copy of the notice, decision log, model explanation or surrogate summary, and evidence of why the principal reasons were selected.
| Area | What to confirm | Evidence to keep |
|---|---|---|
| Timing | 30-day notice, 60-day request, 30-day response | Dated notice and request log |
| ECOA content | Action, creditor, ECOA language, reasons | Final notice copy |
| FCRA content | Agency, no-decision statement, free report | Final notice copy |
| Credit score | Score, date, agency, key factors | Separate score disclosure |
| Decision support | Link from reasons to the file | Decision log and model summary |
Our guides on audit-ready mortgage compliance reporting and the mortgage compliance setup checklist go deeper on retention and documentation habits that hold up under review.
8. Where mortgage teams actually slip on adverse action
I have spent years in mortgage operations as a processor, underwriter, loan originator, and systems consultant, and the same gaps keep showing up. The biggest is overreliance on the sample form. Teams treat it as a safe harbor when it is a starting point. The second is the missing decision log: an underwriter knows exactly why a file failed, but the notice says something generic and nothing in the file connects the two.
The fix is mostly workflow. Decide who owns the notice, who owns the reasons, and who checks them. Make the reason library a controlled document. When a vendor or an automated engine produces the decision, require an explanation you can read and file. Brokers sit in the middle of these hand-offs, which is exactly why they need clear written agreements with the lenders they work with.
If you want to talk through how to structure this in your shop, reach out. We built our tools around problems like these.
— Omar Khamisa
9. How we help brokers keep adverse action workflows documented
Adverse action compliance breaks down at the hand-offs: a decision made in one place, a notice drafted in another, a borrower question answered somewhere else. We built our all-in-one platform for independent brokers, with a customer portal, communication tools, and document storage. See the platform at 1smtg or request a demo.
FAQ
Is denying credit an adverse action?
Yes. A refusal to grant credit in substantially the amount or on the terms requested is an adverse action under Regulation B, unless the applicant accepts a counteroffer. Exceptions exist for actions tied solely to delinquency or default and for credit types the creditor does not offer.
What does the Equal Credit Opportunity Act prohibit?
ECOA prohibits creditors from discriminating against applicants on the basis of characteristics listed in the law and in Regulation B, such as race, sex, marital status, or age. The CFPB's ECOA compilation explains the statute's purpose and the Regulation B framework behind adverse action notices.
What actions require notification within 30 days?
A creditor must notify an applicant within 30 days after receiving a completed application, and within 30 days after taking adverse action on an existing account or an incomplete application. Under Regulation B, the notice either states the specific reasons or discloses the right to request them.
Is an adverse action notice bad for my credit?
No. The notice itself does not change your credit. It explains a decision and, if a report was used, tells you how to get a free copy and dispute errors. Reviewing it is often the fastest way to fix a problem before you reapply.
Sources
- CFPB Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB’s sample forms provided in Regulation B
- Consumerfinance