12 CFR § 1002.9: Adverse Action Notice Timing, Content, and Retention

Regulation B’s adverse action notice requirements apply whenever a creditor denies a credit application, approves it on terms different from what the applicant asked for, or worsens the terms of an existing account for a specific customer. The creditor generally has 30 days from the decision to send a written notice that states what action was taken, identifies the creditor and its federal regulator, gives the applicant a statement of their rights under the Equal Credit Opportunity Act, and either lists the specific reasons for the decision or tells the applicant how to request them. When a credit report factored into the decision, the Fair Credit Reporting Act layers additional disclosures on top. Miss the deadline, skimp on the reasons, or leave out the FCRA pieces, and the creditor is exposed to actual and punitive damages per 15 USC 1691e.¹

When a Notice Is Required

Adverse action under Regulation B is broader than a flat denial. A creditor takes adverse action when it refuses to grant credit in substantially the amount or on substantially the terms the applicant requested, unless the creditor makes a counteroffer that the applicant accepts or uses. Refusing to increase a credit limit counts. So does closing an account or making its terms worse, as long as the change targets specific customers rather than a whole class of accounts.²

That class-versus-individual line matters. Raising an annual fee on every checking-line-of-credit account the bank offers is a class-wide change and triggers no individual notices. Singling out one cardholder for a rate hike or a lower limit does trigger one.

Situations That Look Like Adverse Action But Aren’t

Several events sit outside the rule. No notice is required when the creditor changes terms the applicant expressly agreed to, acts on an account that is currently in default or delinquent, declines to authorize a routine point-of-sale transaction, refuses credit because the law prohibits that particular loan, or refuses because it simply doesn’t offer the type of credit requested.²

The delinquency carve-out is narrower than many creditors assume. It covers action taken because the borrower is currently behind on the account in question. A decision based on a past delinquency the borrower has since cured still requires a notice. Where both the adverse-action definition and an exception apply, the exception controls.

The Deadlines

Three clocks run under Section 1002.9, depending on the situation:³

Completed application: 30 days from receipt to notify the applicant of the decision, whether approval, counteroffer, or denial.
Existing account: 30 days from the decision to take adverse action.
Counteroffer: 90 days from the date the counteroffer was presented, if the applicant neither accepts nor uses the credit offered. At that point the creditor must send a full adverse action notice on the original request.

Incomplete Applications

If an application is missing information the applicant can supply, the creditor has 30 days to either act on it or send a written notice of incompleteness. That notice must identify the specific information needed, set a reasonable deadline for providing it, and warn that the application won’t be considered further if the deadline passes.³

The creditor can first ask orally or by phone. If the application stays incomplete after that, written notice has to follow. Once the applicant supplies what was requested within the stated deadline, the regular 30-day clock on a completed application starts. If the applicant never responds, the creditor has no further obligation.

What the Notice Must Contain

Every adverse action notice must be in writing and must include:³

A clear statement of the action taken.
The name and address of the creditor.
A statement that federal law prohibits discrimination based on race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or exercise of rights under the Consumer Credit Protection Act.
The name and address of the federal agency that oversees the creditor’s ECOA compliance.
Either the specific reasons for the adverse action or a disclosure of the applicant’s right to request them.

Giving Specific Reasons

The reasons are where most compliance trouble lives. The creditor must identify the principal factors behind the decision. Official CFPB commentary notes that disclosing more than four reasons is unlikely to help the applicant, so most notices stop at four.⁴ Vague explanations like “you did not meet our internal standards” or “your score was insufficient” don’t satisfy the rule. The reasons need to be specific enough that the applicant can see what drove the outcome.

The Right-to-Request Alternative

Instead of listing reasons upfront, the creditor can tell the applicant they have the right to request them within 60 days. That version of the notice must include the name, address, and telephone number of the person or office that will provide the reasons. If the applicant asks within the 60-day window, the creditor has 30 days to respond in writing. A creditor that gives the reasons orally must also tell the applicant they can get written confirmation on written request within 30 days.³

Joint Applicants

When more than one person applies, the creditor only needs to send the notice to one of them. Where there is an obvious primary applicant, the notice should go to that person.³

Added FCRA Disclosures When a Credit Report Was Used

If the adverse action was based even partly on information from a consumer report, the Fair Credit Reporting Act layers on additional content:⁵

The name, address, and phone number of the consumer reporting agency that supplied the report, including a toll-free number if it is a nationwide agency.
A statement that the reporting agency did not make the decision and cannot explain why it was made.
The applicant’s numerical credit score, if one was used, along with the key factors that affected the score.
Notice that the applicant can get a free copy of the report from that agency within 60 days of the request.
Notice of the right to dispute inaccurate or incomplete information with the reporting agency.

Because almost every credit decision involves a credit report, most adverse action notices in practice combine Regulation B’s elements with these FCRA disclosures in one document. Leaving out the credit score piece is among the more common slip-ups.

Business Credit Applicants

The rules bend for business credit, using the applicant’s gross revenues in the preceding fiscal year as the dividing line.

Businesses with Gross Revenues of $1 Million or Less

Mostly the same rules as consumer credit, with two differences. The statement of action taken can be delivered orally. And specific reasons don’t have to be given unless the applicant requests them in writing within 60 days of the notification.⁶

Businesses with Gross Revenues Over $1 Million

For larger businesses, and for trade credit, factoring, and similar commercial arrangements, the creditor must notify within a “reasonable time” rather than the 30-day deadline. That notification can be oral or written. A written statement of reasons and the ECOA notice are required only if the applicant requests them in writing within 60 days.⁶

Penalties and the Inadvertent-Error Safe Harbor

A creditor that violates any ECOA requirement, including Section 1002.9, faces civil liability under 15 USC 1691e. The applicant can recover actual damages. The court can also award punitive damages up to $10,000 in an individual action, or in a class action, the lesser of $500,000 or one percent of the creditor’s net worth. The court weighs how often the creditor has failed to comply, whether the violation was intentional, and the creditor’s resources. A successful plaintiff can also recover attorney’s fees and court costs.¹

Regulation B does provide a narrow cushion for genuine mistakes. A failure that results from an inadvertent error, meaning a mechanical, electronic, or clerical error that was not intentional and happened despite reasonable compliance procedures, is not treated as a violation. Computer malfunctions, printing errors, and calculation mistakes are the sort of thing contemplated. An error of legal judgment does not qualify. On discovering such an error, the creditor must correct it as soon as possible.

Record Retention

Creditors must keep applications, adverse action notices, and related documentation for at least 25 months after notifying the applicant of the decision. For business credit, the retention period is 12 months.⁷ If an applicant later files a discrimination complaint, those records are what proves the decision was explained and the notice went out on time.

1
Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability
2
eCFR. 12 CFR 1002.2 – Definitions
3
eCFR. 12 CFR 1002.9 – Notifications
4
Consumer Financial Protection Bureau. Comment for 1002.9 – Notifications
5
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
6
eCFR. 12 CFR 1002.9 – Notifications
7
eCFR. 12 CFR 1002.12 – Record Retention