Adverse Action Notices Under the FCRA: Timing, Delivery, and Penalties

An adverse action notice under the FCRA is the written notification a business must send you when it makes a negative decision — denying credit, refusing to hire, raising an insurance premium, or turning down a rental application — based even in part on information from a consumer report. The Fair Credit Reporting Act spells out what the notice must say, who it must come from, and when it has to arrive. Getting it wrong exposes the business to statutory damages between $100 and $1,000 per violation, plus punitive damages and attorney fees.¹

What Counts as an Adverse Action

The FCRA defines adverse action broadly.² In credit, it covers denying a loan or card application, cutting a credit limit, raising an interest rate, or otherwise changing account terms unfavorably. In employment, it covers refusing to hire, denying a promotion, or terminating an employee. In insurance, it reaches denials, cancellations, and premium increases. It also applies to government licenses and benefits.

Landlords and property managers fall under the same rules. Denying a rental application, raising the rent or deposit, or requiring a co-signer all qualify as adverse actions when the decision relied on a consumer report.³ Smaller landlords often skip the notice entirely; that omission carries the same penalties as if a bank skipped it.

The test is whether the decision was based “in whole or in part” on a consumer report. If the report played any role, even alongside other criteria, the full notice process applies.

The Two-Step Process for Employment Decisions

Employment is the one context where the FCRA builds in a preparatory stage before the final decision. Before an employer can act on negative information from a consumer report, it must give the applicant or employee two things: a complete copy of the specific report it reviewed, and a written summary of the applicant’s rights under the FCRA prescribed by the Consumer Financial Protection Bureau.⁴ The report must be the exact version the employer used, not a fresh pull.

The rights summary explains how to dispute inaccuracies, describes fraud alerts and security freezes, and identifies the federal agencies that enforce the law. Giving the applicant these materials before the door closes is what catches identity theft, data-entry mistakes, and outdated information.

The statute doesn’t set an exact waiting period between the pre-adverse materials and the final decision. A 1999 FTC advisory opinion treated five business days as generally reasonable while noting that the right interval depends on the facts.⁵ Five business days has become the working standard. During that window, the applicant can contact the reporting agency, flag errors, and provide context. An employer who pushes ahead with a rejection while the applicant is actively disputing the underlying data invites exactly the kind of lawsuit the process was designed to prevent.

Once the waiting period runs and the employer confirms the decision, the final adverse action notice goes out.

What the Final Notice Must Contain

The statute lists the required elements of the post-adverse action notice.⁶ Every notice must include:

A clear statement that a negative decision has been made.
The name, mailing address, and phone number (with a toll-free number for nationwide agencies) of the consumer reporting agency that supplied the report.
A statement that the reporting agency did not make the decision and cannot explain the specific reasons behind it.
Notice that the consumer can obtain a free copy of the report from that agency within 60 days.
Notice of the right to dispute the accuracy or completeness of any information in the report with the reporting agency.

The disclaimer language feels backwards to some businesses: the agency supplied the damaging information, yet the notice must say the agency isn’t responsible for the decision. The point is to route the consumer’s challenge correctly. If the data was wrong, the agency handles the dispute. If the data was accurate but weighed against the applicant, that’s between the applicant and the business that made the call.

Credit Score Disclosures

If a numerical credit score factored into the decision, the notice must include additional detail: the actual score used, the date it was created, the range of possible scores under the model, the key factors that hurt the score, and the entity that provided it.⁷

Key factors are capped at four, or five if one of them is the number of credit inquiries.⁸ They must be listed in order of how much each one dragged the score down. Common ones include high revolving balances, recent late payments, short credit history, and too many recent inquiries. Scoring companies deliver these as standardized reason codes; the notice should translate them into language a consumer can actually read.

Timing Rules for Credit Denials

The FCRA isn’t the only law governing these notices in lending. Regulation B, which implements the Equal Credit Opportunity Act, sets its own timeline. A creditor must send an adverse action notice within 30 days of receiving a completed application, within 30 days of acting on an incomplete application, or within 30 days of taking adverse action on an existing account.⁹ A creditor that makes a counteroffer the applicant neither accepts nor uses has 90 days to send the notice.

Regulation B also demands substance in the explanation. The notice must either state the specific reasons for the denial or disclose the applicant’s right to request those reasons within 60 days.⁹ Vague explanations like “based on internal standards” or “failed to achieve a qualifying score” are explicitly insufficient. The reason has to be concrete enough for the applicant to know what went wrong, such as “insufficient income relative to the requested credit amount” or “excessive existing debt obligations.”

How the Notice Can Be Delivered

Adverse action notices can be delivered in writing, orally, or electronically. First-class mail is the most common method and the easiest to prove. Oral notices are legally allowed but create proof problems; if the consumer later says they never received one, a phone log is harder to defend than a mailing receipt.

Electronic delivery is permitted only if it complies with the E-SIGN Act, which requires the consumer to give affirmative consent to receive records electronically and to demonstrate they can actually access the format being used.¹⁰ An email address on file isn’t enough. The consent has to be specific and can’t have been withdrawn.

What To Do If You Receive One

The most important deadline is the 60-day window to request a free copy of your consumer report from the agency named in the notice.⁶ Request it and read it line by line. Look for accounts you don’t recognize, balances that look wrong, and negative marks that should have aged off.

If you find errors, you have the right to dispute them directly with the reporting agency. The agency must investigate and respond, typically within 30 days. If the dispute produces a correction, consider reapplying: the original decision rested on bad data, and the corrected report may change the outcome. Even if the report is accurate, the notice should tell you exactly what worked against you, especially where credit-score key factors are disclosed. That’s usable information for improving your position before you try again.

Penalties When a Business Skips the Notice

The FCRA creates two tiers of liability. For willful violations, a business faces statutory damages between $100 and $1,000 per affected consumer, even without proof of actual financial harm.¹ Courts can add punitive damages with no statutory cap, plus attorney fees and litigation costs. A company that skips the process across thousands of applicants runs into serious math fast.

For negligent violations, the consumer can recover actual damages plus attorney fees and court costs.¹¹ No statutory minimum, no punitive damages. The consumer has to prove concrete harm — a lost job, a higher interest rate, or a similar financial loss traceable to the missed notice.

A consumer can bring an FCRA lawsuit in any federal district court regardless of the amount at stake. The deadline is the earlier of two years after the consumer discovers the violation, or five years after it actually occurred.¹² The discovery rule matters because people often don’t learn about a notice failure right away. Someone who was never told why a job offer disappeared may not connect it to a consumer report for months.

1
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
2
Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction
3
Consumer Financial Protection Bureau. Federal Housing Agencies Strongly Encourage Landlords to Provide Tenants Written Notice of Their Rights
4
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
5
Federal Trade Commission. Advisory Opinion to Vail (04-05-99)
6
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
7
Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
8
Consumer Financial Protection Bureau. 12 CFR 1022.73 – Content, Form, and Timing of Risk-Based Pricing Notices
9
eCFR. 12 CFR 1002.9 – Notifications
10
Federal Deposit Insurance Corporation. Consumer Compliance Examination Manual – X-3 The Electronic Signatures in Global and National Commerce Act (E-Sign Act)
11
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
12
Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions