An adverse action notice is the disclosure a lender must give an applicant whenever it denies credit, offers less favorable terms than the applicant asked for, or otherwise takes an unfavorable action on an application. It sits at the intersection of two federal laws — the Equal Credit Opportunity Act (ECOA), implemented through Regulation B, and the Fair Credit Reporting Act (FCRA) — and getting it wrong is one of the most common, and most litigated, compliance failures in lending. This guide explains when an adverse action notice is required, exactly what it must contain, how the two laws combine into a single notice, and how long you have to send it.
New to this? Start with the plain-language explainer: what is an adverse action notice.
The short version: Send the notice within 30 days of a completed application. Include the ECOA elements (creditor identity, action taken, ECOA notice, and reasons or the right to request them). If a consumer report factored into the decision, add the FCRA elements (credit bureau contact info, the "the bureau didn't decide" statement, free-report and dispute rights, and the credit score if one was used). Retain the file for 25 months (consumer) or 12 months (business).
What is an adverse action notice?
"Adverse action" has slightly different definitions under each law, and a compliant lender has to satisfy both:
- Under ECOA / Regulation B (12 CFR § 1002.2(c)): a denial or revocation of credit, a change in the terms of an existing account, or a refusal to grant credit in the amount or on the terms requested.
- Under the FCRA (15 U.S.C. § 1681a(k)): a broader definition that also covers unfavorable actions in insurance, employment, and other transactions — but for lenders, the trigger is a credit denial or less-favorable terms based on a consumer report.
A counteroffer that the applicant accepts is generally not adverse action. A counteroffer the applicant does not accept, a denial, or approval on worse terms than requested all trigger the notice requirement.
When must a lender send an adverse action notice? (the 30-day rule)
Regulation B (12 CFR § 1002.9) sets the timing. The core deadline is 30 days from a completed application, with parallel rules for related situations:
| Situation | Deadline to notify |
| Action taken on a completed application | Within 30 days of receiving the completed application |
| Adverse action on an incomplete application | Within 30 days — or send a notice of incompleteness specifying what's needed and a reasonable time to provide it |
| Adverse action on an existing account | Within 30 days of taking the action |
| Counteroffer the applicant does not accept | Within 90 days of notifying the applicant of the counteroffer |
What an adverse action notice must contain
Because most credit denials involve a consumer report, most notices must satisfy ECOA and FCRA at once. Here's how the required elements line up:
| ECOA / Regulation B (§ 1002.9) | FCRA (§ 615(a) / 15 U.S.C. § 1681m) — when a consumer report was used |
| Creditor's name and address | Name, address, and phone number of the consumer reporting agency (CRA) that supplied the report |
| A statement of the action taken | A statement that the CRA did not make the decision and cannot explain the specific reasons for it |
| The ECOA anti-discrimination notice, identifying the federal agency that enforces compliance | Notice of the applicant's right to a free copy of the report from the CRA within 60 days |
| Either the specific principal reasons for the adverse action, or a statement of the right to request those reasons within 60 days | Notice of the right to dispute the accuracy or completeness of the report — plus, if a credit score was used, the score and related information |
One notice can do both. Lenders may — and usually do — combine the ECOA and FCRA disclosures into a single adverse action notice. It's compliant as long as every element above appears. Regulation B Appendix C provides model notice forms that already incorporate the required language; starting from those is the safest path.
Be specific about the reasons
If you choose to state reasons rather than offer the right to request them, they must be specific and reflect the principal reasons for the decision. Vague statements like "you did not meet our credit standards" or "insufficient score" do not satisfy Regulation B. Acceptable reasons point to the actual factors — for example, "length of credit history too short," "delinquent past or present credit obligations," or "income insufficient for amount of credit requested."
Recordkeeping and retention
The notice isn't the end of the obligation. Under Regulation B (§ 1002.12), you must retain the records:
- Consumer credit: 25 months from the date of notification.
- Business credit: generally 12 months from the date of notification.
The retained file should include the application and a copy of the adverse action notice. For business applicants with gross revenue over $1 million, the notice rules are adapted: you may notify within a reasonable time, orally or in writing, and provide written reasons only on the applicant's written request within 60 days.
Common adverse action mistakes
- Missing the FCRA half. Sending an ECOA reason statement but omitting the credit bureau contact info, free-report notice, or (when a score was used) the credit score disclosure.
- Reasons that aren't specific. Generic language that doesn't identify the principal factors.
- Late notices. Blowing the 30-day window because "completed application" wasn't tracked from the right date.
- No retained copy. Keeping the decision but not a copy of the notice that was sent, leaving a gap in the 25-month file.
- Counteroffers handled as approvals. Forgetting that an unaccepted counteroffer is adverse action with its own 90-day clock.