Hero background
Compliance Updates4 min read

ECOA Compliance and Fair Lending: What Regulation B Requires in 2026

By Michael Dunleavey
August 4, 2026Updated August 4, 2026
regulation bfair lending complianceecoa disparate impact

ECOA compliance is the fair-lending backbone of a credit operation. The Equal Credit Opportunity Act, implemented through Regulation B, prohibits discrimination in any aspect of a credit transaction, requires adverse action notices, and sets record-retention rules — and in 2026 it changed in a significant way at the federal level. This guide covers what ECOA and Regulation B require, and the new rule on disparate impact that took effect this year.

What ECOA and Regulation B prohibit

ECOA (15 U.S.C. § 1691 et seq.) prohibits discrimination against a credit applicant on a prohibited basis: race, color, religion, national origin, sex, marital status, age (provided the applicant has capacity to contract), receipt of income from a public assistance program, or the good-faith exercise of rights under the Consumer Credit Protection Act. The prohibition reaches every aspect of a credit transaction — from application and evaluation through servicing. Decisioning logic applied to credit data must be neutral with respect to these bases.

Adverse action under Regulation B

Regulation B requires notifying an applicant of action taken on a completed application within 30 days, with the notice including the creditor's identity, the action taken, the ECOA notice, and either specific reasons or the right to request them within 60 days. This runs in parallel with the FCRA's adverse action requirements, and the two are usually combined into one notice. For the full requirements and timing, see our adverse action notice guide.

Record retention

Under Regulation B, retain application and adverse action records for 25 months (consumer credit) or generally 12 months (business credit) from the date of notification. The retained file should include the application and a copy of the notice.

The 2026 disparate-impact change

The most significant recent shift: after proposing it in November 2025, the CFPB finalized a Regulation B rule — effective July 21, 2026 — providing that ECOA does not authorize disparate-impact ("effects test") liability, removing that theory and its commentary from Regulation B. The rule also narrows the anti-discouragement provision and tightens the standards for special purpose credit programs offered by for-profit creditors.

That eliminates disparate impact as a federal ECOA theory — but it does not end fair-lending risk. State regulators in several jurisdictions, including Massachusetts, New York, Illinois, and California, may continue to pursue disparate-impact theories under state law. Prudent compliance programs should continue to test for and address potential disparate impact in credit decisioning, especially in automated systems, rather than treating the federal change as the end of the analysis.

An ECOA compliance checklist

  • Ensure decisioning logic does not discriminate on a prohibited basis.
  • Generate adverse action notices within 30 days of action on a completed application.
  • Include all required notice elements (creditor identity, action, ECOA notice, reasons or the right to request them).
  • Retain application and adverse action records for 25 months (consumer) or 12 months (business).
  • Continue to monitor for potential disparate impact — federal change notwithstanding, state law and sound practice still call for it.
  • Document your fair-lending testing and its results.

Where LASER fits

LASER Credit Access supports consistent, documented decisioning — its DECIDE engine is built around the principle that identical loans are scored identically — and it retains the application and decision data that a fair-lending review depends on. As with every compliance area, LASER helps you surface, apply, and record these controls; it does not make the fair-lending determination for you, and nothing here is legal advice.

For the connected rules, see our FCRA compliance guide, the adverse action notice guide, and our lending compliance software.

This article is for informational and educational purposes only and is not legal advice. Fair-lending requirements change and vary by jurisdiction; confirm current obligations with qualified legal counsel before acting.

Frequently Asked Questions

What is ECOA compliance?

ECOA compliance means meeting the requirements of the Equal Credit Opportunity Act and its implementing Regulation B: not discriminating against applicants on a prohibited basis in any aspect of a credit transaction, providing adverse action notices, and retaining application and decision records for the required period.

What are the prohibited bases under ECOA?

Race, color, religion, national origin, sex, marital status, age (provided the applicant can contract), receipt of income from any public assistance program, and the good-faith exercise of any right under the Consumer Credit Protection Act. A creditor may not discriminate on any of these in any aspect of a credit transaction.

Does ECOA still recognize disparate impact in 2026?

At the federal level, the CFPB finalized a Regulation B rule — effective July 21, 2026 — providing that ECOA does not authorize disparate-impact (effects-test) liability, removing that theory from the regulation and its commentary. Some state regulators may still pursue disparate-impact theories under state law, so prudent compliance programs continue to test for it.

How long must ECOA records be retained?

Under Regulation B, 25 months from the date of notification for consumer credit and generally 12 months for business credit. Adverse action files must include the application and a copy of the written notice.

Michael Dunleavey

Founder — LASER Credit Access

Michael Dunleavey brings over 15 years of experience in credit infrastructure and lending compliance, helping financial institutions streamline operations on Salesforce.

Ready to Transform Your Credit Operations?

Discover how LASER Credit Access streamlines compliance and decisioning natively inside Salesforce — unified in a single app, ready from day one.