ECOA compliance means meeting the requirements of the Equal Credit Opportunity Act, implemented through Regulation B, which prohibits discrimination in any aspect of a credit transaction, requires adverse action notices when credit is denied, and sets record-retention rules. In 2026 it changed in a significant way at the federal level. This guide covers what ECOA and Regulation B require, and the new rule on disparate impact that took effect this year.
What do ECOA and Regulation B prohibit?
ECOA (15 U.S.C. § 1691 et seq.) prohibits discrimination against a credit applicant on a prohibited basis: race, color, religion, national origin, sex, marital status, age (provided the applicant has capacity to contract), receipt of income from a public assistance program, or the good-faith exercise of rights under the Consumer Credit Protection Act.
The prohibition reaches every aspect of a credit transaction — from application and evaluation through servicing. Decisioning logic applied to credit data must be neutral with respect to these bases.
Adverse action under Regulation B
Regulation B requires notifying an applicant of action taken on a completed application within 30 days, with the notice including the creditor's identity, the action taken, the ECOA notice, and either specific reasons or the right to request them within 60 days. This runs in parallel with the FCRA's adverse action requirements, and the two are usually combined into one notice. For the full requirements and timing, see our adverse action notice guide.
Record retention
Under Regulation B, retain application and adverse action records for 25 months (consumer credit) or generally 12 months (business credit) from the date of notification. The retained file should include the application and a copy of the notice.
The 2026 disparate-impact change
The most significant recent shift: after proposing it in November 2025, the CFPB finalized a Regulation B rule — effective July 21, 2026 — providing that ECOA does not authorize disparate-impact ("effects test") liability, removing that theory and its commentary from Regulation B. The rule also narrows the anti-discouragement provision and tightens the standards for special purpose credit programs offered by for-profit creditors.
That eliminates disparate impact as a federal ECOA theory — but it does not end fair-lending risk. State regulators in several jurisdictions, including Massachusetts, New York, Illinois, and California, may continue to pursue disparate-impact theories under state law. Prudent compliance programs should continue to test for and address potential disparate impact in credit decisioning, especially in automated systems, rather than treating the federal change as the end of the analysis.
An ECOA compliance checklist
- Ensure decisioning logic does not discriminate on a prohibited basis.
- Generate adverse action notices within 30 days of action on a completed application.
- Include all required notice elements (creditor identity, action, ECOA notice, reasons or the right to request them).
- Retain application and adverse action records for 25 months (consumer) or 12 months (business).
- Continue to monitor for potential disparate impact — federal change notwithstanding, state law and sound practice still call for it.
- Document your fair-lending testing and its results.