Consumer Compliance Outlook > 2013 > Second Quarter 2013

Consumer Compliance Outlook: Second Quarter 2013

Adverse Action Notice Requirements Under the ECOA and the FCRA

By Sarah Ammermann, Examiner, Federal Reserve Bank of Minneapolis

INTRODUCTION

Two federal laws — the Equal Credit Opportunity Act (ECOA), as implemented by Regulation B, and the Fair Credit Reporting Act (FCRA) — reflect Congress’s determination that consumers and businesses applying for credit should receive notice of the reasons a creditor took adverse action on the application or on an existing credit account.¹ Notice is also required under the FCRA for adverse actions taken with respect to insurance transactions, employment decisions, and in certain other circumstances.

The two laws serve different purposes. Adverse action notices under the ECOA and Regulation B are designed to help consumers and businesses by providing transparency to the credit underwriting process and protecting against potential credit discrimination by requiring creditors to explain the reasons adverse action was taken. The FCRA’s requirements for adverse action notices apply only to consumer transactions and are designed to alert consumers that negative information was the basis for the adverse action. Under the FCRA, the consumer has 60 days from the date of the notice to obtain more details about the negative information so that if it is erroneous, the consumer can correct it. To reduce the compliance burden, a creditor can use a single, combined notice to comply with the adverse action requirements of both laws, and model forms have been published in connection with Regulation B.

To ensure compliance, it is important to understand how the requirements of Regulation B and the FCRA relate to and differ from one another. In this article, we review the adverse action requirements of both Regulation B and the FCRA, explain recent disclosure requirements under the FCRA mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and discuss common adverse action violations.

WHAT IS ADVERSE ACTION?

Regulation B defines adverse action as:

• A refusal to grant credit in substantially the amount or on substantially the terms requested in an application unless the creditor makes a counteroffer (to grant credit in a different amount or on other terms), and the applicant uses or expressly accepts the credit offered;
• A termination of an account or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts; or
• A refusal to increase the amount of credit available to an applicant who has made an application for an increase.²

To provide greater clarity about the definition, Regulation B also specifically delineates what is not adverse action:

• A change in the terms of an account expressly agreed to by an applicant;
• Any action or forbearance relating to an account taken in connection with inactivity, default, or delinquency as to that account;
• A refusal or failure to authorize an account transaction at point of sale or loan except when the refusal is a termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts or when the refusal is a denial of an application for an increase in the amount of credit available under the account;
• A refusal to extend credit because applicable law prohibits the creditor from extending the credit requested; or
• A refusal to extend credit because the creditor does not offer the type of credit or credit plan requested.³

The FCRA, by contrast, defines adverse action more broadly to include:

• Adverse action as defined in section 701(d)(6) of ECOA ;
• A denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance;
• A denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee;
• A denial or cancellation of, an increase in any charge for, or any adverse or unfavorable change in the terms of a government license or benefit; or
• An action on an application or transaction initiated by a consumer, or in connection with account review that is adverse to the consumer’s interests.⁴

Thus, the FCRA definition not only specifically includes the ECOA definition but also covers certain noncredit, consumer-initiated transactions and applications, including consumer applications for insurance, employment, a rental, and a government license or benefit. Note, however, that the FCRA only applies to consumer transactions, so adverse action notices are not required under the FCRA for business transactions.

When Is Notice Required?

Generally, Regulation B notice requirements are triggered when adverse action is taken on a credit application or an existing credit account, and FCRA notice requirements are triggered when adverse action is taken based on information provided in one of the three circumstances listed in Table 1 in the FCRA column.

Because of different coverage rules, an adverse action notice may be required under one law but not the other. For example, an employer must comply with the FCRA notice requirements when denying an employment application based on information in a consumer report⁵; however, the disclosures under Regulation B are not triggered because the application does not involve credit.

Who Must Receive Notice?

Regulation B and the FCRA differ on who must receive the adverse action notice. Regulation B defines an applicant more broadly than the FCRA, incorporating businesses as well as individuals. Table 2 shows the two requirements.

The requirements are different for multiple applicants. According to Regulation B, if multiple applicants submit an application, notice need only be given to the primary applicant if the primary applicant is readily apparent.⁶ In the case of multiple applicants under the FCRA, the statute has been interpreted to require notice to all consumers against whom adverse action is taken if the action taken was based on information in a consumer report.⁷ If the applicants’ credit scores were used in taking adverse action, each individual should receive a separate adverse action notice with the credit score and related disclosures associated with his or her individual consumer report; however, an applicant should not receive credit score information about a coapplicant. Regulation B does not prohibit delivery of an adverse action notice to each applicant. If applicable, financial institutions can provide a combined notice of adverse action to all consumer applicants to comply with multiple-applicant requirements under the FCRA, provided a credit score is not required for the adverse action notice because a score was not relied upon in taking adverse action.

What Are the Notice Timing Requirements?

As shown in Table 3, Regulation B includes detailed timing requirements for adverse action notices, while the FCRA does not include such requirements. Typically, financial institutions include the disclosures required under both Regulation B and the FCRA in one adverse action notice when both notices are required. For these combined notices, Regulation B’s timing requirements apply.

For businesses with gross annual revenues of $1 million or less, Regulation B requires notice be provided according to the same timing requirements applicable to consumers as described in Table 3.⁸ For businesses with gross annual revenues greater than $1 million, Regulation B requires only that a creditor provide notice within a reasonable time.⁹

Common notice violations.¹⁰ Common Regulation B adverse action notification and timing errors relate to handling incomplete applications. Creditors may fail to identify an application as incomplete and, as such, fail to meet notice content and timing requirements. A creditor has two options after receiving an incomplete application: it can (1) take action on the application and notify the applicant according to Regulation B’s standard notice requirements or (2) refrain from taking action and notify the applicant that the application is incomplete.¹¹ If the creditor provides a notice of incompleteness, the notice must (1) be in writing, (2) detail the information needed to complete the application, (3) provide a reasonable deadline, and (4) state that the application will not be reviewed if the information is not received.¹² Regardless of which notice is provided, the notice must be provided within 30 days.¹³

What Disclosures Are Required?

Both Regulation B and the FCRA include particular content and format requirements for adverse action notices. Regulation B requires the notice be in writing except for business applicants, who may receive oral notice of adverse action.¹⁴ The FCRA, on the other hand, states that adverse action notices may be provided orally, in writing, or in electronic format.¹⁵ Although Regulation B does not specifically provide for electronic delivery, a combined adverse action notice that incorporates both Regulation B and the FCRA requirements may be provided electronically if the consent requirements of the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. §7001 et seq., are complied with.¹⁶

Appendix C of Regulation B contains model adverse action notices that include the disclosures required under both Regulation B and the FCRA. Although not mandatory, proper use of the model notice forms satisfies the adverse action disclosure requirements of the FCRA and the ECOA. Table 4 includes current adverse action disclosure requirements for Regulation B and the FCRA.

Similar to the timing requirements, the contents of the disclosures under Regulation B may vary based on the type of applicant or account holder. For businesses with gross annual revenues of $1 million or less, the notice must include the same information described in Table 4, except the disclosure of the applicant’s right to receive the statement of reasons can be given at application.¹⁷ For businesses with gross annual revenues greater than $1 million, a creditor is only required to provide a statement of reasons for adverse action and the ECOA antidiscrimination statement if the applicant makes a written request for the information within 60 days of notification.¹⁸

Common content violations. Regulation B adverse action errors involving content typically relate to the statement of specific reasons for the action taken. The regulation requires the statement to be specific and indicate the principal reason(s) for taking adverse action.¹⁹ Creditors should disclose up to four principal reasons; disclosure of more than four reasons is unlikely to be helpful to the applicant.²⁰ Violations often involve inaccurate, ambiguous, or confusing statements of the principal reasons.

When are additional FCRA credit score disclosures required?

Section 1100F of the Dodd-Frank Act amended the FCRA to include additional disclosure requirements when adverse action is taken because of the consumer’s credit score. Specifically, the FCRA requires a person to make the following disclosures in writing or electronically as part of the adverse action notice in addition to those identified in Table 4:

• The consumer’s numerical credit score used by the person in taking adverse action²¹
• The range of possible credit scores;
• All the key factors that adversely affected the credit score²²;
• The date on which the credit score was created; and
• The name of the person or entity providing the credit score or the information upon which score was created.

But if the credit score did not play a role in the decision to take adverse action, these disclosures are not required.²³ One question that frequently arises is whether credit score disclosures are required for adverse action on a credit application where the creditor already provided a credit score disclosure because the creditor uses the credit score exception method of complying with the FCRA risk-based pricing (RBP) rules. Under this compliance option, the creditor provides RBP notices with credit scores to all applicants. A creditor taking adverse action in this circumstance must still include the credit score disclosure in the adverse action notice because the credit score exception notice is provided at a different time in the application process and serves a different purpose than the adverse action notice.²⁴

Credit score disclosures cannot be combined with any other disclosures required under the FCRA, although they can be combined with the adverse action notice disclosures required by Regulation B. Finally, the credit score disclosures cannot be provided on a separate form; they must be included on the adverse action form.²⁵

Key factors. A person relying on a credit score in taking adverse action is required by section 615(a) of the FCRA to disclose the key factors adversely affecting the consumer’s credit score. Because credit scores are typically purchased from a consumer reporting agency, that agency is in the best position to identify the factors that adversely affected the score. The final rule therefore permits disclosure of the reasons identified by the agency to satisfy the key factors requirement.²⁶

Providing applicants with a list of key factors affecting their credit score does not relieve the creditor of its duty to also disclose, under Regulation B, the reasons for taking adverse action. In some instances, the key factors affecting a credit score will be the same as the reasons for taking adverse action under Regulation B. But in other cases, they may be unrelated. For example, a creditor may deny a loan application because of factors unrelated to a credit score, such as an applicant’s income, employment, or residence.²⁷ In addition, a person cannot provide an applicant with a general reference to the key factors that affected a credit score as a reason for taking adverse action under Regulation B.

Multiple credit scores.²⁸ In certain cases, a person may receive multiple credit scores from consumer reporting agencies. If the person only uses one credit score in making the decision, that particular score and related information for that specific credit score must be disclosed. If the person uses multiple credit scores in making the credit decision, only one of the scores is required to be disclosed; however, the FCRA does not prohibit creditors from disclosing multiple credit scores to the consumer.

Common violations related to credit score disclosures. Violations involving the FCRA’s requirement to include credit score information in adverse action notices typically involve failing to recognize when the requirement applies. The disclosure requirements are triggered when a credit score is used by a person in taking adverse action.²⁹ Some violations have occurred when persons interpreted the term “use” too narrowly to include only situations when adverse action is solely or primarily based on the credit score. Similarly, other violations have involved persons incorrectly providing additional credit score disclosures only in cases when a minimum credit score was established. To avoid these violations, a person must provide the additional credit score disclosures whenever a credit score is used in the decision to take adverse action.

CONCLUSION

Compliance with the requirements of both Regulation B and the FCRA involving adverse action decisions is important to provide applicants and account holders timely and relevant information. To ensure compliance with the rules, financial institutions should implement appropriate policies and procedures. In addition, financial institutions should ensure that updates for automated disclosure systems are received, tested, and correctly implemented. A strong training program, both for current regulations and any recent changes, will help ensure compliance. Controls that a financial institution may consider include a secondary review of all adverse action notices and a consistent process, even in excess of regulatory requirements, such as delivering a combined adverse action notice to all consumer applicants. Specific issues and questions should be raised with your primary regulator.

• ¹ There are no implementing regulations for the adverse action requirements in the FCRA.
• ² 12 C.F.R. §1002.2(c)(1)
• ³ 12 C.F.R. §1002.2(c)(2))
• ⁴ FCRA section 603(k)(1). The last bullet concerning consumer-initiated transactions and applications is often referred to as a catch-all provision and was added to the FCRA in 1996 to overturn an FTC interpretation that stated that refusal to accept payment by check or rent an apartment based on a consumer report did not require an adverse action notice under the FCRA. See H.R. Rep. No. 103–486 at 26 (1994).
• ⁵ FCRA sections 615(a) and 603(k)(1)(b)(ii)
• ⁶ 12 C.F.R. §1002.9(f)
• ⁷ Section 615(a) of the FCRA requires notice to “any consumer” against whom adverse action is taken if the adverse action is based in whole or in part on information from a consumer report. The Federal Reserve Board has interpreted this to apply to co-applicants. See 76 Fed. Reg at 41,596-97.
• ⁸ 12 C.F.R. §1002.9(a)(3)(i)
• ⁹ 12 C.F.R. §1002.9(a)(3)(ii)(A)
• ¹⁰ Outlook published an article on common compliance violations in the First Quarter 2011 issue that included a discussion of issues with ECOA adverse action notices. See “View from the Field: Commonly Cited Compliance Violations in 2011.”
• ¹¹ 12 C.F.R. §1002.9(c)(1)
• ¹² 12 C.F.R. §1002.9(c)(2)
• ¹³ 12 C.F.R. §1002.9(a)(1)
• ¹⁴ 12 C.F.R. §1002.9(a)(3)(i)(A) and (a)(3)(ii)(A)
• ¹⁵ FCRA section 615(a)(1)
• ¹⁶ Outlook reviewed the consent requirements for the E-Sign Act in the Fourth Quarter 2009 issue: “Moving from Paper to Electronics: Consumer Compliance Under the E-Sign Act.”
• ¹⁷ 12 C.F.R. §1002.9(a)(3)(i)
• ¹⁸ 12 C.F.R. §1002.9(a)(3)(ii)
• ¹⁹ See 12 C.F.R. §1002.9(b)(2) and commentary to that section
• ²⁰ Comment 9(b)(2)-1 of the Official Staff Commentary for Regulation B
• ²¹ Under section 609(f)(2)(A) of the FCRA and section 1100F of the Dodd-Frank Act, “credit score” means “a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict likelihood of certain credit behaviors, including default.” In some cases, a person may use a proprietary scoring system that results in a proprietary score that also meets the definition of “credit score.” 76 Fed. Reg. at 41,594.
• ²² FCRA section 609(f)(9). The number of key factors listed should not exceed four; however, if the number of inquiries was listed as a key factor but not one of the top four, this should be listed as a fifth key factor. See also 76 Fed. Reg. at 41,593.
• ²³ 76 Fed. Reg. at 41,592
• ²⁴ 76 Fed. Reg. at 41,596
• ²⁵ Section 615(a). For more information, see the two prior Outlook articles on risk-based pricing notices: “An Overview of Risk-Based Pricing Implementing Regulations” (Fourth Quarter 2010) , and “An Overview of Credit Score Disclosure Requirements for Risk-Based Pricing Notices” (Third Quarter 2011) .
• ²⁶ 76 Fed. Reg. at 41,592
• ²⁷ 76 Fed. Reg. at 41,592
• ²⁸ 76 Fed. Reg. at 41,597
• ²⁹ FCRA section 615(a)(2)(A). See also 76 Fed. Reg. 41,590, 41,592 (July 15, 2011) (“Section 1100F of the Dodd-Frank Act requires disclosure if a credit score was used in taking adverse action. A creditor that obtains a credit score and takes adverse action is required to disclose that score, unless the credit score played no role in the adverse action determination. If the credit score was a factor in the adverse action decision, even if it was not a significant factor, the creditor will have used the credit score for purposes of section 1100F of the Dodd-Frank Act.”)