Consumer Compliance Outlook
Adverse Action Notice Requirements Under the ECOA and the FCRA
Two federal laws — the Equal Credit Opportunity Act (ECOA), as implemented by Regulation B, and the Fair Credit Reporting Act (FCRA) — reflect Congress’s determination that consumers and businesses applying for credit should receive notice of the reasons a creditor took adverse action on the application or on an existing credit account.1 Notice is also required under the FCRA for adverse actions taken with respect to insurance transactions, employment decisions, and in certain other circumstances.
The two laws serve different purposes. Adverse action notices under the ECOA and Regulation B are designed to help consumers and businesses by providing transparency to the credit underwriting process and protecting against potential credit discrimination by requiring creditors to explain the reasons adverse action was taken. The FCRA’s requirements for adverse action notices apply only to consumer transactions and are designed to alert consumers that negative information was the basis for the adverse action. Under the FCRA, the consumer has 60 days from the date of the notice to obtain more details about the negative information so that if it is erroneous, the consumer can correct it. To reduce the compliance burden, a creditor can use a single, combined notice to comply with the adverse action requirements of both laws, and model forms have been published in connection with Regulation B.
To ensure compliance, it is important to understand how the requirements of Regulation B and the FCRA relate to and differ from one another. In this article, we review the adverse action requirements of both Regulation B and the FCRA, explain recent disclosure requirements under the FCRA mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and discuss common adverse action violations.
WHAT IS ADVERSE ACTION?
Regulation B defines adverse action as:
- A refusal to grant credit in substantially the amount or on substantially the terms requested in an application unless the creditor makes a counteroffer (to grant credit in a different amount or on other terms), and the applicant uses or expressly accepts the credit offered;
- A termination of an account or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts; or
- A refusal to increase the amount of credit available to an applicant who has made an application for an increase.2
To provide greater clarity about the definition, Regulation B also specifically delineates what is not adverse action:
- A change in the terms of an account expressly agreed to by an applicant;
- Any action or forbearance relating to an account taken in connection with inactivity, default, or delinquency as to that account;
- A refusal or failure to authorize an account transaction at point of sale or loan except when the refusal is a termination or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor’s accounts or when the refusal is a denial of an application for an increase in the amount of credit available under the account;
- A refusal to extend credit because applicable law prohibits the creditor from extending the credit requested; or
- A refusal to extend credit because the creditor does not offer the type of credit or credit plan requested.3
The FCRA, by contrast, defines adverse action more broadly to include:
- Adverse action as defined in section 701(d)(6) of ECOA ;
- A denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance;
- A denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee;
- A denial or cancellation of, an increase in any charge for, or any adverse or unfavorable change in the terms of a government license or benefit; or
- An action on an application or transaction initiated by a consumer, or in connection with account review that is adverse to the consumer’s interests.4
Thus, the FCRA definition not only specifically includes the ECOA definition but also covers certain noncredit, consumer-initiated transactions and applications, including consumer applications for insurance, employment, a rental, and a government license or benefit. Note, however, that the FCRA only applies to consumer transactions, so adverse action notices are not required under the FCRA for business transactions.
Table 1: When Adverse Action Notices Are Required
(Consumer and Business)
A creditor must provide notice if it has:a
- Taken adverse action on a completed credit application;
- Taken adverse action on an incomplete credit application;
- Taken adverse action on an existing credit account; or
- Made a counteroffer to an application for credit and the applicant does not accept the counteroffer:b
Notice is not required if:
- The transaction does not involve credit;
- A credit applicant accepts a counteroffer;
- A credit applicant expressly withdraws an application; or
- The creditor approves a credit application and both parties expect that the applicant will inquire about its status, but the applicant does not inquire within 30 days after applicationc (the approved application is treated as withdrawn)
For a covered transaction, a person must provide notice if:
- Adverse action was taken based in whole or in part on information in a consumer reportd;
- Consumer credit is denied or a charge for credit increased based on information obtained from third parties other than consumer reporting agencies bearing upon the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of livinge; or
- Adverse action was taken based on information furnished by a corporate affiliate of the person taking the actionf
When Is Notice Required?
Generally, Regulation B notice requirements are triggered when adverse action is taken on a credit application or an existing credit account, and FCRA notice requirements are triggered when adverse action is taken based on information provided in one of the three circumstances listed in Table 1 in the FCRA column.
Because of different coverage rules, an adverse action notice may be required under one law but not the other. For example, an employer must comply with the FCRA notice requirements when denying an employment application based on information in a consumer report5; however, the disclosures under Regulation B are not triggered because the application does not involve credit.
Who Must Receive Notice?
Regulation B and the FCRA differ on who must receive the adverse action notice. Regulation B defines an applicant more broadly than the FCRA, incorporating businesses as well as individuals. Table 2 shows the two requirements.
Table 2: Who Must Receive Adverse Action Notices
Regulation B (Consumer and Business)
|Any applicant, including individuals applying for credit, businesses of all sizes, and any person liable or who will become liable for the debt such as a coapplicant. Guarantors are not “applicants” under Regulation B’s definition of applicanta
||Any consumer defined as an individual, including coapplicantsb
The requirements are different for multiple applicants. According to Regulation B, if multiple applicants submit an application, notice need only be given to the primary applicant if the primary applicant is readily apparent.6 In the case of multiple applicants under the FCRA, the statute has been interpreted to require notice to all consumers against whom adverse action is taken if the action taken was based on information in a consumer report.7 If the applicants’ credit scores were used in taking adverse action, each individual should receive a separate adverse action notice with the credit score and related disclosures associated with his or her individual consumer report; however, an applicant should not receive credit score information about a coapplicant. Regulation B does not prohibit delivery of an adverse action notice to each applicant. If applicable, financial institutions can provide a combined notice of adverse action to all consumer applicants to comply with multiple-applicant requirements under the FCRA, provided a credit score is not required for the adverse action notice because a score was not relied upon in taking adverse action.
What Are the Notice Timing Requirements?
As shown in Table 3, Regulation B includes detailed timing requirements for adverse action notices, while the FCRA does not include such requirements. Typically, financial institutions include the disclosures required under both Regulation B and the FCRA in one adverse action notice when both notices are required. For these combined notices, Regulation B’s timing requirements apply.
For businesses with gross annual revenues of $1 million or less, Regulation B requires notice be provided according to the same timing requirements applicable to consumers as described in Table 3.8 For businesses with gross annual revenues greater than $1 million, Regulation B requires only that a creditor provide notice within a reasonable time.9
Table 3: Timing Requirements for Adverse Action Notices
Regulation B (Consumer and Business)
|A creditor must notify the applicant of adverse action within:*
- 30 days after receiving a complete credit application
- 30 days after receiving an incomplete credit application
- 30 days after taking action on an existing credit account
- 90 days after making a counteroffer to an application for credit if the applicant does not accept the counteroffer
|The FCRA does not have specific timing requirements for adverse action notices.
Common notice violations.10 Common Regulation B adverse action notification and timing errors relate to handling incomplete applications. Creditors may fail to identify an application as incomplete and, as such, fail to meet notice content and timing requirements. A creditor has two options after receiving an incomplete application: it can (1) take action on the application and notify the applicant according to Regulation B’s standard notice requirements or (2) refrain from taking action and notify the applicant that the application is incomplete.11 If the creditor provides a notice of incompleteness, the notice must (1) be in writing, (2) detail the information needed to complete the application, (3) provide a reasonable deadline, and (4) state that the application will not be reviewed if the information is not received.12 Regardless of which notice is provided, the notice must be provided within 30 days.13
What Disclosures Are Required?
Both Regulation B and the FCRA include particular content and format requirements for adverse action notices. Regulation B requires the notice be in writing except for business applicants, who may receive oral notice of adverse action.14 The FCRA, on the other hand, states that adverse action notices may be provided orally, in writing, or in electronic format.15 Although Regulation B does not specifically provide for electronic delivery, a combined adverse action notice that incorporates both Regulation B and the FCRA requirements may be provided electronically if the consent requirements of the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. §7001 et seq., are complied with.16
Appendix C of Regulation B contains model adverse action notices that include the disclosures required under both Regulation B and the FCRA. Although not mandatory, proper use of the model notice forms satisfies the adverse action disclosure requirements of the FCRA and the ECOA. Table 4 includes current adverse action disclosure requirements for Regulation B and the FCRA.
Similar to the timing requirements, the contents of the disclosures under Regulation B may vary based on the type of applicant or account holder. For businesses with gross annual revenues of $1 million or less, the notice must include the same information described in Table 4, except the disclosure of the applicant’s right to receive the statement of reasons can be given at application.17 For businesses with gross annual revenues greater than $1 million, a creditor is only required to provide a statement of reasons for adverse action and the ECOA antidiscrimination statement if the applicant makes a written request for the information within 60 days of notification.18
Table 4: Content Requirements for Adverse Action Notices
(Consumer and Business)
Notice provided shall include the following disclosures:a
- The creditor’s name and address
- An ECOA antidiscrimination notice substantially similar to the one in 12 C.F.R. §1002.9(b) (1)
- The name and address of the creditor’s primary regulator
- A statement of action taken by the creditor
- Either a statement of the specific reasons for the action taken or a disclosure of the applicant’s right to a statement of specific reasons and the name, address, and telephone number of the person or office from which this information can be obtained
Section 615(a) notice (adverse action based on information in a consumer report) must include the following disclosures:b
Section 615(b)(1) notice (consumer credit denied or a charge for credit increased based on information obtained from third parties other than consumer reporting agencies) must include the following disclosures:
- Notice that adverse action was taken based on information obtained from a consumer reporting agency
- The consumer’s right to:
- Obtain a free copy of his or her consumer report from the consumer reporting agency providing the information if requested within 60 days
- To dispute the accuracy or completeness of any information in a consumer report furnished by the consumer reporting agency
- The name, address, and telephone number of the consumer reporting agency that furnished the report to the person
- A statement that the consumer reporting agency did not make the credit decision and is unable to provide to the consumer the specific reasons why the adverse action was taken
- Credit score disclosures if the credit score was a factor in taking adverse action
Section 615(b)(2) notice (taking adverse action based on information obtained from an affiliate) must include the following disclosures:
- The consumer’s right to request the information that was relied on in taking adverse action within 60 days of receipt of the adverse action notice; the information must be provided to the consumer within a reasonable period of time
- Notice that adverse action was taken based on information from an affiliate and the consumer’s right to obtain the information by sending a written request within 60 days after receipt of the adverse action notice; the information must be provided within 30 days after receiving the request
Common content violations. Regulation B adverse action errors involving content typically relate to the statement of specific reasons for the action taken. The regulation requires the statement to be specific and indicate the principal reason(s) for taking adverse action.19 Creditors should disclose up to four principal reasons; disclosure of more than four reasons is unlikely to be helpful to the applicant.20 Violations often involve inaccurate, ambiguous, or confusing statements of the principal reasons.
When are additional FCRA credit score disclosures required?
Section 1100F of the Dodd-Frank Act amended the FCRA to include additional disclosure requirements when adverse action is taken because of the consumer’s credit score. Specifically, the FCRA requires a person to make the following disclosures in writing or electronically as part of the adverse action notice in addition to those identified in Table 4:
- The consumer’s numerical credit score used by the person in taking adverse action21
- The range of possible credit scores;
- All the key factors that adversely affected the credit score22;
- The date on which the credit score was created; and
- The name of the person or entity providing the credit score or the information upon which score was created.
But if the credit score did not play a role in the decision to take adverse action, these disclosures are not required.23 One question that frequently arises is whether credit score disclosures are required for adverse action on a credit application where the creditor already provided a credit score disclosure because the creditor uses the credit score exception method of complying with the FCRA risk-based pricing (RBP) rules. Under this compliance option, the creditor provides RBP notices with credit scores to all applicants. A creditor taking adverse action in this circumstance must still include the credit score disclosure in the adverse action notice because the credit score exception notice is provided at a different time in the application process and serves a different purpose than the adverse action notice.24
Credit score disclosures cannot be combined with any other disclosures required under the FCRA, although they can be combined with the adverse action notice disclosures required by Regulation B. Finally, the credit score disclosures cannot be provided on a separate form; they must be included on the adverse action form.25
Key factors. A person relying on a credit score in taking adverse action is required by section 615(a) of the FCRA to disclose the key factors adversely affecting the consumer’s credit score. Because credit scores are typically purchased from a consumer reporting agency, that agency is in the best position to identify the factors that adversely affected the score. The final rule therefore permits disclosure of the reasons identified by the agency to satisfy the key factors requirement.26
Providing applicants with a list of key factors affecting their credit score does not relieve the creditor of its duty to also disclose, under Regulation B, the reasons for taking adverse action. In some instances, the key factors affecting a credit score will be the same as the reasons for taking adverse action under Regulation B. But in other cases, they may be unrelated. For example, a creditor may deny a loan application because of factors unrelated to a credit score, such as an applicant’s income, employment, or residence.27 In addition, a person cannot provide an applicant with a general reference to the key factors that affected a credit score as a reason for taking adverse action under Regulation B.
Multiple credit scores.28 In certain cases, a person may receive multiple credit scores from consumer reporting agencies. If the person only uses one credit score in making the decision, that particular score and related information for that specific credit score must be disclosed. If the person uses multiple credit scores in making the credit decision, only one of the scores is required to be disclosed; however, the FCRA does not prohibit creditors from disclosing multiple credit scores to the consumer.
Common violations related to credit score disclosures. Violations involving the FCRA’s requirement to include credit score information in adverse action notices typically involve failing to recognize when the requirement applies. The disclosure requirements are triggered when a credit score is used by a person in taking adverse action.29 Some violations have occurred when persons interpreted the term “use” too narrowly to include only situations when adverse action is solely or primarily based on the credit score. Similarly, other violations have involved persons incorrectly providing additional credit score disclosures only in cases when a minimum credit score was established. To avoid these violations, a person must provide the additional credit score disclosures whenever a credit score is used in the decision to take adverse action.
Compliance with the requirements of both Regulation B and the FCRA involving adverse action decisions is important to provide applicants and account holders timely and relevant information. To ensure compliance with the rules, financial institutions should implement appropriate policies and procedures. In addition, financial institutions should ensure that updates for automated disclosure systems are received, tested, and correctly implemented. A strong training program, both for current regulations and any recent changes, will help ensure compliance. Controls that a financial institution may consider include a secondary review of all adverse action notices and a consistent process, even in excess of regulatory requirements, such as delivering a combined adverse action notice to all consumer applicants. Specific issues and questions should be raised with your primary regulator.