ECOA (15 U.S.C. 1691(d)) requires a creditor that takes adverse action on a credit application to give the applicant a statement of the specific reasons, and Regulation B section 1002.9 requires that notice within 30 days of receiving a completed application. The reasons must be specific and indicate the principal reasons; saying the applicant failed the creditor's internal standards or did not achieve a qualifying score is expressly insufficient. This is the legal foundation for every CFPB statement on AI in lending: the duty applies identically to a machine-learning model and to a human underwriter.
| Document | ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) — Equal Credit Opportunity Act section 701(d) and Regulation B section 1002.9 — notification of adverse action and statement of specific reasons |
| Issued by | Consumer Financial Protection Bureau |
| Type | Statute |
| Status | In force |
| Published | Oct 28, 1974 |
| Effective | Oct 28, 1974 |
| Applies to | Every creditor extending consumer or business credit in the United States, including banks, credit unions, mortgage lenders, card issuers and fintech lenders, regardless of whether decisions are made by humans, scorecards or machine-learning models |
| Official source | consumerfinance.gov ↗ |
| Use cases | Credit scoring & underwriting · Fair lending & discrimination · Model risk management |
What are the key points of ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9)?
- ECOA prohibits credit discrimination on the basis of race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or good-faith exercise of Consumer Credit Protection Act rights (15 U.S.C. 1691(a)).
- Section 701(d) entitles applicants to a statement of specific reasons for adverse action; Regulation B section 1002.9(a)(1) sets a 30-day deadline after receipt of a completed application.
- Section 1002.9(b)(2): reasons 'must be specific and indicate the principal reason(s)'; references to internal standards or failure to achieve a qualifying score are insufficient.
- Official Interpretation to 1002.9(b)(2): disclosed reasons 'must relate to and accurately describe the factors actually considered or scored'; a creditor may not simply check the closest reason on the Appendix C sample form (C-1) if it was not a factor actually used.
- Adverse action includes denials, account terminations, unfavorable changes in terms and refusals to increase a credit limit (12 CFR 1002.2(c)).
- Regulation B applies to business credit as well as consumer credit, with modified notice rules for larger businesses (1002.9(a)(3)).
- Regulation B was amended by a final rule published April 22, 2026 (effective July 21, 2026) removing disparate-impact liability; section 1002.9 was not changed.
What did ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) change for banks?
This is the baseline rather than a change: the adverse-action requirement predates AI by decades and is the single obligation the CFPB has consistently said no model architecture can escape. In practice it forces banks to build explainability tooling (reason-code extraction, factor attribution) around any ML underwriting model so that the principal reasons disclosed match the factors the model actually used. Because the duty is statutory, the May 2025 withdrawal of the CFPB's interpretive circulars did not lessen it.
How many reasons must an adverse-action notice give when a model is used?
Regulation B does not fix a number; the Official Interpretation says disclosing more than four reasons is generally not helpful, and the reasons given must be the principal factors actually scored by the model, accurately described.
Does Regulation B require lenders to explain the model itself?
No. It requires the specific principal reasons for the individual decision, not the model's design. But a creditor cannot satisfy the rule if its model is too opaque to identify those reasons accurately.
| Date | Document | Status |
|---|---|---|
| Apr 22, 2026 | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions | In force |
| May 12, 2025 | CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal | In force |
| Aug 12, 2024 | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector | Final |
| Sep 19, 2023 | CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B | Withdrawn |
| Jun 6, 2023 | CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance | Final |
| Apr 25, 2023 | Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →