The Fair Credit Reporting Act governs the data feeding many AI credit, fraud and account-opening models. Section 615 (15 U.S.C. 1681m) requires anyone taking adverse action based in whole or part on a consumer report to notify the consumer, name the reporting agency, and disclose any credit score used with up to four 'key factors' that adversely affected it (15 U.S.C. 1681g(f)). The CFPB's position, stated in its 2024 comment to Treasury, is that algorithmic scores and 'alternative data' used for eligibility decisions can fall within FCRA's accuracy, dispute and permissible-purpose rules.
| Document | FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) — Fair Credit Reporting Act — adverse-action notices based on consumer reports and disclosure of key factors affecting credit scores |
| Issued by | Consumer Financial Protection Bureau |
| Type | Statute |
| Status | In force |
| Published | Oct 26, 1970 |
| Effective | Apr 25, 1971 |
| Applies to | Users of consumer reports (banks, lenders, insurers, employers, landlords) and consumer reporting agencies, including fintech and data-analytics firms whose algorithmic scores meet the definition of a consumer report |
| Official source | consumerfinance.gov ↗ |
| Use cases | Credit scoring & underwriting · Fraud detection · Data & privacy · Third-party & vendor AI |
What are the key points of FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f))?
- Section 615(a) adverse-action notice: identify the consumer reporting agency, state that the agency did not make the decision, and inform the consumer of the right to a free report and to dispute accuracy.
- Section 615(a)(2) and 609(f): when a credit score is used, disclose the score, its range, the date, and the key factors (up to four, five if inquiries are a factor) that adversely affected it.
- Section 615(h) risk-based pricing notices apply when a consumer report leads to materially less favorable terms.
- Consumer reporting agencies must follow reasonable procedures to assure maximum possible accuracy (section 607(b)); furnishers must correct inaccurate data (section 623).
- Permissible-purpose limits (section 604) restrict use of report data for model training or targeting outside credit, insurance, employment and similar purposes.
- The CFPB withdrew several FCRA advisory opinions and Circular 2024-06 (algorithmic scores in employment) on May 12, 2025, but the statute and Regulation V (12 CFR 1022) are unchanged.
What did FCRA adverse action and credit-score disclosures (15 U.S.C. 1681m, 1681g(f)) change for banks?
FCRA is the second statutory pillar behind CFPB AI enforcement: where ECOA governs the decision, FCRA governs the data and the score. Banks using third-party AI scores, fraud screens or identity models need to determine whether the vendor is a consumer reporting agency, whether the bank must send FCRA adverse-action notices, and whether 'key factor' disclosures can be produced from the model.
Does FCRA apply to an AI fraud score used to decline account opening?
If the score is supplied by a third party that assembles consumer information for eligibility decisions, it is likely a consumer report and declining based on it triggers a section 615 adverse-action notice. The CFPB has said fraud screening tools must meet consumer-protection standards regardless of the technology.
What is the difference between an FCRA and an ECOA adverse-action notice?
ECOA requires the specific principal reasons for the credit decision; FCRA requires disclosure that a consumer report was used, the agency's name, and any score with its key factors. Lenders normally combine both in one notice.
| Date | Document | Status |
|---|---|---|
| Apr 22, 2026 | Regulation B final rule on disparate impact (April 2026) — Equal Credit Opportunity Act (Regulation B) — final rule amending disparate impact, discouragement and special purpose credit program provisions | In force |
| May 12, 2025 | CFPB withdrawal of 67 guidance documents (May 2025) — Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal | In force |
| Aug 12, 2024 | CFPB comment to Treasury on AI in financial services (2024) — CFPB Comment on Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector | Final |
| Sep 19, 2023 | CFPB Circular 2023-03 — Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B | Withdrawn |
| Jun 6, 2023 | CFPB Chatbots in Consumer Finance (issue spotlight, 2023) — Chatbots in consumer finance | Final |
| Apr 25, 2023 | Joint Statement on Automated Systems (CFPB, DOJ, EEOC, FTC) — Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →