[.green-span]What is an adverse action notice? A guide for lenders[.green-span]
An adverse action notice is a written disclosure a lender must send when it denies credit, offers materially worse terms, or revokes an existing account. Two federal laws govern it: the Equal Credit Opportunity Act (ECOA), implemented by Regulation B, and the Fair Credit Reporting Act (FCRA). Together they tell an applicant what happened and why.
This guide explains what an adverse action notice is, when it is required, and what it must contain. It also covers how the rules differ for consumer and business credit. Finally, it shows the common mistakes and the steps that keep a growing lending program compliant.
What an adverse action notice is
An adverse action notice is one of the most fundamental borrower protections in consumer credit law. It exists so applicants can understand a decision, correct errors in their files, and detect unfair treatment. Note: this guide is general information, not legal advice.
What counts as adverse action
Regulation B requires written notice when a creditor takes adverse action against an applicant. The CFPB says this includes declining an application, worsening account terms, or denying a credit-limit increase. A counteroffer the applicant does not accept can also trigger the requirement.
The two laws behind the notice
ECOA and FCRA work in tandem, and one action can trigger both. ECOA and Regulation B require disclosure of the reasons for adverse action on a credit application.
FCRA Section 615 adds requirements when the decision relied on a consumer report. The Federal Trade Commission confirms that a report-based decline triggers the FCRA notice.
What the notice must include
Under 12 CFR 1002.9, an ECOA notice must be in writing and state five things:
- The action the creditor took.
- The name and address of the creditor.
- The ECOA anti-discrimination notice from Section 701(a).
- The name and address of the creditor's federal regulator.
- The specific reasons for the action, or how to request them.
The reasons must be specific and name the principal factors behind the decision. The CFPB staff commentary notes that listing more than four reasons is usually not helpful to applicants.
When the decision used a consumer report, the FCRA piece adds more. Include the reporting agency's name, address, and phone number, plus a statement that the agency did not make the decision. Also disclose the applicant's right to a free report within 60 days.
If a credit score drove the decision, the notice must disclose the score and the key factors that affected it, per the FTC.
How Lendflow supports compliant decisions
Lendflow processes real volume, with $1.5B+ in offers made on the platform in the trailing 12 months as of March 2025. That scale depends on decisions a lender can explain and deliver on time.
Lendflow Automate uses a Trust Score agent that produces an explainable, composite risk score. Teams can surface the principal reasons behind a decline even when AI models drive it. The CFPB has said creditors must give specific, accurate reasons even when complex algorithms make that hard, as the law firm Skadden has detailed.
Automate also delivers 80% faster document review and 65% faster time-to-decision, which keeps notices inside the required window. Its Comms Platform and Voice AI agent automate the borrower outreach that carries the notice. The Data Graph unifies the data behind each decision.
How to send a compliant adverse action notice
Use a repeatable process so no step depends on memory. The framework below follows the ECOA timing rules in 12 CFR 1002.9.
- Confirm the trigger. Decide whether the action is a denial, a worse-terms offer, an account change, or an unaccepted counteroffer.
- Start the clock. For consumer credit, the creditor generally has 30 days after a completed application to notify the applicant of the action taken.
- Handle incomplete applications. Send a notice of incompleteness or an adverse action notice within 30 days when information is missing.
- Track counteroffers. If the applicant does not accept a counteroffer, send notice within 90 days.
- State the specific reasons. Name the principal factors, or disclose the applicant's right to request them within 60 days.
- Add the FCRA content. Include the reporting agency details, free-report rights, and the credit score disclosure when a report or score was used.
- Deliver and document. Send the notice, then retain the application record and proof of delivery.
Match the rules to consumer versus business credit
ECOA and Regulation B apply to both consumer and business credit, but the notice rules differ by borrower type. Regulation B section 1002.9 sets the split for business applicants:
- Businesses with $1M or less in prior-year revenue: timing and content match consumer rules, but notice may be oral or written.
- Businesses with more than $1M in revenue: notify the applicant of the action within a reasonable time, orally or in writing.
- Written reasons on request: larger businesses can request a written statement of reasons within 60 days of the notice.
Record retention also differs. Regulation B section 1002.12 requires creditors to keep records for 12 months for business credit, versus 25 months for consumer applications. Lendflow serves SMB lending across term loans, MCAs, invoice factoring, and equipment financing, so these business-credit rules apply to most of its use cases.
Best practices and common pitfalls
Small errors in adverse action notices create outsized compliance risk. The most-cited problems are avoidable with clear controls.
- Vague reasons. Replace generic language with the specific factors that most affected the decision.
- Late or batched notices. Send each notice inside the required window rather than in periodic batches.
- Missing score disclosures. Include the credit score and key factors whenever a score drove the decision.
- Silence on existing accounts. Send a notice when you cut a limit or close an account for cause.
- Skipped co-applicants. Provide notice to each applicant the FCRA requires, using separate notices when scores differ.
Guarantors are a common point of confusion. Under Regulation B, guarantors are not applicants, so the notice duty runs to the applicant. The stakes are real: under Regulation B section 1002.16, ECOA violations carry civil liability for actual and punitive damages.
A strong control set pays off here. Lendflow Intelligence keeps decision data and reason codes consistent. Lendflow Connect can route a declined deal to a second-look marketplace before a final decline is issued.
Conclusion
An adverse action notice tells an applicant what a lender decided and why, under ECOA and FCRA. It is required when you deny credit, worsen terms, or act against an existing account. Compliance comes down to three habits: send it on time, state specific reasons, and add FCRA content when needed.
Business credit follows the same laws with different timing and delivery options. Explainable decisioning and automated communications make these habits repeatable as volume grows. A lean team can then scale without adding compliance risk.
FAQs
Is an adverse action notice required when a business is denied a loan? Yes. ECOA and Regulation B cover business credit, though timing and delivery differ by the applicant's prior-year gross revenue.
How long does a lender have to send the notice? For consumer credit, generally 30 days after a completed application. Unaccepted counteroffers allow up to 90 days.
What must an adverse action notice include? The action taken, the creditor's name and address, the ECOA notice, the regulator's contact, and specific reasons or how to request them.
Do I still need specific reasons if an AI model made the decision? Yes. The CFPB has said creditors must provide specific, accurate reasons even when complex algorithms make the decision hard to explain.
What happens if a lender fails to send a notice? Missing or defective notices are among the most-cited exam findings and can expose a lender to civil liability and regulatory penalties.
