Last reviewed: 8 October 2026

Home › Credit help › Adverse action notices

What a lender has to tell you when it says no

A denial letter that only says “your application was not approved” is not, on its own, what federal law requires. Two statutes govern the notice: the Equal Credit Opportunity Act and Regulation B decide when you must be told and why, and the Fair Credit Reporting Act decides what you must be told when a credit report or score was part of the decision.^[1][3] This page explains both and is not legal advice.

Update and correction, 8 October 2026: an earlier version of this page described CFPB Consumer Financial Protection Circular 2022-03 (on lenders that use complex algorithms) as current guidance. The CFPB withdrew that circular, with dozens of other guidance documents, in a notice published in the Federal Register on 12 May 2025.^[11] The page now cites the regulation’s own text and official interpretation for the same point, and says what the withdrawal does and does not change. The page was also re-read against the current text of 12 C.F.R. § 1002.9 and 15 U.S.C. § 1681m; the 30-day and 60-day figures were right, and the sections below add the exceptions and details the earlier version left out.

The short version

• The deadline: a creditor must notify you of the action taken within 30 days after receiving a completed application, 30 days after taking adverse action on an incomplete application, or 30 days after taking adverse action on an existing account.^[1]
• The reasons: the notice must either state the specific reasons or tell you that you can ask for them within 60 days of the notice, after which the creditor has 30 days to give them.^[1]
• The credit report: if a consumer report was part of the decision, the notice must name the reporting agency, say the agency did not make the decision, and tell you about a free copy within 60 days and your right to dispute.^[3][5]
• The score: if a numerical credit score was used, the notice must disclose it with its range, the date, who provided it and up to four key factors that hurt it (more if the number of inquiries was a factor).^[3][4]
• A score’s key factors are not the same as the reasons. The official interpretation of Regulation B says disclosing the score’s key factors does not satisfy the requirement to give the specific reasons for the denial.^[7]

Two overlapping laws, doing different jobs

Regulation B, which implements the Equal Credit Opportunity Act, applies to a creditor’s action on a credit application or account whatever information the decision rested on.^[1] The Fair Credit Reporting Act’s adverse-action provision, 15 U.S.C. § 1681m(a), applies when the adverse action was “based in whole or in part on any information contained in a consumer report.”^[3] A credit card, auto loan or personal loan denial that used a credit report usually triggers both, which is why one notice is often written to satisfy both. Outside lending, a similar notice can follow a report-based decision about insurance, employment, or certain licenses and benefits.^[6]

What counts as “adverse action” under Regulation B

Regulation B defines it to include a refusal to grant credit in substantially the amount or on substantially the terms requested (unless the creditor makes a counteroffer you accept or use), a termination of an account or an unfavorable change in its terms that does not affect all or substantially all of a class of the creditor’s accounts, and a refusal to increase the credit available when you applied for an increase.^[2] It excludes, among other things, action taken in connection with inactivity, default or delinquency on that account, and a refusal to extend credit because the creditor does not offer the type of credit requested or because applicable law prohibits it.^[2] So a card closed because you stopped paying it is generally not the kind of adverse action that triggers the Regulation B notice, while a card closed or a limit cut for a reason that is not default or delinquency may be. For credit, the FCRA uses the ECOA definition and adds categories of its own (insurance underwriting, employment, certain licenses and benefits, and other actions adverse to a consumer on a consumer-initiated application), so check the notice against both laws.^[6]

The 30-day clock, with its details

Under Regulation B § 1002.9(a)(1), a creditor must notify an applicant of the action taken within 30 days after receiving a completed application, 30 days after taking adverse action on an incomplete application (unless it sends a notice of incompleteness), 30 days after taking adverse action on an existing account, or 90 days after a counteroffer that the applicant does not expressly accept or use.^[1] A “completed application” is one in which the creditor has received everything it regularly obtains and considers for that amount and type of credit, including credit reports.^[2] If an application is incomplete on matters you can complete, the creditor has 30 days either to act or to send a written notice specifying what is needed, giving a reasonable time to supply it, and stating that no further consideration will be given if you do not.^[1]

Exceptions to know: the rules differ for business credit (other than trade credit and similar business credit: for a business with gross revenues of $1 million or less in its preceding fiscal year the notice may be oral when action is taken, and the reasons disclosure may be given at the time of application; for a larger business or trade credit the creditor must notify within a reasonable time and give written reasons if asked within 60 days); a creditor that received no more than 150 applications in the preceding calendar year may satisfy the section with oral notifications; and where more than one person applied, notice need only go to one of them, the primary applicant where one is readily apparent.^[1] Section 1002.9 has further provisions this page does not summarize.

A worked example

The example uses invented dates only to show the counting. If a credit report was used, the 60-day period to request your free copy runs from when you receive the notice, so ask the named agency at the same time.^[5]

What the reasons have to look like

The statement of reasons “must be specific and indicate the principal reason(s) for the adverse action,” and statements that the action was based on the creditor’s internal standards or policies, or that the applicant failed to achieve a qualifying score on the creditor’s credit scoring system, are insufficient.^[1] The regulation’s official interpretation adds that there is no mandated number of reasons, though disclosing more than four is not likely to be helpful; that the reasons must relate to and accurately describe the factors actually considered or scored; and that disclosing that a credit report was used does not by itself satisfy the requirement.^[7] Where the decision came from a credit scoring system, the official interpretation says the reasons must relate only to factors actually scored in the system and that no factor that was a principal reason may be excluded.^[7]

The CFPB’s 2022 Circular 2022-03 applied the same rules to lenders that use complex or “black-box” algorithms, saying the requirements apply regardless of the technology used. The CFPB withdrew that circular on 12 May 2025.^[11][12] A withdrawal removes the circular as guidance; it does not change the text of § 1002.9 or its official interpretation, which still require specific, accurate principal reasons.^[1][7]

The credit score disclosure Dodd-Frank added

Section 1100F of the Dodd-Frank Act amended the FCRA so that a notice following an adverse action based on a consumer report must include a numerical credit score used in the decision, plus the information in 15 U.S.C. § 1681g(f)(1)(B) through (E): the range of possible scores under the model, all key factors that adversely affected the score (not more than four, except that a factor consisting of the number of inquiries is included without regard to that limit), the date the score was created, and the name of the person or entity that provided it.^[3][4] The statute’s definition of credit score excludes a mortgage score or automated-underwriting rating that considers factors beyond credit information, such as loan-to-value ratio or down payment.^[4] The statutory amendments took effect on 21 July 2011, and the Federal Reserve Board and FTC rules implementing them took effect on 15 August 2011.^[10]

If the information came from someone other than a credit bureau

The FCRA has a separate rule for credit for personal, family or household purposes that is denied or made more costly because of information from a person other than a consumer reporting agency. The user must tell you of your right to ask, and on your written request received within 60 days after you learn of the adverse action it must, within a reasonable time, disclose the nature of the information.^[3] A related affiliate-information rule applies when the information comes from a company related by common ownership or control, with a 60-day request window and a 30-day response.^[3]

The other side of the coin: risk-based pricing notices

Not every unfavorable outcome is a denial. Under Regulation V, a person must give a risk-based pricing notice when it uses a consumer report in connection with credit primarily for personal, family or household purposes and, based in whole or in part on that report, grants the credit on material terms materially less favorable than the most favorable terms available to a substantial proportion of its consumers.^[8] A lender may decide who gets a notice by comparing terms directly or by a proxy method; one example in the rule is a cutoff score at the point where roughly 40 percent of the lender’s consumers score higher and 60 percent lower.^[8]

The rule also lists exceptions. A person need not give a risk-based pricing notice if it gives an adverse action notice under FCRA § 615(a), or if it instead gives each consumer a credit score disclosure notice.^[9] For loans secured by one to four units of residential real property, that notice contains the statements and score information listed in § 1022.74(d); for other credit it contains the current score, the range of possible scores, the distribution of scores among consumers scored under the same model (a bar graph with at least six bars, or a clear statement of how the score compares), the date, the source, and the statements listed in § 1022.74(e).^[9] That is why two lenders can send differently worded notices after similar decisions.

What this page does not say

It does not say whether a particular denial was lawful, whether a score was computed correctly, or what any state law adds. Section 1002.9 and Regulation V contain further provisions and exceptions that are not summarized here; read the cited sections for a specific situation.

When we will update this page

We revisit it when 12 C.F.R. § 1002.9, 15 U.S.C. § 1681m or Regulation V changes. Sources last read 8 October 2026.