FCRA and Adverse Action Notices: Training the People Who Decline Credit

A decline letter can arrive on time, address the applicant by name, use the institution's approved template, and still violate Regulation B. Nothing on the page will look wrong to a reviewer. The defect is in one sentence, and it is the sentence the template wrote for you.

One such sentence usually reads very much like this one does. Read it as an applicant would. "We are unable to approve your application at this time because it did not meet our credit standards." The letter is courteous, it is prompt, and it is insufficient.

12 CFR 1002.9(b)(2) requires the statement of reasons to be specific and to indicate the principal reasons for the adverse action. It names statements resting on the creditor's internal standards or policies as not qualifying. The letter gives the applicant nothing to act on.

Letters of this kind survive because nothing about them looks wrong. They pass a proofread and a template review without anyone stopping on the sentence that matters. They fail only against the text of the regulation. The person who sent one is usually a loan officer or a branch employee working from a dropdown menu, while the compliance officer who would recognize the defect never sees it.

Defects like it reduce to 4 questions, and whoever sends the letter answers all 4 within a few minutes. The questions are which regime the file falls under and what the letter has to say. The others are when it has to go out, and whether the file is a credit file at all.

The Decline Letter That Breaks the Rule Without Looking Wrong

Take that sentence apart one clause at a time. "Did not meet our credit standards" describes the creditor's own threshold. It tells the applicant that a line existed and that they were on the wrong side of it, without saying what the line measured.

The Two Formulations the Rule Names

Measuring nothing is the problem, and 12 CFR 1002.9(b)(2) addresses it directly. The statement of reasons must be specific and indicate the principal reason or reasons for the adverse action, and the regulation names 2 formulations that do not qualify. Both of them appear on most dropdown menus today:

• A statement that the adverse action was based on the creditor's internal standards or policies.
• A statement that the applicant failed to achieve a qualifying score on the creditor's credit scoring system.

Both are sentences a busy decline desk will choose, because both are accurate and neither requires the writer to open the file. That is what makes the defect a systematic one. A careful writer working from the same dropdown produces the same letter, because the workflow never asks anyone to open the file.

Institutions across banking and finance issue these letters at volume through templates. A single insufficient option in a dropdown then produces thousands of insufficient letters before anyone compares one against the regulation. An annual training calendar for a banking compliance officer will list adverse action notices as a topic, and the letters still go out in whatever form the template offers.

What the template cannot decide is which regime the file belongs to, and that is the first of the 4 questions. That decision is made before the letter is written. It is made by whoever opened the consumer report.

Which Notice You Owe Depends on Why You Opened the File

Which regime the file belongs to is settled by the reason the consumer report was obtained. The reason is recorded at the moment of the pull. Reading it off the file takes a few seconds.

The reason matters, because 15 U.S.C. 1681a(k)(1) defines adverse action for FCRA purposes by adopting the ECOA definition at 15 U.S.C. 1691(d)(6) for credit. It then extends that definition to insurance, employment, licenses, and certain other transactions. So a credit decline can be adverse action under both statutes at once, and each statute asks the letter to contain something different.

Why the First 2 Rows Can Apply Together

A declined credit application where the decision used a credit report falls under both of the first 2 rows at once. The Regulation B duty is to say why you declined. The FCRA duty is to say where the information came from and that the agency is not the decision maker.

15 U.S.C. 1681m(a)(3) states that second requirement quite plainly. It calls for a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons. Both sentences have to appear in the same letter.

The division between the 2 is the part templates get wrong. A letter naming the credit bureau and stopping there has satisfied FCRA and left the Regulation B obligation open. Giving detailed reasons and never naming the bureau does the reverse. Of the 2 halves, the reasons are the harder one.

What Specific Means in a Statement of Reasons

The reasons are harder because the regulation sets a standard and leaves the wording to the creditor. Specific and principal are the 2 tests, and a reason satisfies them when it identifies the factor in the file that produced the decision. Your template can offer the wording, and only a person can pick the right one.

Common but wrong

A credit score below our cutoff is a specific reason.

12 CFR 1002.9(b)(2) names a failure to achieve a qualifying score on the creditor's credit scoring system as insufficient. Where a score was used, 15 U.S.C. 1681m(a)(2) separately requires the numerical score itself to be disclosed, which is a disclosure duty and not a statement of reasons.

Naming the Factor in the File

A workable reason names the underlying factor in the file. The length of credit history, the balance to limit ratio on revolving accounts, the number of recent credit inquiries, and income measured against the obligation applied for all qualify. Each of those is a fact recorded in the file, and each tells the applicant something about their own record that they could go and check.

The insufficient versions all report the decision back to the applicant in different words. "Credit standards" reports only that some threshold was applied. "Insufficient score" reports that a model returned a number. Neither identifies what in the applicant's record moved the outcome, which is what 12 CFR 1002.9(b)(2) asks for.

A decline desk that understands this distinction writes correct letters from the same template. The template was never the problem. The fix is entirely in which option gets chosen. The paragraph around that option never has to change.

2 Clocks of 30 Days, and a Notice with No Deadline

That statement of reasons has a deadline of its own. Missing it is a separate finding from missing the notice. It is a different deadline from the notice that contains it. Most lending operations know one of the 2 and assume it covers both.

15 U.S.C. 1691(d)(1) requires a creditor to notify the applicant of its action within 30 days after receipt of a completed application. 12 CFR 1002.9(a)(1)(i) states the same period as 30 days after receiving a completed application. That is the clock most people in a lending operation know.

The second clock covers a different piece of work. Under 12 CFR 1002.9(a)(2), a creditor can satisfy the reasons duty by disclosing the applicant's right to a statement of specific reasons within 30 days. Far fewer people in the same operation know that one.

The applicant has to request that statement within 60 days of the notification. The disclosure has to include the name, address, and telephone number of the person or office the statement can be obtained from. Leaving the office name out of it voids the disclosure.

The Deadline FCRA Does Not Set

15 U.S.C. 1681m(a) states what the adverse action notice must contain and says nothing about when it has to be sent. The phrase most often attached to it is as soon as reasonably practicable. That phrase belongs to a different notice altogether, the credit score disclosure under the risk-based pricing rules at 12 CFR 1022.74(e)(3).

The confusion is worth correcting inside your own institution. It points a procedure at a standard the statute does not contain, and leaves staff believing the FCRA notice has its own clock. Under Regulation B the 30 day period is the one that governs the letter, and every deadline above assumes the file is a credit file.

The Employment File Is a Different Regime

Why the Order Reverses

A file opened for employment purposes reverses the sequence entirely. The notice goes out before the decision is acted on. Everything above this section assumed the opposite order.

15 U.S.C. 1681b(b)(3)(A) governs any adverse action based in whole or in part on a consumer report obtained for employment purposes. Before taking that action, the person intending to take it must provide the individual with a copy of the report. A written description of the individual's rights goes with the copy.

Those rights arrive in a fixed order, and the order is what the statute controls. The order is the substance of the rule, and reversing it is the whole violation:

1. The consumer report is obtained for employment purposes.
2. The copy of the report and the description of rights go to the person, before the decision is acted on.
3. Only then can the adverse action be taken.

A credit decline runs the other way, with the decision made first and the notice following it. An institution that processes employment screening through the same workflow as credit declines will send the copy of the report after the candidate has already been rejected. That is the sequence the statute forbids.

Both sequences have to live in one head at the desk. Keeping both regimes inside one compliance training program without separating them produces this error steadily, because the staff involved are frequently the same people. In both regimes the words in the letter are chosen by whoever sends it.

The Letter Is Written by Whoever Sends It

Whoever sends the letter is rarely the person who read the regulation. The template offers options, the file holds facts, and a loan officer with a queue picks between them in a minute or two. Neither FCRA nor ECOA requires an institution to train that person, and both make the institution answerable for the sentence they select.

If I were setting this up, I would stop treating adverse action as a policy document and start treating it as a vocabulary problem. The people who decline credit need to identify which regime a file falls under, and to name the factor in the record that produced the decision.

FCRA compliance training is what puts both of them in front of the people who issue declines. A policy document filed on a server is read by nobody at a counter. Those are 2 specific skills, and neither is acquired by reading a procedure manual once a year.

Both skills are covered by KC Library, with FCRA, ECOA, and Regulation B in its finance and compliance catalog, aimed at the staff who issue declines. That is the difference between a program that records the rule somewhere and one that changes the sentence a branch employee types at 4 in the afternoon.

Frequently Asked Questions

1. What must an adverse action notice say?

It depends on which regime applies. Under 12 CFR 1002.9 a credit applicant must receive the specific principal reasons for the decision, or a disclosure of the right to request them. Under 15 U.S.C. 1681m(a), where the decision used a consumer report, the notice must also identify the consumer reporting agency, state that the agency did not make the decision and cannot give the reasons, disclose the credit score used, and describe the consumer's rights. A credit decline based on a report has to satisfy both.

2. Does "failed to meet our credit standards" violate Regulation B?

Yes, as a statement of reasons. 12 CFR 1002.9(b)(2) requires the statement to be specific and to indicate the principal reasons, and it names statements based on the creditor's internal standards or policies as insufficient. The same paragraph names a failure to achieve a qualifying score on the creditor's credit scoring system as insufficient. A compliant reason identifies the factor in the applicant's record, such as the length of credit history or the balance to limit ratio on revolving accounts.

3. How long do you have to send an adverse action notice?

For credit, 15 U.S.C. 1691(d)(1) and 12 CFR 1002.9(a)(1)(i) set 30 days from receipt of a completed application. A separate 30 day period in 12 CFR 1002.9(a)(2) applies to supplying the statement of reasons when an applicant requests it, and the applicant has 60 days from the notification to make that request. 15 U.S.C. 1681m(a) sets no deadline of its own for the FCRA adverse action notice.

4. What is the difference between FCRA and ECOA adverse action?

15 U.S.C. 1681a(k)(1)(A) adopts the ECOA definition at 15 U.S.C. 1691(d)(6) for credit, so the FCRA definition is the broader of the 2 rather than a competing one. FCRA then extends the term to insurance, employment, licenses, and certain other transactions. The practical difference is in the notice contents: Regulation B asks why the decision was made, and FCRA asks where the information came from.

5. Do background check declines follow the same process?

No, and the order is reversed. Under 15 U.S.C. 1681b(b)(3)(A), where a consumer report is obtained for employment purposes, the person intending to take adverse action must give the individual a copy of the report and a written description of their rights before taking that action. A credit decline sends its notice after the decision. Running employment screening through a credit decline workflow produces the notice too late.

References

1. United States Code. "15 U.S.C. 1681m(a)(1), duties of users taking adverse actions on the basis of information in consumer reports."
2. United States Code. "15 U.S.C. 1681m(a)(2), disclosure of the numerical credit score used."
3. United States Code. "15 U.S.C. 1681m(a)(3), identification of the consumer reporting agency."
4. United States Code. "15 U.S.C. 1681a(k)(1), definition of adverse action."
5. United States Code. "15 U.S.C. 1681b(b)(3)(A), conditions on use of a consumer report for adverse actions taken for employment purposes."
6. United States Code. "15 U.S.C. 1691(d)(1), notification of action on a completed application."
7. Code of Federal Regulations. "12 CFR 1002.9(a)(1)(i), notification within 30 days of a completed application."
8. Code of Federal Regulations. "12 CFR 1002.9(a)(2), disclosure of the right to a statement of specific reasons."
9. Code of Federal Regulations. "12 CFR 1002.9(b)(2), the statement of specific reasons must be specific and principal."
10. Code of Federal Regulations. "12 CFR 1022.74(e)(3), timing of the credit score disclosure under the risk-based pricing rules."