ECOA adverse action notices: how many days a lender has, and what the notice must say

Our TRID explainer covers when cost disclosures have to arrive while an application is moving forward. This page covers a separate federal question: when, and how specifically, an applicant has to be told the outcome of that application, including a denial.

The federal law requiring notice of action taken

The requirement comes from the Equal Credit Opportunity Act (ECOA), 15 U.S.C. § 1691(d). It says that within thirty days "after receipt of a completed application for credit, a creditor shall notify the applicant of its action on the application," and that "each applicant against whom adverse action is taken shall be entitled to a statement of reasons for such action from the creditor."¹ The Consumer Financial Protection Bureau implements the Act through Regulation B. The notice rules are in 12 CFR 1002.9.²

How many days does a lender have to notify an applicant?

For consumer credit, Regulation B sets four clocks. A creditor must notify an applicant of action taken within:²

Situation	Deadline
Completed application: approval, counteroffer or adverse action	30 days after receiving the completed application²
Adverse action on an incomplete application (unless a notice of incompleteness is sent instead)	30 days after taking the adverse action²
Adverse action on an existing account	30 days after taking the adverse action²
Counteroffer the applicant does not expressly accept or use	90 days after notifying the applicant of the counteroffer²

There is one exception for small lenders. A creditor that "did not receive more than 150 applications during the preceding calendar year" can satisfy these requirements, including the statement of specific reasons, "by oral notifications."² And if a creditor approves an application, the parties expected the applicant to check on its status, and the applicant has not done so within 30 days of applying, the creditor "may treat the application as withdrawn."²

An incomplete application gets its own 30-day notice

Section 1002.9(c) covers an application missing information that the applicant can supply. Within 30 days of receiving it, the creditor must notify the applicant either of action taken or "of the incompleteness."² A notice of incompleteness must be written. It must specify the information needed, designate "a reasonable period of time" to provide it, and tell the applicant that failing to provide it "will result in no further consideration being given to the application."² If the applicant does not respond in time, the creditor "shall have no further obligation under this section." If the applicant does respond, the creditor must act on the application and send a notice of action taken.²

Can the notice of incompleteness be oral? Partly. Regulation B says that "at its option, a creditor may inform the applicant orally of the need for additional information," but "if the application remains incomplete the creditor shall send a notice in accordance with paragraph (c)(1)."²

What the notice has to say

An adverse action notice "shall be in writing" and must contain:²

a statement of the action taken;
the creditor's name and address;
the ECOA anti-discrimination notice (Regulation B gives model wording);²
the name and address of the federal agency that administers compliance for that creditor; and
either a statement of specific reasons, or a disclosure of the applicant's right to a statement of specific reasons within 30 days, if requested within 60 days of the notice. That disclosure must include the name, address and telephone number of the person or office to contact.²

The reasons must be specific. Regulation B says the statement "must be specific and indicate the principal reason(s) for the adverse action," and that statements that the action "was based on the creditor's internal standards or policies" or that the applicant "failed to achieve a qualifying score on the creditor's credit scoring system are insufficient."² The CFPB also published Circular 2023-03 on adverse action reasons; its website now marks that page as archived content.³

When more than one lender is involved: Regulation B covers applications "made on behalf of an applicant to more than one creditor." If the applicant accepts or uses credit from one of them, the others do not have to send notice. If no credit is offered, or the applicant does not accept it, "each creditor taking adverse action must comply with this section, directly or through a third party," and a third-party notice "shall disclose the identity of each creditor on whose behalf the notice is given."² When there are joint applicants, notice "need only be given to one of them but must be given to the primary applicant where one is readily apparent."²

Why specificity matters

A vague "internal standards" notice leaves a denied applicant unable to tell what to fix. It also removes the detail that makes lending patterns checkable. Our HMDA data explainer covers how fair-lending patterns are analyzed across many applications, and the CFPB's UDAAP authority covers another checkable compliance point about a lender's practices.

Questions people ask

Is 30 days counted from when I applied?

From when the creditor receives a completed application. For an incomplete application, the 30 days run from receipt of the incomplete application (for a notice of incompleteness) or from the adverse action.²

Can a lender tell me the reasons over the phone?

For consumer credit, only a creditor that received 150 or fewer applications in the preceding calendar year can satisfy the requirements orally. Otherwise the adverse action notice must be in writing.²

What if the notice only says I did not meet the lender's standards?

Regulation B says that statement is "insufficient" as a reason.² If you think a lender has not met these rules, see how to file a complaint.