Adverse action notices, a perennial compliance issue, should not be neglected and, indeed, warrant closer scrutiny. The CFPB has long been interested in adverse action issues. This began in 2015 when it reported citing one or more institutions for deficient FCRA adverse action notices in its Supervisory Highlights. Then again in 2016, in its Summer Supervisory issue, the CFPB reported that companies failed to provide FCRA adverse action notices when it obtained and relied on information in consumer reports. Adverse action reappeared in the Winter 2020 and Fall 2021 Supervisory Highlights. In the fall of 2021, the CFPB alleged that LendUp failed to timely issue required adverse action notices and failed to provide accurate denial reasons, violating ECOA and Reg. B. In May 2022, the CFPB issued a circular regarding ECOA adverse action notice requirements as relates to credit decisions using algorithms.

Most companies' adverse action notices were implemented years ago when their programs were first launched. And because it's not an issue that most think problematic, few companies revisit and review their programs. Typically, folks consider adverse action an issue for new entrants to the consumer credit marketplace. But a company may be surprised to find that their program is not quite "up to snuff." A reassessment may be in order.

Does the company have a formal adverse action program? Are there written policies and procedures? How often are these programs and written materials reviewed? Does the company periodically review or audit the output of these programs? How about recordkeeping? These are questions an organization should be asking and considering. And creditors are not the only ones who should be asking these questions; so should lead generators, others involved in the arrangement of credit, and those who obtain and use consumer reports.

I've also seen companies review their programs due to a new focus—for example, recalibrating what language they use in communicating why they took adverse action. These companies seek to be more transparent and helpful to the consumer, to empower the consumer to take action to improve their credit standing so they can obtain credit at a later point in time. Note that while this is a laudable aim, it's not risk-free. A company should consult with an attorney before embarking on this effort. Reg. B contains safe harbor language for adverse action reasons that should always be considered.

Two federal laws regulate adverse action notices, and they have different purposes. ECOA and Reg. B are intended to prohibit discrimination on a prohibited basis. Adverse action requirements provide transparency to the credit underwriting process and explain to applicants the reasons why adverse action was taken. The FCRA's requirements, on the other hand, enable consumers to learn about negative information in their consumer reports and inform them of their right to dispute inaccurate information.

While two federal laws impose separate requirements, a creditor may use a single, combined notice to comply with both laws. But a combined notice is not always appropriate. An ECOA-only notice may be required in certain circumstances. Also, certain less-frequently used FCRA disclosures may be required when a company obtains information from a third-party non-consumer reporting agency. This could occur when a company contacts an employer or other non-consumer reporting agency to confirm employment.

Because adverse action notices can create regulatory risk, it's important for a company to know what's required, and how and where issues can arise. For example, a company's notice template could omit or misstate required disclosures. The FCRA's credit score disclosures are also a source of confusion. I've seen creditors use the reasons provided for the credit scores (provided by the consumer reporting agency) as their own principal reasons for taking adverse action to comply with ECOA and Reg. B. Unless the credit score was the sole reason for the decline, this approach is not accurate or compliant.

I've also seen companies provide more than four reasons. The Commentary to Reg. B makes clear that providing more than four reasons is unhelpful to the consumer. Additionally, how those reasons are selected, and the specific language used is keenly important.

Then there are prequalification processes. Many companies believe that if they do a "soft pull" on a consumer report that an adverse action is not "triggered." That's not always true. Whether a consumer report is obtained pursuant to a "soft pull" or a "hard pull" is irrelevant for purposes of ECOA and FCRA. Neither law recognizes these distinctions; rather, they are operationally relevant for credit score development, consumer reporting agency recordkeeping purposes, and for determining what information to include in credit reports that are provided to users and consumers.

Whether a novice or veteran of adverse action notices, taking a second look at your notices and program is a good idea.