An AI credit denial still needs an adverse action notice, and the notice still has to name the real reasons. The Equal Credit Opportunity Act says a statement of reasons meets the law “only if it contains the specific reasons for the adverse action taken,” and nothing in the statute or in Regulation B makes an exception for a machine learning model.

What has changed since 2022 is the guidance around that rule. The Consumer Financial Protection Bureau withdrew its two circulars on adverse action notices in May 2025, and in April 2026 it finalized a separate overhaul of Regulation B that left the notice section alone. This explainer covers what the notice must contain, how the reason rules apply to a scoring model, what the withdrawn guidance said, and what that leaves for teams that build credit models.

What counts as adverse action

The statute defines adverse action as a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested. It excludes a refusal to extend more credit under an existing arrangement when the applicant is delinquent or in default, or when the extra credit would exceed a previously set limit.

The technology behind the decision is not part of the definition. A denial produced by a logistic regression, a gradient-boosted model or an underwriter reading a file triggers the same duty.

What the notice must contain

Section 1002.9 of Regulation B sets the clock and the contents. A creditor has 30 days after receiving a completed application to notify the applicant of approval, a counteroffer or adverse action. A written adverse action notice must include:

  • a statement of the action taken;
  • the creditor’s name and address;
  • the ECOA anti-discrimination notice and the name and address of the federal agency that oversees the creditor;
  • either the specific reasons, or a disclosure that the applicant may ask for them within 60 days and will get them within 30 days of asking, with a contact for that request.

A creditor that received no more than 150 applications in the preceding calendar year may give these notifications orally. Business credit follows a modified set of rules that depends on whether the business had gross revenues above $1 million.

The reason rules, applied to a model

Section 1002.9(b)(2) says the reasons “must be specific and indicate the principal reason(s) for the adverse action.” It also names two statements that are not enough: that the decision rested on the creditor’s internal standards or policies, or that the applicant failed to achieve a qualifying score on the creditor’s scoring system.

The official interpretations to the same section add the detail that matters most to a model team:

  • Reasons must be real. They “must relate to and accurately describe the factors actually considered or scored by a creditor.”
  • Scored factors only. For a credit scoring system, the reasons must relate only to factors actually scored, and no factor that was a principal reason may be left out, even if its link to creditworthiness “may not be clear to the applicant.” The example given is “age of automobile.”
  • No set number. The rule does not fix a count, but says more than four reasons is not likely to help the applicant.
  • No required method. The commentary describes two acceptable ways to pick reasons from a scoring system: compare the applicant’s score on each factor with the average for applicants at or slightly above the passing score, or with the average for all applicants. Any method producing substantially similar results is also acceptable.
  • The why can stay out. A notice need not explain how a factor hurt the applicant; “length of residence” is enough.

The sample forms in Appendix C carry a checklist of common reasons, but the appendix warns that a creditor “will not satisfy the notice requirement by simply checking the closest identifiable factor listed” when the listed reasons are not the factors it actually used. A model built on cash-flow data or other inputs the checklist never anticipated needs its own reason language.

A credit score disclosure is a separate duty. The commentary says the Fair Credit Reporting Act requires creditors to disclose a credit score used in adverse action along with up to four key factors (five when the number of inquiries is one of them), and that disclosing those key factors does not satisfy the ECOA requirement to give specific reasons.

What the withdrawn CFPB circulars said

In Circular 2022-03, published May 26, 2022, the CFPB said creditors using complex algorithms, “including artificial intelligence or machine learning,” must still give the specific principal reasons, and that ECOA and Regulation B do not permit a model when using it means the creditor cannot provide them. A footnote said post-hoc explanation methods approximate a model and that creditors must still be able to validate those approximations. Circular 2023-03 addressed adverse action notices and the proper use of the sample forms in Regulation B.

The CFPB withdrew both circulars, along with other policy statements, advisory opinions, circulars and bulletins, in a notice published May 12, 2025. The notice says the withdrawal “is not necessarily final,” that guidance is generally non-binding, and that the Bureau does not intend to prioritize enforcement of withdrawn guidance while its review continues.

The withdrawal removed the CFPB’s commentary, not the rule it described. The statutory requirement for specific reasons and the regulation and official interpretations quoted above remain in force.

What the 2026 Regulation B rule changed

On April 22, 2026, the CFPB issued a final rule amending Regulation B on disparate impact, discouragement of applicants and special purpose credit programs, effective July 21, 2026. The Federal Register text amends Sections 1002.4, 1002.6, 1002.8 and 1002.15 and parts of the official interpretations. It does not amend Section 1002.9, so the notice timing, contents and reason rules are unchanged.

Supervision of the models themselves is a separate track. For larger banks, the interagency model guidance covered in our explainer on SR 26-2 model risk management treats machine learning credit scores as models subject to validation and monitoring.

What this means for teams building credit models

The rules point to a few design consequences:

  • Each declined application needs its principal reasons recorded at decision time, tied to the inputs the model actually used.
  • The reason-selection method has to produce reasons from scored factors, not from a generic list.
  • Plain-language reason text has to match each model feature or feature group, including inputs the sample forms never listed.
  • Notices that combine an ECOA statement and an FCRA score disclosure need both, since one does not satisfy the other.

Applicants can enforce the requirements themselves. The statute’s civil liability section makes a non-compliant creditor liable for actual damages and, except for government creditors, punitive damages of up to $10,000 in an individual case. Consumers who think a notice was wrong can also use the CFPB complaint process.

This article explains federal law and regulation. It is not legal or compliance advice for any particular creditor.

Sources