FCRA Fundamentals – Adverse Action Disclosures and the Intersection with ECOA

Jim Treacy
Director

As published in ABA Risk and Compliance, November/December 2024

Along with the equal credit opportunity act (ECOA), the Fair Credit Reporting Act (FCRA) is one of the two critical regulations that must be considered when adverse action is taken on an application for credit or on an existing account. This article will focus on the requirements of FCRA related to applications for credit as well as touch on ECOA adverse action requirements as they are closely intertwined.

Defining adverse action

It is important to first understand the definition of adverse action as there are some differences between the definitions in FCRA and ECOA. FCRA has adopted the same definition of adverse action as section 701(d)(6) of ECOA. Section 1002.2(c) of Regulation B, implementing ECOA, states adverse action means:

1. “A refusal to grant credit in substantially the amount or on substantially the terms requested in an application,” unless the creditor makes and the consumer accepts a counteroffer,
2. “The termination of an account or an unfavorable change in terms of an account that does not affect all or substantially all of a class of the creditor’s accounts,” or
3. “A refusal to increase the amount of credit available to an applicant who has made an application for an increase.”

FCRA expands this definition in section 603(k) to also include:

1. A denial, cancelation, or unfavorable change in terms of coverage of any insurance,
2. A denial of employment,
3. A denial of any increase or unfavorable change in terms of any license or benefit granted by a governmental instrumentality, and
4. An action adverse to the interests of the consumer that is taken in connection with an application by, or transaction initiated by, any consumer, or in connection with a review of an account (under the permissible purpose of “legitimate business need,” 604(a) (3)(F)(ii)) to determine whether the consumer continues to meet the terms of an account.

Due to the definition of adverse action in FCRA, it also covers some non-credit transactions that are initiated by the consumer, including insurance coverage, employment applications, rental agreements, or a government license. Adverse action requirements also apply to consumers who are denied the opening of a deposit account at a financial institution (FI) if information from a consumer reporting agency (CRA) was used in making the decision. However, these other areas are generally not related to lending operations and will not be a focus of this article. FIs must ensure that appropriate policies and procedures are established for addressing compliance with FCRA requirements for these areas.

Adverse action notice requirements

While FCRA and ECOA can both apply to credit transactions, these regulations have different requirements once an adverse action has been taken. Regulation B (implementing ECOA) requires:

1. A written notice be delivered to the consumer that provides the specific reasons for denial once a loan application is denied (section 1002.9(a)(2)),
2. Inclusion of a statement similar to the language in section 1002.9(b)(1) stating that FIs are prohibited from discriminating against consumers based on certain factors.

FCRA requires a notice if  adverse action was taken in whole or in part based on information obtained from a CRA (section 615(a)), based on certain information from a third party other than a CRA (section 615(b)(1)), or based on certain information obtained from a corporate affiliate (other than information solely about the transactions or experiences between the consumer and the corporate affiliate) (section 615(b)(2)). Further discussion on the specific FCRA notification requirements is presented below.

It is critical to integrate the requirements from both regulations into lending operations processes to avoid regulatory errors. When loan applications are denied, it should be determined whether information from an outside source was used in making the decision to ensure that the adverse action notice contains the FCRA disclosures when required.

Common examination/audit findings related to FCRA

Bank examiners and independent compliance audits of FIs recently have noted issues with the completeness and accuracy of adverse action notices required by FCRA. These issues include:

1. Omitting the required disclosure on the adverse action notice that information from a CRA was used in making the credit decision as required by Section 615(a) of FCRA. Examples of this would include failing to notify the consumer that information from a CRA was used when the adverse action was based in whole or in part on a negative credit history in the consumer report or information in the consumer report on the consumer’s debts that were determined to be an excessive amount of debt in relation to income. These errors can occur due to deficient procedures for preparing and delivering adverse action notices, inadequate training of employees, or using a static adverse action template form that defaults to either always including or always excluding the language that information from a CRA was used in making the credit decision. Including the language on an adverse action form that information from a CRA was used in making the credit decision when this was not the case also is not correct. For example, if the FI denies a consumer’s loan application because it is unable to verify the consumer’s employment, then the language should not be included because the consumer report obtained from the CRA did not have an impact on the final credit decision. Disclosing to the consumer that they can contact the CRA to dispute the FI’s inability to verify employment is not accurate and could lead to consumer confusion.
2. Failing to provide all required disclosures when the FI takes adverse action based on information obtained from a CRA. Pursuant to section 615(a)(3) & (4) of FCRA, FIs are required to provide additional information on the adverse action notice, including the name, address, and phone number of the CRA, a statement that the CRA did not make the credit decision, the consumer’s right to obtain a copy of the consumer report from the CRA within 60 days, and the consumer’s right to dispute the accuracy and completeness of the information.
3. Indicating certain information from a third party other than a CRA was used in making the credit decision on the adverse action notice when this was not the case. This requirement applies to information bearing on the consumer’s creditworthiness, credit standing, credit capacity, or character (Section 615(b)(1)), but not to other information that does not fall into these categories. For example, if the consumer is denied due to an appraisal coming in lower than expected, this disclosure is inapplicable and should not be on the notice. However, if an FI contacts the consumer’s landlord by phone and receives a negative rental payment history, then it would be appropriate to include this language because having delinquent or late rental payments does impact the consumer’s creditworthiness, and the information was obtained from a source other than the CRA. This type of error can also be caused by inadequate procedures or training, or using a static template for the adverse action notice that either always includes this language or always excludes this language regardless of whether information from a source other than a CRA was used in making the specific credit decision in question.
4. Taking adverse action based on the consumer’s credit score and not including all required information about the consumer’s credit score on the adverse action notice as required by section 615(a)(2) as well as section 609(f)(1) including paragraphs (B) through (E). If the consumer was denied due to a numerical score as defined in section 609(f)(2)(A), the notice is required to include the numerical score used in making the credit decision, the range of possible scores, all key factors that adversely affected the credit score (no more than four), the date on which the score was created, and the name of the entity that provided the score. In addition, the notice is required to include a fifth key factor that adversely affected the score if the number of inquiries was also one of the factors (609(f)(9)). Not including the fifth key factor as required is one of the more common FCRA-related exceptions that has been noted by examiners and compliance auditors.
5. Failing to disclose on the adverse action notice that information obtained from an affiliate was used in making the credit decision. An adverse action notice must indicate when an FI has used information from an affiliate bearing on the consumer’s creditworthiness, credit standing, credit capacity, or character to make the decision that results in the adverse action. In that case, it must also include a statement of the consumer’s right to obtain further information regarding the nature of the information upon which the adverse action was based by sending a written request within 60 days after receipt of the adverse action notice (section 615(b)(2)). Care should be taken to ensure that an FI is considering whether information from an affiliate was used in making the decision if information is being shared between affiliates and providing all required information on the notices when applicable.

CFPB guidance on credit denials by lenders who use complex algorithms

The CFPB issued Consumer Financial Protection Circulars 2022-03 and 2023-03 that included guidance to FIs who use artificial intelligence or complex algorithms to render credit decisions on loan applications. Although this guidance discusses ECOA requirements to provide the specific reasons for denial—and specifically notes the guidance focuses on ECOA and does not address FCRA requirements—the guidance recognizes that FCRA also includes adverse action notification requirements that may apply to these situations.

The guidance reminds FIs that when adverse action is taken based in whole or in part on any information contained in a consumer report or based on a credit score, the FI must disclose the credit score, and, as well as other items, the key factors that adversely affected the score of the consumer, the total of which shall generally-not exceed four factors, except if a key factor was the number of inquiries made with respect to a consumer report, as discussed above.

In this guidance, the CFPB reminds FIs that they are required to be compliant with ECOA requirements and that the use of AI does not relieve creditors from adhering to all aspects of the regulation. The same can be inferred for FCRA requirements. Therefore, FIs need to work with their AI vendors to confirm that they have the capability to provide fully compliant adverse action notices that include all required information when applicable. It is important for FIs to perform thorough due diligence on its AI vendors prior to implementing the functionality so the FI does not risk failing to comply with FCRA requirements, such as when a consumer is denied credit due to the credit score on the consumer report.

Considerations for examination management

Examiners assess FCRA compliance risk as part of the FI’s compliance examination. This includes reviewing policies and procedures related to complying with FCRA requirements when providing adverse action notices to consumers.

A strong FCRA compliance management system (CMS) is crucial to ensuring regulatory requirements are met and in avoiding potential examiner criticism. An FI should establish policies and procedures that include the following elements:

• Detailed procedures that instruct employees when to indicate on adverse action notices whether information from a CRA or a source other than a CRA was used in making the credit decision.
• Identification of FI personnel responsible for preparing and performing a secondary review of adverse action notices for completeness and accuracy.
• Periodic review of static and/or dynamic adverse action templates used to ensure the forms are complete and accurate.
• FCRA training within the FI’s framework to cover the requirements that apply when preparing and delivering adverse action notices to consumers.
• Board or management committee approval of the FCRA Policy.

Providing training is beneficial for employees who are responsible for completing and delivering adverse action notices to consumers. Be sure to retain documentation to evidence that these employees were assigned FCRA training, that they successfully completed the training, and that they understood the topics covered, such as by receiving a satisfactory score on the quiz that follows the training.

It is also beneficial to test adverse action notices as part of the compliance monitoring program to confirm adherence to established policies and procedures and FCRA requirements. This includes confirming that the FI provided complete and accurate adverse action notices to consumers that correctly disclosed whether information from a CRA or information from a source other than a CRA was used in making the credit decision and also included all required information if the consumer’s credit score was used in making the credit decision.

Any consumer complaints received regarding adverse action notices need to be tracked and monitored to ensure that the FI is complying with FCRA requirements and that all such complaints are properly investigated and resolved. Any negative trends noted in these types of complaints could indicate the adverse action notices delivered to consumers contained incomplete or inaccurate information.

Conclusion

FCRA continues to be an area of focus for bank regulators, including FIs’ practices when delivering adverse action notices to consumers. FIs need to ensure that all aspects of their CMS related to providing adverse action notices are functioning as intended to avoid potential FCRA pitfalls.