US mortgage AI denials: what the adverse action notice must say

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

A home loan in the United States can now be scored, priced and declined by software that no single person at the lender fully reads. The federal rule on what the applicant is told afterwards is much older than that software. The Equal Credit Opportunity Act, at 15 USC 1691(d), gives every applicant who is turned down a right to a statement of reasons, and says that such a statement is sufficient only if it contains the specific reasons for the action taken. The Consumer Financial Protection Bureau's Regulation B, at 12 CFR 1002.9, turns that right into deadlines and a list of contents.

Between 2022 and 2023 the Bureau issued two circulars saying how those words apply when the decision comes from a complex algorithm. In May 2025 it withdrew both, along with dozens of other guidance documents. This guide sets out what the statute and the regulation require, what the two circulars said, what the withdrawal notice says about them, and which questions the pages read for this article leave open. It describes the federal rule only; state law is outside its scope.

Regulation B, section 1002.9 and its official interpretation; CFPB withdrawal notice in the Federal Register, 90 FR 20084.

The rule comes from the statute, not from the circulars

The order of the sources matters for everything that follows. The Equal Credit Opportunity Act is a federal statute. Section 1691(a) makes it unlawful for a creditor to discriminate against an applicant, in any aspect of a credit transaction, on the basis of race, colour, religion, national origin, sex or marital status, or age where the applicant has the capacity to contract; because all or part of the applicant's income comes from a public assistance programme; or because the applicant has in good faith exercised a right under the Act.

Section 1691(d) is the notification part. It says a creditor must tell the applicant what it has done within thirty days of receiving a completed application. It says each applicant against whom adverse action is taken is entitled to a statement of reasons. And at paragraph (d)(3) it sets the test: the statement is sufficient only if it contains the specific reasons for the adverse action taken.

Regulation B is the Bureau's rule under that statute, and section 1002.9 is where the notification duties sit. Its official interpretation, published with the regulation, adds numbered comments. The two circulars came later and, as the 2023 one says of itself, a circular is a general statement of policy that does not impose legal requirements on outside parties. The withdrawal of the circulars therefore removed a reading of the rule, not the rule.

What counts as adverse action on a home loan

The notice duty is triggered by adverse action, and Regulation B defines the term at section 1002.2(c). It covers three situations: a refusal to grant credit in substantially the amount or on substantially the terms requested, unless the creditor makes a counteroffer and the applicant uses or expressly accepts the credit offered; a termination of an account or an unfavourable change in its terms that does not affect all or substantially all of a class of the creditor's accounts; and a refusal to increase the amount of credit available to an applicant who asked for an increase under the creditor's procedures.

For a purchase mortgage, the first situation is the one that matters. A flat denial is adverse action. So is an offer of a smaller loan or of different terms that the applicant does not take up: the counteroffer only removes the label of adverse action when it is used or expressly accepted.

The same section lists what is not adverse action. A refusal to extend credit because applicable law prohibits the creditor from extending it is excluded. So is a refusal because the creditor does not offer the type of credit or credit plan requested, although the official comment to that exclusion adds that when an applicant asks for terms the creditor does not offer, a denial is adverse action unless the creditor makes a counteroffer that the applicant accepts. Where an act could fall under both lists, section 1002.2(c)(3) says the exclusion governs.

Two more definitions set the starting point of the clock. An application, under section 1002.2(f), is an oral or written request for an extension of credit made in accordance with the procedures the creditor uses for that type of credit. A completed application is one for which the creditor has received all the information that it regularly obtains and considers in evaluating applications for the amount and type of credit requested, and the creditor must exercise reasonable diligence in obtaining it.

The clock: 30 days in most cases, 90 after a counteroffer

Section 1002.9(a)(1) of Regulation B sets four time limits. The table gives each one as the regulation states it.

A worked example shows how the first and last rows behave. The dates are illustrative, and the example assumes that every day of the calendar is counted, which the pages read for this guide do not spell out. A lender receives the last document it regularly asks for on 2 March 2026, so the application is complete that day. Thirty days later is 1 April 2026: by then the applicant is owed a notice of what the lender has done. Suppose instead that on 10 March 2026 the lender tells the applicant it will not lend the amount requested but will lend a smaller one. If the applicant neither accepts nor uses that offer, the 90 days in the fourth row end on 8 June 2026.

An incomplete file has its own path under section 1002.9(c). Within 30 days of receiving an application that is incomplete regarding matters the applicant can complete, the creditor either notifies the applicant of the action taken or sends a notice of incompleteness. That written notice must name the information needed, give a reasonable period for supplying it, and say that the application will not be considered further if the information does not arrive. If the applicant answers in time, the creditor acts on the application and the ordinary deadline applies. Appendix C to the regulation carries a sample for this purpose, Form C-6.

What the notice must contain

Section 1002.9(a)(2) requires the adverse action notice to be in writing and lists what goes in it:

• a statement of the action taken;
• the name and address of the creditor;
• a statement of the provisions of section 701(a) of the Act, the anti-discrimination clause;
• the name and address of the federal agency that administers compliance for that creditor;
• and either a statement of the specific reasons for the action, or a disclosure of the applicant's right to obtain them.

The third and fourth items are usually delivered together in what section 1002.9(b)(1) calls the ECOA notice. The regulation gives a model text and asks for a notice substantially similar to it, with the agency taken from the list in Appendix A to the regulation. Which agency appears depends on the type of lender; the pages read for this guide do not give that list, so it is not reproduced here.

On the fifth item the creditor has a choice, and the choice comes straight from section 1691(d)(2) of the statute. It can give the reasons with the notice as a matter of course. Or it can tell the applicant that the reasons are available on request, in which case three more deadlines apply.

A second worked example, again with illustrative dates and calendar-day counting assumed: a notice dated 1 April 2026 discloses the right to reasons. The 60 days for asking end on 31 May 2026. If the lender receives the request on 20 May 2026, the 30 days for answering end on 19 June 2026.

A home purchase often involves two borrowers. When an application has more than one applicant, section 1002.9(f) says the notice need only be given to one of them, and must go to the primary applicant where one is readily apparent.

Small volumes get a lighter form, not a lighter duty. Under section 1002.9(d), which mirrors section 1691(d)(5) of the statute, a creditor that received no more than 150 applications in the preceding calendar year may give the notifications, reasons included, orally.

Specific and principal: the wording Regulation B asks for

The sentence that makes complex models difficult is section 1002.9(b)(2). The statement of reasons must be specific and must indicate the principal reason or reasons for the adverse action. The regulation then names two formulas that fail: saying that the decision was based on the creditor's internal standards or policies, and saying that the applicant failed to achieve a qualifying score on the creditor's credit scoring system.

The official interpretation of that paragraph adds nine comments. Read together, they describe a rule that was written for scorecards and still fits them closely.

On quantity, the first comment says the regulation does not fix a number of reasons, but that disclosing more than four is not likely to be helpful to the applicant. On accuracy, the second says the reasons must relate to and accurately describe the factors actually considered or scored. On depth, the third says the creditor need not explain how or why a factor counted against the applicant: "length of residence" is enough, without saying it was too short.

The fourth and fifth comments deal with credit scoring. Reasons must relate only to factors actually scored in the system, and no factor that was a principal reason may be left out, even if its link to creditworthiness may not be clear to the applicant. The regulation does not impose one method for choosing the reasons from a score. The commentary gives two examples of acceptable methods: pick the factors on which the applicant scored furthest below the average of applicants who passed, or furthest below the average of all applicants.

The sixth comment covers what Regulation B calls a judgmental system, which section 1002.2(t) defines simply as any system for evaluating creditworthiness other than an empirically derived, demonstrably and statistically sound credit scoring system. There, the reasons must relate to the factors in the applicant's record that the decision-maker actually reviewed. The seventh covers lenders that combine the two: the reasons come from the component the applicant failed, and where a borderline score is sent to a person who then declines, from both components, with a combined total that should not exceed four. The eighth says that when one factor triggers an automatic denial, that factor is the reason to disclose; a bankruptcy is one of the examples given.

The ninth comment draws a line that is easy to miss. A notice may combine the disclosures of the Equal Credit Opportunity Act with those of the Fair Credit Reporting Act, but saying that a credit report was used does not satisfy the first Act. Nor do the key factors that came with a credit score. The creditor has to give its own specific reason.

What Circular 2022-03 said about black-box models

Consumer Financial Protection Circular 2022-03 is dated 26 May 2022. It asked one question: when a creditor uses complex algorithms that prevent it from accurately identifying the specific reasons for denying credit, does it still have to provide the statement of specific reasons? The answer was yes.

The reasoning was short. The notice requirements of the Act and of Regulation B, the circular said, apply to all credit decisions regardless of the technology used to make them, and so they do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions. The circular described a black-box model as one that is uninterpretable, where it is difficult, if not impossible, to identify accurately the specific reasons for a decision. It added that a creditor's lack of understanding of its own methods is not a defence.

The circular rested on text already described above: section 1691(d) of the statute, section 1002.9(b)(2) of the regulation, and the comments on accuracy and on credit scoring.

Its first footnote addressed the tools that lenders use to explain a model after the fact. The circular did not rule them out. It said such post-hoc explanations approximate the model, that a creditor must still be able to validate their accuracy, and that this may not be possible with less interpretable models.

What Circular 2023-03 said about the sample forms

The second circular was released on 19 September 2023 and published in the Federal Register on 17 April 2024, at 89 FR 27361. It asked whether creditors using artificial intelligence or complex credit models may rely on the checklist of reasons in the Bureau's sample forms when those reasons do not specifically and accurately say why the applicant was declined. The answer was no.

To follow it, one has to know the forms. Appendix C to Regulation B holds ten samples, C-1 to C-10. Forms C-1 to C-4 are adverse action notices: two general ones, one for credit scoring and one that combines a statement of reasons with a counteroffer. Form C-5 discloses the right to request reasons, and Form C-9 is the notice of the right to receive a copy of an appraisal. Form C-1 has a first part, to be completed in all instances, that lists 23 named reasons and a twenty-fourth line reading "Other, specify". The named reasons include income insufficient for the amount of credit requested, excessive obligations in relation to income, limited credit experience, and value or type of collateral not sufficient.

The appendix itself already limits how far the checklist can be trusted, and the circular quoted it. The introduction to Appendix C says the forms are illustrative and may not be appropriate for all creditors. It says a creditor that uses a checklist but relies on a reason not listed should substitute or add it. And it says that if the reasons listed are not the factors actually used, the creditor does not satisfy the notice requirement by checking the closest identifiable factor listed; it should add the factor or tick "other" and explain.

The circular's contribution was its examples. If a model lowers an applicant's standing because of their profession, it said, a notice reading "insufficient projected income" or "income insufficient for amount of credit requested" would likely not comply. For decisions on existing credit lines driven by behavioural data, it said terms such as "purchasing history" or "disfavored business patronage" would likely be insufficient, and that the creditor might need to disclose details such as the type of establishment, its location or the type of goods bought. It observed that some complex models draw on data harvested from consumer surveillance or on data not usually found in a credit file or an application, and that a creditor cannot avoid the notice because the factor might surprise the applicant.

Two limits were stated in the circular itself. It dealt only with the notice requirement and did not decide whether using any particular data is otherwise lawful. And it noted, in a footnote, that the obligations under the Fair Credit Reporting Act and under the Equal Credit Opportunity Act are distinct.

Where the two circulars stand in 2025 and 2026

On 12 May 2025 the Bureau published in the Federal Register, at 90 FR 20084, a notice titled "Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal". It withdrew 67 guidance documents: 8 policy statements, 7 interpretive rules, 13 advisory opinions and 39 other items, the circulars and bulletins. The withdrawals applied from the day of publication. Both adverse action circulars are on the list.

The notice gives three reasons it calls independent. The Bureau says it will issue guidance only where it is necessary and would reduce compliance burdens. It says it is reducing its enforcement activity to areas where enforcement is required by statute. And it says reliance interests do not justify keeping the documents, since guidance is generally not binding.

The Bureau's own pages do not present the two documents in the same way. When read on 10 October 2026, the page for Circular 2023-03 carried an "Archived content" label and a last-modified date of 11 April 2025. The page for Circular 2022-03 showed a last-modified date of 28 August 2024 and no archived or withdrawal label. The Federal Register notice names both, so the difference is one of web presentation; it is recorded here because a reader who finds the 2022 page could take it for current guidance. No page read for this guide says that either circular has been reissued.

Regulation B itself was amended in 2026, on other subjects. The final rule published on 22 April 2026 at 91 FR 21620, effective 21 July 2026, amends section 1002.6(a) on disparate impact, section 1002.4(b) on discouragement, and section 1002.8 on special purpose credit programmes. In the part of that document read for this guide, no amendment to section 1002.9 or to Appendix C appears.

What a breach can cost and who can bring a claim

Because the notice duty sits in the statute, the statute's own liability section applies to it. Under 15 USC 1691e, a creditor that fails to comply with any requirement of the Act is liable to the aggrieved applicant for actual damages. A creditor that is not a government body may also owe punitive damages of up to US$10,000 in an individual action. In a class action the total punitive award cannot exceed the lesser of US$500,000 or 1 per cent of the creditor's net worth. A successful applicant also recovers costs and a reasonable attorney's fee, and a court may grant equitable and declaratory relief.

A worked example of the class cap, with invented net worths: for a lender with a net worth of US$20 million, 1 per cent is US$200,000, which is less than US$500,000, so US$200,000 is the ceiling. For a lender with a net worth of US$80 million, 1 per cent is US$800,000, so the ceiling is US$500,000. The two limits meet at a net worth of US$50 million.

The time limit for a private action is five years from the violation. Where an enforcement agency or the Attorney General opens a proceeding within those five years, an applicant affected by the same conduct may sue within one year of that proceeding starting.

Section 1691e(e) contains a protection that explains why official texts matter so much in this area. No liability attaches to an act done or omitted in good faith in conformity with an official rule, regulation or interpretation of the Bureau, even if that text is later amended, rescinded or found invalid. The sample forms belong to that official material: the introduction to Appendix C says that proper use of Forms C-1 to C-4 satisfies the requirement of section 1002.9(a)(2)(i). The word "proper" carries the conditions set out earlier.

What the texts leave open

Several questions that lenders, applicants and the agents working with them might ask are not answered by the pages read for this guide.

The first is method. The commentary gives two ways of selecting reasons from a scorecard and says no particular method is required. It does not describe a method for a model with thousands of interacting inputs, and the one Bureau document that mentioned post-hoc explanation tools has been withdrawn.

The second is supervision. The withdrawal notice says what the Bureau will not enforce or rely upon during its review. It does not speak for the other federal agencies listed in Appendix A, for the Attorney General, or for a court hearing a private claim under section 1691e, and none of the pages read says how those bodies treat the reasoning of the withdrawn circulars.

The third is the future of the guidance. The notice describes the withdrawal as not necessarily final and sets a condition for any reissue: that the guidance be necessary and reduce compliance burdens. No timetable is given.

A circular can be withdrawn in a day. The sentence it interpreted, that reasons must be specific, sits in an Act of Congress.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →