If an AI system or complex model drives a credit decision, the adverse action rules still apply in full. Under the Equal Credit Opportunity Act (ECOA) and Regulation B, a creditor that denies credit or worsens terms must give the applicant the specific, principal reasons for that decision, and a model that is hard to explain does not change the duty. The CFPB withdrew its two circulars on this question in May 2025, but the underlying statute and regulation remain in place.
Short answer: if your model declines an applicant, you need reasons that reflect the factors the model actually used, delivered on the Regulation B timeline. Plan the reason logic as part of the model, not as an afterthought.
This article is general information, not legal advice.
What does the law actually require?
The duty starts in the statute. 15 U.S.C. 1691(d) says "Each applicant against whom adverse action is taken shall be entitled to a statement of reasons" and that "A statement of reasons meets the requirements of this section only if it contains the specific reasons for the adverse action taken." It defines adverse action as "a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested."
Regulation B implements this at 12 CFR 1002.9. For a completed application, a creditor must notify the applicant of the action taken within "30 days after receiving a completed application." The notice must be in writing and must include either "A statement of specific reasons for the action taken" or a disclosure of the applicant's right to a statement of specific reasons within 30 days.
What counts as a specific reason?
Under section 1002.9(b)(2), the statement of reasons "must be specific and indicate the principal reason(s) for the adverse action." It also rules out two shortcuts: "Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient."
The official interpretation adds three points that apply directly to scoring models:
- Reasons must come from the model. When adverse action is based on a credit scoring system, "the reasons disclosed must relate only to those factors actually scored in the system." The same comment says "no factor that was a principal reason for adverse action may be excluded from disclosure."
- Fewer, better reasons. "The regulation does not mandate that a specific number of reasons be disclosed," but "disclosure of more than four reasons is not likely to be helpful to the applicant."
- Flexible method, with limits. "The regulation does not require that any one method be used for selecting reasons" for a decision based on a credit scoring system. The comment describes two acceptable methods, and any other method must produce "results substantially similar to either of these methods."
Can you rely on the sample form checklist?
Regulation B's Appendix C includes sample notices with a checklist of common reasons. Using them is optional: "A creditor may design its own notification forms or use all or a portion of the forms contained in this Appendix."
The limit is stated plainly: "If the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed." That is the main risk for AI models that use data the checklist never anticipated.
What happened to the CFPB circulars on complex models?
Circular 2022-03 (May 26, 2022) answered the question for complex algorithms: "Yes. ECOA and Regulation B require creditors to provide statements of specific reasons to applicants against whom adverse action is taken." Circular 2023-03 (September 19, 2023) said creditors using AI or complex credit models "may not rely on the checklist of reasons provided in the sample forms (currently codified in Regulation B) to satisfy their obligations under ECOA if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action."
Both circulars were withdrawn. A Federal Register notice published May 12, 2025 lists both as withdrawn, and the CFPB's Withdrawn Guidance page shows each as withdrawn on May 12, 2025. The notice explains that "guidance is generally non-binding and generally does not create substantive rights" and adds that "Such withdrawal is not necessarily final." The original circular pages are still online without a withdrawal banner.
So the circulars are no longer current CFPB guidance, but the withdrawal did not change the statute or the Regulation B text quoted above. A separate 2026 final rule amended other parts of Regulation B; the text quoted here is from the CFPB's current version of section 1002.9.
Why complex models make this harder
With a points scorecard, the factors where an applicant lost the most points are the principal reasons. Machine learning models blend many inputs and interactions, so the top reasons are not obvious from the output. You need a documented way to rank which inputs drove each decision and to describe them in plain language.
An illustrative example: a model's strongest driver for a decline is irregular deposit timing in linked bank data. "Income insufficient for amount of credit requested" might be the closest checklist item, but it is not what the model scored, so the notice needs a reason describing the deposit pattern.
How to build adverse action into an AI credit workflow
- List every decision that counts as adverse action. Use the statute's definition, quoted above.
- Map every model input to a plain-language reason.
- Choose and document a reason-ranking method.
- Review real declines. Compare stated reasons with the model's drivers before launch and on a schedule after.
- Log each decision. Keep the inputs, model version, reasons selected and the date the notice went out.
- Track the clock. The 30-day window starts when the application is complete, so the notice step should not wait on manual work.
| Requirement | Where it comes from | What to check in an AI workflow |
|---|---|---|
| Give a statement of reasons to each applicant who receives adverse action | 15 U.S.C. 1691(d) | Every decline, revocation or worse-terms outcome triggers the notice step |
| Notify within 30 days of a completed application | 12 CFR 1002.9(a)(1)(i) | The notice is generated automatically, not queued for manual work |
| Reasons must be specific and give the principal reason(s) | 12 CFR 1002.9(b)(2) | Reasons name the actual drivers, not "internal standards" or a failed score |
| Reasons must relate only to factors actually scored | Comment 9(b)(2)-4 | Each reason maps to an input the model used for that applicant |
| No principal reason may be left out | Comment 9(b)(2)-4 | The ranking method cannot drop a top driver because it is awkward to explain |
| Closest checklist item is not enough | Appendix C, paragraph 4 | Custom reason text exists for drivers the sample forms do not name |
How Lean Discovery Group helps
Lean Discovery Group is a software development firm that builds automation for fintech companies and lenders. Our AI automation for fintech and financial services work includes onboarding, statement and document review for underwriting and lending, and reporting. That work is built with complete audit trails, human approval for anything that moves money or changes a customer's account, and AI access limited to the data each task needs, because financial automation has to be accurate, explainable and reversible.
Our AI consulting services include a data and risk review that identifies sensitive data flows, vendor terms and where human review is needed, especially in regulated industries. If your decisions rely on bank statements or application packets, our AI document processing work extracts and validates that data, sends low-confidence results to a person, and logs every extraction and correction. Book a discovery call to talk through your workflow.
Frequently asked questions
Do adverse action rules apply when AI makes the credit decision?
Yes. ECOA and Regulation B require a statement of specific reasons whenever adverse action is taken, and nothing in the rule exempts decisions made by AI or complex models.
Were CFPB Circulars 2022-03 and 2023-03 withdrawn?
Yes. Both appear in the CFPB's May 12, 2025 Federal Register withdrawal notice, and the CFPB's Withdrawn Guidance page lists each as withdrawn on that date. The notice says the withdrawal is not necessarily final.
If the circulars were withdrawn, do I still need specific reasons?
Yes. The requirement comes from 15 U.S.C. 1691(d) and 12 CFR 1002.9(b)(2), which say reasons must be specific and indicate the principal reasons for the adverse action.
Can I use the reasons on the CFPB sample forms?
You can use all or part of the Appendix C forms. But if the reasons on the form are not the factors actually used, checking the closest identifiable factor does not satisfy the notice requirement.
How many reasons should an adverse action notice list?
Regulation B does not set a number. The official interpretation says disclosure of more than four reasons is not likely to be helpful to the applicant, and no factor that was a principal reason may be left out.
Sources
- U.S. Code, 15 U.S.C. 1691 (Equal Credit Opportunity Act), GovInfo, 2020 edition
- CFPB, Regulation B, 12 CFR 1002.9 Notifications, current version
- CFPB, Regulation B, Official Interpretation of 1002.9 (Supplement I), current version
- CFPB, Regulation B, Appendix C: Sample Notification Forms, current version
- CFPB, Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms, May 26, 2022 (withdrawn May 12, 2025)
- CFPB, Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B, September 19, 2023 (withdrawn May 12, 2025)
- CFPB, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, Federal Register, May 12, 2025
- CFPB, Withdrawn Guidance (accessed November 2026)
- CFPB, Equal Credit Opportunity Act (Regulation B) final rule, Federal Register public inspection, April 2026
