FCRA Adverse Action Notice Requirements: What Fintechs Using AI Credit Models Need to Get Right in 2026

TL;DR

• FCRA Section 615 requires adverse action notices any time a consumer report influences a credit decision — and ECOA Reg B requires specific, accurate reasons that must match how your model actually made the decision.
• CFPB examiners found in January 2025 that institutions using AI models with 1,000+ variables failed to ensure their adverse action notices complied — and directed them to test and validate their methodology.
• Credit reporting complaints increased 182% in 2024, giving enforcement agencies substantial complaint-driven investigation capacity even under a scaled-back federal CFPB.
• The CFPB’s BNPL interpretive rule rollback doesn’t eliminate adverse action notice requirements — those obligations attach to the use of consumer reports, not to TILA product classification.

Your AI credit model denied an applicant this morning. Did it tell them why — specifically, accurately, in a way that reflects how the model actually made that decision?

That’s the question CFPB examiners are now asking. And based on the January 2025 Supervisory Highlights, a lot of fintechs can’t answer it.

The Fair Credit Reporting Act has required adverse action notices since 1970. The Equal Credit Opportunity Act and Regulation B have required specific, accurate reasons since 1974. Neither law got simpler when fintechs started using AI models with thousands of input variables. They got harder to comply with — and regulators noticed.

What FCRA Section 615 Actually Requires

When a creditor takes “adverse action” based wholly or partly on information from a consumer reporting agency, FCRA Section 615(a) requires the creditor to:

1. Provide written notice of the adverse action
2. Identify the CRA that provided the report (name, address, phone number)
3. State that the CRA did not make the adverse action decision and cannot explain why it was made
4. Inform the consumer of their right to obtain a free copy of the consumer report from the CRA within 60 days
5. Inform the consumer of their right to dispute the accuracy or completeness of any information in the report

“Adverse action” under FCRA Section 603(k) is broad: denial or revocation of credit, a change in the terms of an existing credit arrangement, and any refusal to grant credit in substantially the amount or on substantially the terms requested.

If you use a consumer report — a traditional credit file, alternative data scored by a CRA, or BNPL payment history from a CRA — to make any of those decisions, Section 615 applies to you.

The ECOA Reg B Overlay: Where “Specific Reasons” Comes From

FCRA sets the floor. ECOA and Regulation B add the requirement that many compliance teams underestimate: specific, accurate reasons.

Under Reg B Section 1002.9, creditors must disclose the principal reason or reasons for taking adverse action. Disclosure of a credit score alone is not sufficient. The reasons must reflect what the decisioning system actually evaluated for that specific applicant.

The Federal Reserve’s Model Form C-1 provides sample reason language, but it’s a starting point — not a shield. Using a preprinted list of generic reasons when your model evaluated completely different factors is a Reg B violation even if the notice format looked right on paper.

This is where AI creates the compliance gap many fintechs haven’t closed.

The AI Problem: When the Model Can’t Explain Itself

The CFPB’s January 2025 Supervisory Highlights documented a specific finding. Examiners assessed institutions using AI/ML credit models — including models using more than 1,000 input variables — and found that the institutions did not sufficiently ensure compliance with adverse action notice requirements.

Specifically, examiners flagged how institutions selected the reasons given in adverse action notices when the decision was based on the model score. The reasons on the notice didn’t accurately reflect how the model made the decision. Examiners directed institutions to test and validate the methodologies used to identify reasons.

This matters for a practical reason. Traditional scorecards map predictive factors directly to reasons — high utilization → “proportion of balances to credit limits is too high.” AI models with nonlinear relationships, interaction effects, and hundreds or thousands of features don’t produce those clean one-to-one mappings. The reasons a logistic regression produces differ mechanically from the reasons a gradient boosting model produces, even for the same adverse decision on the same applicant.

The CFPB addressed this framework in its 2020 innovation spotlight, confirming that explainability techniques like SHAP (SHapley Additive exPlanations) values and LIME can satisfy the specific-reasons requirement if implemented correctly. The phrase “if implemented correctly” does the heavy lifting — many fintechs haven’t validated whether their AI-generated reasons are accurate for each specific denial decision.

What CFPB and State Examiners Are Finding

The January 2025 supervisory findings weren’t isolated. Credit reporting complaints to the CFPB increased 182% in 2024, with incorrect information on consumer reports rising 247% compared to the prior two-year average. That complaint volume creates a substantial pipeline for targeted examinations.

State enforcement remains active even where federal CFPB enforcement has pulled back. In 2025, Massachusetts settled with Earnest Operations LLC for $2.5 million, partially attributable to AI models that embedded bias in lending decisions — a case that shows how adverse action compliance failures intersect with fair lending enforcement and state consumer protection authority.

The Federal Reserve’s examination of state member banks also flagged FCRA adverse action violations among the most common compliance failures: lenders omitting the required credit score disclosure range, failing to send any notice when a consumer report influenced the decision alongside other factors, and failing to include all credit score information required by statute.

For scale perspective: FCRA Section 616 allows consumers to sue creditors for willful violations and recover actual damages, up to $1,000 per violation, punitive damages, and attorney fees. At high application volumes, the class action math gets uncomfortable quickly. The enforcement risk isn’t only from regulators.

5-Step Adverse Action Notice Compliance Checklist

1. Map Every Consumer Report Trigger

Identify every point in your decisioning workflow where you pull or use a consumer report. This includes:

• Hard and soft pulls from traditional CRAs (Equifax, Experian, TransUnion)
• Alternative data CRAs (Nova Credit, Clarity Services, ID Analytics, Experian Boost)
• BNPL payment history reported and then queried from a CRA
• Third-party scored attributes sourced from a consumer reporting agency

Each pull or use that influences an adverse action triggers Section 615. Map them explicitly in your model documentation and your procedures. If the consumer report is one of multiple factors, the notice obligation still applies — “partly based on” is the statutory threshold.

2. Validate Model Explainability End-to-End

If you use an AI or ML model, document how your adverse action reason generation works. This means:

• Identify the explainability methodology (SHAP, LIME, counterfactual explanations, integrated gradients)
• Test whether the generated reasons accurately reflect the model’s actual decision factors for specific individuals
• Test edge cases where model output and stated reasons might diverge
• Document the validation in writing, with version control tied to the model version

The CFPB’s specific finding was that institutions had not validated their methodology. “We use SHAP values” is not sufficient — you need documented evidence that the methodology was tested and produces accurate, applicant-specific results.

3. Audit Notice Content and Delivery

Common gaps that show up in examinations:

• Credit score disclosure language missing or incomplete (FCRA requires the score, the range of possible scores under that model, the date the score was created, and up to four key factors that adversely affected the score)
• Reasons stated at too high a level of generality (“insufficient credit history” when the actual model-specific reason was different)
• Notice delivered via the wrong channel or outside required timing windows
• No notice sent when a decision was partially influenced by consumer report data alongside non-report factors

The trigger test is whether the consumer report was a contributing factor in the adverse action — not whether it was the sole factor.

4. Test AI-Generated Reasons for Accuracy

This is the step most institutions skip. Run a periodic audit — quarterly for high-volume programs — that samples actual adverse decisions and asks: do the reasons on the notice match what the model actually weighted for this specific applicant?

A compliance review that tests notice format but doesn’t test whether the stated reasons were accurate for individual decisions isn’t catching the CFPB’s actual concern. Individual-level accuracy of the stated reasons is what the supervisory findings cited.

5. Build Change Control for Model Updates

When your AI model is retrained, tuned, or updated with new data, your adverse action reason generation needs revalidation. Model drift can cause the stated reasons to drift from the model’s actual decision factors over time even without intentional changes.

Build a model change control process that explicitly includes adverse action notice revalidation as a step before any model update goes to production. Document sign-off from compliance before model changes are deployed.

The BNPL and Embedded Lending Angle

The CFPB withdrew its May 2024 BNPL interpretive rule — the one that would have classified BNPL as a credit card under TILA — in 2025. This created real confusion about what consumer credit obligations still apply.

On FCRA specifically: obligations don’t change based on TILA classification. If your BNPL product uses consumer reports for credit decisioning, or if it reports payment history to a CRA, FCRA applies. The 2025 TILA rollback has no bearing on FCRA requirements.

The CFPB’s rollback also didn’t eliminate state-level enforcement risk. State AGs are using consumer protection statutes and state UDAP authority to pursue fair lending and disclosure failures even where federal enforcement has moderated — see the analysis of what the CFPB Reg B changes mean for AI credit teams for the current state enforcement landscape.

The Intersection with Fair Lending

Adverse action notice failures and fair lending violations frequently appear together in the same examination finding. If your model produces different adverse action rates by race, gender, or national origin — even unintentionally — and the adverse action notices don’t accurately surface what the model was doing, you have a compound problem.

This is the pattern the Earnest Operations case illustrated: AI model bias combined with adverse action notices that didn’t accurately reflect the model’s decision factors.

The disparate impact testing that regulators expect for AI credit models uses the same explainability infrastructure that helps validate whether your adverse action reasons accurately represent how the model differentiates among applicants. The two compliance workstreams should be coordinated, not siloed.

So What?

The January 2025 finding signals that AI/ML adverse action compliance is now standard examination scope — not a cutting-edge question examiners are still developing. They know what to look for, and the complaint volume creates investigation triggers even when proactive examination cycles aren’t prioritized.

The regulatory environment around federal CFPB enforcement posture may be shifting, but state AGs, the FTC, and private plaintiffs have independent authority that doesn’t require federal buy-in.

Three questions to answer before your next examination:

1. Can you show, for any given adverse decision, that the reasons on the notice match how your model weighted features for that specific applicant — not just that your model has an explainability method?
2. Have you documented the adverse action validation methodology in writing, version-controlled to your model?
3. Does your model change control process require adverse action notice revalidation before any update goes live?

If the answer to any of those is “no” or “not sure,” open it as a tracked compliance finding now. Use your Issues Management Tracker to assign an owner, document the gap, and set a remediation timeline before the next examination cycle. An open, owned issue with a remediation plan is defensible. An unacknowledged gap is not.

If you get an MRA on adverse action notices, the MRA Remediation Playbook walks through the 5 Cs format, the 30-day board response requirement, and how to document remediation the way examiners want to see it.

Sources: CFPB FCRA Compliance Resources · CFPB Innovation Spotlight: Adverse Action Notices with AI/ML · FCRA Fundamentals: Adverse Action Disclosures and the Intersection with ECOA · Regulatory Requirements Related to Adverse Action Notifications · CFPB Supervisory Highlights