Adverse Action Notices: ECOA and FCRA BY: ELIZABETH MADLEM, ASSOCIATE GENERAL COUNSEL

B2B HOUSEKEEPING RULES This is only a broad overview—Always refer back to the actual provisions cited. Not Legal Advice– Consult with bank counsel for more detailed inquiries. Live questions will not be addressed, but please feel free to send in any follow-up questions to our Hotline: hotline@compliancealliance.com or 888-353-3933

Adverse Action Notice Requirements: Overview History of Law Adverse Action Notice ECOA Requirements FCRA FAQs ECOA and Regulation B What actions require notice Who, What, Where, When, Why Tops Questions “Credit is an ‘I love debt’ score.” -Dave Ramsey

History of Law ECOA and FCRA

ECOA/Regulation B Equal Credit Opportunity Act (ECOA) as implemented by Regulation B Prohibitions Race Martial Status Color Age (provided they are old enough) Religion Income from public assistance National Origin

Consumer Report / Credit Report FCRA Fair Credit Reporting Act Consumer Report / Credit Report Information about credit Bill payment history Status of credit account How often make payments on time How much credit you have How much credit is available Public Records– liens, judgments, bankruptcies

Adverse Action Definitions: ECOA and FCRA

Adverse Action: ECOA Reg B’s Definition: 1002.2(c) Does not Include: Refusal to grant credit for an amount or specific terms requested; Termination of account or unfavorable change in terms that does not affect all accounts; or Refusal to increase amount of credit available to applicant who made application to increase Change in terms expressly agreed to by applicant Any action/forbearance on account due to inactivity, default or delinquency Refusal/failure to authorize account transactions at POS or loan Refusal to extend credit because applicable laws prohibits Refusal to extend credit because creditor does not offer type of credit or credit plan requested *Notice would be required when a refusal is a termination or unfavorable change that does not affect all class of accounts. *Terms of Credit vs. Types of Credit Offered—Applicant applies for credit and creditor does not offer the CREDIT TERMS requested (interest rate, length of maturity, collateral, amount of down payment), a denial for that reason WOULD require a notice. **Applies to Consumers and Business transactions

Adverse Action: FCRA *REMEMBER! FCRA’s Definition: 15 USC 1681 *REMEMBER! ECOA’s definition; Denial/cancellation of, an increase in any charge for, or a reduction or other adverse/unfavorable change in terms of coverage or amount of any insurance, existing or applied for, in connection with underwriting; Denial of employment or other decision for employment purposes adversely affecting current or prospective employees; Denial/cancellation of, or increase in any charge for, or any adverse/unfavorable change in terms of government license/benefit; or An action on application or transaction initiated by consumer, or in connection with account review that is adverse to consumer’s interests FCRA only applies to consumer transactions Adverse action notices are not required under FCRA for business transactions (limited exceptions)

Adverse Action: ECOA Requirements

Who Receives Adverse Action Notices? ECOA (Consumer and Business) FCRA (Consumer) Any applicant – 1002.2(e): any person who requests or has received an extension of credit from a creditor, and includes any person who is or may become contractually liable regarding an extension of credit. Includes: Individuals applying for credit Businesses of all sizes Government or governmental subdivision or agency Trusts / Estates Partnerships, Cooperatives or Associations Any person liable or who will be liable for debt—coapplicant Any consumer defined as an individual, including coapplicants. *Guarantors do not fall under ECOA or FCRA

Adverse Action Notices Requirements ECOA (Consumer and Business) FCRA (Consumer) Notice is required if bank has: Taken adverse action (AA) on a completed credit application Taken AA on an incomplete credit application Taken AA on an existing credit account; or Made a counteroffer to an application for credit and the applicant does not accept For a covered transaction, notice is required if: AA was taken based in whole or in part on information in a consumer report Consumer credit is denied or a charge for credit increased based on information obtained from third parties other than CRAs bearing on the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; or AA was based on information furnished by a corporate affiliate of the person taking the action.

ECOA Adverse Action Notice Not Required Notice is not required if: Transaction does not involve credit Applicant accepts counteroffer Applicant expressly withdraws an application; or Creditor approves a credit application and both parties expect applicant will inquire about its status, BUT applicant does not inquire within 30 days after application (the approved application is treated as withdrawn)

Adverse Action: Multiple Applicants ECOA (Consumer and Business) FCRA (Consumer) Primary applicant if apparent No prohibition on giving to all applicants Separate notice to all consumers whose AA was based off information in a consumer report Applicant cannot receive credit score information of coapplicant

ECOA (Consumer and Business) Timing Requirements ECOA (Consumer and Business) FCRA (Consumer) AA Notice Timing Requirements: 30 days after receiving a complete credit application 30 days after receiving an incomplete credit application 30 days after taking action on an existing credit account 90 days after making a counteroffer to an application for credit if applicant does not accept the counteroffer No specific timing requirements Businesses with gross annual revenues under $1 million follow consumer timing requirements. Businesses over $1 million require creditor to send notice within a “reasonable time.” *See: 1002.9

What is an Application? 1002.2(f)– oral or written request for an extension of credit that is made in accordance with procedures used by creditor for type of credit requested Completed Application—an application where a creditor has received all the information that the creditor regularly obtains and considers in evaluating applications for the amount and type of credit requested i.e.– credit reports, any additional information requested from applicant, approvals or reports by government agencies or others necessary to guarantee, insure or provide security for credit or collateral Inquiry or Prequalification—generally these are not considered applications. If in giving information the creditor also evaluates information about the consumer and decides to decline the request AND communicates this to the consumer, it is NOW an application and must comply with the notice requirements

Common Timing Violations: Incomplete Application Incomplete Application Options Take action on the application and notify the applicant per ECOA’s requirements (30 days); OR Notify applicant that the application is incomplete. Notice of Incompleteness Written notice specifying specific information needed from applicant Reasonable time period for applicant to provide information Inform applicant that failure to provide information requested will result in no further consideration to application *See: 1002.9(c)(2) *If no response, then the creditor has no other obligations.

Variations: Oral Requests Creditors have the option to inform applicants orally of the need for additional information If remains incomplete, then written notice is required (either Action Taken or Notice of Incompleteness) *See: 1002.9(c)(3) & (d) **Small-Volume Creditors (no more than 150 applications during preceding calendar year)—May provide oral notifications for action taken including statements of specific reasons

Variations: Third Party Applications When application is made on behalf of an applicant to more than one creditor: If applicant expressly accepts or uses credit offered by one of the creditors, notification of action taken by other creditors is not required If no credit is offered or applicant does not expressly accept or use credit offered, EACH creditor taking adverse action must comply directly or through third party Notice from third party has to disclose identity of each creditor on whose behalf notice is given *See: 1002.9(g)

Consumer Content: ECOA Consumer applicants must receive AA notice in writing only (unless the bank meets the small-volume creditor exemption) Required Content Contain a statement of action name Name and address of creditor Statement of provisions of 701(a) of ECOA Name and address creditor’s primary regulator And EITHER: A statement of specific reasons for action taken; OR 2. A disclosure of the applicant’s right to a statement of specific reasons within 30 days IF the statement is requested within 60 days of the creditor’s notification. Right to Statement Content Name, address, and telephone number of person or office from which statement of reasons can be obtained If bank chooses to provide reasons orally, the bank will also disclose applicant’s right to have them confirmed in writing within 30 days of receiving applicant’s written request for confirmation. *See: 1002.9(a)(2)

Business Content: ECOA $1 million or less Excess of $1 million Same content requirement as consumer EXCEPT it can be given orally or in writing Notify applicant within a reasonable time orally or in writing of action taken Disclosure of applicant’s right to statement of reasons may be given at time of application instead of when AA is taken Provide a written statement of the reasons for AA and statement of provisions of 701(a) of ECOA if applicant makes a written request for the reasons within 60 days of the creditor’s notification For telephone applications, bank can satisfy all requirements with oral statement of action taken and applicant’s right to a statement of reasons for AA. *See: 1002.9(a)(3)

Strange Scenarios: Counteroffers and Telephone Applications Counteroffers Combined with AA Notice Denials of Telephone Applications If the bank gives an applicant a combined counteroffer and AA notice, then the bank does NOT need to send a second AA notice if the applicant does not accept the counteroffer. If telephone application and an AA is taken, bank must request applicant’s name and address in order to provide written notification Sample combined notice: C-4 of Appendix C If applicant declines to provide information, creditor has no further responsibility.

701(a) ECOA Notice and Statement of Specific Reasons “The Federal Equal Credit Opportunity Act prohibits creditors from discriminating against credit applicants on the basis of race, color, religion, national origin, sex, marital status, age(provided the applicant has the capacity to enter into a binding contract); because all or part of the applicant's income derives from any public assistance program; or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act. The Federal agency that administers compliance with this law concerning this creditor is [name and address as specified by the appropriate agency or agencies listed in Appendix A of this part].” A statement of specific reasons is required– has to be specific and indicate principal reason(s) for the AA (up to four) **Statements based on creditor’s internal standards/policies, or that applicant/joint applicant or similar party failed to achieve a qualifying credit score on creditor's scoring system is not enough Specific reasons must relate to and accurately describe the factors considered

Credit Scoring vs. Judgmental System Credit Scoring Method There is no one method for selecting reasons for credit denial or other AA based on the credit scoring system One example: identify the factors for which applicant’s score fell furthest below the average score for each of those factors by other applicants whose total score was at or slightly above the minimum passing score Another example: identify the factors where applicant’s score fell furthest below average score for all applicants Judgmental System Reasons for denial or other AA must relate to those factors in applicant’s record actually review by the person making the decision Combined Credit Scoring/Judgmental System Reasons for denial must come from the component of the system that the applicant failed EXAMPLES: If creditor initially credit scores application and denies request as result of that scoring, the reasons disclosed must relate to factors scored in the system If application passes credit scoring, but creditor then denies on judgmental assessment, reasons disclosed must relate to factors reviewed judgmentally, even if factors were also considered in the credit scoring If not approved under credit scoring but falls into grey area and creditor performs judgmental and then denies, reasons must come from both systems (and vice versa)

FCRA Content FCRA notices may be provided orally, in writing, or in electronic format. Section 615(a) Content: AA based on information in a consumer report must include: Notice that AA was taken based on information obtained from a consumer report agency (CRA) The consumer’s right to obtain a free copy of their report from the CRA providing the information within 60 days AND to dispute accuracy or completeness of any information in the report Name, address and telephone number of CRA that furnished the report Statement that CRA did not make the credit decision and is unable to provide specific reasons by AA was taken Credit score disclosures if the credit score was a factor in taking AA Section 615(b)(1) Content: Consumer credit denied or a charge for credit increased based on information from third parties NOT CRA Consumer’s right to request the information relied on in taking AA within 60 days of receipt of AA notice (information requested must be provided by consumer within a reasonable time) Section 615(b)(2) Content: AA based on information from an affiliate Notice that AA was taken based on information from an affiliate Consumer’s right to obtain information by sending written request within 60 days after receipt of AA notice (information requested must be provided by consumer within 30 days after receiving request **ECOA does not specifically allow for electronic delivery! However, a COMBINED ECOA/FCRA AA notice may be provided electronically if the consent requirements for E-Sign are complied with.

Additional FCRA Content Additional Disclosures Additional disclosures are required in writing or electronically if credit score was reason for AA: Consumer’s numerical credit score used by the person in taking the AA Range of possible credit scores All the key factors that adversely affected the credit score The date on which the credit score was created; and The name of person or entity providing the credit score or information upon which score was created

Adverse Action: FAQs

1. Joint Applications Q: How should AA notices be treated with a joint consumer application where primary applicant has poor credit history and co-applicant has excellent credit history? Option 1: Deny Outright Option 2: Counteroffer ECOA requires you to provide AA notices to only primary applicant Can provide to co-applicant an AA notice as well. Here you would give “specific statement” to the applicant to which it pertains and then provide a general statement to co-applicant stating that “applicant does not qualify” No prohibition on disclosing the reasons to other applicants under ECOA FCRA disclosures are required for BOTH applicants as application is denied off credit True even if co-applicant is not being denied on their own credit Each applicant cannot receive credit score information of co-applicants so each receives separate AA notice. If the bank decides to extend counteroffer to co-applicant, you would send an AA notice to applicant who did not qualify and combined AA/counteroffer to co-applicant that did qualify Or, deny outright and have the qualifying borrower apply again individually

2. Cosigner or Guarantor Q: What if the bank requires for an individual applicant a cosigner or guarantor and the cosigner or guarantor does not qualify based on credit history? A: Applicant still has to receive ECOA notice and FCRA notice if the adverse action is based in whole on in part on information from a consumer report. ECOA and FCRA do not consider guarantors an applicant for purposes of notice.

3. Credit Report Pulled but Denied for Something Else Q: If someone was denied because of insufficient income and excessive obligations, but a credit report was pulled with a score of 711, would Bank still need to check that it obtained a credit score and used it in making the credit decision? A: Generally, the credit score disclosure is not required merely because a credit report is pulled and information obtained from it (other than the credit score) and is used to take adverse action. The credit score disclosure is only required if the credit score was a factor in taking adverse action. Conservatively, it is best to provide the credit score disclosures when a credit score is included with a consumer report, even when the score was not used to take adverse action because it may be difficult to explain to an examiner that the score was not a factor in taking adverse action. Providing the credit score disclosure would be harmless.

4. No Credit Score or N/A Score Q: What happens when you pull an applicant’s credit report and the report states N/A or credit score of 0? A: If the lack of credit score information was a determining factor for denial, then both an ECOA and FCRA AA notice with the score needs to be provided to the applicant. Lack of a score or a score of 0 is still a score, just a negative one.

5. Tri-Merge Credit Reports or Multiple Scores Q: How does the bank handle when it pulls a Tri-Merge report and there are multiple credit scores? Who is listed as a Credit Reporting Agency on the AA notice? A: If a Tri-Merge report pulled by a separate company (ie- Kroll or Avantus), best practice is to include all four (Experian, Transunion, Equifax and Company) assuming all three credit bureaus were used in making the decision. 615(a) FCRA— Bank has to provide name, address and telephone number of each of the three repositories whose consumer report included information on which Bank based its decision, in whole or in part, to take the adverse action. See:  "How Many Credit Scores Must Be Disclosed?” When a creditor uses multiple credit scores in setting the terms of credit, the creditor must disclose any one of those scores. Alternatively, the creditor, at its option, may disclose multiple scores used in setting the material terms of credit. If a creditor obtained multiple credit scores, but used only one score, only that score must be disclosed. For example, if the creditor regularly requests scores from several consumer reporting agencies and uses only the lowest score, then the lowest score must be disclosed.

6. Commercial Loan Applications Q: Commercial Loan Applications—Co-applicants? Guarantors? Entities and Individuals? A: So if the borrower is an LLC with an individual guarantor, guarantors are not applicants per Stinneford opinion-so, that individual guarantor would not get an AA notice. But if the individual is a co-applicant and not a guarantor, then AA notices would be sent via ECOA and FCRA assuming credit was pulled. If Bank does get a consumer report on a natural person applicant and not guarantor, you would give the normal combined ECOA and FCRA disclosures with credit score information. If just a business credit report, only ECOA applies. Bank needs to consider notice and timing requirements for ECOA purposes dependent upon business size.

7. Errors Q: What if the Bank detects an error on its AA notice—ie: incorrect reason for denial? A: The conservative approach is to send out new notices, especially if you are still within the window of timing requirements for ECOA. Some examiners will make banks go back and send a corrected notice if the find an error. Customer service standpoint it would be best to clarify the additional notice to the borrower. It is recommend to document the error and review training standards.

8. Preapprovals/Prequalifications/Inquiries Q: Does the Bank need to send out AA notices to applicants of pre-approval programs or pre-qualification programs? A: If you have a denied pre-approval, the applicant(s) need an AA notice per ECOA and FCRA as applicable. If you deny a pre-qualification or inquiry based on the borrower’s qualifications, an AA notice is also needed. It depends on the program but if evaluating creditworthiness, yes AA notices are applicable.

9. Freezing HELOCs, Modifications, and Renewals Q: If Bank is doing a workout on a HELOC and freezing the line of credit, does it need to provide an AA notice? What about a denial on a modification or renewal? A: If it’s based on current delinquency, it will likely not be considered an adverse action and would not require notice. However, if it cannot be considered “inactivity”, “default,” or “delinquency,” then best practice is to provide it. As for modifications and renewals: there are arguments on either side of this debate, but the conservative approach would be to provide the adverse action notice when you deny a modification or renewal request.

10. Hard vs. Soft Credit Pulls Q: A Bank would like to start pulling a soft credit report using TransUnion. The soft credit report does not affect a consumer’s credit score, but would help the Bank in making a better decision on opening an account. If denied, would an AA notice be required? A: “Soft” or “hard pulls” are not terms recognized under the FCRA. This is allowed as long as the Bank has a permissible purpose to pull credit. Even though TransUnion considers this a “soft pull,” if the consumer is denied based on the information provided under the report, an AA notice is required for both ECOA and FCRA.

11. Record Retention Requirements Q: What is the record retention requirement for AA notices under the FCRA? A: While there is no specific record retention requirement for AA notices per the FCRA, best practice is to follow ECOA’s requirements of 25 months or longer.

Important Links CA’s Tools: Fair Lending Adverse Action Review Checklist Fair Lending Adverse Action Review Checklist for Deposit Accounts Consumer Loan Policy Notice of Action Taken Webinar

Questions? Thank you for your participation! We hope you found value in the presentation. If you have any additional questions, contact Compliance Alliance at hotline@compliancealliance.com or 888-353-3933.