ECOA and Regulation B — What a Lender Must Tell You If It Denies You Credit

If you've ever gotten a credit denial letter that just says something like "we're unable to approve your application at this time" and nothing else, you've likely seen a lender fall short of what federal law actually requires. The Equal Credit Opportunity Act (ECOA) and its implementing rule, Regulation B, don't just prohibit discrimination in lending — they also spell out, in specific terms, what a creditor has to tell you when it turns you down. Almost nobody reads the regulation itself. Here's what it actually says.

Where this law comes from

ECOA is a federal statute, codified at 15 U.S.C. § 1691 et seq., and Regulation B (12 CFR Part 1002) is the rule that implements it, according to the National Credit Union Administration's own compliance guide to the law. Its stated purpose, per that same guide, is to promote the availability of credit to all creditworthy applicants without regard to race, color, religion, national origin, sex, marital status, or age, among other protected characteristics.

Enforcement is split by institution type and size. The NCUA's guide confirms it's the primary enforcer of ECOA/Regulation B for federally chartered credit unions with $10 billion or less in total assets; the Consumer Financial Protection Bureau (CFPB) is the primary federal enforcer above that threshold and across most other categories of creditors. Either way, the underlying rule — the one that actually defines what you're entitled to as an applicant — is the same regulation text, and the CFPB is the source cited throughout this piece.

What "adverse action" actually means

Regulation B's protections only kick in when a creditor takes what the rule calls "adverse action." Section 1002.2(c) of the regulation defines that specifically. It includes:

• A refusal to grant credit in substantially the amount or on substantially the terms you requested, unless the creditor makes a counteroffer and you accept it
• A termination of an existing account, or an unfavorable change to its terms, that doesn't apply to all or substantially all of a class of the creditor's accounts
• A refusal to increase your available credit when you've asked for an increase

The regulation also carves out several situations that don't count as adverse action for these purposes — changes you agreed to, actions tied to a default or delinquency, denials made at the point of sale, refusals required by some other law, and a simple refusal because the creditor doesn't offer that type of credit at all. The distinction matters because it determines whether the notice requirements below apply.

The 30-day notice requirement

When a creditor does take adverse action — denying a completed application, denying an incomplete one, or taking adverse action on an existing account — § 1002.9 of the regulation requires written notification within 30 days.

That notice can't just say "no." The creditor has to choose one of two paths, per the regulation text:

1. State the specific reasons for the adverse action directly in the notice, or
2. Disclose your right to request a statement of specific reasons — and if you ask for it within 60 days, the creditor then has 30 days to provide it.

Either way, the regulation is explicit about what does not count as an adequate reason. It states plainly that citing the creditor's "internal standards or policies" or saying the applicant "failed to achieve a qualifying score on the creditor's credit scoring system" is insufficient on its own. In practice, that's why a compliant denial notice names actual factors — things like length of credit history, income relative to the amount requested, or delinquent obligations on file — rather than pointing vaguely at an internal formula.

What the law protects you from

Beyond the notice mechanics, § 1002.2(z) of the regulation lists the specific bases a creditor is not allowed to use against you in a credit decision:

• Race, color, religion, national origin, sex, or marital status
• Age, provided you have the legal capacity to enter into a contract
• The fact that some or all of your income comes from a public assistance program
• The good-faith exercise of any right under the Consumer Credit Protection Act (for example, disputing a bill or a credit report entry)

The regulation goes a step further than most people expect: this protection extends to the characteristics of people you're affiliated with or associate with, not just your own. A creditor can't hold your spouse's, co-applicant's, or associate's protected characteristics against you either.

What this doesn't do

It's worth being precise about the limits here. Regulation B governs the process — what a creditor has to tell you, on what timeline, and which factors are off-limits. It doesn't guarantee approval, and a fully compliant denial notice can still describe a legitimate credit decision based on your actual financial profile. It's also a federal floor, not the whole picture — some states layer additional fair-lending or fair-housing protections on top of it, and those are outside the scope of this piece.

This is a plain-language explanation of a federal disclosure and anti-discrimination rule, not a comprehensive legal treatise, not an assertion about any specific creditor's compliance, and not legal advice. ClearValue is a broker and publisher — we don't originate or approve credit ourselves. If you believe a denial notice you received didn't meet these requirements, the regulation text and the CFPB's own guidance are the authoritative references, not this summary, and you may also have the right to file a complaint with the CFPB directly.

Where this fits

This is the same pattern behind everything we publish in this category: knowing the actual rule a regulator enforces is more useful than trusting that a denial letter "looks official." We've made the same case for what lenders must disclose about the cost of credit under the Truth in Lending Act, for the legal standard behind CFPB and FTC enforcement actions, and for what your bank is required to tell you about your data under GLBA. Regulation B is the rule that governs the moment a "no" actually gets explained to you — knowing what it requires means a vague denial letter is something you can push back on, not just something you have to accept.