How to Give Adverse Action Reasons for ML Credit Models

Current as of October 29, 2026. This guide draws on the Equal Credit Opportunity Act, Regulation B (12 CFR part 1002) and its official interpretations, the adverse action provisions of the Fair Credit Reporting Act, and Consumer Financial Protection Bureau notices in the Federal Register, as published on that date. It covers US federal law only and is not legal advice.

A lender that declines an application with a machine learning model owes the applicant what it would owe after a scorecard or judgmental decision. The statute says: "A statement of reasons meets the requirements of this section only if it contains the specific reasons for the adverse action taken." None of the federal texts reviewed for this guide names a technique for extracting reasons from a machine learning model.

Unless a step quotes a rule, it is a recommendation, labeled (interpretation). Methods such as Shapley-value attribution and reason-code mapping are not terms used in any text reviewed; where this guide discusses them, it is interpretation.

On scope: ECOA and Regulation B are binding. The commentary says they "apply to all credit—commercial as well as personal—without regard to the nature or type of the credit or the creditor", except that an entity excluded by section 1029 of the Consumer Financial Protection Act of 2010 is excluded from Regulation B "but not the Act". The commentary in Supplement I is the CFPB's official interpretation, and "Good-faith compliance with this commentary affords a creditor protection under section 706(e) of the Act." Business credit and creditors that received no more than 150 applications in the preceding calendar year have modified notice rules (sections 1002.9(a)(3) and (d)). The Fair Credit Reporting Act duties in 15 U.S.C. 1681m apply when adverse action is based in whole or in part on a consumer report. A Regulation B final rule published April 22, 2026 (91 FR 21620), effective July 21, 2026, amended the provisions on disparate impact, discouragement and special purpose credit programs; its amendatory instructions revise sections 1002.4, 1002.6, 1002.8 and 1002.15 and the related commentary, and do not amend section 1002.9, section 1002.12, appendix C or the commentary to section 1002.9.

History, not current guidance. Before its withdrawal, Circular 2022-03 (released May 26, 2022) said: "The adverse action notice requirements of ECOA and Regulation B, however, apply equally to all credit decisions, regardless of the technology used to make them." Circular 2023-03 (released September 19, 2023; published in the Federal Register April 17, 2024) said creditors "may not rely on the checklist of reasons provided in the sample forms (currently codified in Regulation B) to satisfy their obligations under ECOA if those reasons do not specifically and accurately indicate the principal reason(s) for the adverse action." The withdrawal notice says the CFPB "does not intend to prioritize the enforcement of such guidance against parties that do not conform to the guidance during the pendency of any withdrawal." The steps below rest on the regulation and commentary, which remain in force.

Step 1: Map every decision path that can produce adverse action

Adverse action includes "a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested", under 15 U.S.C. 1691(d)(6). Regulation B requires notice of action taken within 30 days after receiving a completed application, and within 30 days after taking adverse action on an existing account or on an incomplete application (section 1002.9(a)(1)). The notice must contain either "A statement of specific reasons for the action taken" or a disclosure of the applicant's right to a statement of specific reasons within 30 days, if the statement is requested within 60 days of the creditor's notification. Regulation B's definition in section 1002.2(c) covers "A termination of an account or an unfavorable change in the terms of an account that does not affect all or substantially all of a class of the creditor's accounts", so models that cut lines or close accounts are in scope, but it excludes "Any action or forbearance relating to an account taken in connection with inactivity, default, or delinquency as to that account".

List every model, rule and manual step that can decline an applicant, cut a line or worsen terms, and record which notice path each uses (interpretation).

Step 2: Build the reason inventory from the features the model actually scores

Comment 9(b)(2)-4 says that when adverse action is based on a credit scoring system, "the reasons disclosed must relate only to those factors actually scored in the system. Moreover, no factor that was a principal reason for adverse action may be excluded from disclosure." Regulation B defines a credit scoring system as one that "evaluates an applicant's creditworthiness mechanically, based on key attributes of the applicant and aspects of the transaction", which describes a machine learning credit model (interpretation). The comment continues: "The creditor must disclose the actual reasons for denial (for example, 'age of automobile') even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant."

Map each model feature, or each group of closely related features, to a reason statement an applicant can understand, and have compliance approve the mapping (interpretation).

Step 3: Use the sample checklist only where it matches the model

Appendix C says the sample forms "are illustrative and may not be appropriate for all creditors." It goes on: "If the reasons listed on the forms are not the factors actually used, a creditor will not satisfy the notice requirement by simply checking the closest identifiable factor listed." The creditor "should either add such other factors to the form or check 'other' and include the appropriate explanation."

Add lines for factors the checklist lacks rather than checking the nearest printed one (interpretation).

Step 4: Choose, document and validate a reason-selection method

Comment 9(b)(2)-5 is the fullest statement on method in the texts reviewed: "The regulation does not require that any one method be used for selecting reasons for a credit denial or other adverse action that is based on a credit scoring system. Various methods will meet the requirements of the regulation." It describes two: rank the factors on which the applicant's score fell furthest below the average for applicants at or slightly above the minimum passing score, or below the average for all applicants. It adds: "Any other method that produces results substantially similar to either of these methods is also acceptable under the regulation."

For a model without additive per-factor points, a feature-attribution method can play the same role (interpretation). A Shapley-value method measured against a reference group of applicants at or just above the cutoff resembles the first method, and against all applicants the second (interpretation). Document the method, the reference group and how correlated features are grouped before ranking (interpretation).

Before launch, check that the method ranks factors consistently for similar applicants and never omits a known driver (interpretation). Re-run these tests whenever the model, its features or the reason mapping changes (interpretation).

Step 5: Decide how many reasons to give and how to word them

Comment 9(b)(2)-1: "The regulation does not mandate that a specific number of reasons be disclosed, but disclosure of more than four reasons is not likely to be helpful to the applicant." Comment 9(b)(2)-3: "A creditor need not describe how or why a factor adversely affected an applicant."

Give the top-ranked reasons, usually up to four, but no factor that was a principal reason may be left out under comment 9(b)(2)-4; if more than four factors are principal, document why the list is longer (interpretation).

Step 6: Take reasons from the component that actually declined the applicant

Comment 9(b)(2)-7 says that in a combined system "the reasons for the denial must come from the component of the system that the applicant failed", and that for an applicant who falls into a gray band and is then declined on judgmental review, "the reasons disclosed must come from both components of the system." Comment 9(b)(2)-8: "When a creditor denies the credit request because of an automatic-denial factor, the creditor must disclose that specific factor."

Log which component made each decision (interpretation).

Step 7: Keep FCRA disclosures separate, and retain the record

When adverse action is based in whole or in part on information in a consumer report, the creditor must under 15 U.S.C. 1681m(a) disclose a credit score it used, with related information including the key factors that adversely affected that score (capped at four under 15 U.S.C. 1681g(f)(1)(C), or five if the number of inquiries is a key factor), the consumer reporting agency's name, address and telephone number, a statement that the agency "did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken", and notice of the consumer's rights to a free report and to dispute. That cap belongs to the FCRA score disclosure; Regulation B sets no number of reasons. Comment 9(b)(2)-9: "Disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit."

Section 1002.12(b) requires a creditor to keep the application file and a copy of "The statement of specific reasons for adverse action" for 25 months (12 months for business credit, with exceptions). For mechanical decisions, comment 12(b)-2 permits compliance "by retaining the information actually entered." Also log the model version, inputs, attribution output and reason mapping for each decision, so each reason can be traced to the factor it describes (interpretation).

Checklist

Items restate the recommendations above (interpretation).

• Every decision path that can produce adverse action is mapped
• Each scored feature or feature group maps to an approved reason statement
• Checklist reasons are used only where they match the factor scored; others are added
• The reason-selection method, reference group and feature grouping are documented
• Reason output is tested for accuracy and stability, and retested on change
• Principal reasons are never dropped to fit a four-reason layout
• Reasons come from the component that declined the applicant, including knockout rules
• FCRA score disclosures are given alongside, not instead of, ECOA reasons
• Notices and decision records are retained and traceable to the model version

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.