What a lender has to tell you when it says no

A denial letter that just says "your application was not approved" is not, on its own, what federal law actually requires. Two separate statutes govern what a lender, landlord-screening company, or insurer has to disclose when it takes an "adverse action" against you — and since 2011, that disclosure has to include an actual number if a credit score was part of the decision, not just a vague reference to your credit history.

Two overlapping laws, doing different jobs

The Equal Credit Opportunity Act (ECOA) and its implementing rule, Regulation B (12 C.F.R. § 1002.9), require a creditor to notify you of "action taken" on any credit application — approval, a counteroffer, or denial — regardless of what information the decision was based on, because ECOA's underlying purpose is preventing credit discrimination. Separately, the Fair Credit Reporting Act's adverse-action provision, 15 U.S.C. § 1681m, applies specifically when the decision was based in whole or in part on a consumer report, and exists to make sure you know a credit bureau's file was involved and how to see it. Most everyday consumer credit denials — a credit card, an auto loan, a personal loan — trigger both at once, so in practice the single notice you receive is usually written to satisfy both laws together. The same basic framework extends to insurance and tenant-screening decisions based on a consumer report, through FCRA's adverse-action rule, even though ECOA itself only covers credit.

The 30-day clock

Under Regulation B § 1002.9(a), a creditor has to notify you of the action taken within 30 days of receiving a completed application — one where the creditor has everything it normally uses to decide. If your application is incomplete, the creditor has 30 days to either act on what it has or tell you specifically what's missing. The same 30-day window applies to adverse action taken on an account you already hold, not just a new application. Missing that window doesn't erase the requirement — it just means the creditor is already out of compliance.

What the notice actually has to contain

Under Regulation B, a creditor has to either state the specific, principal reasons for the denial as a matter of course, or tell you plainly that you have the right to request those reasons — a request you can make in writing within 60 days of the notice, which then obligates the creditor to provide the specific reasons, in writing, within 30 days of receiving your request. In practice, most creditors choose the first option and hand you a form checking off the applicable reasons (examples used on standard model forms include "insufficient credit references," "too short a period of employment," or "too many recent inquiries on your credit report"), because it's simpler than fielding a separate follow-up request. A 2022 CFPB circular addressed a modern wrinkle directly: a creditor using a complex or proprietary algorithm to make the decision doesn't get an exception from this rule just because the model is hard to interpret — the specific-reasons requirement applies "regardless of the technology used," and a lender can't point to a "black box" as an excuse for a vague or generic reason.

When the decision drew on a consumer report, the notice separately has to give you the name, address, and phone number of the credit reporting agency that supplied it; state plainly that the agency did not make the decision and can't explain the specific reasons for it; and tell you about your right to a free copy of that report from the named agency if you ask within 60 days, plus your right to dispute the accuracy or completeness of anything in it.

Time to notify (completed app): 30 days

Window to request a free report: 60 days

Score disclosure required since: 21 Jul 2011

The credit score disclosure Dodd-Frank added

Before 2011, an adverse-action notice could reference your "credit history" without ever putting a number on it. Section 1100F of the Dodd-Frank Act amended FCRA § 615(a) to close that gap: if a numeric credit score was used in the decision, the notice now has to state the actual score, the range of possible scores under that model, the date it was generated, the name of whoever provided it, and — this is the part that most changes what the letter actually tells you — up to four specific factors that adversely affected that score (or, if a fifth factor was the number of inquiries on your file, that too). The requirement took effect 21 July 2011, with implementing rules from the Federal Reserve and FTC effective a few weeks later. It's a genuinely useful right on its own: it's one of the few situations where a lender is required to tell you your actual credit score for free, tied to a specific decision, rather than you having to buy or separately request it.

The other side of the coin: risk-based pricing notices

Not every unfavorable outcome is an outright denial. If you're approved for credit but on materially worse terms than most of the creditor's customers get — a higher interest rate, because of something in your credit report — a related but separate rule can require a "risk-based pricing notice" instead of, or in addition to, an adverse-action notice. Rather than sort out case by case who got worse terms, many creditors take a simpler route the rule specifically allows: give every applicant a "credit score disclosure exception notice," which includes your actual score, the range of the model, and a graph showing where your score sits relative to other consumers under that model. If a creditor takes that route, it satisfies the requirement regardless of what terms you personally received — which is one reason a same-decision credit product from two different lenders can come with two differently worded notices, both fully compliant.

What to actually do with a denial notice: if it doesn't already list specific reasons, request them in writing within 60 days — the creditor has to respond. If a credit report was involved, get your free copy from the named bureau within that same 60-day window and read it against the stated reasons; a reason that doesn't match anything actually on the report is itself worth disputing. See furnishers and your FCRA dispute rights for how to challenge something inaccurate once you've found it.

Related: this is a different right from the one covered in who's actually allowed to pull your credit report, which governs whether your file could be accessed at all — this page covers what has to happen after it was, if the decision goes against you. See FICO vs. VantageScore, explained for what the disclosed score and "key factors" actually mean.