Regulation B and ECOA testing requirements
The Equal Credit Opportunity Act and Regulation B (12 CFR Part 1002) prohibit credit discrimination by US creditors in consumer and business credit. Regulation B testing verifies application fields, scoring inputs, adverse action notice timing and content, and record retention. The evidence produced includes a reason code trace per credit decision, notice timing logs, and a retention test report.
- Jurisdiction
- US (federal; 15 U.S.C. 1691 et seq., implemented by the CFPB in 12 CFR Part 1002)
- Primary source
- ecfr.gov
Engineering interpretation of testing requirements, not compliance advice.
What the Equal Credit Opportunity Act and Regulation B require
The Equal Credit Opportunity Act (ECOA) prohibits discrimination against credit applicants on a prohibited basis: race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or good-faith exercise of a right under the Consumer Credit Protection Act. The Consumer Financial Protection Bureau (CFPB) implements ECOA in 12 CFR Part 1002, Regulation B (checked on 2026-09-16; eCFR up to date as of 2026-09-14). A creditor under §1002.2(l) is anyone who regularly participates in a credit decision, including setting terms.
- §1002.4(a) and (b), discrimination and discouragement. A creditor does not discriminate on a prohibited basis in any aspect of a credit transaction, and makes no oral or written statement, including visual images, that it knows or should know would make a reasonable person believe an application would be denied because of a prohibited basis characteristic.
- §1002.5, information requests. A creditor does not ask about race, color, religion, national origin, or sex except for monitoring or a self-test (§1002.5(b)). For individual unsecured credit, marital status is asked only in community property states (§1002.5(d)(1)). Income from alimony or child support is asked about only with a disclosure that the applicant need not reveal it (§1002.5(d)(2)).
- §1002.6, evaluation. A scoring system does not take a prohibited basis into account (§1002.6(b)(1)). An empirically derived scoring system may use age, but does not assign a negative value to an applicant aged 62 or older (§1002.6(b)(2)(ii) and §1002.2(o)). Part-time, annuity, pension, and retirement income is not discounted (§1002.6(b)(5)).
- §1002.9, notifications. Notice of approval, counteroffer, or adverse action goes out within 30 days of a completed application; within 30 days of adverse action on an existing account; and 90 days after a counteroffer the applicant does not accept or use. An incomplete application gets a notice of action or a written notice of incompleteness within 30 days (§1002.9(c)). Reasons must be specific and principal; a statement that the action followed internal standards or policies, or that the applicant failed to achieve a qualifying score, is insufficient (§1002.9(b)(2)).
- §1002.12, record retention. Applications, information used in evaluation, notices, and statements of reasons are kept 25 months after notice for consumer credit and 12 months for business credit.
- §1002.13, monitoring information. For credit to buy or refinance a principal dwelling secured by it, the creditor asks for ethnicity, race, sex, marital status, and age, and notes ethnicity, race, and sex by visual observation or surname when the applicant declines.
Changes in 2026. A final rule published on 22 April 2026 (91 FR 21620), effective 21 July 2026, states in §1002.6(a) that ECOA does not provide an effects test, further defines discouragement in §1002.4(b), and adds prohibitions and conditions for special purpose credit programs in §1002.8. A complaint filed on 27 May 2026 in the District of Columbia federal court asks to vacate that rule; Mayer Brown reported on 5 June 2026 that the plaintiffs did not ask for temporary relief. On 12 May 2025, the CFPB withdrew Circulars 2022-03 and 2023-03 on adverse action reasons from complex algorithms and sample forms. Section 1002.9(b)(2) and its official interpretations in Supplement I, cited below as comments, still apply to every credit model.
Subpart B, small business lending data. The section 1071 final rule of 1 May 2026 (91 FR 23530) took effect on 30 June 2026. Under §1002.114(b)(1), a lender that originated at least 1,000 covered credit transactions for small businesses in each of 2026 and 2027 complies from 1 January 2028. A small business has gross annual revenue of $1 million or less (§1002.106(b)(1)).
What testing verifies under Regulation B
| Requirement | What we test | Evidence produced |
|---|---|---|
| §1002.9(a)(1)(i): notice of action within 30 days of a completed application | Send time of approval, counteroffer, and denial notices against the application completion timestamp | Notice timing log per test application |
| §1002.9(a)(1)(iv): notice 90 days after an unaccepted counteroffer | Counteroffers that the test applicant neither accepts nor uses | Counteroffer expiry log with the adverse action notice send date |
| §1002.9(a)(2) and (b)(1): adverse action notice content | Action taken, creditor name and address, ECOA notice text, and federal agency name and address on each decline template | Field checklist per adverse action notice template |
| §1002.9(b)(2) and comments 9(b)(2)-2 and 9(b)(2)-4: reasons match the factors actually scored | Reason codes on the notice against the scored factors behind each synthetic applicant's decline | Reason code trace from model output to notice text |
| Comment 9(b)(2)-7: reasons come from the failed stage of a combined system | Declines at the scoring stage, at manual review, and in the manual review band between approve and decline cut-offs | Reason source matrix per decision stage |
| §1002.9(a)(1)(iii) and §1002.2(c)(1)(ii): adverse action on an existing account | Credit limit decreases and account closures that do not affect all or substantially all accounts of a class | Existing-account adverse action notice log |
| §1002.9(a)(3): business credit notices by applicant revenue | Business applicants at $1 million or less, above $1 million, and on trade credit or factoring | Business credit notice path matrix |
| §1002.5(b) to (d): limits on information requests | Application form and API fields for sex, marital status, spouse, alimony income, and childbearing intentions | Application field inventory with the rule applied to each field |
| §1002.6(b)(2) and (b)(5): age and income source in scoring | Score changes for synthetic applicants aged 62 or older and for pension or part-time income | Scoring input variation test results |
| §1002.12(b): 25-month and 12-month record retention | Application, evaluation inputs, notice, and reasons after deletion jobs run | Retention test report per record type |
Artifacts an examiner requests
A CFPB or prudential examiner, or a partner bank reviewing a lending programme, can ask for:
- the credit policy and decision rule inventory, with every input variable and its data source;
- the mapping from model features to adverse action reason codes and the method used to select principal reasons (comment 9(b)(2)-5);
- a sample of declined, counteroffered, and incomplete applications with the notices sent and their send dates;
- every notice template by product and applicant type, including the business credit variants under §1002.9(a)(3);
- the application field inventory for web, mobile, API, and broker channels against §1002.5;
- the retention schedule and deletion job configuration against §1002.12(b);
- the arrangement for notices sent by a third party on behalf of several creditors, with each creditor's identity (§1002.9(g));
- monitoring information records for dwelling-secured purchase and refinance applications (§1002.13).
Common findings in credit decisioning systems
- Reasons from global feature importance. The notice lists the model's strongest features across all applicants, not the factors that drove this applicant's score. The defect breaks §1002.9(b)(2) as read with comment 9(b)(2)-2.
- Credit report factors as the only reasons. The decline letter prints up to four credit score key factors required by the Fair Credit Reporting Act and no ECOA reasons. Comment 9(b)(2)-9 states that key score factors do not satisfy §1002.9(b)(2).
- "Does not meet credit criteria" as the reason. A fallback template fires when the reason code mapping returns nothing. The defect breaks §1002.9(b)(2), which names internal standards as insufficient.
- Knockout rules hidden behind score reasons. A prior charge-off with the lender triggers automatic denial, and the notice shows score factors instead. The defect breaks comment 9(b)(2)-8.
- Manual review declines with scoring reasons. An underwriter declines an application that passed the model, and the notice repeats the model's reason codes. The defect breaks comment 9(b)(2)-7.
- Notice queue stall. A failed batch job retries without alerting, and decline notices leave on day 34. The defect breaks the 30-day limit in §1002.9(a)(1)(i).
- Wrong agency on a partner bank programme. The notice names the Federal Trade Commission while the creditor is a national bank. The defect breaks §1002.9(b)(1), which names the agency for that creditor from Appendix A.
- Early purge of declined applications. A privacy deletion job removes consumer decline records and notices after 12 months. The defect breaks the 25-month period in §1002.12(b)(1).
How we cover Regulation B
We test credit decisioning for consumer lending, buy now pay later, and business credit products. The lending and credit decisioning testing service delivers the credit decisioning rule test matrix, which carries the reason code trace for §1002.9(b)(2), and the lead routing and partner handoff test report for §1002.9(g) notices. The consumer lending and buy now pay later segment pages cover origination and instalment failures, and revenue-based financing covers the factoring and business credit notice paths of §1002.9(a)(3).
Disclosure timing and annual percentage rate checks for the same applications are on the Regulation Z testing requirements page. Notice timing and retention checks run as release gates through test automation, so a template or job change that breaks §1002.9 fails before release. Test applicants use synthetic identities and synthetic account data, never real applicant records.
Related
Segments
Adjacent standards
Questions
What is Regulation B?
Who does Regulation B apply to?
Does Regulation B apply to commercial loans?
What must be included in an adverse action notice?
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing