Skip to content
GONATURELLE
United States (federal)

CFPB Adverse Action AI Testing & Governance Guide

ECOA and Regulation B require a creditor that takes adverse action to give the applicant the specific principal reasons, and those reasons must reflect the factors the model actually used. When an LLM agent drafts or selects the reasons, the test is not whether the letter reads well but whether every stated reason traces back to the decision record.

Jump to assertionsAudit checklist
Reviewed by Nandini Joshi, Head of Regulatory Science · updated 1 Nov 2026
CFPB adverse action
Instrument
CFPB adverse action requirements for AI credit decisions (ECOA, Regulation B and FCRA)
Primary citation
15 U.S.C. 1691(d); 12 CFR 1002.9 and Supplement I comment 9(b)(2); FCRA section 615(a)
Authority
Consumer Financial Protection Bureau, with prudential regulators, the FTC and state attorneys general
Status
As of November 2026: the statutory and regulatory duties in 15 U.S.C. 1691(d) and 12 CFR 1002.9 are unchanged. The CFPB withdrew Circulars 2022-03 and 2023-03, which applied those rules to complex algorithms, on 12 May 2025 as part of a broad guidance withdrawal; the underlying regulation text and official interpretations still apply, and state regulators continue to enforce similar expectations.
FinTech

Statutory requirements

  1. 01

    Notice of action taken within 30 days

    12 CFR 1002.9(a)(1)

    A creditor must notify an applicant of action taken within 30 days after receiving a completed application, and within 30 days after taking adverse action on an incomplete application or an existing account. An agent that leaves applications in limbo, or that loops on document requests without a decision, can create a timing violation without ever producing a wrong answer.

  2. 02

    Statement of specific reasons

    12 CFR 1002.9(a)(2) and (b)(2); Supplement I, comment 9(b)(2)

    The notice must contain a statement of specific reasons, or disclose the applicant's right to obtain them within 60 days. Regulation B says the reasons must be specific and indicate the principal reasons for the adverse action; statements that the action was based on internal standards or that the applicant failed to achieve a qualifying score are insufficient. The official commentary ties the reasons to the factors actually considered or scored.

  3. 03

    Sample forms do not excuse inaccurate reasons

    12 CFR Part 1002, Appendix C

    Appendix C sample forms list common reasons, but using a checklist reason that does not match the true driver does not satisfy the rule. While in effect, Circular 2022-03 stated that creditors cannot use complex algorithms when doing so means they cannot provide specific and accurate reasons, and Circular 2023-03 said creditors cannot rely on sample-form checklists when those reasons do not reflect the actual reasons. Both were withdrawn in May 2025, but they restated existing regulation text rather than creating new duties.

  4. 04

    FCRA disclosures when a consumer report is used

    15 U.S.C. 1681m(a)

    If the adverse action is based in whole or part on information in a consumer report, FCRA section 615(a) requires notice including the reporting agency's contact details, the consumer's right to a free report and to dispute, and, where a credit score was used, the score and key factors. The agent must not merge or omit these disclosures when it composes the letter.

  5. 05

    Record retention and prohibited bases

    12 CFR 1002.12(b); 12 CFR 1002.4 and 1002.6

    Creditors keep applications, notices and statements of reasons for 25 months after notification for consumer credit. Reasons must never reference or proxy a prohibited basis such as race, sex, marital status, age (outside the permitted exceptions) or receipt of public assistance income.

Evaluation methodologies

Reason-to-attribution alignment

For each declined case, compare the reasons in the notice with the top contributors from the underwriting model's attribution (for example SHAP values or a reason-code engine). Score exact match on the principal reasons and penalize any reason that has no supporting feature. GONATURELLE treats a reason with no upstream evidence as a hallucinated argument.

Counterfactual consistency

Generate paired applications that differ only in the stated reason's driver (raise income, lower utilization) and check that the decision or the reason changes accordingly. If changing the cited factor never changes the outcome, the reason is probably not principal.

Prohibited-basis and proxy probes

Run paired cases that vary names, ZIP codes, languages or public assistance income while holding credit attributes fixed. Assert that reasons and decisions do not move, and that no reason text mentions a protected characteristic.

Timing and completeness trajectory checks

Assert that every completed application reaches a decision tool call and a notice tool call, that the notice includes the FCRA block whenever a bureau pull occurred, and that the agent never closes a file without one of the permitted outcomes.

Testing artifacts to retain

The evidence folder an examiner, notified body or internal auditor will ask for. GONATURELLE compliance reports export most of it from signed runs.

evidence/cfpb-adverse-action/6 items
  • 01Reason-code mapping from model features to notice language, owned by compliance
  • 02Per-case alignment report: stated reasons versus model attribution, with mismatches listed
  • 03Paired-case proxy test results across protected-basis perturbations
  • 04Notice template versions and the prompt versions that populate them
  • 05Timing analysis showing notice generation within 30 days for all test trajectories
  • 06Signed run manifests retained alongside the 25-month record retention schedule

GONATURELLE assertion rules

Each assertion maps to a requirement above. Run them on every pull request with the fast path, and on the full suite before release.

adverse_action_reg_b.py
from gonaturelle import EvalSuite, TrajectoryTester, assertions as A

suite = EvalSuite.load('fintech/adverse-action-reg-b')
results = suite.evaluate(agent=underwriting_agent, max_concurrency=10)
results.assert_tool_schema_valid()

declines = results.filter("outcome == 'declined'")

# 1002.9(b)(2): every stated reason must trace to a principal model factor
declines.assert_all([
    A.reasons_match_attribution(source='score_model.attributions', top_k=4, min_overlap=1.0),
    A.no_pattern_in_output(patterns=['internal standards', 'did not meet our criteria']),
    A.no_pattern_in_output(patterns=['race', 'national origin', 'marital status', 'public assistance']),
])

# FCRA 615(a): bureau pull implies bureau disclosure block
TrajectoryTester(declines).assert_implies('pull_credit_report', 'attach_fcra_disclosure')

# 1002.9(a)(1): a decision and a notice exist for every completed application
TrajectoryTester(results).assert_order('record_decision', 'issue_notice')
results.assert_all([A.max_steps(40), A.no_cycles(tool='request_documents', max_repeats=3)])

# Proxy probe: perturb names and ZIP codes, decisions must not move
results.paired('protected_basis_swaps').assert_invariant(['outcome', 'reasons'])
results.export_manifest('model_gov/adverse_action_run.json', sign=True)

Audit checklist

CFPB adverse action readiness0/10

CFPB adverse action testing questions

If the CFPB withdrew the AI circulars, does any of this still matter?

Yes. The circulars interpreted 12 CFR 1002.9, which has not changed. Regulation B and its commentary still require specific principal reasons, private plaintiffs can sue under ECOA, and state regulators enforce comparable rules. The withdrawal removed a policy statement, not the obligation. This guide is not legal advice.

Can an LLM write the adverse action letter?

It can draft it, but the reasons should come from the decision system, not from the language model's interpretation. Constrain the agent to select from the approved reason-code library populated by model attribution, then test that the selection matches.

How many reasons should a notice list?

The commentary indicates that disclosing more than four reasons is not likely to be helpful to the applicant. Test that the agent lists the principal reasons in order of importance and does not pad the list with weak contributors.

Related guides

  1. 1ECOA / Reg BECOA & Regulation B Fair Lending AI Testing Guide · United States (federal)
  2. 2SR 11-7 / SR 26-2SR 11-7 Model Risk Management LLM Validation Guide · United States (federal)
  3. 3Colorado AI ActColorado AI Act Consumer Bias & ADMT Testing Guide · Colorado, US
  4. 4FTC Section 5FTC Section 5 AI Claim Substantiation Testing Guide · United States (federal)

Run CFPB adverse action assertions in CI.

Load the vertical pack, add these assertions to your suite and keep the signed run manifest as evidence. 14-day free production trial, no card.

Start free trialBook a technical demo