Ecoa Compliance: Regulation B Rules, Notices, and Lender Risk

ECOA compliance requires creditors to evaluate applicants on objective financial factors and never on protected characteristics.

The Equal Credit Opportunity Act, codified at 15 U.S.C. § 1691 and following sections, prohibits discrimination based on race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or the good faith exercise of consumer credit rights. It applies to consumer and business credit alike. Historically, fair lending programs also tested for neutral policies that produced discriminatory effects, but current Regulation B developments should be reviewed carefully, because the CFPB's 2026 amendments removed the effects test from Regulation B and stated that ECOA does not recognize disparate-impact liability.

Regulation B implements ECOA, and it is codified at 12 C.F.R. Part 1002.

The Consumer Financial Protection Bureau writes and enforces Regulation B, a role it took over from the Federal Reserve under the Dodd-Frank Act in 2010. Regulation B fills in the operational detail behind the statute, including notices, application evaluation, and recordkeeping. Because Regulation B was amended in 2026, lenders should confirm the current rule text and official guidance before relying on older ECOA compliance materials.

Creditors must notify applicants of action taken on a completed application within 30 days.

If a lender denies credit or offers less favorable terms, it must send an adverse action notice that states the specific reasons or explains how to obtain them. For loans secured by a first lien on a dwelling, creditors must also give applicants copies of all appraisals and valuations. These disclosure duties exist so applicants can understand and challenge decisions.

Lenders may ask about anything relevant to creditworthiness, but several personal questions are off limits.

Creditors generally cannot ask about marital status on an individual unsecured application, except in community property states or for joint or secured credit. They cannot ask whether an applicant plans to have children. They also cannot discount protected income such as alimony, child support, public assistance, or part-time wages. Knowing these permissible and prohibited inquiries is central to daily ECOA compliance.

If your application forms or scripts have not been reviewed recently, audit them now. A single noncompliant question, repeated across thousands of applications, can become systemic exposure.

An ECOA compliance checklist should cover policies, fair lending testing, training, notices, and record retention.

At a minimum, the program should include written nondiscrimination policies, documented staff training, and templates for adverse action notices. Fair lending testing should review underwriting, pricing, marketing, adverse action reasons, and outcomes for patterns that may indicate compliance risk. Consumer credit records are generally retained for 25 months, while many business credit records are retained for 12 months, with special rules for certain large-business, trade-credit, and enforcement situations. Embedding these controls within your corporate risk and governance framework, alongside consistent loan agreements and disputes handling and a periodic compliance review, keeps the program defensible.

Regulators enforce ECOA through examinations, civil actions, and mandatory referrals to the Department of Justice.

The CFPB, FTC, OCC, FDIC, and NCUA share enforcement depending on the institution. Under 15 U.S.C. § 1691e, agencies must refer suspected patterns or practices of lending discrimination to the DOJ. The CFPB and DOJ continue to enforce ECOA actively, especially in mortgage lending, marketing, and redlining matters. For example, the DOJ reported that its Combating Redlining Initiative had secured more than $107 million in relief as of late 2023, and lenders should review the latest fair lending reports for current figures.

ECOA noncompliance can lead to actual damages, punitive damages, and government enforcement penalties.

Under 15 U.S.C. § 1691e, punitive damages can reach $10,000 in an individual action and, in a class action, the lesser of $500,000 or one percent of the creditor's net worth. Violations can also trigger consumer litigation similar to debt collection litigation and related claims under laws like the FDCPA. The 2024 Seventh Circuit decision in CFPB v. Townstone Financial addressed discouragement of prospective applicants, but lenders should also review the CFPB's 2026 Regulation B amendments, which modified the discouragement rule.

You do not always need a lawyer for routine ECOA compliance, but legal guidance is valuable for audits, examinations, and disputes.

Counsel can review policies, test lending outcomes, and respond to regulatory inquiries before they escalate. Because fair lending rules change through new rulemaking and court decisions, periodic legal review keeps a program current. If your institution faces an examination finding or a discrimination claim, consult qualified counsel promptly to protect your position and limit exposure.

ECOA compliance is the practice of following the Equal Credit Opportunity Act and Regulation B when making credit decisions. It requires creditors to evaluate applicants on objective financial factors, avoid discrimination on protected bases, send timely notices, and keep proper records of applications and adverse action decisions.

Regulation B implements ECOA and appears at 12 C.F.R. Part 1002. The Consumer Financial Protection Bureau writes and enforces it after assuming that authority from the Federal Reserve under the Dodd-Frank Act. Regulation B sets the detailed rules for notices, application evaluation, inquiries, and recordkeeping.

According to the CFPB, 2026 amendments to Regulation B removed the effects test and stated that ECOA does not recognize disparate-impact liability, and they modified the discouragement rule. Because these changes affect fair lending programs, lenders should confirm the current rule text and official guidance before relying on older materials.

Yes, ECOA applies to business credit as well as consumer credit. Creditors generally cannot discriminate on prohibited bases in commercial lending, and certain notice and recordkeeping duties apply, though some rules differ. For example, many business credit records are retained for 12 months rather than the 25 months used for consumer applications.

ECOA permissible inquiries focus on creditworthiness, such as income, debts, assets, and credit history. Creditors may ask about existing dependents and obligations, but not whether an applicant plans to have children. Marital status questions are limited, and protected income like alimony or public assistance cannot be discounted.

An adverse action notice is a required communication when a creditor denies credit or offers less favorable terms. It must state the specific reasons for the decision, or explain how to request them, and identify the relevant regulatory agency. Timely, accurate notices are a core ECOA compliance duty.

Penalties for violating ECOA include actual damages and punitive damages of up to $10,000 in individual actions, or the lesser of $500,000 or one percent of net worth in class actions, under 15 U.S.C. § 1691e. Regulators can also impose civil penalties and corrective requirements.