Compliance Blog

The NAFCU compliance team receives many questions about Regulation B’s adverse action notice requirements. Adverse action notices were included in the National Credit Union Administration’s (NCUA) 2019 supervisory priorities, and the NAFCU compliance team has written several times about them. Here are some of our most recent publications on the subject:

• Loan Modifications, Skips, and Adverse Action Notices;
• When to Include a Credit Score on Adverse Action Notices;
• What to do when you don’t: Let’s talk about Adverse Action Notices;
• Adverse Action Notices for Cosigners;
• Joint Applicants and Adverse Action Notices;
• Prequalifications and Adverse Action Notices; and
• Adverse Action Notices: NCUA Supervisory Priority for 2019.

Most of our past efforts have focused on what is required when notifying consumers about adverse action taken by a credit union. Today’s blog will solely focus on the Regulation B adverse action requirements as they pertain to business credit applicants.

The Fair Credit Reporting Act’s (FCRA) adverse action notice requirements only apply to individual consumers. See, 15 USC §§ 1681a(c), 1681m(a) & 1681m(b)(1) & (2). While adverse action under the FCRA encompasses a variety of different actions, the FCRA’s definition of adverse action includes anything that would be adverse action under ECOA. See, 15 USC § 1681a(k)(1)(A). But notices of adverse action under the FCRA are only required if a credit union takes “adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report . . . .” See, 15 USC § 1681m(a). The question about whether an adverse action notice might be required under the FCRA for a business credit applicant if a credit union takes adverse action under Regulation B depends on whether the action taken was based in whole or in part on information contained in a consumer report. For example, FCRA adverse action notice requirements could apply to an application for business credit when the borrower is a sole proprietor and an adverse action is taken based in whole or in part on information contained in the sole proprietor’s individual consumer report.

What Constitutes Business Credit Under Regulation B?

As this NAFCU Compliance blog from last year explains, Regulation B, which implements the Equal Credit Opportunity Act (ECOA), and all of its requirements, including those governing adverse action notices, apply to both consumer and business credit. Regulation B defines business credit as “extensions of credit primarily for business or commercial (including agricultural) purposes, but excluding extensions of credit of the types described in § 1002.3(a)-(d).” These exclusions encompass:

• Public utilities credit, which includes when an electric utility bills users after providing the electricity service (see, comment 3(a)-2);
• Securities credit, which includes when a broker or dealer covered by the Securities Exchange Act of 1934 is deemed to have extended credit;
• Incidental credit, which includes things like deferring debt when there is no finance charge for doing so and no agreement permitting installment payments (see, comment 3(c)(-1)); and
• Government credit, which includes “extensions of credit made to governments or governmental subdivisions, agencies, or instrumentalities.”

It is important to remember that these exceptions are not absolute exceptions from all Regulation B requirements. Section 1002.3 merely identifies specific requirements that may not be applicable to these four types of credit. For example, section 1002.3(c)(2)(vi) and section 1002.3(d)(2) note that adverse action notice requirements do not apply to incidental credit or government credit.

Adverse Action Notice Requirements For Business Credit

Section 1002.9(a)(3) governs adverse action notice requirements for business credit applicants. The rule distinguishes between business credit applicants that have gross revenues of $1 million or less in the preceding fiscal year and those that have gross revenues greater than $1 million.

Gross Revenues of $1 Million or Less

If a business credit applicant has gross revenues of $1 million or less, then section 1002.9(a)(3)(i) requires credit unions to comply with the requirements set forth in sections 1002.9(a)(1) and (2). For a business credit applicant with gross revenues of $1 million or less, Regulation B requires complying with the timing requirements in section 1002.9(a)(1), including notifying an applicant of action taken within 30 days after receipt of a completed application, but oral notice when adverse action is taken will suffice. This provides a credit union with greater flexibility because business credit applicants with gross revenues of $1 million or less can be provided with oral notice of the action taken unlike consumer credit applicants who need to receive written notice of the action taken under section 1002.9(a)(2).

Regulation B also gives credit unions more flexibility regarding the statement of specific reasons requirement. In lieu of providing a written statement of specific reasons as required by section 1002.9(a)(2)(i), a credit union may disclose the business credit applicant's right to a statement of reasons on the application if the disclosure contains the information required by section 1002.9(a)(2)(ii) (i.e., right to receive statement of specific reasons, timing requirements, contact information to use in obtaining the statement of reasons, right to have statement of reasons confirmed in writing if provided orally) and section 1002.9(b)(1) (i.e., the ECOA notice).

For business credit applicants with gross revenues of $1 million or less who make an application for credit by phone, the rule provides even greater flexibility. Section 1002.9(a)(3)(i)(C) permits providing an oral statement of the action taken and an oral disclosure of the information required by section 1002.9(a)(3)(i)(B)—the information about the statement of reasons that would otherwise be disclosed on the written credit application. This makes sense because of the difficulty in providing that written disclosure about the statement of reasons when taking an application by phone.

Gross Revenues in Excess of $1 Million

For businesses with gross revenues greater than $1 million in the preceding fiscal year, section 1002.9(a)(3)(ii) requires notifying the business credit applicant of the action taken within a reasonable time rather than imposing the 30-day timing requirement from section 1002.9(a)(1)(i) following receipt of a completed application. Neither the rule nor the commentary explains the boundaries of what constitutes a reasonable time, but the commentary suggests that complying with the timing requirements for consumers—within 30 days of receipt of a completed application—will satisfy the rule. See, 12 CFR Part 1002, Supp. I, comment 9(a)(3)-1

As with applicants with gross revenues of $1 million or less, the credit union may provide the notice of the action taken orally or in writing. Regulation B also requires credit unions to provide these business credit applicants with a written statement of reasons for the adverse action and the ECOA notice described in section 1002.9(b)(1) if the applicants request in writing the reasons within 60 days of the credit union’s notification of the adverse action.

This is a little more lenient than what is required for business credit applicants with gross revenues of $1 million or less. That said, the commentary provides that a credit union can comply with Regulation B for adverse action notices sent to business credit applicants with gross revenues of greater than $1 million or  "an extension of trade credit, credit incident to a factoring agreement, or other similar types of business credit," if the credit union follows the requirements that relate to consumers or for businesses with gross revenues of $1 million or less. See, 12 CFR Part 1002, Supp. I, comment 9(a)(3)-4. Because it may be difficult to determine a business credit applicant’s gross revenue based on the application received by the credit union, Regulation B provides credit union’s with the flexibility to treat all business credit applicants the same. Whether the credit union chooses to have separate procedures for consumers, business credit applicants with gross revenues of $1 million or less, and business credit applicants with gross revenues greater than $1 million is ultimately a risk-based decision for the credit union.

One final thing to note about the requirements that govern business credit applicants with gross revenues greater than $1 million. These requirements also apply to “an extension of trade credit, credit incident to a factoring agreement, or other similar types of business credit” regardless of the applicant’s gross revenues. The commentary provides more guidance about what constitutes trade credit or factoring as contemplated by section 1002.9(a)(3)(ii). See, 12 CFR Part 1002, Supp. I, comments 9(a)(3)-2 & 3.

If a credit union seeks guidance about what these disclosures should look like under the rule, then the credit union can look to sample forms C-8 and C-9 in Appendix C to Regulation B.

While NCUA did not include adverse action notices in its list of updated supervisory priorities resulting from the COVID-19 pandemic, the CFPB noted that its prioritized assessments, which implement the CFPB’s targeted supervisory approach developed to deal with the effects of the COVID-19 pandemic, will look at how institutions complied with adverse action notice requirements for Paycheck Protection Program (PPP) loan applications. See, Prioritized Assessments FAQs, Question 11. While NCUA may or may not increase scrutiny on compliance with adverse action notice requirements for PPP loan applications, it may be useful to look at your credit union’s business credit adverse action policies and procedures to determine if there are any gaps that should be addressed.