Yes. In the US, ECOA and Regulation B require a creditor to give specific reasons when it denies credit or takes other adverse action, and that duty does not change because a model or an agent was involved. The harder part is accuracy: the reasons must be what the decision rested on, not a plausible story written afterwards.
What do the rules require, in plain words?
The Equal Credit Opportunity Act and its implementing Regulation B prohibit discrimination in credit and require creditors to notify applicants of adverse action. The notice must give the specific principal reasons for the decision, or tell the applicant how to obtain them. Vague statements such as "you did not meet our internal standards" do not satisfy the rule. The requirement applies when a model is used to make or support the decision, however complex that model is. Our entry on what an adverse action notice is covers the basics.
Supervision of these rules sits with the CFPB and the prudential banking regulators, among others. Other markets reach similar ground by different routes: the EU AI Act lists creditworthiness assessment and credit scoring of natural persons as high-risk, and the UK's Consumer Duty expects firms to support customers' understanding of decisions that affect them.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
Creditors: banks, credit unions, finance companies, lenders of many kinds, and others who regularly make credit decisions. The duty belongs to the creditor, not to a vendor whose agent or model it uses. If you buy a decisioning tool, you still owe the applicant accurate reasons.
What changes when an agent helps decide?
Three things become harder.
First, the decision may rest on several steps: the agent gathers data, checks it against policy, applies a scorecard or model, and drafts a recommendation that a person approves. The reasons must reflect the factors that actually drove the outcome across those steps.
Second, language models are good at producing fluent explanations. An agent asked "why was this declined?" may give a reasonable-sounding answer that is not what drove the decision. That answer must not become the notice. Our view on why adverse action reasons are harder when an agent helped explains the risk.
Third, a person approving the agent's recommendation does not remove the duty. The creditor took adverse action either way.
How do you meet it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Specific principal reasons | Reasons drawn from the policy rules and model factors recorded for the decision, not from free-text explanation | Reason codes stored with each decision |
| Accuracy | Reasons tested in certification against cases where the true reasons are known | Certification results for the reason step |
| Timely notice | Notice drafted by the agent at depth 2 from stored reason codes, sent within your process | Sent notices with dates |
| Consistency | One reason-code library across agents and channels | Versioned library |
| Fair lending | Monitoring outcomes across groups as your compliance programme requires | Monitoring reports |
| Human review | Credit officer approves declines where policy requires | Approval on the filed record |
The guide to ECOA and Regulation B adverse action reasons when an AI agent is involved works through each row in more detail.
What will an examiner ask?
Expect: how do you know the reasons on the notice are the real principal reasons? Show me a declined application, its stored factors and its notice. What happens if the agent's explanation and the stored reason codes disagree? How do you test reason accuracy when the brief or model changes?
What does that look like in practice?
Say a credit union uses an agent to assess personal loan applications. The agent gathers the credit report, income and existing debts, applies the credit union's scorecard and policy rules, and drafts a recommendation. Declines are approved by a loan officer.
Each decision stores the scorecard factors and any policy rule that failed. For a decline, the agent drafts the notice using only those stored reasons, such as "debt obligations too high relative to income" and "length of credit history". It is not allowed to write its own explanation into the notice. In certification, reviewers check that the drafted reasons match the stored factors on a set of past declines. The loan officer sees both before approving.
What does it not cover?
The notice rules do not make a decision fair or lawful in other respects. Discrimination, data use and model risk have their own requirements. And the notice duty is separate from any rights the applicant may have under other laws to dispute the data the decision used.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Can the agent write the adverse action notice?
It can draft it from stored reason codes, and a person or a controlled template sends it. It should not generate the reasons itself.
Does a declined credit limit increase count?
Adverse action covers more than outright denial of new credit, and can include some changes to existing accounts. Check the definition with counsel for each product.
What if the decision was made by a person using the agent's summary?
The creditor still owes specific reasons. They should reflect what the person relied on, which is why the agent's summary must show its sources and factors.