What is the 30-Day ECOA Rule?

This is a guest post by one of our Compliance Cohort members, Jennifer Johnson.  Jennifer is a Vice President and Chief Risk Officer at a $225 million community bank, and shares her years of experience in multiple banks with us in this article.

In an ideal world, loan applicants would come to us fully prepared with all the documentation we need to make a loan decision. I don’t know about you, but I certainly do not live in that ideal world. More commonly, applicants come to us with a loan request and bits and pieces of what we need, which can lead us to stash applications on the shelf while we wait for more information. Time passes, and before you know it, we have violated Regulation B’s 30-day rule. “Wait!” you may say, “what are you talking about? I didn’t have a completed application! How could I have violated ECOA’s 30-day rule?”  

While it may be true that you didn’t have a completed application, if you stop there, you’re missing some of the important nuances of Regulation B’s notification requirements (i.e. the 30-day ECOA rule). I’d like to make the argument that any request for credit is subject to one of three 30-day notification requirements.

Application Definition and the 30-Day Rule

Before I get into the notification requirements under Regulation B, let’s make sure we’re on the same page about what constitutes an application. Regulation B §1002.2(f) says that an application is “an oral or written request for an extension of credit that is made in accordance with procedures used by a creditor for the type of credit requested.”  The key here is the word request. Notice, the request can be verbal or written. If you take written apps, they count. If you take phone apps, they count. Online requests? Yes. If you allow a customer to start the process by having a conversation with you while you input their information, that counts too. If you allow it (in other words, if it’s a procedure you use to take a request, whether formalized or not), it counts as an application. 

Notice, there is nothing in this definition that requires “six pieces of information” (that’s another regulation for another time.) Ultimately, if you have a request that is made in accordance with procedures used for the type of credit requested, you have an application.  


Hold that thought. We’ll come back to it. Let’s talk about notifications first. 

Approvals & the 30-Day ECOA Rule

Approval notification is the most pleasant part of this rule. A lot of people don’t realize it, but Regulation B §1002.9(a)(1) says that once we have enough information to approve a loan, we are required to notify the applicant of that fact within 30 days. The nice thing about this requirement, and the reason we don’t think about it much, is that there is no formal, written approval that must be sent. The notification may be express or by implication. For example, if we make the loan, it counts as notification (assuming it’s done in 30 days.) If we issue the applicant a credit card, it also counts as notification. 

There may be times when written notice is appropriate, though. For example, if you take a request for a mortgage preapproval, the best way to demonstrate approval may be through a letter you send stating that the applicant has been preapproved. The rule doesn’t disqualify verbal notification, but it will be more challenging to demonstrate that you have met the 30-day requirement if you don’t send a written letter which can be retained as your proof. 

Adverse Action & the 30-Day Rule

This notification is not as much fun, but it’s the one we probably think of most often when we talk about Regulation B’s 30-day rule. Once we have enough information to determine that we are going to take adverse action on a request, Regulation B §1002.9(a)(1) says we must notify the applicant of our decision within 30 days. While adverse action usually comes in the form of a denial to grant a credit request, it also includes a refusal to increase a line of credit when a customer requests it, termination of an existing account, or an unfavorable change to an existing account.  

One big difference you should note in this section is that notification of adverse action must be in writing for all consumer applicants (See Regulation B §1002.9(a)(2)-(3)). There’s not a verbal or implied option in this scenario. You do get some flexibility in the type of notification you provide to business applicants, however. Business applicants have some oral notification options depending on their size. Regardless of the applicant type, though, the notification of adverse action must occur within 30 days.   

Completed Applications & the 30-Day Rule

Okay, back to the completed application. Both 30-day notification requirements we’ve discussed so far are based on receipt of a completed application. In other words, you have enough information to make a decision about the request. Regulation B §1002.2(f) defines a completed application as a request in which “a creditor has received all the information that the creditor regularly obtains and considers in evaluating applications for the amount and type of credit requested (including, but not limited to, credit reports, any additional information requested from the applicant, and any approvals or reports by governmental agencies or other persons that are necessary to guarantee, insure, or provide security for the credit or collateral).”  

First, I want to emphasize that a completed application does not always mean you will have the six pieces of information you may look for in a mortgage application. For example, if you receive a request for a mortgage preapproval, you may have everything you would need to approve a traditional mortgage request except a property address (because one hasn’t been identified yet.) It’s still a completed application for that particular type of request. Alternatively, you may obtain the applicant’s credit report and know right away that you will be taking adverse action on a request. That’s a completed application too. The rule of thumb is that if you have enough information to evaluate the request and make a decision, you have a completed application for Regulation B. The regulation gives specific examples of this in the commentary to §1002.2(f). 

Incomplete Applications & the 30-Day Rule

So let’s assume you DON’T have enough information to either approve or deny the loan because the applicant hasn’t provided it to you. You can just sit on it, right?  


 Regulation B addresses this scenario too, first in §1002.2(f). At the end of the list of information that may be considered to be part of a completed application, the regulation says, “The creditor shall exercise reasonable diligence in obtaining such information.” 

Okay, fair enough. But where does the 30-day ECOA rule come into play? 

Let’s take a look at Regulation B §1002.9(c). This section sets the standard for the “reasonable diligence” we must perform in obtaining the information we need when an application is incomplete. It requires us to send notification to an applicant in 30 days . . . even if we don’t have enough information to make a decision. We have a couple options for this notification: 

  1. Send an adverse action notification (basically denying the request because we don’t have enough information to make a decision); or  

  2. Send a written notification that the application is incomplete. 

While there’s nothing wrong with using option 1, option 2 is usually my first choice, because we want to try and make the loan if possible, right? Option 2 allows us to send written notice to the applicant asking for specific information, so there’s no question as to what we need to make a decision. It also allows us to put a cutoff date on the request and inform the customer we will no longer consider the application if the information isn’t provided by that date. Please note that any notification that an application is incomplete must be written in order to satisfy the 30-day Reg B rule.  

If the customer provides the requested information after you send this notification, great. You now have a completed application and have 30 days to evaluation the application and notify the customer of your decision. If the customer does not provide the information, no problem. You’ve met the notification requirements of the 30-day ECOA rule and can close the file for incompleteness. 

I generally sum it up this way. If you receive a credit request from a customer, do one of three things within 30 days to be in compliance with Regulation B’s 30-day rule: 

  1. Approve the request, 

  2. Take adverse action on the request, or 

  3. Notify the customer that the request is incomplete and further information is needed. 

The type of notification you send in each of these scenarios may change depending on the action taken, but as long as you do one of the three, you should be in compliance with Regulation B’s 30-day rule. You can find more information about incomplete applications here

NCUA Speech Says NCUA Needs Greater Compliance Enforcement