Thursday, 9:40 a.m. A fair lending review pulls thirty declined applications from last month. Every adverse action notice is on time. Every reason is specific. Every disclosure is signed. On file 19, the notice lists two reasons — and neither one is why the file was declined. The loan officer’s notes say something else entirely.
Nobody approved that step. Nobody owns it. The reason codes on those adverse action notices are not in the QC checklist, the mapping from policy screen to decline reason is not in the exception log, and nobody has reconciled a reason to what drove the decision since the models changed.
This is the least dramatic version of what just happened to mortgage compliance.
What the CFPB Published on October 1
On October 1, 2026, the CFPB released its Fair Lending Report for 2025 to Congress. The enforcement numbers look like a retreat. The Bureau closed 76% of its supervisory actions — nearly 1,500 matters — roughly 12% of them fair-lending related. It initiated no new fair lending supervisory activity, cited no institution for a fair lending violation, and made no ECOA referrals to the Department of Justice. Across the eleven agencies with ECOA enforcement authority, 140 institutions were cited for ECOA or Regulation B violations, and no public ECOA enforcement action was brought in 2025.
Here is the part that should change your review schedule. The same report says ECOA examination work now focuses on three things: direct evidence of intentional discrimination on a prohibited basis, systemic failures to provide applicants with legally required notices of adverse actions, and the systems a lender uses to identify ECOA and Regulation B risk. HMDA exam work focuses on validating the accuracy of key data points.
Read that list again. Two of the three ECOA exam priorities are about the file in front of you, not the portfolio behind you. The statistical screen you scaled back in July is not what a 2026 exam is testing. The notice is.
Then on October 14, the OCC released Guaranteeing Fair Banking for All Americans, its review of debanking practices at the nine largest national banks it supervises — JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC, TD and BMO. The review covered September 2020 through September 2025, drawing on nearly 100,000 complaints and about 50,000 documents totaling roughly 420,000 pages. The OCC found broad reputation risk policies lacking clear standards and objective, risk-based criteria, plus industry-specific restrictions on oil and gas, coal, firearms, detention facilities, tobacco and digital assets.
Be precise about what that report does and does not say. It identifies no violation of law and announces no enforcement action. It did remove reputation risk from the OCC’s own supervisory framework, issue Bulletin 2025-22 allowing debanking to be considered in licensing and CRA exams, and signal further rulemaking. Hours later, the CFPB announced it will fully investigate whether the institutions in the report and others complied with federal consumer financial laws — naming ECOA, FCRA “particularly the adverse action notice requirements,” and UDAAP.
Four Risks That Replaced the Statistical Screen
Stripped down, a fair lending file is one of four things, and they are nowhere near equal in risk. The tiers are our suggested placements for your own scoring — no examiner grades declination files for you, so treat them as a starting position, not an official classification.
The inaccurate reason. The notice is timely, specific, and still wrong, because the reason the borrower was given is not the reason the file was decided. The CFPB has named systemic failures in adverse action notices as an exam priority, so a notice that cannot be tied to the decision is a finding waiting for a file. Our suggested tier: High.
The reputation-risk screen. A decline that passed through a policy screen — an industry, a brand, an ESG or reputation review, a manual escalation — and left no trace on the notice, because the screen is not a “credit reason.” The risk is what the OCC documented: criteria broad enough to apply inconsistently, and outcomes nobody can reconstruct later. Our suggested tier: High.
The stale notice regime. Templates, timing and disclosures that were correct in 2024 and have not been re-read since. Section 1002.9 was not amended by the April rule, so the 30-day notice requirement and the specific-reasons standard still apply exactly as they did. The risk is that the file reads like a rulebook from a year ago. Our suggested tier: Moderate.
The data that does not reconcile. HMDA data points that do not tie back to the source document, or a reason code in the loan system but not on the notice. The exam focus the CFPB named for HMDA is the accuracy of the key data points. Our suggested tier: Moderate.
The line worth memorizing: a statistical test tells you what your portfolio looks like. An adverse action notice tells the examiner what your lender did to one applicant.
What the Rules Actually Say Now
Last verified against primary sources October 21, 2026. This is a moving target — state law changes and the regulators are still writing. Re-verify before you rely on any of it.
What the April rule changed, and what it did not
Start with what did not change, because the volume of material saying otherwise is the problem. The CFPB’s final rule amending Regulation B was published April 22, 2026 and took effect July 21, 2026 (91 FR 21620, Docket No. CFPB-2025-0039). It removed the effects test and states ECOA does not authorize disparate impact liability. It did not amend 12 CFR 1002.9: the duty to give the specific principal reasons for adverse action within 30 days of a completed application is untouched, as is FCRA’s adverse action requirement and the credit score key factor disclosure. Disparate treatment survives in full under ECOA.
And the rule amended Regulation B only. Disparate impact remains available under the Fair Housing Act, which the CFPB cannot amend, under HUD’s FHA disparate impact standard, whose rulemaking is still open, and under state regimes — New Jersey, New York, and Illinois from January 1, 2027 — plus private litigation. We covered that in why state fair lending rules now drive your testing and in what the ECOA rule eliminated and what lenders must fix in fair lending QC. The short version has not changed.
The scope of what the CFPB can actually reach
One scope point, and it matters. ECOA reaches credit, not deposit accounts, and does not list political beliefs as a prohibited basis. The OCC placed state-law compliance outside its scope. So the live theories are the three the CFPB named: ECOA, FCRA — especially the adverse action notice requirements — and UDAAP. Debanking is the context. The document you can be held to is the notice.
Watch three things. HUD’s FHA disparate impact rulemaking. State adoption of new testing expectations, and the multi-state letter opposing the federal rule. And further OCC rulemaking on reputation risk and pretextual account terminations.
The risk nobody has absorbed
The risk most operators have not absorbed is the mapping. The CFPB now describes an exam that looks for a lender’s systems for identifying ECOA risk and for systemic failures in adverse action notices. Accurate reasons with no evidence that the reasons came from the decision is half of what that exam needs. The Massachusetts Attorney General’s 2025 Earnest settlement is the most detailed published template of what a state regulator expects: interpretable models, every decline reason validated, principal reasons stated specifically and accurately. It binds one lender, not you — but it is a template you can be examined against.
The Numbers Vendors Want You to Believe
Before the controls, a word about the arithmetic, because these numbers will reach a board deck whether you are ready or not. The headline number in fair lending software right now is relief: disparate impact testing is no longer a federal requirement, the effects test is gone, and the statistical review that ate a quarter of your compliance calendar can be scaled back. For ECOA that is largely true, and we wrote about it.
The second number is certainty, and that is where the risk is. Some vendors still sell disparate impact testing as the requirement it no longer is. Some sell “compliant with the 2026 Reg B” as if the April rule resolved fair lending exposure. Others quote guidance the CFPB has withdrawn — 67 documents, seven fair-lending related, in May 2026 — while vendor pages kept citing a “CFPB Circular 2026-03” that does not exist.
- Which regime are you actually answering to? A vendor’s “compliant” claim is a claim about ECOA. Your book is also covered by the Fair Housing Act, HUD’s FHA standard, and the state regimes where you operate. Ask which regimes it maps to.
- What is the denominator? Coverage of a statistical test is not coverage of the notice. A product that scans your portfolio and reports a pass has not tested one declination notice.
- What is the measurement window? Ask when the vendor last reviewed its regulatory content against the April 22 rule and the July 21 effective date. Where guidance is withdrawn quarterly, content with a 2024 review date is a liability.
Keep the ROI column separate from the evidence column. A lender with both a credible efficiency claim and a defensible file walks into a review with an answer. A lender with only the first one is negotiating one.
Six Controls to Put Around Your Adverse Action Process
None of this requires a data scientist. All of it is something an examiner can ask for on the record.
- Test the notice against the file, not the template. Pull the notice and the credit file together. Confirm the reasons on the notice are reasons that appear in the file, and that nothing else drove the outcome.
- Map every decline reason to what actually drove the decision. If a model or a policy screen is in the path, document the mapping and validate it the way the Massachusetts settlement describes: interpretable models, every reason validated, no reason invented to fill a menu.
- Inventory every screen that can end a file. Reputation risk, brand, ESG, industry, manual escalation. For each, write down the objective criteria, who applies it, and where it shows up in the file. A screen that can decline a file and never appears on the notice is the gap the OCC documented.
- Stop letting reason codes be a dropdown. The Earnest assurance alleged that staff picked an available reason when the real one was not on the menu, and that auto-generated reasons sometimes produced nothing specific. Both are cheap to prevent, expensive to catch.
- Reconcile your HMDA data points to source. The exam focus is accuracy. Sample the fields, trace them to source, and fix the definition, not the file.
- Date and version your fair lending policy. Record what changed, when, on whose authority, and re-verify the citations before each exam cycle. A 2024 review date is a finding waiting to happen.
Where to Start on Monday
You do not need a program. You need a week. Pull thirty declination files closed in the last 90 days. For each, produce the notice, the credit file, the reason-code mapping, the source of the decision, the policy behind any screen, and the HMDA data points. Any gap you find now is a roadmap. The same gap, found by an examiner, is a finding — and if you would rather someone else pull the sample, our fair lending compliance assessment runs that review.
Adverse action notices are the cheapest artifact in a mortgage file and the most expensive one to get wrong. The CFPB has told you what it is looking at. Now it is whether your file can answer it.
Compliance guidance for discussion, not legal advice. Requirements vary by lender, product, and state, and state adoption is still moving. Consult counsel on your facts.
Synergy supports mortgage banks and credit unions that have to answer for fair lending in a file, not a slide deck — adverse action notice review, declination file testing, and policy work that holds up on the record. Book a 30-minute call and we will send our one-page declination review checklist for last quarter’s files.
