Your question doesn’t clarify whether a legitimate applicant provided fraudulent information in connection with an application or whether the person requesting credit assumed the identity of another. According to Regulation B an adverse action notice must be sent to an applicant within 30 days after receiving a completed application. The term application means an oral or written request for an extension of credit that is made in accordance with procedures used by a creditor for the type of credit requested. We suggest that you state in your procedures that any application containing fraudulent information is not consider as an application and that any request for credit received from a fraudulent applicant is also not considered as an application. This should eliminate future concerns. For now, if a legitimate applicant submits fraudulent information send an adverse action notice and indicate the reason(s) for denial, such as “unable to verify income.”