My bank was bought by another bank and in reviewing adverse action notices I was told we must send privacy notices with all consumer adverse action notices. I do not believe this is required by the regulation. If the applicant is not a customer the notice is not required and if the applicant is a customer, the notice was provided at account opening. Can someone point me to a section of the regulation that addresses adverse actions?

There is no requirement to send a Privacy Notice with an AAN that I am aware of. If you share non public personal information outside of the Reg P exceptions, then you would need to ensure that all consumers receive a privacy notice, even if an ongoing relationship is not established- e.g., you decline the loan. It could be that a for a consumer who has no other relationship with the bank and who may have applied for a loan online or through your call center, sending the notice with the AAN is the best way to get it to him/her. However, if you do not share outside of the exceptions, then a privacy notice would not be required if no customer relationship is established.
BC

If the applicant is not a customer a privacy notice is not required as long as you aren't sharing information about these rejected applicants. See section .4(b) of the privacy regulations.