Perhaps this is too risky, but we've always followed Reg. B literally:
"(f) Multiple applicants. When an application involves more than one applicant, notification need only be given to one of them but must be given to the primary applicant where one is readily apparent."
We provide: one adverse action notice; listing all reasons for denial (but no more than four) without disclosing who was accountable for the adverse information. As an aside, there's not much guidance in the Commentary.
Of course, the rules changed not too long ago with respect to cosigners.
Merely my opinion...