If the "vendor" is acting in the capacity of an indirect lender it will depend on how you outline the adverse action notice responsibilities in your contract.
Official Interpretation
9(g) Applications submitted through a third party.
1. Third parties. The notification of adverse action may be given by one of the creditors to whom an application was submitted, or by a noncreditor third party. If one notification is provided on behalf of multiple creditors, the notice must contain the name and address of each creditor. The notice must either disclose the applicant's right to a statement of specific reasons within 30 days, or give the primary reasons each creditor relied upon in taking the adverse action—clearly indicating which reasons relate to which creditor.