Regulation B applies, and the exemption is far smaller than the phrase "limited exceptions" suggests. Only two provisions drop out for public utilities credit: 12 CFR 1002.5(d)(1), on asking about marital status, and 1002.12(b), on record retention (1002.3(a)(2)). Everything else in the regulation stands, including the general bar on discrimination. The official commentary makes the application to deposits explicit rather than leaving it to inference. Comment 3(a)-2 says a utility company "is a creditor when it supplies utility service and bills the user after the service has been provided. Thus, any credit term (such as a requirement for a security deposit) is subject to the regulation's bar against discrimination on a prohibited basis." So a utility may decide that an applicant is a credit risk, and it may not reach that decision on the basis of race, color, religion, national origin, sex, marital status, age, or the fact that income comes from public assistance.
The consumer-report side is where a reader gets something actionable. A utility that pulls a credit file to decide about a deposit is doing so under the permissible purpose at 15 U.S.C. 1681b(a)(3)(F)(i), a legitimate business need in connection with a transaction the consumer initiated. The Fair Credit Reporting Act then defines adverse action broadly, to include an action taken in connection with an application made by a consumer that is "adverse to the interests of the consumer" (1681a(k)(1)(B)(iv)). A demand for several hundred dollars that would not have been made had the file looked different fits that description. Where it does, 1681m(a) requires the utility to notify the consumer, to identify the consumer reporting agency that supplied the report, to say that the agency did not make the decision, and to tell the consumer about the right to a free copy of the report within 60 days and the right to dispute what is in it. That is the practical route to getting a deposit reduced or removed: find out which file was used, read it, and dispute anything wrong in it.
The numbers all come from the state, and Pennsylvania's rules show how much detail sits at that level. Under 52 Pa. Code 56.32, a public utility may require a cash deposit equal to one-sixth of the applicant's estimated annual bill, and only on stated grounds: a prior account terminated for reasons the rule lists, or an applicant who cannot establish creditworthiness through a credit scoring methodology filed in the utility's tariff that "must specifically assess the risk of public utility bill payment". The Commission's own policy statement at 56.31 requires the judgment to rest "upon the credit risk of the individual applicant or customer rather than the credit history of the affected premises or the collective credit reputation or experience in the area in which the applicant or customer lives", which forecloses judging an applicant by the address. An applicant confirmed eligible for the utility's customer assistance program may not be charged a deposit at all (56.32(e)). Where credit is denied, the utility must give written reasons within three business days, naming the provider of the credit score and explaining how to challenge it and how to reach that provider (56.36(b)(1)). And a customer who cannot post cash may offer a third-party guarantor instead, in writing (56.33).
Getting the money back is a schedule rather than an event. Pennsylvania's utility may hold the deposit until "a timely payment history is established", which the rule defines as paying in full and on time for 12 consecutive months; at that point the utility deducts any outstanding balance and returns or credits the difference (56.53(a)-(c)). If service ends first, the balance is deducted and the positive difference returned within 60 days (56.53(d)). Interest accrues on the deposit until it is returned or credited, at the simple annual rate the Secretary of Revenue sets for underpayment of tax, reset each January 1 (56.57). Those are Pennsylvania's numbers. Another state's commission will have its own, and some have none, which is why the only correct general statement is that this is a question for the commission that regulates the provider.
Two limits are worth knowing before assuming any of this applies. First, these are rules for regulated utilities. A municipal electric or water system, a rural electric cooperative, or a company delivering propane or heating oil may not be under the state commission at all, and the deposit rules, the notice rules and the shutoff protections that go with them may simply not reach it. Second, a deposit that is never claimed does not vanish: an unrefunded utility deposit is a classic item of unclaimed property, which a holder eventually must turn over to a state that holds it as custodian until the owner asks for it.