The FCRA was originally passed in the Omnibus Federal Consumer Credit Protections Act, along with other important legislation such as the Truth in Lending Act and the Fair Debt Collection Practices Act. Together, the Federal Consumer Protections Act introduced landmark legislation (for the time) aimed at curbing consumer abuse within lending, debt collection, and credit reporting practices. Now, more than 50 years since its inception, the FCRA has undergone substantial rewrites, revisions, and additions, amended by Congress many times over, and has become a legal cornerstone of basic financial rights for consumers.

With Congress’ enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), among other modifications, the Consumer Financial Protection Bureau (CFPB) was granted rulemaking authority under the FCRA (excluding § 1681m(e) (red flag guidelines and regulation) and § 1681w (disposal of records)). And on December 21, 2011, the CFPB restated and implemented FCRA regulations as Regulation V (12 CFR 1022). Today, the CFPB maintains this rulemaking authority of the FCRA, as implemented by Regulation V.

This white paper will provide an overview of the FCRA’s and Regulation V’s main proponents applicable to financial institutions, common compliance pitfalls, and best practices. Baldini Lang LLC has extensive experience assisting clients in building compliance programs and policies to meet their legal requirements and establish best practice standards. Contact us for more information.

FCRA’s and Regulation V’s Application to Financial Institutions

Although generally speaking, the FCRA and Regulation V are targeted at regulating consumer reporting agencies (CRAs), furnishers of information to CRAs, and users of consumer reports received from CRAs also have specific compliance obligations. Accordingly, while financial institutions are not CRAs, a financial institution will typically fall within the confines of the FCRA and Regulation V as either: (1) a furnisher of information or (2) a user of consumer reports. It is important to note that there is no legal requirement for a financial institution to furnish information to CRAs; reporting information to CRAs is completely voluntary. However, if a financial institution chooses to furnish such information to CRAs, it must comply with the requirements set forth in the FCRA and Regulation V.

Duties of Furnishers

Under Regulation V, a “furnisher” is “an entity that furnishes information relating to consumers to one or more consumer reporting agencies for inclusion in a consumer report.” 12 CFR 1022.41(c). There are a few narrow exclusions to this broad definition, including (i) the consumer to whom the information pertains and (ii) an associate of the consumer providing information in response to a specific request by a CRA. Any other person reporting information to a CRA is a “furnisher.”

Furnishers generally have the following duties under the FCRA and Regulation V:

1. Duty to provide accurate information. 15 U.S. Code § 1681s–2(a)(1).

Furnishers hold a duty to provide accurate information and are prohibited from reporting any information that it “knows or has reasonable cause to believe that the information is inaccurate.” 15 U.S. Code § 1681s–2(a)(1)(A).  A furnisher is not required to rely solely on an allegation by the consumer that information is inaccurate; however, if a furnisher has specific knowledge that leads to reasonable and substantial doubts about the accuracy of the information (regardless of whether the consumer initially raised such claim of inaccuracy or not), then such information shall not be reported to a CRA. Financial institutions should also be aware that special reporting requirements may apply to private education loans for which the financial institution offers the consumer a loan rehabilitation program.

Some common violations of the duty to provide accurate information include:

• Misstating the balance due;
• Listing members as a debtor on an account when they are only the authorized user; and
• Reporting debt as charged off when member settled it or paid it in full.
• Reporting timely payments as late

Nonetheless, the FCRA generally provides a broad safe harbor for violations of this duty if furnishers clearly and conspicuously specify an address where consumers can send disputes concerning the accuracy of their information. All furnishers should be sure to implement procedures to take advantage of this safe harbor and shield themselves from violations resulting from the furnishing of inaccurate information.

2. Duty to implement policies and procedures to ensure the provision of accurate information. 12 CFR 1022.42.

Additionally, in support of a furnisher’s obligation to provide accurate information, Regulation V further requires that all furnishers implement written policies and procedures (appropriate its nature, size, complexity, and scope of activities) to ensure the accuracy and integrity of consumer information reported to CRAs. Appendix E to Regulation V provides guidelines financial institutions should reference and incorporate into such policies. Furnishers must periodically review and update such policies to maintain their effectiveness and compliance with the FCRA.

3. Duty to correct and update information. 15 U.S. Code § 1681s–2(a)(2).

If a financial institution furnishes information that it later determines is inaccurate or incomplete, the financial institution has the duty to correct and update that information by promptly notifying the CRA(s) to which such information was furnished of such inaccuracy. This duty remains regardless of the application of any safe harbor that may apply to inaccurate information so furnished, as mentioned above.

4. Duty to correct and update information. 15 U.S. Code § 1681s–2(a)(2).

If a consumer disputes the completeness or accuracy of any information, the furnisher must provide notice of the dispute to the CRA. The furnisher may not continue to provide such disputed information to any CRA unless the furnisher also notifies such CRA that the consumer disputes the information.

5. Duty to provide notice of closed accounts. 15 U.S. Code § 1681s–2(a)(4).

As a furnisher, a financial institution holds the duty to provide notice of closed accounts to the CRA. If a financial institution regularly reports to CRAs information regarding a consumer who has a credit account, the financial institution shall also notify such CRAs of any voluntary closure of the credit account by a consumer (as may be applicable) in its next regular report to the CRA.

6. Duty to provide notice of delinquency of accounts. 15 U.S. Code § 1681s–2(a)(5).

A furnisher is responsible for providing notice of the delinquency of accounts to CRAs. If a furnisher reports information to a CRA about a delinquent account being placed for collection or charged to profit or loss, the furnisher must notify the CRA of the delinquency date of the account within 90 days of reporting the information (subject to narrow exceptions). The delinquency date is the month and year the first payment was missed.

7. Duties of furnishers upon notice of identity theft-related information. 15 U.S. Code § 1681s–2(a)(6).

Furnishers have a duty to take certain actions upon receiving notice of identity theft. A furnisher is required to implement and maintain reasonable procedures to prevent (i) its refurnishing of any information upon notification from a CRA that such information is the result of identity theft of the consumer; and (ii) its furnishing of information that a consumer as informed is the result of identity theft unless the furnisher subsequently obtains actual knowledge or is informed by the consumer that such information is correct.

8. Duty to provide notice of negative information. 15 U.S. Code § 1681s–2(a)(7).

A financial institution has a duty to provide a consumer with written notice of any negative information, which includes any information concerning a customer’s delinquencies, late payments, insolvency, or any form of default, that it reports to a CRA. If subsequent negative information is provided to the CRA regarding the same transaction, extension of credit, or account, a financial institution is not required to provide subsequent notice to the consumer; the initial notice is sufficient.

Under the FCRA, such written notice to the consumer: (i) must be provided prior to or within 30 days of reporting the negative information to a CRA; (ii) must be clear and conspicuous; and (ii) may be combined with other disclosures, such as a notice of default or a billing statement. The CFPB provides model forms in Appendix B of Regulation V that may be used by financial institutions; a financial institution that chooses such model form shall be deemed to comply with this duty.

Notwithstanding the foregoing requirements, a broad safe harbor for non-compliance is also provided. Generally, a financial institution will not be liable for a violation of its duty to notify consumers of negative information if: (i) the financial institution maintains reasonable policies and procedures to comply with this duty; or (ii) the financial institution reasonably believes it was prohibited, by law, from contacting the consumer. Accordingly, all financial institutions should implement and maintain appropriate policies and procedures to avail themselves of this safe harbor and protect themselves from liability for any violations of such duty.

9. Duty to conduct a reasonable investigation if information is disputed directly. 15 U.S. Code § 1681s–2(a)(8); 12 CFR 1022.43(e).

Subject to certain limited exceptions, upon receiving a notice of dispute from the consumer, a furnisher has the duty to: (i) conduct a reasonable investigation; (ii) review all relevant information provided by the consumer with the notice; (iii) report the results of the investigation to the consumer within 30 days (or as such time period may be extended under 15 USCS § 1681i(a)(1); and (iv) if the investigation finds that the information reported was inaccurate, promptly notify each consumer reporting agency to correct and update the information. Similar duties apply to a furnisher upon receiving notice of a dispute to the completeness or accuracy of any information pursuant to 15 USCS § 1681i(a)(2).

Exceptions to a furnisher’s duty to conduct a reasonable investigation may include (12 CFR 1022.43(b); 12 CFR 1022.43(f)):

• The dispute relates to certain identifying information such as name(s), date of birth, Social Security number, telephone number(s), or address(es).
• The dispute relates to the identity of past or present employers.
• The dispute relates to inquiries or requests for a consumer report;
• The dispute relates to information derived from public records, such as judgments, bankruptcies, liens, and other legal matters (unless regarding the consumer’s account or other relationship with the furnisher);
• The dispute relates to information related to fraud alerts or active duty alerts.
• The dispute relates to information provided by another furnisher.
• The furnisher reasonably believes the dispute is submitted or prepared by a credit repair organization.

The dispute is frivolous or irrelevant, provided the furnisher must notify the consumer within five business days after making such determination identifying the reasons for such determination and any information required to investigate the disputed information.

Duties of Users

Under the FCRA and Regulation V, although not explicitly defined, a “user” is generally any person that uses a consumer report. The FCRA and Regulation V prescribe certain duties to users of consumer reports; however, a broad safe harbor for non-compliance is also provided. Generally, the safe harbor will apply to any person that maintains reasonable procedures for compliance. 15 U.S. Code § 1681m(c). All users of consumer reports should implement and maintain such procedures to take advantage of this safe harbor and shield themselves from violations resulting from the use of consumer reports.

Users generally have the following duties under the FCRA and Regulation V:

1. Duty to provide notice of adverse actions based on information in consumer reports. 15 U.S. Code § 1681m(a).

A consumer report user that takes adverse action based in whole or in part on any information contained in the consumer report has the duty to provide notice of the adverse action to the consumer. Such notice is required to (i) disclose (a) the numerical credit score used in taking the adverse action, (b) the range of possible credit scores under the model used, (c) the key factors (not to exceed four) that adversely affected the consumer’s credit score in the model used, (d) the date on which the credit score was created, (e) the name of the person that provided the credit score or credit file; (ii) provide the name, address, and telephone number of the CRA that furnished the consumer report to the person; (iii) include a statement that the CRA did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken; and (iv) inform the consumer of their right to obtain a free copy (if requested within 60 days) of a consumer report from the CRA and to dispute the accuracy or completeness of any information their consumer report.

2. Duty to provide notice of adverse action based on information obtained from third parties. 15 U.S. Code § 1681m(b).

A user of any information obtained from affiliates or third parties (other than CRAs) that takes adverse action based in whole or in part on such information has the duty to notify the consumer of the adverse action. The notice must clearly communicate the consumer’s right to request, within 60 days, the reasons for such adverse action. As related adverse actions based on information obtained from affiliates, notice is not required if such information solely relates to its transactions or experiences with the consumer or a consumer report.

3. Duties of users making written credit or insurance solicitations based on information contained in consumer files. 15 U.S. Code § 1681m(d).

A user that uses a consumer report to initiate a credit or insurance transaction has a duty to make certain disclosures in each solicitation to a consumer related to such transaction. Such disclosures must be clear and conspicuous and are required to include the following: (i) a statement that (a) their consumer report was used in connection with the transaction, (b) the consumer received the offer of credit or insurance because the consumer satisfied the criteria for creditworthiness or insurability, (c) the credit or insurance may not be extended if any applicable criteria bearing on credit worthiness or insurability changes after the consumer responds to the offer or the consumer does not furnish any required collateral, and (d) the consumer has the right to prohibit any information contained in the consumer’s file from being used in connection with any transaction that the consumer does not initiate by notifying the CRA; and (ii) CRA contact information, including address and toll-free telephone number. Regulation V, 12 CFR Part 1022 also sets forth specific formatting requirements for such disclosures and provides additional guidance on ensuring such notice is clear and conspicuous. Users should ensure that such disclosures comply with both the content requirements set forth in the FCRA and the formatting requirements provided under Regulation V.

In addition to such disclosures, a user that initiates an offer of insurance or credit to a consumer has a duty to maintain records of the criteria bearing on creditworthiness or insurability used to select the consumer for such an offer. These records shall be kept for at least three years from the date of the offer.

4. Duties of users in credit transactions with less favorable terms. 15 U.S. Code § 1681m(h).

A user has a duty to notify a consumer if it provides less favorable terms for credit to a consumer based on their credit report. This notice may be given to the consumer at the time of application for or approval of the credit and should: (i) state that the terms of the offer are based on their consumer report; (ii) identify the appropriate CRA and provide contact information; (iii) inform the consumer that they may obtain a copy of their consumer report from the CRA free of charge; and (iv) disclose (a) the numerical credit score used in making the credit decision, (b) the range of possible credit scores under the model used, (c) the key factors (not to exceed four) that adversely affected the consumer’s credit score in the model used, and (d) the date on which the credit score was created, (e) the name of the person that provided the credit score or credit file.

However, the user is not required to provide such notice of less favorable terms if: (1) the consumer applied for the specific material terms and such terms were granted, or (2) the user has provided or will provide notice of an adverse action to the consumer in connection with the credit transaction.

FCRA Compliance Failures and Best Practices

The Federal Deposit Insurance Corporation (FDIC) recently published its annual Consumer Compliance Supervisory Highlights reviewing the most frequently cited and/or most significant regulatory violations that impacted consumers during 2022. Included in this list was the FCRA and violations related to what is referred to as “trigger leads.”  Generally, trigger leads are a pre-screened report that compiles a list of consumers based on certain credit criteria. While trigger leads are permissible under the FCRA, in using such pre-screened solicitation, financial institutions must still comply with their duty to make certain disclosures in each solicitation that the financial institution initiates, such as via trigger leads.

During 2022, some financial institutions were found to have violated this duty by failing to communicate firm offers of credit (and other disclosure requirements) to consumers during sales calls. It is important to note that these FCRA disclosure requirements do not only apply to written solicitations and must be met regardless of the form of communication, including verbal offers. Financial institutions should review their policies to ensure it adequately addresses the use of trigger leads and consider implementing the following best practices:

• Implement comprehensive controls and compliance management systems for FCRA compliance, including for the use of pre-screened solicitations.
• Ensure there is ongoing compliance monitoring and oversight of marketing materials.
• Develop scripts that comply with FCRA requirements for pre-screened solicitation sales calls.
• Develop offer letters that comply with FCRA requirements for written pre-screened solicitations.

In sum, the FCRA and Regulation Z set forth onerous obligations on all parties involved in the provision of consumer reports and credit decisions (not just CRAs), including financial institutions that are furnishers and users of the information contained in consumer reports. Furnishers and users of consumer reports should implement comprehensive policies to adhere with these compliance obligations and avail themselves of the various safe harbors available to largely mitigate the risk of non-compliance. By implementing a strong FCRA compliance program, your financial institution will be able to avoid some of the major consumer compliance pitfalls identified by the regulators during the past year.

Contact us for more information.

Baldini Lang LLC has extensive experience assisting clients in building compliance programs and policies to meet their legal requirements and establish best practice standards. Contact us for more information.