The Fair Credit Reporting Act continues to be an important and increasing regulatory risk. It is a source of numerous consumer complaints. In 2020, the Bureau of Consumer Financial Protection reported that the largest number of complaints received involved credit or consumer reporting, and five percent of complaints within that category involved ‘improper use of report.” Improper use of report would include obtaining the consumer’s report for an impermissible purpose. Regulators are maintaining continuing pressure on both consumer reporting agencies (CRAs) and furnishers/creditors of consumer information to ensure compliance with the FCRA.
One of the FCRA provisions that impacts both CRAs and furnishers is the Permissible Purpose provision that prohibits CRAs from furnishing consumer reports to anyone except as permitted by the statute. CRAs are also required by the FCRA to have procedures in place to require users of consumer reports to:
- Identify themselves
- Certify the purposes for which they are seeking the consumer report information
- Certify that the consumer report information will not be used for any purpose other than a permissible purpose
Furnishers/creditors are not left out. FCRA Section 604(f) also makes users responsible for obtaining consumer reports only for a permissible purpose.
The FCRA specifies the permissible purposes for which a CRA may furnish, and a furnisher may obtain a consumer report. There are four permissible purposes that focus specifically on creditors:
- To a person which the CRA has reason to believe intends to use the information in connection with a credit transaction involving the consumer and involving the extension of credit to, or review or collection of an account of the consumer
- In accordance with the written instructions of the consumer to whom the information relates
- To a person which the CRA has reason to believe otherwise has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer or to review an account to determine whether the consumer continues to meet the terms of the account
- Relating to a consumer involving a firm offer of credit if the CRA has complied with the conditions of a firm offer of credit
In Connection with a Credit Transaction Involving the Consumer
This is the permissible purpose that covers loan applications where the majority of the consumer reports are generated. A specific written authorization from the consumer for this permissible purpose is not legally necessary. A credit application or evidence of a credit transaction involving the consumer is all that’s necessary. However, many lenders take the precautionary step of obtaining the consumer’s permission to obtain the consumer report by including an authorization somewhere on or with the credit application that the consumer signs.
There are certain situations allowed under Regulation B for the creditor to obtain information about a nonapplicant spouse (including the credit report of the spouse). If the applicant lives in a community property state or is relying on property to qualify for credit that is located in a community property state, the creditor may also obtain a credit report on the applicant’s spouse. If the applicant is relying on the spouse’s income as a basis for repayment of the loan, the creditor may obtain a credit report on the spouse as well as the applicant.
The question comes up about how this provision applies to business purpose loans when a creditor obtains a consumer report on the individual guarantor or business owner. Based on FTC staff opinions and banking agency opinions, the creditor would have a permissible purpose for obtaining a consumer report on an individual proprietor, co-signer, or guarantor of a commercial loan because that individual is personally liable for the credit transaction. That would not be true of an officer of the company that is signing on behalf of the company who is not personally liable, because the information being furnished does not involve an extension of credit to that consumer. In that case, you would need to obtain the individual company officer’s express written authorization to obtain a consumer report if you wanted to obtain one.
Blanket certifications to the CRA by the creditor that certify that the creditor is seeking consumer report information only for a permissible purpose and under the contract terms are how the CRAs ensure that their reasonable procedures are covered. Separate certifications are not obtained or needed for every individual request.
In Accordance with Written Instructions of the Consumer
Which brings up the second major permissible purpose… in accordance with the written instructions of the consumer to whom the information relates. This permissible purpose applies only to the consumer providing the authorization and not, for example, to a spouse of the consumer in a joint credit application situation in a community property state. One consumer would not be able to authorize the CRA to furnish a consumer report of another party to a joint transaction under this provision. A consumer may authorize anyone to obtain a consumer report under any circumstances.
Legitimate Business Need in Connection with a Business Transaction Initiated by Consumer or Review of an Account
A CRA may furnish a consumer report to a person that the CRA has a reason to believe otherwise has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer. This provision is intended to cover business transactions with consumers that are not credit, insurance, or employment-related transactions, which are already covered by other permissible purpose provisions. Transactions involving deposit accounts and non-credit account activities, for example, check cashing verification services would be examples of such business transactions. This permissible purpose does not cover collection activities in connection with accounts. It only covers consumer reports used in reviewing accounts to determine if the consumer continues to meet the terms of the account. The permissible purpose that deals with credit transactions involving the consumer, on the other hand, DOES cover collection as well as review activities.
Firm Offer of Credit
There is another permissible purpose for obtaining a consumer report relating to a consumer in connection with a credit transaction that is not initiated by the consumer, which is in the event of a “firm offer of credit.” A firm offer of credit is any offer of credit to a consumer that will be honored if the consumer is determined to meet the specific selection criteria, based on information in a consumer report on that consumer. There are a few conditions that may be placed in addition to those selection criteria that are used to pull the list of consumers for the firm offer of credit from the CRA:
- The creditor may verify that the consumer continues to meet the selection criteria by obtaining an updated credit report or verifying consumer eligibility information from an application form if the criteria have been pre-determined
- If the offer is contingent on acceptable collateral and that condition was disclosed in the offer, the creditor may require the consumer to meet the collateral requirement as a condition of acceptance
Firm offers of credit must include a Prescreen Opt-Out Notice, to be included on the solicitation sent to the consumer. There are two notices: a short-form notice and a long-form notice. The model notices are in Regulation V and explain the consumer’s right to opt-out of receiving future prescreened offers.
Creditors are also required to keep a record of the criteria used to select the consumers for any firm offer of credit for a period of three years. This includes the criteria that was used to select the group of consumers for the offer, as well as any follow-up criteria such as collateral requirements that were not part of the credit bureau pull.
There are other permissible purposes for obtaining a consumer report (which won’t be covered in this article) under the FCRA, such as:
- In response to a court order having jurisdiction or a Federal grand jury subpoena
- For employment purposes, subject to certain conditions
- For underwriting of insurance
It is important to have effective compliance controls in place to ensure that consumer reports are obtained only for a permissible purpose.
ACTION STEPS
- Review consumer complaints for any evidence that the institution may have obtained consumer reports without a permissible purpose. What, if any, response or action has been taken in response to the complaints? Was there anything in the institution’s disclosures or communications that was unclear or misleading that could be improved?
- Conduct periodic training on the FCRA’s restrictions on obtaining consumer reports for lending staff. Even if consumer reports are routinely generated for loan processing, lending staff should be familiar with the Act’s requirements and understand when it is permissible to obtain a consumer report on a loan applicant and related parties.
- Is there a monitoring program in place to periodically test policy standards and adherence to the Act’s requirements?
Copyright © 2021 Compliance Action. Originally appeared in Compliance Action Vol. 26, No. 5, 9/30/2021
Compliance Lifeline