Fair Credit Reporting Act Overview

Fair Credit Reporting Act (FCRA) and Amendments

• FCRA became effective in 1971, amended by the FACT Act of 2003, and further amended by the Dodd-Frank Act of 2010.
• The Consumer Financial Protection Bureau (CFPB) gained rule-making authority under FCRA (with exceptions) via the Dodd-Frank Act.
• CFPB restated FCRA regulations in 12 CFR Part 1022 (76 Fed. Reg. 79308) in 2011.

Consumer Disclosure Requirements

• Creditors must disclose credit scores when used for credit term decisions.
• Disclosure must include:
  • Explanation that a credit score is a number reflecting consumer report information.
  • Statement that the credit score is part of loan term determination, and credit scores are based on credit use and history.
  • Identification of the credit scoring model used.
  • Range of possible credit scores.
  • Main factors affecting the credit score adversely.
  • Date of credit score creation, and the credit reporting agency that provided the score.
• Additional disclosures required for adverse actions based on consumer reports:
  • Oral, written, or electronic notice of adverse action.
  • Consumer reporting agency's name, address, and toll-free number.
  • Statement that the reporting agency did not make the decision and cannot explain the reasons.
  • Notice of consumer's right to a free credit report and to dispute report accuracy.

Opt-Out Notices and Identity Theft

• FCRA mandates opt-out notices when lenders use prescreened reports for credit offers.
• Provisions to address identity theft include:
  • Enabling consumers to add free fraud alert notifications to credit reports.
  • A fraud alert at one bureau applies to all three.
  • Instructions to verify identities for credit applications.
• Three types of fraud alerts:
  • Temporary/initial alert (90-day minimum, one-year maximum, renewable).
  • Active-duty alert (protects military, one-year maximum, unless removed).
  • Extended fraud victim alert (seven years).
  • Alert requires submission of a law enforcement report.

Access to Consumer Reports and Data

• Provisions for improved access to consumer report information.
• Dodd-Frank Act mandates credit score disclosure when used for adverse actions or risk-based pricing.

Covered Entities and Account Types

• Entities covered by FCRA/FACTA include: procurers/users of credit information (creditors, purchasers of dealer paper, deposit account providers), and furnishers/transmitters of information.
• “Creditor” defined as persons who regularly extend, renew, or continue credit and their assignees. Creditors may potentially be other parties with a legitimate business need to access consumer reports.
• Covered accounts: personal, family, or household accounts permitting multiple payments/transactions, and accounts with foreseeable identity theft risks.

"Red Flag" Rules

• The FTC retains authority for identity theft rules (Red Flag rules, 16 CFR Part 681).
• Red flag is any pattern/practice that indicates possible identity theft.
• Red flags include: alerts from bureaus or fraud services, suspicious documents, unusual account activity, notification from customers/authorities about possible fraud.
• Financial institutions with covered accounts must develop and implement written Identity Theft Prevention Programs including detection, prevention, and mitigation of identity theft losses.

Contents of Credit Reports

• Required information: bankruptcy information, key factors affecting credit scores, account closure indications, consumer dispute indications, full credit card account numbers, and address discrepancies.
• Excluded information: bankruptcies discharged over 10 years prior. Civil suits, judgments, arrest records, paid tax liens and collection/charge-off accounts from beyond 7 years. Exceptions for statute of limitations longer than 7 years. Medical service information may be withheld. Some criminal convictions may be reported although generally excluded.

Permissible Purposes for Credit Reports

• Permissible purposes: court orders, written consumer instructions, credit extensions, employment, insurance underwriting, license eligibility determination, valuations/risk assessments, legitimate business needs, consumer-initiated business transactions, account review, government-sponsored travel charge cards, child support enforcement, and liquidation of failing institutions.