Fair Credit Reporting ActApril 15, 2020

Fair Credit Reporting Act

• The Fair and Accurate Credit Transactions Act (“FACTA”) greatly amended the Fair Credit Reporting Act (FCRA).• Partially

implemented by regulation found at 12 CFR 1022 (Regulation V)

Page 1

Purpose and Scope

• Serves the following principal purposes:• To regulate the consumer-

reporting industry• To prohibit unfair actions

from CRAs • To restrict the availability and

use of consumer reports• Applies to all types of accounts

Page 1

Definitions

• Consumer: An individual. • Consumer Report• Any oral, written, or other communication of information by a CRA.• Information about consumer’s creditworthiness, credit standing, credit

capacity, character, general reputation, personal characteristics, or mode of living.• Used in establishing a consumer’s eligibility for any of the purposes

permitted under the FCRA.

• Consumer-Reporting Agency: Assembles consumer information for the purpose of furnishing consumer reports to third parties.

Page 1-2

Permissible Purposes for Consumer Reports

• Determining a consumer’s eligibility for an account or a service• In response to a Court Order• Prescreening a list of members to solicit for

credit services• Member’s written permission

Page 2

What About Marketing?Question: Is it true that the FCRA doesn't permit credit unions to use credit reports pulled for account eligibility or review purposes for cross-selling purposes?

Answer: This is generally true, with one limited exception (prescreened offers of credit)

Page 2

FCRA and Marketing

• Credit reports can only be obtained if the user has a "permissible purpose" as defined in Section 604 of the Fair Credit Reporting Act (see previous)• A credit report cannot be obtained for a permissible purpose (for

example, in connection with a loan application or opening a deposit account) and then used for an impermissible one (cross-selling additional products and services).• If a credit union wants to use a credit report (pulled for account

eligibility purposes) to cross sell other products, the credit union must get a consumer’s written consent to do so.• The written authorization must be:• Specific to the reason you want to use the CR• Not combined with other consents

Page 2-3

Adverse Action Notice

• Required when the credit union denies or increases the cost of a member’s credit or deposit account based on third-party information.

• May be combined with the ECOA notice (Model Notice in Appendix C of Reg B)

Page 3

Credit Bureau Information

Credit Bureau Information• If information related to an adverse

credit decision came from a credit bureau, the creditor must disclose certain items to the applicant (see list)

Credit Score Information• Creditors must also disclose credit

scores and related information to consumers in risk-based pricing and adverse action notices under the FCRA if a credit score was used in setting the credit terms or taking adverse action (see list)

Page 3-4

Other Information

Information From Outside Sources• If information related to an adverse credit decision was obtained

from an outside source other than a credit bureau, the creditor must either disclose the nature of the information or the consumer’s right to obtain the nature of the information, if a written request is filed within 60 days of the adverse action notice. • The creditor may, but need not, disclose the source of the

information.Information From a Creditor’s Own Internal Records• If the credit union uses information from its own experience with the

consumer, there are no disclosure obligations.

Page 4

Don’t Become a CRA!

• You can report your own transactions and experiences to others.

• Do not report information received from third parties to others.

Page 4

Negative Report Notice

• Required when you report negative information about a consumer to a CRA• Provide to consumer before or after reporting information• Notice must be clear and conspicuous and in writing• Use Model Notices (Appendix B of Reg V)• Use of Model Notice is not required• Guaranteed Compliance

• Specific delivery timing required (Hint, provide before)• Delivery:• Negative information means a consumer’s delinquencies, late payments,

insolvency or any form of default. • Provide only once per account• Can provide on other forms provided to the consumer except TIL disclosures

Page 5

Notice to Home Loan Applicants

Required if you use or obtain credit scores in connection with a mortgage loan.• Mortgage loan applications include purchase money mortgages,

refinanced loans, home equity loans, second mortgages, and home equity lines of credit secured by 1 to 4 units of residential real property• Provide as soon as “reasonably practical” • Required whether or not the loan is approved• Each applicant must receive their own• Use model notice! (see contents on page 6-7)

Page 6-7

Risk Based Pricing Notice

Creditors are required to provide a risk-based pricing notice when:

• The creditor uses a consumer report in connection with a consumer’s credit application or extension; and

• Based at least in part on that report, the creditor grants or extends credit to the consumer on “material terms” that are “materially less favorable” than the most favorable terms available to a substantial portion of the creditor’s borrowers.

Page 7

Risk Based Pricing Notice

• Applies to consumer credit only.• Use Model Forms!• There are various methods to determine who gets a notice:• A creditor must use the same method to evaluate all consumers receiving a

specific type of credit (e.g., auto loans, mortgages, etc.), but may vary the methods among different products. • Risk- based pricing notices may only be given to consumers who receive

materially less favorable terms, and not to all consumers who apply for credit (hint – you can provide an ”exception notice” to all consumers)

1. Method 1: Consumer to Consumer Comparison2. Method 2: Credit Score Proxy Method3. Method 3: Tiered Pricing Method

• Alternative approach available for credit cards

Page 7-8

Tiered Pricing Method

• A creditor may place a borrower within one of a discrete number of pricing tiers based on a consumer report. • The only factor a creditor using this

method must consider is tiers with different APRs or, for credit with no annual percentage rate, other financial terms that the creditor varies based on consumer report information. • A notice must be sent to those consumers

who do not qualify for the top tier (lowest-priced) for a four or fewer tier system; or the top two tiers for a five or more tier system, as well as additional tiers that comprise between 30-40% of the total number of tiers.

Page 8

Content, Form, and Timing of Notice

• A creditor must generally provide the notice before the consummation of the transaction, or the first transaction for credit cards or other open-end credit, but no earlier than the time that approval of the credit is communicated to the consumer. • Required Content (seriously – use the

model notice)

Page 9-10

Account Review Notice

• A notice must be provided if creditor reviews a consumer’s credit account, and based on credit report information, increases the APR on that account. • A notice must be provided if a credit card issuer periodically obtains

consumer reports in order to review the terms of the credit it has extended to a consumer and based on that review increases the APR.• Notices issued in response to account review must include the same

basic information as notices provided for credit applicants.• The notice must be provided at the time the decision to increase the

APR is communicated to the consumer.

Page 10

Exceptions

Application for Specific Terms Exception• A risk-based pricing notice is not required if the consumer applies for

and is granted specific terms for credit, unless those terms were specified after the credit was applied for and after the creditor obtained a consumer report.

Adverse Action Exception• A creditor does not have to provide a risk-based pricing notice if it

provides an adverse action notice under Section 615(a) of the FCRA.Prescreened Solicitations Exception• A creditor does not have to provide a risk-based pricing notice if it

obtains a consumer report that is a prescreened list and uses that report to make a firm offer of credit to a consumer, regardless of whether the material terms of such an offer differ from the terms the creditor includes in firm offers of credit to other consumers.

Page 10-11

Exceptions

Credit Score Disclosure Exception for Non-mortgage Credit• A creditor may provide a credit score disclosure instead of the risk-based

pricing notice. • The disclosure must contain the consumer’s credit score along with

explanatory information regarding the score, and information regarding the use of consumer reports and scores in the underwriting process. • Under this exception, a creditor must provide this disclosure to any

consumer who requested an extension of credit. • Use of this notice does not give the consumer a right to a free copy of their

credit report.Credit Score Disclosure Exception for Mortgage Loans• For mortgage loans, creditors are allowed to add supplementary information

to the already required credit score disclosure for mortgage loans. Credit Score Disclosure Exception When no Credit Score is Available• A creditor provides this disclosure when the credit score for a particular

consumer is unavailable from the consumer reporting agency the creditor regularly uses.

Page 11

Model Risk Based Pricing NoticesNumber Name Use WhenH-1 Risk-Based Pricing Notice • The creditor only provides a RBP to applicants who don’t qualify for its best rate.

• The creditor doesn’t use a credit score to set “material terms” of credit

H-2 Account Review Risk Based Pricing Notice

• The creditor increases a consumer’s APR during an account review

• The creditor doesn’t use a credit score in its decision

• The creditor doesn’t provide and Adverse Action Notice (but, um, you have to)

H-3 Exception Notice for Residential Real Property

• The application is for a loan secured by one to four units of residential real property

H-4 Exception Notice (non RealEstate)

• The creditor provides a RBP to all applicants

H-5 Exception Notice: Credit Score Not available

• Credit score for the applicant is unavailable

H-6 Risk-Based Pricing Notice with Credit Score Information

• The creditor only provides a RBP to applicants who don’t qualify for its best rate.

• The creditor uses a credit score to set “material terms” of credit

H-7 Account Review Risk Based Pricing Notice with Credit Score Information

• The creditor increases a consumer’s APR during an account review

• The creditor uses a credit score in its decision

• The creditor doesn’t provide and Adverse Action Notice (again, you have to)

Page 11-12

Obligations of Furnishers of Data

Reporting Inaccurate Information• A creditor is prohibited from providing incorrect

information to a CRA it knows (or consciously avoid knowing) is inaccurate. • A creditor is not subject to this prohibition if it

clearly and conspicuously specifies an address to which consumers may write in order to report that certain information is inaccurate.

Duty to Correct and Update Information• A creditor must provide updated information to a

CRA anytime it discovers it is reporting incomplete or inaccurate information.• Creditors must notify all CRAs that received the

information of any corrections.

Establish Accuracy Policy and Procedures • Required Content (See page 12-13, PolicyPro

Model Policy 11003)

Page 12-13

Investigating Direct Disputes

• Creditors must investigate a direct dispute if it relates to an account at the institution and involves specific information regarding that account.• The creditor does not have to investigate anything having to

do with:• The consumer’s identifying information (DOB, SSN, address, etc.)• The identity of past employers• Inquiries or requests for consumer reports• Information derived from public records (e.g., judgments, bankruptcies),• Fraud or active duty alerts• Information provided by another furnisher• Direct disputes submitted by credit repair organizations.

Page 14

Direct Disputes

Address for Disputes• A creditor will only be required to investigate a direct dispute if a consumer

submits a dispute notice to the creditor at:• An address provided by the creditor and set forth on the consumer report relating to that

consumer• An address clearly and conspicuously specified by the creditor for submitting direct disputes

that is provided to the consumer in writing• Any creditor address if the creditor has not otherwise specified an address for submitting

direct disputesDispute Notice Contents• A consumer’s dispute notice must include:

• Sufficient information to identify the account or other relationship that is in dispute, such as an account number and the name, address and telephone number of the consumer

• The specific information that the consumer is disputing and an explanation of the basis for the dispute

• Any supporting documentation or other information reasonably required by the creditor to substantiate the basis of the dispute (e.g., a copy of consumer report allegedly containing the inaccurate information, a police report, ID theft affidavit, court order, account statements, etc.)

Page 14

Direct Disputes

Investigation Procedures• A creditor must complete its investigation of direct disputes within 30 days of

receiving the dispute notice. • If the investigation finds that the information in the report was inaccurate, the

creditor must correct the error and provide accurate information to the credit bureau.• Results of the investigation must be reported to the consumer upon completion.Frivolous Disputes• A creditor is not be required to investigate disputes that are determined to be

frivolous or irrelevant, such as:• Those containing insufficient information to conduct an investigation• Substantially similar disputes that were previously submitted to the creditor or a CRA by or on behalf of

the consumer

• Upon making a determination that a dispute is frivolous or irrelevant, the creditor must notify the consumer not later than 5 business days after making the determination, by mail (or other means if authorized for that purpose by the consumer)

• The notice to the consumer must explain the reasons for the creditor’s determination that the dispute was frivolous

Page 15

Investigating Disputes from CRAs

When a CRA notifies the creditor that a consumer disputes the completeness or accuracy of information provided, the creditor must:• Conduct an investigation and review all relevant information provided by the

CRA, including information given to the CRA by the consumer.• Report the results to the CRA, and, if the investigation establishes that the

information was, in fact, incomplete or inaccurate, report the results to all CRAs that compile and maintain files on nationwide basis to which the creditor provided the information.• Complete the investigation and make necessary corrections within 30 days from

the date the CRA receives the dispute (or 45 days, if the consumer later provides relevant additional information to the CRA).

Page 15

Other Furnisher Obligations

Reporting Voluntary Account Closures• Creditors must promptly report voluntary

account closures to CRAs.

Reporting Delinquency Dates•Within 90 days of reporting to a CRA that

an account is a delinquent, has been placed for collection, charged to profit or loss, or subject to any similar action, the creditor must provide the CRA with the month and the year of the commencement of the delinquency that immediately preceded the action.

Page 15

Identity Theft Notifications

• Creditors are required to have reasonable procedures in place to respond to any notification from a credit bureau that information they have furnished was the result of identity theft, and to prevent refurnishing that information in the future.• Information a consumer has identified as resulting from ID theft must not be

furnished unless the creditor later learns or is informed by the consumer that the information actually is correct. • If the creditor learns it has furnished information that is incorrect due to ID theft,

each consumer-reporting agency that received the incorrect information must be notified and the creditor must from then on report only complete and accurate information.• If the creditor is notified that a debt has resulted from identity theft, that debt may

not be sold, transferred, or placed for collection.

Page 16

Fraud and Active Duty Alerts

• CRAs maintain an alert system to notify all prospective users of consumer reports that a consumer may be a victim of fraud, including ID theft, or that a consumer is an “active duty military consumer,” as applicable.• Consumers may request that fraud alerts be placed on

their credit reports for an initial period of 90 days, or for an extended period lasting seven years. • Active duty military consumers may request that an

“active duty alert” be placed on their credit report files during the period of their active duty.

Page 16

Responding to Alerts

• A creditor must maintain procedures to form a “reasonable belief” it knows the true identity of a consumer with an alert on his or her credit report before establishing a new credit plan, issuing additional cards on an existing credit account, or increasing any credit limit in the subject consumer’s name.• For initial active duty alerts, if the consumer has specified a

telephone number in the alert, the creditor cannot extend any credit until it contacts the consumer using that number, or takes other reasonable steps to verify the person’s identity and confirm that the application for credit is not the result of ID theft. • For extended alerts, the creditor must contact the consumer in

person, at the telephone number indicated in the alert, or other reasonable contact method specified by the consumer before credit is granted or additional cards are sent.

Page 16-17

Identity Theft Red Flags

Financial Institutions must develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.

Page 17

ID Theft Red Flags

Covered Accounts • Accounts offered or maintained primarily for personal, family, or

household purposes that involve or are designed to permit multiple payments or transactions or• Any other accounts the financial institution offers or maintains for

which there is a reasonably foreseeable risk to members or to the safety and soundness of the financial institution from ID theft, including financial, operational, compliance, reputation, or litigation risks.

Red Flags• Red flags are patterns, practices, or activities that indicate a possible

risk of ID theft. (See List, page 17-18)ID Theft Program Requirements• (See List, page 18)

Page 17-18

Special rules for card issuers

• Card issuers must assess the validity of change of address requests.• Validation is required when a card issuer receives a change-of-address

notice and then, within a short period of time (at least 30 days) afterwards receives a request for an additional or replacement card.

• The card issuer is prohibited from issuing a new card unless it takes steps to assess whether the change of address is valid, such as:• Notifying the cardholder at the old address• Notifying the cardholder through some other means of

communication that the cardholder has previously agreed to• Using another method of assessing the validity of the change of

address that the issuer has included in its red flag program

Page 18-19

Address Discrepancies

Responding to Address Discrepancy Reports• Financial institutions must have reasonable policies

and procedures to respond to notices of address discrepancy received from a CRA.• The policies and procedures must be designed to

enable the financial institution to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report. • The financial institution can only use a consumer

report if it has verified the information actually belongs to the individual for whom the report was obtained.

Furnishing Addresses• Financial institutions are required maintain

reasonable policies and procedures for furnishing a consumer’s address to a consumer reporting agency that the creditor has reasonably confirmed is accurate.

Page 19

Prescreening Rules

Financial institutions that request prescreened lists from CRAs to in order to market to consumer must follow certain rules.

Page 19

Prescreening Rules

Notice Accompanying Prescreened Offer• A financial institution that uses credit reports to make

prescreened solicitations must provide notices to consumers that contain an initial prominent statement that provides basic opt-out information followed by a separate, longer explanation that provides additional details. (see short and long notice requirements, page 19-20)

Prescreened Offers• A financial institution must make an offer of credit to all

consumers who pass the prescreening process. • The offer may contain certain conditions (see list of

conditions, page 20)Record Retention• Financial Institutions that obtain prescreened lists, and

make offers of credit based on such lists, must maintain a record of the criteria used to select the consumers who are to receive the offer of credit and any requirements for furnishing collateral as a condition for the extension of credit.

• This information must be maintained for a three-year period beginning on the date the offer of credit is made.

Page 19-21

Medical Information

A creditor may not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit, except in certain limited circumstances.

Page 21

Eligibility, or Continued Eligibility, for credit

Eligibility, or Continued Eligibility, for credit means the consumer's qualification or fitness to receive, or continue to receive, credit, including the terms on which credit is offered. The term does not include:• Any determination of the consumer's qualification or fitness for

employment, insurance (other than a credit insurance product), or other non-credit products or services;• Authorizing, processing, or documenting a payment or transaction on

behalf of the consumer in a manner that does not involve a determination of the consumer's eligibility, or continued eligibility, for credit; or• Maintaining or servicing the consumer's account in a manner that

does not involve a determination of the consumer's eligibility, or continued eligibility, for credit.

Page 21

Unsolicited Medical Information

• A creditor does not obtain medical information in violation of the prohibition if it receives medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit without specifically requesting medical information.• Even unsolicited medical information may only be used in

determining a consumer’s eligibility, or continued eligibility, for credit if an exception applies.

Page 21

Financial Information Exceptions for Obtaining and Using Medical Information

A creditor may obtain and use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit so long as:• The information is the type of information routinely used in making

credit eligibility determinations, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds;• The creditor uses the medical information in a manner and to an

extent that is no less favorable than it would use comparable information that is not medical information in a credit transaction; and• The creditor does not take the consumer's physical, mental, or

behavioral health, condition or history, type of treatment, or prognosis into account as part of any such determination.

Page 21-22

Financial Information Exceptions for Obtaining and Using Medical Information

Examples A creditor is permitted to obtain and use information about:• The dollar amount, repayment terms, repayment history, and similar

information regarding medical debts to calculate, measure, or verify the repayment ability of the consumer, the use of proceeds, or the terms for granting credit• The value, condition, and lien status of a medical device that may

serve as collateral to secure a loan• The dollar amount and continued eligibility for disability income,

workers' compensation income, or other benefits related to health or a medical condition that is relied on as a source of repayment• The identity of creditors to whom outstanding medical debts are

owed in connection with an application for credit, including but not limited to, a transaction involving the consolidation of medical debts.

Page 22

Exceptions

A creditor may obtain and use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit:• To determine whether the use of a power of attorney

or legal representative that is triggered by a medical condition or event is necessary and appropriate or whether the consumer has the legal capacity to contract when a person seeks to exercise a power of attorney or act as legal representative for a consumer based on an asserted medical condition or event

• To comply with applicable requirements of local, state, or Federal laws

• To determine, at the consumer's request, whether the consumer qualifies for a legally permissible special credit program or credit-related assistance program (additional conditions apply)

• To the extent necessary for purposes of fraud prevention or detection;

• In the case of credit for the purpose of financing medical products or services, to determine and verify the medical purpose of a loan and the use of proceeds

Page 22

Exceptions

• Consistent with safe and sound practices, if the consumer or the consumer's legal representative specifically requests that the creditor use medical information in determining the consumer's eligibility, or continued eligibility, for credit, to accommodate the consumer's particular circumstances, and such request is documented by the creditor;

• Consistent with safe and sound practices, to determine whether the provisions of a forbearance practice or program that is triggered by a medical condition or event apply to a consumer;

• To determine the consumer's eligibility for, the triggering of, or the reactivation of a debt cancellation contract or debt suspension agreement if a medical condition or event is a triggering event for the provision of benefits under the contract or agreement;

• To determine the consumer's eligibility for, the triggering of, or the reactivation of a credit insurance product if a medical condition or event is a triggering event for the provision of benefits under the product.

Page 23

Disposal of Records

• Credit unions must procedures for disposing of information contained in consumer reports.

• Follow Information Security Guidelines!

Page 23