Fair Credit Reporting Act

Staff Training It is the responsibility of the Bank to ensure that all Bank personnel receive appropriate training on the

FCRA/FACTA and the directives of their policy on an on-going basis. The Bank’s general program for compliance should consist of the following measures:

This training program provides employees with current FCRA/FACTA training information to ensure staff comprehension of training information and directives.

All employees are required to complete the training.

What is the Fair Credit Reporting Act?The Fair Credit Reporting Act (FCRA) is a federal law that regulates how consumer reporting agencies use consumers information.

Enacted in 1970 and substantially amended in the late 1990s and again in 2003, the FCRA, among other things, restricts who has access to consumers sensitive credit information and how that information can be used.

The federal Fair Credit Reporting Act (FCRA) is designed to promote accuracy, fairness, and privacy of information in the files of every "consumer reporting agency" (CRA).

FCRA & FACTAThe Fair Credit Reporting Act (FCRA), amended by The Fair and Accurate Credit Transaction Act (FACTA), states that its primary goals are to:Provide fair and accurate credit reporting. Inaccurate credit reports directly impair the efficiency of the banking system, and unfair credit reporting methods undermine the public confidence which is essential to the continued functioning of the banking system;Create an efficient mechanism for investigating and evaluating the credit worthiness, credit standing, credit capacity, character, and general reputation of consumers;Provide consumer reporting agencies with regulatory guidance in assuming a vital role in assembling and evaluating consumer credit and other information on consumers; andInsure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy.

FCRAThe FCRA regulates the following:

Use of consumer reports;

Adverse action;

Sharing information with both affiliates and non-affiliates;

Reporting accurate information and correction errors;

Identity theft;

Free annual consumer reports; and

Coverage of business transactions.

Obtaining Consumer ReportsThe FCRA states that a consumer reporting agency may issue a consumer report only if the Bank certifies that it has a permissible purpose and will use the report for no other purpose.

The Bank has a permissible purpose and may obtain a consumer report in certain situations:Written instructions of the consumer;In connection with a credit transaction involving an extension of credit to or the review or collection of an account of the consumer; orIn connection with a business credit transaction where the consumer "is or will be personally liable" on the loan.

An individual is the sole proprietor of the business applicant;

A general partner of a partnership applicant;

A cosigner or guarantor on a business loan.

Re-use of Credit Reports or Credit Scores The Bank may only use the credit report for the purpose it certified to the

credit bureau when it obtained the report.

Credit scores are a type of credit report and the Bank cannot browse through its credit files, select all persons with a credit score above a certain number and cross market those people for any other product or service.

Request for Information from Parties Outside of the Bank Procedures1. Make certain the requesting party is authorized to request information about

the Bank's consumer customer. This may be done by: Viewing the consumer's express written consent (a copy should be retained in the Bank's files).

If the requesting party and the Bank have an agreement that information will not be requested unless express authorization from the subject has been received, and the requesting party is willing to protect the Bank against any loss, injury or damage for a loss suffered. If that is the case, a notation should be retained in the Bank's files).

2. Disclose to an authorized party only the Bank's own experience with the inquiry. Do not disclose any information from outside sources, such as other institutions, merchants, or the like.

3. Record the inquiry in a log kept specifically for recording requests for information from outside parties.

4. This procedure is complete.

Use of Information for the Bank’s Decision Making Procedures1. Has the Bank:

Approved the consumer's credit request as it was submitted by the consumer?

Notified the consumer of the approval, documented the credit as directed by the bank’s policy and procedure for the requestedtype of credit. – Go to Step 6.

Denied credit, or approved credit with less-than favorable terms than what the consumer originally applied for? – Go to Step 2.

2. Was the Bank's decision influenced in anyway by information received from a third party, (i.e., a CRA, another bank, company, or other entity that supplied information concerning the consumer? Yes – Go to Step 3.

No – Clearly document the Bank’s reasons for the decision on the Adverse Action Notice – Go to Step 4.

3. Complete the Adverse Action Notice. Be sure to state the name, address and the source the bank relied upon to reach its decision.

4. Mail the Adverse Action Notice to the consumer.

5. Repeat Steps 1 through 4 for each co-applicant.

FCRA Disclosure RequirementsThe Bank must meet the following disclosure requirements whenever obtaining consumer information:

Information From a Consumer Reporting Agency – When the Bank denies or increases the cost of credit based entirely or in part on information obtained from a credit report given by a consumer reporting agency, check the correct statement on the ADVERSE ACTION FORM and fill in the name, address and phone number of the consumer reporting agency that supplied the report. This must be disclosed so that the consumer will know where the information was obtained and their right to receive a copy of the consumer credit report.

Information From a Source Other Than a Consumer Reporting Agency – When the Bank denies or increases the cost of credit because of information obtained from a source other than a consumer reporting agency (i.e., another creditor), it must inform the customer that he or she has a right to receive this information. This can be disclosed to the consumer on the ADVERSE ACTION FORM.

If a customer wants the information, he or she must send a written request to the Bank within 60 days after receiving a Statement of Credit Denial, Termination or Change and the Bank should respond with the information. However, the specific source of information does not have to be revealed. The Bank can tell a consumer what the adverse information is and reveal its general source (i.e., a finance company or a department store); however, the Bank does not have to specify the name of the particular finance company or department store involved.

Timing of Disclosure - It is the policy of the Bank to require the notification of adverse action on credit transactions be sent within 30 days of receipt of a completed application.

Credit Score Disclosure Procedures Under FCRA, added by the FACTA, the Bank is required to disclose a home loan applicant’s credit score to an

applicant. This provision DOES OR DOES NOT apply to the Bank since the Bank DOES NOT DOES NOT make or arrange loans using a consumer credit score (or has the credit score printed on the consumer report) in connection with an application initiated or sought by a consumer, whether closed-end or open-end loan, for a consumer purpose that is secured by 1-4 units of residential real property (i.e. home equity/home improvement loans and equity lines).

It is the responsibility of the DEPARTMENT to disclose to the consumer “as soon as reasonably practicable”. This standard is not defined by the FCRA, therefore the Bank’s definition is within TIME PERIOD.

The Bank’s CREDIT SCORE INFORMATION DISCLOSURE FORM contains the following information:

1. The current credit score calculated by the credit reporting agency;

2. The range of possible credit scores under the model used;

3. All of the key factors that adversely affected the credit score, the total number of which shall not exceed 4, except if one of the key factors consists of “the number of inquires”, then five factors could be listed.

4. The date on which the credit score was created; and

5. The name, address and telephone number of the credit reporting agency that provided the credit score used.

6. broker-dealer for execution.

Adverse InformationInformation regarding bankruptcies may only appear on the credit report for ten years, while other information may only appear on the credit report for a period of seven years (i.e., paid tax liens, suits, judgments, accounts placed in collection, charged-off debts, arrests, indictments or correction records).

Although consumer reporting agencies are responsible for updating their information, the Bank can be held liable if it uses outdated information from a credit bureau.

Note: There is no time limit on the Bank's in-house information which can be used despite its age.

Fraud and Active Duty AlertUnder the FCRA, added by the FACTA, the credit bureaus must allow consumers to place “initial” fraud alerts and “extended” fraud alerts in their credit bureau files. Servicemembers may place active duty alerts in their credit files. The impact of this rule is to substantially shift the risk of identity theft from the consumer to the Bank once the consumer has filed a fraud alert with the credit bureau.

Under the FCRA, the Bank is responsible for placing an “initial fraud alert” in a consumer’s credit report for 90 days at the request of the consumer. An “extended fraud alert” can remain in a consumer’s report for seven years. An “active duty alert” will remain in servicemember’s consumer report for 12 months.

If Fraud Alert Exists:The Bank may not conduct the following in an event a fraud alert exists on aconsumer credit report:

1.Establish a new credit plan or extension of credit (other than extending creditunder an existing open-end credit plan, such as allowing the continued use of anexisting credit card);

2.Issue an additional card on an existing credit card account; or

3.Grant an increase in the credit limit on an existing credit account.

Note: The only exception to the above is in the event the Bank forms areasonable belief that the user knows the identity of the person making therequest.

Notice of Negative Information Under the FCRA, added by the FACTA, it is the responsibility of the Bank that extends

credit and regularly, in the ordinary course of business furnishes information to a consumer credit reporting agency, and furnishes negative information to such an agency regarding credit extended to a customer, to provide a notice of such furnishing of negative information, in writing, to the customer.

The written notice may be provided before the information is either furnished or no later than 30 days after the information has been furnished to the consumer reporting agency.

The term “negative information” is information concerning a customer’s delinquencies, late payments, insolvency, or any form of default.

Although use of the model disclosures, created by the Federal Reserve Board, are not required, banks will be deemed in compliance with the rule if they use the notices as written or with slight changes.

Prescreen Opt-Out Notice RequirementsUnder the FCRA, added by the FACTA, it is the responsibility of the Bank to adhere to established federal guidelines with respect to the format, type size and manner of the notices to consumers regarding the right to prohibit (‘‘opt-out’’ of) the use of information in a consumer report to send its customers solicitations of credit or insurance.

Under the FCRA, this provision applies to any person who uses a consumer report on any consumer in connection with any credit or insurance transaction that is not initiated by the consumer and that is provided to that person.

Prescreen Opt-Out Notice RequirementsIf the Bank uses a consumer report on any consumer in connection with any credit or insurance transaction that is not initiated by the consumer, and that is provided to that person, shall with each written solicitation made to the consumer about the transaction, provide the consumer with a Prescreen Opt-Out Notice, either:

1.Prescreen Opt-Out Short Notice

2.Prescreen Opt -Out Long Notice

Prescreen Opt-Out Short NoticeShort Notice - The Bank’s PRESCREEN OPT-OUT SHORT NOTICE is designed in a clear, conspicuous, and simple and easy to understand statement that contains the following requirements:

Content - The short notice shall state that the consumer has the right to opt out of receiving prescreened solicitations, and shall provide the toll free number the consumer can call to exercise that right. The short notice also shall direct the consumer to the existence and location of the long notice, and shall state the heading for the long notice. The short notice shall not contain any other information.

Form - The short notice shall be: In a type size that is larger than the type size of the principal text on the same page, but in no event smaller than 12-

point type, or if provided by electronic means, then reasonable steps shall be taken to ensure that the type size is larger than the type size of the principal text on the same page;

On the front side of the first page of the principal promotional document in the solicitation, or, if provided electronically, on the same page and in close proximity to the principal marketing message;

Located on the page and in a format so that the statement is distinct from other text, such as inside a border; and

In a type style that is distinct from the principal type style used on the same page, such as bolded, italicized, underlined, and/or in a color that contrasts with the color of the principal text on the page, if the solicitation is in morethan one color.

Prescreen Opt-Out Long NoticeLong Notice - The Bank’s PRESCREEN OPT-OUT LONG NOTICE is designed in a clear, conspicuous, and simple and easy to understand statement that contains the following requirements:

Content - The long notice shall state the information required by section 615(d) of the FCRA. The long notice shall not include any other information that interferes with, detracts from, contradicts, or otherwise undermines the purpose of the notice.

Form - The long notice shall: Appear in the solicitation;

Be in a type size that is no smaller than the type size of the principal text on the same page, and, for solicitations provided other than by electronic means, the type size shall in no event be smaller than 8-point type;

Begin with a heading in capital letters and underlined, and identifying the long notice as the ‘‘PRESCREEN & OPT-OUT NOTICE’’;

Be in a type style that is distinct from the principal type style used on the same page, such as bolded, italicized, underlined, and/or in a color that contrasts with the color of the principal text on the page, if the solicitation is in morethan one color; and

Be set apart from other text on the page, such as by including a blank line above and below the statement, and by indenting both the left and right margins from other text on the page.

Prescreening ProceduresPrescreening, now referred to as "a credit transaction that is not initiated by the consumer," is a method used to send preapproved credit offers to consumers that meet minimum criteria set by the Bank. There are a couple of different ways to prescreen consumers for new credit:Without Credit Report - The simplest way is to perform a mailing to current customers whose creditworthiness is determined solely on the basis of information in the Bank's files and its own experience and does not involve obtaining a credit report on the customer. The Bank could either send the solicitations as preapproved or make any other offer as long as the terms were explicit. These guidelines would also apply if the Bank bought a list of prospective customers, provided credit reports are not obtained.Note: If this method is followed, the Bank is not required to furnish any kind of notice.Use Of Credit Report - In this instance, the Bank provides the credit criteria to a consumer reporting agency with instructions that the agency send back a list of names and addresses of consumers meeting the criteria.

Prescreening ProceduresIf a list is obtained from a Credit Reporting Agency, the Bank must make a "firm offer of credit" to every name on the list that satisfied the criteria.

Prior to the 1996 amendments, this requirement was almost absolute. Now the Bank may verify information, such as income and collateral information, after the list is obtained, and may exclude names from the offer if the customer no longer meets the Bank's initial credit criteria or collateral requirements. Also the firm offer of credit may vary among names on the list.

Not everyone must be offered the same amount of credit.

Prescreening ProceduresUse of Credit Report, Continued The disclosure of certain items must be made to any consumer receiving a

firm offer of credit from a prescreened list. The following must accompany the offer:

1. A statement that information from the consumer's credit file was used in connection with the solicitation.

2. A statement that the consumer meets the criteria used in consideration for the credit or insurance.

3. A statement that the consumer has the right to prohibit the use of his or her information for any such solicitations.

4. A statement that the consumer may elect to have his or her name excluded from any such solicitation lists and how to accomplish this.

Prescreening Record RetentionThe Bank is required to retain records relating to the criteria used in any prescreened solicitation.

Records indicating the initial criteria used in requesting the initial list from the consumer reporting agency, final criteria used to determine creditworthiness, and any collateral criteria must be retained for three years.

The prescreened list, and the credit criteria used in compiling that list, should not be shared with any third party independent and outside of a particular project.

Sharing Information with Affiliates Marketing Opt-Out

Sharing Opt-Out

Special Adverse Action Rule

Marketing Opt-OutThe FACTA of 2003 added an entirely new Section 624 to the FCRA regarding the use of information acquired from an affiliate for the purpose of sending out marketing solicitations. Section 624 gives consumers the right to opt-out of such use of their information. This is referred to as the "Marketing Opt-out."

As a general rule, the receiving affiliate may not use the information received from the sharing affiliates to make a "solicitation for marketing purposes" unless a specific disclosure and opt-out have been given.

No disclosure or opt-out must be given if:The consumer has a pre-existing business relationship with the receiving affiliate; orThe consumer initiated the communication or authorized or requested the solicitation.

Sharing Opt-OutA Sharing Opt-Out notice is required pursuant to FCRA Section 603 in order to share non-experience information with affiliates. This is referred to as the "Sharing Opt-out.”

Sharing of non-experience information is permitted between persons related by common ownership or affiliated by corporate control as long as it is clearly and conspicuously disclosed to the consumer that the information may be shared among those persons and the consumer is given an opportunity, before the information sharing, to direct otherwise.

Special Adverse Action RuleWhenever adverse action is taken based on information obtained from an affiliate, the party taking the adverse action must give a modified FCRA notice to a consumer, stating that the consumer may obtain the information upon written request made within 60 days.

If a consumer makes the request, the creditor has 30 days to disclose the nature of the information upon which the action is based.

Consumer Medical InformationIt is solely a Bank decision to to obtain or use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit. If the Bank opts to obtain and use medical information, they must follow the Financial Information Exception for Obtaining and Using Medical Information.

Consumer DisputesThe FCRA imposes a duty upon the Bank to report accurate and complete information. The Bank is prohibited from reporting information if it has knowledge that the information may be incorrect and is required to investigate alleged errors.Consumer Disputes Made Through Credit Bureaus

Duty of Credit Bureau - FCRA includes an elaborate procedure for credit bureaus to reinvestigate any item of information in a consumer's file that the consumer disputes.

Bank's Duties Upon Receipt of Credit Bureau's Notice of Dispute - Section 632(b) governs how the Bank must respond when it receives a notice of dispute from a credit bureau.

Notification from Credit Bureau - Within five business days of receiving notice of a consumer dispute, the credit bureau must notify the Bank of the information of the disputed item(s). The credit bureau must provide the furnisher (the Bank) with all "relevant information" that the consumer provides during the reinvestigation period (generally 30 days).

Investigation - After receiving notice of a dispute from a consumer reporting agency with regard to any information provided by the Bank, the Bank must:

Conduct an investigation with respect to the disputed information;

Review all relevant information provided by the credit bureau;

Report the results of the investigation to the credit bureau;

If the investigation finds that the information is incomplete or inaccurate, report those results to all other nationwide consumer reporting agencies to which the Bank furnished the information; and

Consumer Disputes Investigation, Continued

If the information is found to be inaccurate or cannot be verified after any reinvestigation, promptly:

Modify the item of information;

Delete the item; or

Permanently block the reporting of the item.

The Bank must modify, delete or block any item of information it finds to be inaccurate or simply cannot verify. In other words, if the Bank cannot go back to the source of the information to verify it, the information must be treated as inaccurate and delete the information.

Deadline - The Bank generally must complete its investigation and report within 30 days.

Retention of Documents It is the responsibility of the DEPARTMENT to retain all adverse action

disclosures for 25 months.

Questions?

If you have any additional questions, contact Compliance Alliance at hotline@compliancealliance.com or 888-353-3933.