Week 3 - Fair Credit Reporting Act (FCRA)

Bank products impacted by FCRA

Credit, deposit accounts, insurance, employment, and child support

Purpose of FCRA

To regulate the consumer credit reporting and related industries to ensure that consumer information is reported in an accurate, timely, and complete manner; to give individuals information when consumer reports are used to evaluate credit applications; and to protect the confidentiality of information. The act places obligations on consumer reporting agencies and on users of consumer reports.

Short form notice content

May contain only a statement that the consumer has the right to opt out of credit solicitations, a toll-free number that can be used to opt out, and a statement directing the consumer to the longform notice with the title of this notice.

Duties of card issuers- Communication with the cardholder

Any communication required must be sent to the cardholder separately from the issuer's regular correspondence with the cardholder.

Adverse decision notification requirements when using credit information from a third-party

If credit information received from a third-party including an affiliate, is used to make the adverse decision, the user must 1. Notify the consumer of the action including a statement that the consumer may obtain the information if it is requested within 60 days after transmittal of the notice 2. On the receipt of the request for the information by the consumer, disclose to the consumer the nature of the information on which the action is based within 30 days of the receipt of the request

Notice format

Must be clear and conspicuous and provided to the consumer in oral, written or electronic form

Affiliate sharing notice

The notice must be provided by an affiliate that has or has had a pre-existing relationship with the consumer

General content requirements for the notice

1. A statement that a consumer report includes information about the consumer's credit history 2. A statement that the terms of the credit offered are based on information in the consumer report 3. A statement that the terms offered may be less favorable than those offered to consumers with better credit histories 4. A statement that the consumer has the right to verify the accuracy of the consumer report into dispute any inaccurate information 5. The identity of any consumer reporting agency that furnished a report used in the credit decision 6. A statement that federal law gives the consumer the right to request a copy of the consumer report without charge for 60 days after receiving the notice 7. A statement that instructs the consumer how to obtain a consumer report from the consumer reporting agencies identified in the notice, including a toll-free number, where applicable 8. A statement directing the consumer to the FTC and Federal Reserve Board websites to obtain more information about Consumer Reports 9. If a credit score of the consumer is used in setting the material terms of credit, then the following must be included - A statement that a credit score is a number that takes into account information in a consumer report and that the consumer's credit score was used to set the terms of the credit offered and the credit score can change over time to reflect changes in the consumer's credit history - The credit score used by the person in making the credit decision - The range of possible credit scores under the model used to generate the credit score - all the key factors that adversely affected the credit score; this cannot exceed four key factors, except that if one of the key factors is the number of inquiries made, then the number of key factors may not exceed five - The date on which the credit score was created - The name of the consumer reporting agency that provided the credit score

Red flag requirements - covered accounts

1. Accounts that involve continuing relationships established for personal, family or household purposes that involve or are designed to permit multiple payments for transactions, including credit cards, mortgages, checking account, savings accounts, utility accounts, and phone accounts 2. Any other accounts the institution offers for which there is a reasonable risk to the consumer of identity that

Timing requirements to provide the notice

1. Closed-end credit - must be provided to consumers before confirmation but not prior to giving notice that the consumer's application has been approved 2. Open-end credit - must be provided before the first transaction is made but not earlier than the time the credit decision is communicated to the consumer 3. Review of accounts - must be given at the time the decision is made to raise the APR on the account, or in the case of a credit card, within five days of changing the rate 4. Automobile loans - may be provided by the lender or the dealer as long as the lender maintains a method for ensuring that the dealer actually provides the proper notice at the appropriate time 5. Contemporaneous purchases - when is granted under an open-end plan for the purpose of financing a contemporaneous purchase any risk-based pricing notice required to be given may be given either at the time of the first mailing to the consumer after the purchase or within 30 days of the purchase.

Identity theft

A fraud committed or attempted using the identifying information of another person without authority

Account review

A risk-based pricing notice must be provided to the consumer when the lender uses a consumer report in the review of an existing account and, as a result, increases the APR on the account.

Consumer report

Any written or oral communication bearing on a consumer's individual credit worthiness or general reputation that is collected to establish the consumers eligibility for 1. credit or insurance to be used for personal, family or household purposes, 2. employment purposes, or 3. any other authorized purposes

Blocking information related to ID theft

Furniture's must have procedures in place to respond to notifications and block re-reporting of information.

Multiple consumers

In a transaction involving multiple consumers a notice must be provided to each. If I credit score is used for each consumer, each must receive a notice even if both have the same address. A notice to a consumer must include only the information on that consumer's credit score.

Eligibility information

Includes any information that would be considered a consumer report if the FCRA exclusions did not apply. Does not include aggregate information and blind data.

Identify theft program

Must develop and implement an identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with any existing covered account or the opening of a covert account.

Fraud alerts

Must notify users of reports that the consumer may be a victim of fraud, including Identity theft, or is an active duty military consumer

Active-duty alerts

Upon receipt of a request from an active duty military consumer, the CRA must include an active duty alert in the file for 12 months. Requesters are excluded from prescreen list for two years.

Identity Theft - Address Discrepancies

Notice of address discrepancy is a notice informing a user that a consumer address supplied by the user in it's request for a report is substantially different from one in the consumer's file at the consumer reporting agency.

Risk based pricing notice

Required: 1. Anyone who uses a credit report in connection with an application for consumer purpose credit, and who grants credit on terms that are materially less favorable than the most favorable terms offered to consumers by that person (business credit is excluded) 2. Notices must be provided to a consumer when the terms on the credit product offered to the consumer are materially less favorable (when directly compared) than terms offered on the same product to other consumers. 3. Material terms include - for open-end plans, the APR required to be disclosed under Reg Z, but not a temporary discounted APR that is lower than the APR that will apply after the temporary rate expires, a penalty APR, or fixed rate option APR. - for credit cards, the APR for purchases, or if there is no APR for purchases, the APR that varies based on credit information that has the most significant financial impact on the customer - for closed-end plans, the APR disclosed under Reg Z - for credit with no APR, the financial term that varies based on credit information and that has the most significant financial impact on the customer, such as a required deposit or membership fee.

Consumer report does not include

1. A report containing information only on the transactions or experiences between the consumer and the person making the report 2. The sharing of experience information between affiliates 3. The communication of other information among persons related by common ownership or by corporate control, if it is clearly and conspicuously disclosed to the consumer that information may be shared by affiliates and the consumer is given the opportunity to opt out before the time the information is shared 4. The authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card 5. A report in which a person who has been requested by a third-party to extend credit directly or indirectly to a consumer, provided the third-party advises the consumer of the name and address of the person requesting the report and the required disclosures are given 6. And investigative consumer report for a prospective employer that has been previously authorized by the consumer

Alternative method for credit card issuers

1. Credit card issuers may use the credit score proxy or tiered pricing method, or may provide a risk based pricing notice to a consumer when the consumer is responding to a direct mail application or solicitation in which there is more than one purchase APR and the issuer provides the consumer with an APR that is greater than the lowest rate that has been provided on the credit card product based on a consumer report. 2. A credit card issuer is not required to provide a risk based pricing notice if the issuer's program offers only one rate (not including a temporary discounted rate or a penalty rate) or if the issuer offers the consumer the lowest APR available on the program, even if there is a lower APR offered by the issuer on another card program.

Requirements for users of consumer reports

1. Give an oral, written, or electronic disclosure to a consumer when information from a consumer reporting agency contributes in whole or in part to take an adverse action against the consumer. Adverse actions include: 1. I denial of consumer credit or insurance 2. The refusal to open a checking account 3. An adverse change in terms of consumer credit or insurance such as refusing to renew a policy, credit card, or line of credit 4. The denial of employment

Elements of an identity theft program

1. Identify relevant red flags for covered accounts and incorporate them into the ID theft program 2. Detect red flags that have been incorporated into the financial institution's program 3. Respond appropriately to any red flags to prevent and mitigate ID theft 4. Ensure the program is updated periodically to reflect changes in risks to its customers and to its own safety and soundness

Permissible purposes for providing consumer reports

1. If authorized in writing by the consumer 2. In response to a court order having jurisdiction or a subpoena issued by the federal grand jury or review or collection of an account of the consumer 3. In connection with a credit or insurance transaction 4. For employment purposes however before procuring a consumer report, an employer must disclose to the individual in writing that a consumer report may be obtained and must obtain written authorization from the individual before procuring the report 5. To a person with a legitimate business need for the information: - in connection with the business transaction initiated by the consumer or - to review an account to determine whether the consumer continues to qualify for terms - for use by a potential investor or servicer - for business purpose transactions if the consumer is or will be personally liable for the businesses' debt 6. To a financial institution, to obtain prescreened Consumer Reports to make firm offers of credit or insurance unless consumers have elected to opt out of being included on prescreened lists

Multiple credit scores

1. If multiple scores are obtained the notice must be provided and include the information on the credit score that was used 2. If multiple scores are used and averaged, the notice must include information on one of them, and, at the creditor's option, may include information on more than one

Responsibilities of information providers

1. Information must be accurate 2. If the issuer has been notified by the consumer that information is inaccurate and the information is in fact inaccurate, the information may not be reported 3. If an information provider determines that it has made an inaccurate report, it must promptly corrected and updated information 4. Information reporters must notify consumer reporting agencies of the voluntary closure of an account by the consumer, during the period in which the account is closed. 5. Information reporters must provide the month and year of the start of the delinquency that resulted in a charge off, placing in the account for collection or similar action within 90 days of furnishing the charge off or collection information

Administration of the ID theft program

1. Obtain approval of the ID theft program from the Board of Directors or committee of the board 2. Involve the board, a member of the board committee, or senior management in the program's oversight, development and implementation 3. Regularly train the institution's staff to effectively implement the program 4. Exercise appropriate oversight of service provider relationships

Adverse decision notification requirements when using credit reporting agency information

1. The name, address, and telephone number of the consumer reporting agency (including a toll-free number if the agency maintains files on a nationwide basis) 2. State that the consumer reporting agency did not make the decision, nor can it speak specifically to the reasons for the adverse action 3. Inform the consumer of the right to obtain a free copy of the consumer credit report within 60 days 4. Inform the consumer of the right to dispute the accuracy or completeness of any information contained in the consumer credit report

Identity Theft - Address Discrepancies Requirements

1. Users must implement reasonable procedures to allow them, at the time they receive a notice of address discrepancy, to form a reasonable belief that the consumer report relates to the consumer about whom it has requested the report; users can comply with this by verifying the CIP information given to them by the consumer, verifying the information with third-parties, or asking the consumer to verify it 2. When it receives a notice of address discrepancy from a consumer reporting agency a user must have reasonable policies and procedures to ensure that it furnishes a consumer address to the consumer reporting agency that the user has confirmed is accurate 3. Compliance may be achieved by verifying the address with the consumer, verifying the address with it's own records, verifying the address with a third-party,, or using other reasonable means 4. The accurate address must be furnished as part of the information the user regularly reports to the consumer reporting agency for the reporting period in which it establishes a relationship with the consumer

Disputes

After receiving a notice of dispute from a consumer reporting agency, the provider must 1. Conduct and complete an investigation within timeframe stated by the consumer reporting agency 2. Review all relevant information 3. Report the results of the investigation to all consumer reporting agency's that were given the incomplete or inaccurate information

Identity theft report

Alleges identity theft with this much specificity as the consumer can provide, such as specific dates related to the ID theft, how a consumer discovered the theft, identification information of perpetrator if known, names of information furnishers account numbers or other information related to the Identity theft

Affiliate information sharing

An institution may not use eligibility information about a consumer, obtained from an affiliate to solicit the consumer for marketing purposes unless the consumer receives a disclosure in writing that the bank may use the information from an affiliate for marketing purposes, the consumers given a reasonable opportunity and a simple method to opt out of the solicitation and the consumer has not opted out

Identifying information

Any name or item of information that may be used, alone or in conjunction with other information, to identify a person. Such as name, Social Security number, date of birth, drivers license or ID number, alien registration number, government passport number, employer or tax identification number, unique biometric data, unique electronics identification number address or routing code, telecommunication identifying information or access device

Prescreen notices

Any person who uses a credit report on a consumer for a credit or insurance transaction that is not initiated by the consumer. With each solicitation sent to the consumer, the bank must provide a short form and a longform prescreen notice.

Consumer reporting agency

Anyone who regularly engages in assembling or evaluating consumer credit or other information to furnish consumer reports to third parties. Among other responsibilities it must purge obsolete information and it may report negative credit information for no longer than seven years and bankruptcies for no longer than ten years unless the information is related to credit or insurance for $150,000 or more.

Initial alert

As requested, a CRA must include a 90 day initial fraud alert in the file of the consumer and alert other CRAs. If the consumer specifies and phone number, the user of a report must contact the consumer at that number or make reasonable steps to verify the consumer's identity and confirm that the credit application is not the result of ID theft

Proof of identity

CRAs must develop reasonable procedures for what information consumers must provide to constitute proof of identity. Must insured the information is sufficient to enable the consumer reporting agency to match consumers with their files and adjust the information so as not to cause harm from misidentifying the consumer.

Extended alert

CRAs must include extended fraud alerts if the consumer provides an identity theft report such as police reports. Users must contact consumers in person or by telephone or other reasonable contact method to confirm the applications for new credit.

Limited information obtained for credit and insurance solicitations

Creditors may use information from consumer reporting agencies, even if the consumer has not initiated the transaction, for credit and insurance solicitations, based on prescreened lists under some circumstances: 1. The information provided is limited to name, address, consumer identifier, and other limited information 2. The user advises the consumer: a. The information contained in the consumer's credit report was used in connection with the transaction b. That the consumer received the offer of credit or insurance because the consumer satisfaction the credit or insurability criteria c. That the unsolicited offer may not be extended if the consumer fails to meet the criteria that was established for the offer or does not furnish any required collateral d. That the consumer has the right to prohibit information contained in a file with any consumer reporting agency from being used if its usage is not initiated by the consumer e. Of the address and toll-free telephone number of the consumer reporting agency for the consumer to exercise the right to opt out of prescreened offers 3. The user makes a "firm offer" of credit or insurance to qualified consumers 4. The entity making the solicitation must maintain on file the criteria used to select the consumer to receive the offer for three years after the offer is made 5. The prescreened solicitation includes an opt out whereby the consumer can elect to be excluded from future pre-screenings

Content requirements for notice of account review

Generally these are the same requirements, however must include a statement that the lender has conducted a review of the account using the consumer's credit history and as a result the consumer's APR has increased

Denial of employment

If the employer uses the report in whole or in part to make an adverse employment decision, the user must provide the consumer a copy of the report and a description of the consumer's right under FCRA

Red flag requirements - risk assessments

Institutions must initially and periodically perform risk assessments to determine whether they offer or maintain "covered accounts," taking into consideration the methods they use to open accounts, methods they provide to access accounts and their previous experience with identity theft

Duties of card issuers - Address validation requirements

Issuers of debit and credit cards must implement reasonable policies and procedures to assess the validity of changes of address if they receive a change of address for consumer's debit or credit card and within a short period of time (during at least the first 30 days after receiving the notice) the issuer receives a request for replacement or an additional card. The issuer my satisfy the timing requirements if it verifies the address change before it receives a request for a replacement or an additional card. The issuer may satisfy the address verification requirement if it: 1. Notifies the card holder at the cardholder's address, or by any means previously agreed to by the car holder, and provides to the cardholder a means of promptly reporting incorrect address changes, or 2. Otherwise assesses the validity of the change of address in accordance with its identity theft prevention policy

Longform notice content

Must contain the language required by the FACT Act, must begin with the heading and capital letters and underlined, identifying the long notice as the "PRESCREEN & OPT-OUT NOTICE", must be set apart from other text on the page, such as by including a blank line above and below the statement and by indenting both the left and right margins from other text on the page and must include a type style distinct from that of the principal marketing message

Materially less favorable

The direct comparison method is used when the lender directly compares borrowers to other similar borrowers in the portfolio to determined who receives a notice. With respect to the same lender, the material terms granted to one consumer differ from the material terms granted to another consumer such that the cost of the credit to the first consumer would be significantly greater than the cost of the credit to the other consumer. Factors that are relevant in determining the significance of the cost difference are the type of credit, the credit term, and the extent of the difference in material terms

Credit score proxy method

The credit score proxy method is used when a lender derives a cut off credit score where at least 40% of its borrowers fall above the cut off and 60% below the cut off. 1. The lender may meet at obligations by determining a cut off score and providing risk-based pricing notice to all consumer borrowers who score fall below the cut off 2. In the case where the lender has granted credit on its most favorable terms to more than 40% of its borrowers, the lender can set its own cut off score at the point at which the approximate percentage of customers would have received credit on other than the most favorable terms and therefore, would receive a risk-based pricing notice

Tiered pricing method

The tiered pricing method allocates notices to borrowers in the higher pricing tiers. Lenders that set the material terms of credit by placing consumers within discrete pricing tiers based on the consumers credit report must provide a risk-based pricing notice to all consumers who are not in the top tier or tiers 1. If the lender has four or fewer pricing tiers, consumers in all tears except the top-tier (lowest price) must be provided with risk-based pricing notices 2. If a lender has five or more pricing tiers, it can comply with the notice requirement by providing risk-based pricing notices to all consumers who are not in the top two tiers. The lender may add any other tiers to the top to tiers that, together with the top two tiers, comprise no less than the top 30% but no more than the top 40% of the total number of tiers. Consumers in the remaining bottom tiers must receive a risk-based pricing notice.