Fair Credit Reporting Act:
What is the "credit decision to Third Party" information sharing exception that wouldn't make you a CRA?
The term "consumer report" doesn't include any report in which a person (including bank) who has been request by TP to make a specific extension of credit to consumer, conveys decisions with respect to the request. (TP has to give name and address of bank request of credit was made to and bank must make adverse action disclosures)
What is "negative information" on a credit report?
Any info concerning delinquencies, late payments, insolvency, or any form of default.
There are six exceptions to the risk-based pricing notice requirements, what are they in general? Does this mean you don't have to send any notice?
*No, generally you always have to send some sort of credit notice when some customers get materially less favorable terms. 1 - if consumer applies for specific terms of credit (before a consumer report is considered) and receives them 2 -when a creditor provides adverse action (duh, they didn't get terms) 3 - when a creditor makes a firm offer of credit in prescreened solicitation 4 - when a bank generally provides a credit score disclosure to each customer that requests a loan that is or will be secured by residential real property (think notice to home loan applicant) 5 - when a bank generally provides a credit score disclosure to each consumer that requests a loan that is not or will not be secured by residential property (i.e. they're already providing them the info) 6 - when a bank, which otherwise provides credit score disclosures to consumers that request loans, provides a disclosure about credit scores when no credit score is available (idk what this means)
What are the requirement for FI's that obtain a consumer report of its employees or prospective employees prior to, and/or during, the term of employment?
1. they have to get written permission to procure report from consumer 2. they have to provide a clear and conspicuous disclosure that they may obtain a consumer report 3. prior to taking adverse action involving employment based in WHOLE or in PART on consumer report, the bank must 1. provide copy of report and 2. description in writing of rights under this title 4. give adverse action notice
When a creditor is required to follow the "notice of address change" procedures, what alternative do they have to the normal procedures? (Its related to timing)
A card issuer may satisfy the requirements of the rules prior to receiving any request for an additional or replacement card by validating an address when it receives the an address change notification.
What is the "Tiered Pricing Method"? How does it apply to risk-based pricing notices?
A tier pricing method is when you fall into a pricing tier based off of your score. This method requires creditors to send risk-based pricing notices to the top 30-40% of tiers, if they have 5 or more tiers. If they have 4 tiers or less, they must send to everyone but the top tier. (i.e. a tier would be the materially term like APR for closed-end consumer loan)
If a bank takes adverse action on an application based on information obtained from a source other than a CRA, what must it do?
Adverse action includes denial OR increase in charge for credit that is partially or wholly based on person other than a CRA that bears on consumer's creditworthiness, standing, capacity, character, general reputation, personal characteristics, or mode of living. The bank must communicate this action to customer and clearly disclose right to file written request for adverse action info. If within 60 days consumer request info they have to provide sufficient detail to enable consumer to evaluate its accuracy. (don't need to disclose the source)
When can a bank use medical information, or request medical information, when determining a consumer's eligibility, or continued eligibility, for credit? I.e. what exceptions are there, because this is generally a prohibited practice.
Financial Information Exception: credit can obtain and use info so long as it follows these three requirements: 1 - the info is the type routinely used in making credit decisions (i.e. debts, expenses, income, benefits, assets, collateral, purpose of the loan) 2 - credit uses medical info in a manner and to an extent that is NO less favorable that it would use comparable information that isn't medical AND 3 - does not take into account consumer's physical, mental, or behavioral health condition or history, type of treatment, prognosis, etc. in determination.
What are the technical notice and opt out requirements for pre-screened notices?
If a bank provides a pre-screened notice, they must provide the "short notice" and the "long notice". There is specific language that must be in each. They also must be in specific places and specific fonts.
If say a customers comes to Carter Bank and disputes a late payment on a loan with Will Bank. Is Carter Bank obligated to investigate the error and report findings to the CRA? (assume both Carter and Will are furnishers of information)
NO. There are 6 exceptions where a customer disputing something wouldn't trigger the direct dispute rules. 1-disputing consumers identifying info (social, telephone #, etc.) 2-identity of past or present employers 3-inquiries or requests for a consumer report 4-info derived from public records (unless it was related to bank) 5-info related to fraud alerts or active duty alerts 6-info provided to a CRA by another furnisher. 7(or if consumer is disputing anything with help from credit repair organization)
If a bank provides its affiliate with marketing criteria, and the affiliate then uses that criteria to market to customers, is this subject to the "affiliate marketing opt-out" requirements?
No. Banks are allowed to provide affiliates criteria. However, if they use eligibility information FROM the affiliate, then it is subject to requirements.
How often do creditors have to recalculate thresholds for risk-based pricing notices? Are they required to use the universe of customers?
They can use a representative sample of customer or the universe. They must recalculate the score no less than every 2 years.
How should credit card issuers decide when to send risk-based pricing notices?
They can use any of the methods (i.e. tiered pricing method, credit score proxy method, alternative to 40/60 custom method), OR they can use a special exception when they meet two requirements. 1. they provide the notice when a consumer applies for a credit card in connection with an application program or in response to a solicitation, and more than one purchase APR may apply and 2. based in whole or in part on a consumer report, the credit card is issued to a consumer with an APR that is HIGHER than the lowest APR available in connection with the application or solicitation (i.e. everyone but the lowest APR), OR if they only offer a single APR under the program/solicitation, then risk based notices do not apply!
When does a furnisher have to let the CRA know about a customer voluntarily closing an account?
They have to let them know in info regularly furnished in the period they close the account.
If you are a victim of identity theft, how soon does a bank have to provide you requested records?
They have to provide victims of fraudulent transactions (and the government agency or law enforcement agency) the documents within 30 days of request.
What is the "joint user rule" exception that banks can share information under without becoming a CRA?
Under this exception, financial institutions may share info if they are jointly involved in the decision to approve a consumer's request for product or service, provided that each has a permissible purpose to obtain a consumer report on the individual. (i.e.high LTV loan requires PMI, you can share info with PMI company)
A bank has a cutoff score of 650 for sending risk-based pricing notices to customers. One of its customers has no credit history and thus no credit score available. Is a bank required to send them the notice?
Yes. If no credit scores is available, a bank must assume that is granting credit on materially less favorable terms and thus must provide a risk-based pricing notice to the consumer.
Where and in what form should the "long notice" for opt-out of prescreened solicitations be?
Long notice has specific language. Must appear in solicitation. Must be no smaller than type size of principal text on same page, no smaller than 8pt font. Notice has to begin with "PRESCREEN&OPT OUT NOTICE" (this must be underlined)
When determining when to send a risk-based pricing notice, what terms are considered "material"? they differ by types of credit.
Material terms means... 1-open-end credit where APR is required to be disclosed under reg Z 2-for credit cards (other than cards to access HELOCs) the APR that applies for purchases. 3-for closed-end credit, APR required to be disclosed by reg Z. 4-for non APR credit, the financial term that varies based on the consumer report info and has most significant financial impact on consumers (i.e. annual membership fee)
In addition to the 3 "general exceptions" of when sharing information doesn't make you a CRA, there are 3 additional "other exceptions" that when shared also don't make you a CRA. What are the three?
-Specific extensions of credit: -Credit Decision to Third Party (e.g. auto dealer) -Joint User Rule
What does a lender have to disclose to meet the "notice to home loan applicant" requirements?
-They have to provide the specific language in the reg. They also have to provide the name, address, and # of each CRA that provided information. -they have to also disclose the credit scores used, date credit score was created, and "key factors" used in score calculation. -Key factors should be listed in order of importance based on their effect on score. Total factors shouldn't be more than 4 unless one factor is the # of inquiries then they can disclose 5.
What is the difference between an "investigative consumer report" and a "consumer report"?
-a consumer report is provided by a Consumer Reporting Agency (CRA) bearing on creditworthiness, credit standing, etc. to be used to get credit or insurance for household purposes, or employment purposes. -An investigative consumer report is when information (info on character, general reputation, mode of living, personal characteristics) was obtained through personal interviews with neighbors, friends, or associates of the consumer reported on.
What is the prevention of re-pollution of consumer report information supposed to prevent?
-when a furnisher receives notice from a CRA that furnished info may be fraudulent as a result of identity theft, it must have procedures in place to ensure the data isn't depolluted.
How do you determine who received materially less favorable terms? (i.e. who gets the risk-based pricing notice) There are two methods.
1 - Credit Score Proxy method: if credit scores set material terms of credit, creditor can find cutoff score where 40 percent of consumers have higher credit, and 60 have lower credit scores. Consumers in bottom 60% get it. 2-Alternative to 40/60 cutoff: basically, if say 80% of customers get the most favorable terms and 20% don't, then set the cutoff at the 80% threshold. (i.e. 80% of consumers got the best materially term offered and had scores of 750. The 20% with scores below 750 get notice)
When a customer notifies bank of change of address, and then requests a replacement or additional card within 30 days, what must the bank do?
1 - Notify the cardholder of the request for an additional or replacement card a. at the cardholders former address or b. by any other means of communication that the card issuer and the cardholder have previously agreed to use. 2- provide to the cardholder a reasonable means of promptly reporting incorrect address changes 3-assess the valid of the change of address according to the procedures the card issuer has established as part of its "Identity Theft Prevention Program"
what three things constitute a "pre-existing business relationship"? for purposes of the Affiliate Marketing Opt-Out requirements?
1 - a financial contract between person and consumer is in force 2 - 18 month period immediately preceding the date on which the consumer is sent a solicitation after it has purchased, rented, or leased, or has a financial transaction with bank 3 - an inquiry or application by consumer regarding product or service offered by person during 3 month period immediately preceding the date on which a solicitation covered by "affiliate marketing regulation" is sent.
There are special requirements to obtain an "investigative consumer report." what are the 4?
1 - disclose to consumer that an investigative report may be obtained 2 - disclose consumer's right to request and other info about report, 3 - The disclosure is in writing and is mailed or otherwise delivered not later than 3 business days after the date the report was requested 4 - bank procuring report certifies to CRA that it has complied with disclosure requirements and will comply in the event that the consumer requests additional disclosures about report.
What are the 4 permissible purposes for a CRA to furnish a consumer reports?
1 - response to court order or subpoena 2 - in accordance with written instruction fo the consumer 3 - to a person (including financial institution) which it has reason to believe intends to... (there 6 times, but basically employment, credit, insurance, underwriting, or legitimate business need) This is #1 reason banks get consumer reports. 4 - in response to a request by head of state or local child support enforcement agency. (banks wouldn't really do this.)
In addition to requirement related to financial institutions acting as CRAs, FCRA requirements also apply to who? (4 categories)
1- procurers and users of information 2- furnishers and transmitters of information 3 - Marketers of credit or insurance products 4 - Employers
What are the general requirements for sending a risk-based pricing notice?
1-bank uses consumer report in connection with application or extension of credit to a consumer for personal, family, or household purposes 2-based in whole or in part on the consumer report, the credit granted is materially less favorable than the most favorable material terms available. *the original creditor is required to provide this, not brokers or other intermediaries.
A user of consumer reports must develop and implement reasonably policies and procedures for furnishing a correct address for the consumer that the user has reasonably confirmed is accurate when the user does what three things?
1-can for a reasonable belief that the report relates to the consumer who requested it 2-establishes a continuing relationship with the consumer (i.e. new account) 3-regularly furnished info to an NCRA that provided the notice of address discrepancy Must do this within period it starts reporting new relationship to NCRA
When a furnisher gets a direct dispute from a consumer, what must they do?
1-conduct a reasonable investigation 2-review all relevant info provided by consumer 3- complete its investigation of dispute and report results to the consumer before the expiration of the period under 611(a)(1) (which is basically the period the CRA would have to report back by if the dispute when thorough them) 4-If there was inaccurate info, fix it and report it to all CRAs you provided it to to make it accurate.
What are the five things a furnisher must do upon notice of dispute from a CRA?
1-conduct an investigation 2-review all relevant info provided by CRA along with notice 3-report the result of investigation to the CRA 4-If disputed info is found to be incomplete or inaccurate, report those results to whoever you reported it to previously (fix your mistake everywhere) 5-if disputed info is incomplete, inaccurate, or not verifiable then they must modify/delete/permanently block info for reporting.
What three things can't a bank do if there is a fraud or active duty alert on the report?
1-establish a new credit plan or extend credit (other than under an open-end credit plan duh) in name of consumer 2-issue an additional card on an existing account or 3-increase a credit limit
When is a dispute considered "frivolous or irrelevant" and the bank wouldn't have to dispute it?
1-if consumer didn't provide sufficient information to investigate the disputed info 2-the direct disputes is substantially the same a dispute previously submitted (its not similar if its alleging new errors around already disputed one) 3-or for a dispute with an exception (i.e. its about another bank's loan)
What did FCRA require federal banking agencies and FTC to issues regulations for for furnishers of information?
1-issues guidelines for use by furnishers regarding the accuracy and integrity of the information about consumers that they furnish 2-prescribe regulations requiring furnishers to establish reasonable policies and procedures for implementing guidelines 3-issue regulations identifying the circumstances under which a furnisher must reinvestigate disputes concerning accuracy of info contained in a consumer report based n a direct request from a consumer.
What are some general requirements that must be on the risk-based pricing notice?
1-tells them what a consumer repot is 2-a statement encouraging them to verify accuracy of information contained in report and right to dispute 3-identify each CRA that furnished a consumer report 4-a statement that federal law gives the consumer right to obtain copy without charge for 60 days 5-how the consumer can get that report (including telephone #) 6-statement directing consumers to bureau website 7-a statement that terms offered, such as APR, have been set based on consumer report 8-statment that terms offered may be less favorable than the terms offered to consumers with better credit histories.
When a consumer wants to dispute something directly with a bank, what do they need to provide for the bank to actually have to address something?
1-they have to provide it to specified address, or to any business office if not specified. 2-they have to provide support for their claim (i.e. print out of credit report showing inaccurate informtation) and enough info to identify account.
What are the 4 examples of how a user may reasonably confirm an address is accurate?
1-verifying address with the consumer who's report was requested 2-reviewing its own records 3=verifying the address through TP sources 4-using other reasonable means.
What transactions require a "Notice to The Home Loan Applicant" about credit score?
Anyone who uses a credit score in conjunction with closed- or open-end credit for consumer purposes that is secured by 1-4 family residential real properties. (wouldn't include 1-4 family secured for business purposes) *an automated underwriting system that considered one or more factors in addition to "credit information" such as LTV, or amount of down payment, or financial assets of consumer do NOT trigger this requirement.
When must the "notice to home loan applicant" be provided?
As soon as reasonably practicable after using a credit score.
If there is an active duty alert, extended fraud alert, or regular fraud alert, what does it require a bank to do?
Basically verify that it is truly the consumer. If it is not then they can't extend credit basically.
Summarize how "prescreening" works....
Basically, bank gives criteria to a CRA. CRA eliminates customers who don't meet that criteria and provides 1. name and address of a consumer 2. an identifier that is not unique to the consumer, but is used to verify identify of consumer and 3. other information pertaining to a consumer that does not identify the relationship or experience fo the consumer with respect to a particular creditor or other entity. The bank has to make a "firm offer" of credit to these individuals and each name is considered a consumer report. However, bank doesn't have to grant credit if consumer isn't creditworthy, insurable, or cannot furnish rcollateral.
What is the purpose of risk-based pricing notices?
Basically, it is to tell a consumer they got terms that were "materially less favorable" than other consumers, rather than being denied, based on info from a consumer report.
If a bank starts offering a new product, or they acquire a portfolio, how do they determine the cutoffs for sending a risk-based pricing notice?
Basically, they can use market data to determine it up front. If it is newly acquire portfolio, they can use cutoff from the party they acquired it from. HOWEVER, they have to within one year, recalculate the cut-off score.
How can a bank identify an identify theft victim?
Basically, they have to have a high degree of confidence it is the victim. They can require 1-a government issued ID 2-PII of same type that was provided to financial institution by unauthorized person
What is the "Truncation of Credit and Debit Card Account Numbers" rule?
Basically, you can't provide more than the last 5 digits on an electronic receipt, or the card expiration date. If it is a hand-written receipt, this doesn't apply.
FCRA could easily apply to many banks and make them CRAs and subject to hefty requirements. However, there are certain exception that if operated within, they are not CRAs. 1. what type of information and 2. what three information sharing practices don't make bank's CRAs?
If a bank shares information that bears on a consumers creditworthiness, character, and capacity, it could be a CRA unless... 1 - reports containing information solely as to transactions or experiences between consumer and bank making report may be shared with any TP and bank won't be a CRA (remember though, privacy GLBA still applies) 2 - Communication of transaction or experience information among affiliates 3 - It shares "other information" (i.e. not transaction or experience information) with a. an affiliate, and b. provides notice to consumer and change to opt-out (opt-out is same as GLBA opt out) (examples of other information include an application with info about accounts at other institutions)
When are the "Change of Address" rules triggered? (i.e. what circumstances require procedures to follow?)
If a creditor receives notification of change of address on a consumer's credit or debit card, AND it is within a short period of time afterword (within 30 days of such notification) someone requests additional or replacement cards
What is "eligibility information"? for purposes of the Affiliate Marketing Opt-Out requirements?
Includes Transaction and Experience information from FI and customer, and "other" information from TP's like credit score and such. (remember, this can't be shared for marketing purposes unless provided opt-out requirements)
How many days does a fraud or activity duty report stay on credit file?
Initial fraud alerts are on for no less than 90 days active duty alerts must remain in service members files for no less than 12 months.
If a bank uses multiple credit scores, how does it determine the threshold to send risk-based pricing notices?
It can use an average, or reasonable means to determine this.
What are the timing requirements for delivery of the risk-based pricing notice?
It depends on type of credit... 1. closed-end credit is after credit decision and before consumation 2. open-end credit is after credit decision and before first transaction is made 3. for account reviews when APR is increased and communicated to customer. or 5 days after it takes affect if no notice of increased APR was required. 4. for automobile lending made through an auto dealer, the dealer can provide it 5. for instant credit granted under open-end credit plan to a consumer in person or by telephone, risk-based notice can be provided earlier of 1. time of first mailing or 2. within 30 days after credit decision.
What should you know about the six exceptions to the risk-based pricing notice requirements?
Know that 1. they still have to provide a credit "notice" of some sort. There are model forms for all the notices. If there's multiple credit scores used, you general go with the most reasonable one, and there are timing requirements (general as soon as reasonably practicable after bank has requested credit score.), AND that there are specific language on each notice that you need to use, but generally it just tells consumer about a credit score.
If a consumer opts out of an "affiliate marketing" arrangement, how long is that opt-out good for?
It has to be good for at least 5 years. It can be more.
What is a "notice of address discrepancy"?
It is a notice sent to the user of a consumer report by the NCRA that provided it that tells the user of a substantial difference between the address for the consumer that the user provided to request the consumer report and the addresses in the NCRA's file for the consumer.
Under FCRA, what is adverse action?
It is the same as under ECOA. 1 - denial or revocation of credit 2 - a change in terms of existing credit arrangement 3 - refusal to grand credit in substantially the same amount or on same terms as requested. There are 5 additional things that constitute adverse action under FCRA. I'd just know that denial of employment, changes or denial in insurance count. Others are weird.
Where and in what form should the "short notice" for opt-out of prescreened solicitations be?
Must be in a type size larger than principal text on page, no smaller than 12 pts. Must be on front side of first page of principal promotional document in the solicitation.
In addition to the "financial information exception" how many other times can a bank obtain and use medical information on a consumer? (these are much less common)
There are 9 different times as follows.... 1-to determine if power of attorney or legal representative that is triggered by a medical condition/event is is necessary and appropriate (i.e. bank can get documentation that true medical condition exists and person need Power of Attorney) 2-to comply with applicable local, state, or federal laws 3- in conjunction with a legally permissible special credit program related to medical conditions 4 - to extent necessary for purposes of fraud prevention 5 - in case of credit for purpose of financing medical products or services 6 - consistent with safe and sound banking practices, if the consumer requests that the creditor use medical information in determining eligibility, or continued eligibility for credit, to accommodate consumers circumstances, and request is documented by creditor. 7- consistent with safe and sound banking practices, to determine whether the provisions of a forbearance practice or program that is triggered by a medical condition or event apply to a consumer. 8 - to determine consumer's eligibility for/triggering of/reactivation of debt cancellation contract or debt suspension agreement 9 - to determine eligibility for, triggering of, or reactivation of credit insurance product if a medical condition or event is a triggering event for the benefits
What is on the notice to the consumer about reporting negative credit info?
There is a really short paragraph that has the model text basically saying we will/have told credit bureau about a late payment, etc.
Are furnishers of information required to have certain policies and procedures? If so, around what?
They HAVE to have reasonable policies and procedures concerning the accuracy and integrity of furnished information and interagency guidelines and must review and update them regularly.
How long is an extended fraud alert good for? How can a consumer place one?
They are good for 7 years. They require consumer to submit identity theft report and appropriate proof of identity to the nationwide CRAs.
What does a regular furnisher of credit information do when they find become aware that information may be inaccurate?
They have to stop reporting that information, or they can furnish it if they have notice that the information is being disputed by the consumer. They would also have to be correcting it.
How soon before reporting "negative information" about you must the bank notify you?
They must notify consumer either before, or within 30 days of reporting, that negative info was reported.
When a debt collector is notified that any information relating to a debt that it is attempting to collect may be fraudulent, or may be the result of identify theft, what must they do?
They must notify third party they are collecting for of this fact. *remember debt collectors aren't banks collecting their debt in their name.
If a bank takes adverse action with respect to any consumer based on information received from a CRA, what must they do?
They must provide the 1. adverse action ORALLY, WRITTEN, or ELECTRONICALLY 2. the name, address, and telephone # of CRA from which it received info 3. the right to free copy of consumer report from CRA within 60 days of adverse action notice/right to dispute accuracy
What is the "specific extensions of credit" exception?
This exception allows banks to share certain information without become a CRA. Basically, a lender can communicate an authorization through the credit card network to a retailer to enable them to complete the purchase. Even though this is financial information and kind of bears on the consumers character, it wouldn't make them a CRA.
What is the "affiliate marketing opt out" requirement? What other requirement does it relate to?
This gives the consumer the right to restrict an entity, that it doesn't have a pre-existing business relationship with, from using certain information obtained from an affiliate to make solicitations to that consumer. (this is distinct from affiliates being allowed to share transaction or experience and "other" information (i.e. credit applications and reports) with affiliate because those aren't MARKETING purposes)
How long are you supposed to maintain the criteria used for selecting prescreened lists?
Three years from the date of the offer was made to customer. Remember, you also have to keep the underwriting requirements like collateral requirements.
Can banks share 1. medical information 2. an individualized list or description based on the payment transaction of the consumer for medical products or services or 3. an aggregate list of identified consumers based on payment transactions for medical products or services an with affiliates?
Yes, but they become CRA's unless exceptions apply! Exceptions are weird. They include HIPPA purposes, GLBA section 502(e) purposes, or in connection with a determination of consumer's eligibility for credit consistent with the "financial information exceptions", and a few others.
What is a "solicitation" for purposes of the Affiliate Marketing Opt-Out requirements?
means the marketing of a product or service initiated by a person, such as a FI, to a particular consumer that a. is based on eligibility information from affiliate and b. intended to encourage consumer to purchase or obtain a product/service. Remember, before this happens consumer has to consent!
If a bank takes adverse action based on information in whole or in part provided by an affiliate, what must it do?
must notify consumer that... 1-information was furnished by person related by common ownership or affiliated by corporate control 2-info bears on consumers creditworthiness, standing, capacity, character, general reputation, personal characteristics, mode of living 3-information is not solely involving transaction or experiences between consumer and person furnishing information 4-information isn't consumer report *notification has to inform consumer of action and that they may obtain a disclosure of the nature of info relied on within 60 days by written request. Must disclose info not later than 30 days after request.
For FCRA, is there a difference between a "consumer" and a "person"?
yes. A consumer is an individual. A person can be a "individual, partnership, corporation, trust, estate, cooperative, association, government, etc. Therefore, all consumers are persons, but not all persons are consumers.