Fair Credit Reporting Act (FCRA)

FCRA Creates *Business Disincentive* (rather than containing sharing prohibitions):

Such That if a Bank Shares Consumer Report Information Outside of the Exceptions, the Bank is considered a Consumer Reporting Agency and then *SUBJECT TO SUBSTANTIVE REQUIREMENTS of the FCRA* (Typically a Bank will structure Information Sharing Processes within the exceptions to avoid becoming a Consumer Reporting Agency)

*Notice of Address Discrepancy* is sent by a NCRA to a Bank:

That informs the Bank of a *SUBSTANTIAL DIFFERENCE* between the address for the consumer provided for application of credit and the address the NCRA has on file.

Negative Information Notice:

**CANNOT BE Included in Initial TILA Notices.**

For example, if Person A is attempting to act on behalf of Person B under a Power of Attorney that is invoked based on a medical event,

A creditor is *ALLOWED to OBTAIN and USE Medical Information* to verify that Person B has experienced a medical condition or event such that Person A is allowed to act under the Power of Attorney.

Banks *ARE NOT SUBJECT* to:

A number of different requirements under FCRA. *(because most banks are not Consumer Reporting Agencies)*

Consumer under FCRA is:

An individual.

FCRA substantially covers:

Banks acting as *Consumer Reporting Agencies*.

If Two Joint Applicants Apply for a Mortgage Loan to Purchase a single-family residence and the lender uses Both credit scores:

Both Credit Scores should be Disclosed. Both Scores can be included on *ONE DISCLOSURE*.

(MEDICAL INFORMATION CAN BE USED) If Forbearance Program *CAN BE* triggered:

By a Medical Condition.

Medical Information Can be Obtained and Used to:

Comply with Local, State, or Federal Law.

Initial Fraud Alert:

Consumers who suspect that they may be the victims of Fraud (including identity theft) *MAY REQUEST* nationwide consumer reporting agencies to place initial fraud alerts on their Consumer Report. *THEY MUST REMAIN ON THE REPORT for NO LESS THAN 90 DAYS*

ALSO if a Bank is allowed to obtain a full consumer report on anyone responding to the offer to verify that the consumer continues to meet the creditworthiness criteria.

If the consumer no longer meets those criteria, the bank does not have to grant the loan.

The bank *MUST PROMPTLY notify the NCRA* if it determines Address information to be:

Inaccurate

Also, Medical Information Can be Obtained and Used For:

Purposes of Financing Medical Products or Services, to Determine and Verify the Medical Purpose of the loan and the use of the proceeds.

If a Bank obtains Medical Information about a Consumer from a Consumer Reporting Agency or it Affiliate:

The Bank *CANNOT DISCLOSE* that Information to Any Other Person.

This Next one Does Not Apply to Banks that Only collect their own debts (ONLY APPLIES TO BANKS ACTING AS DEBT COLLECTORS)

When the Debt Collector is Notified that Information Related to a Debt that is attempting to Collect *MAY BE FRAUDULENT or RESULT of IDENTITY THEFT, the Debt Collector MUST Notify the Third Party of this fact* Additionally if the Consumer (who they are collecting debts from) Requests Information about the transaction, the Debt Collector must provide ALL information(applicable to the Bank) the consumer would be entitled to if the Consumer wished to Dispute the debt.

A Bank that receives notice from a Consumer Reporting Agency that furnished information *MAY BE FRAUDULENT* as a result of Identity Theft:

When the potential fraudulent Notice is received from the Bank they must establish procedures to *Ensure the information is not Re-Reported to the Consumer reporting agency, thus "re-polluting" the consumer report*

Banks *MUST HAVE* Policies and Procedures:

Designed to *Form a Reasonable Belief that the Consumer Report relates to a consumer whose Report was requested*, when the Bank receives a *Notice of Address Discrepancy*

A Bank that furnishes Information to Credit Reporting Agency regarding a Loan Account:

*MUST NOTIFY* the Consumer Reporting Agency of *VOLUNTARY CLOSURE* of the account by the consumer in information regularly furnished for the period which the account is closed.

The medical information must be used in a manner:

*NO LESS FAVORABLE* that it would use comparable *NON-MEDICAL INFORMATION*

The Reasonable Policies and Procedures Should Include:

(1) *Comparing information in the consumer report with the information the Bank*: - Has obtained and used to verify the consumer's identity as required by CIP rules; - Maintained in its records; or - Obtains from Third Parties. AND (2) *Verifying the information in the consumer report with the consumer*.

Medical Information Can be Obtained and Used For:

Purposes of Fraud Prevention or Detection.

Consumer who allege they are the victim of Identity Theft *MAY PLACE an EXTENDED ALERT*:

Which *LASTS 7 YEARS* (Consumer's must submit ID theft reports and appropriate proof of identity to the nationwide credit reporting agencies)

(MODULE 5) Two Primary Requirements Exist:

(1) A consumer report that Contains a *FRAUD or ACTIVE DUTY Alert* Must take steps to verify the identity of an individual to whom the Consumer Report Relates; AND (2) A Bank must disclose certain information when consumers allege that they are victims of identity theft.

Risk-Based Pricing Notice Must be Provided when:

(1) Bank uses a Consumer Report in connection with an application for a loan for PERSONAL, FAMILY, or HOUSEHOLD PURPOSES, AND (2) The Terms are Based Whole or In Part on the Consumer Report are *Materially Less Favorable*

The bank MUST:

(1) Develop and Implement reasonable Policies and Procedures for furnishing to the NCRA an address for the Consumer; (2) And Confirm that address is Accurate.

The election of the *Opt-Out* is good for:

*AT LEAST 5 YEARS beginning when the opt-out election is received and implemented.* *An Opt-Out period can be set for MORE THAN 5 YEARS and even set to NEVER EXPIRE*

When Pre-Screened Consumer Reports are used:

*An Opt-Out Notice is Required*

Risk-Based Pricing Notice is REQUIRED WHEN:

*BASED ON A CONSUMER REPORT*, The bank extended terms that are *"MATERIALLY LESS FAVORABLE"* than the terms the bank has extended to other consumers.

Banks *MUST* provide Consumers with a Notice Either:

*BEFORE* Negative Information is provided to a Nationwide Consumer Reporting Agency, or *WITHIN 30 Days AFTER REPORTING the Negative Information*

Comparative File Method:

*CANNOT BE USED*

Risk- Based Pricing Notices:

*DO NOT* need to be provided to Co-Signer, Guarantor, Surety, or Endorser for another consumer.

If the bank uses Tiered Pricing:

*If 4 or Fewer Tiers: Risk-Based Pricing Notice provided to all not in Top Tier.* *In 5 or More: Risk-Based Pricing Notice provided to all not in Top 2 Tiers. (or Top 30% or 40%)*

Risk-Based Pricing Notice does *Not* need to be provided:

*If everyone gets the same rate.*

Transaction and Experience Data Only Needs an Opt-Out when shared *with an Affiliate:*

*That is using it for Solicitation Purposes.*

Pre-screened Consumer Reports *MAY BE OBTAINED* by Banks to make *"Firm Offers of Credit or Insurance"* to Consumers:

*UNLESS* the Consumers have *Elected to Opt-Out* of being included on Pre-Screened Lists.

Banks *MUST PROVIDE* records of Fraudulent Transactions to Victims of ID Theft:

*Within 30 Calendar Days after the Receipt of a Request for the Records.*

Solicitations include:

- A telemarketing call, - direct mail, - e-mail, - or other form of marketing communication directed to a particular consumer that is based on eligibility information received from an affiliate.

Materially LESS FAVORABLE TERMS:

- APR - Fees Significantly greater than the cost of credit to another applicant based on Consumer report.

(MODULE 4) FCRA requires:

- Accurate Reporting; - Prompt Investigation; and - Resolution of Accuracy Disputes.

Examples of when consumer reports CAN BE Obtained:

- Applying for a mortgage; - Consumer signs a Borrower Authorization to Obtain Credit report (MUST BE WRITTEN); -Credit card increase of limit by Bank

In order to determine who gets the notice the bank can use: (Credit Score Proxy)

- Credit Score Proxy method 40/60 > 60 get the notice BUT DIFFERENT CUT OFFS CAN BE SET.

***The Bank CAN Share Medical Information with an Affiliate ONLY IF:***

- In connection with business of Insurance or Annuities; - Purpose permitted under HIPAA; - Purpose permitted under Privacy Act; - In connection with Determining a Consumer's Eligibility *CONSISTENT* with above-mentioned Financial Information Exceptions - Otherwise permitted by FFIEC

Generally, A Bank *CANNOT* use Eligibility Information about a consumer that is received from an AFFILIATE to make a solicitation for marketing purposes, UNLESS:

- It is Clearly and Conspicuously Disclosed in *WRITING or ELECTRONICALLY* - Consumer is provided a reasonable opportunity to *OPT OUT*; and - *Consumer has NOT OPTED-OUT.*

If a Bank receives a Consumer Dispute from the Credit Reporting Agency and they determine the Consumer's Allegations are Correct:

- The Bank *MUST* Correct the Disputed Information; AND - *Notify ALL CONSUMER AGENCIES* to which Disputed Information was furnished.

Medical Information CAN BE OBTAINED and USED in connection with ANY DETERMINATION of a CONSUMER'S ELIGIBILITY IF Used for Following Financial Information:

- The information is the type *ROUTINELY USED in making credit eligibility determinations*, SUCH AS: *Information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including USE OF PROCEEDS*; - The Bank uses Medical Information in a manner and to an extent that is *NO LESS FAVORABLE* than it would use Comparable Information that is Not Medical Information in a Credit Transaction; AND - *The Bank Does NOT take the Consumer's Physcial, Mental, or Behavioral Health, Condition or History, Type of Treatment, or Prognosis Into Account as Part of Such Determination*

The lists (obtained from credit reporting agencies) that banks Obtain for Pre-Screening (Using consumer reports to make firm offers of credit or insurance) MUST ONLY contain: (The consumer reports are pre-determined based on creditworthiness)

- The name and address of consumer; - Identifier that is NOT unique to the customer and is use solely for the purpose of verifying the identity of the consumer; and - Other information pertaining to a consumer that does *NOT IDENTIFY* the relationship or experience of the consumer with respect to a particular creditor or other entity.

Banks *CAN MAKE Solicitations* with information received from an Affiliate (without initial notice and opt-out) IF:

- They have a *Pre-Existing Business Relationship* with the consumer; - Communications are to an individual for whose benefit the Bank provides employee benefit or other services pursuant to a contract with an employer; - Perform Services on behalf of an affiliate (not if the customer has opted out); - Response to Communication about Bank's products and services; - Response to a consumer's authorization or request to receive solicitations; or - Bank's compliance with the affiliate marketing regulation would prevent it from complying with State insurance laws.

Non-Compliance under FCRA may result in Imprisonment for:

2 Years

The Bank MUST ALSO provide Consumers With:

A Pre-Screened Opt-Out Notice when they make an offer after obtaining a Pre-Screened List. (Also state they got the notice because they met the criteria of the pre-screened criteria) It must provide the Toll-Free Number operated by the nationwide Consumer Reporting Agencies.

If No Credit score is available, the bank must assume they are providing credit on Materially Less Favorable Terms:

A Risk-Based Pricing Notice is REQUIRED.

New products:

A bank can use Market Research to determine the cut-off score (MUST BE RECALCULATED within 1 year of introducing the new product)

Banks MUST MAKE a "firm offer of credit or insurance" in order to obtain the list, BUT:

A bank is *NOT REQUIRED* to grant credit or insurance if the consumer is *NOT CREDITWORTHY or INSURABLE, or CANNOT furnish required collateral, provided that the underwriting criteria are determined in advance, AND APPLIED CONSISTENTLY*

Risk-Based Pricing NOT required when:

Adverse Action.

Person under FCRA is:

Any individual, partnership, corporation trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

For example, A sample of credit extended in the past six months, a creditor may determine that approximately 80 percent of its consumers received credit at its lowest APR (i.e., the most favorable material terms), and 20 percent of its consumers received credit at a higher APR (i.e., material terms other than the most favorable). Approximately 80 percent of the sampled consumers had a credit score at or above 750, and 20 percent had a credit score below 750.

As a result, the card issuer could select 750 as its cutoff score. Consumers who have credit scores lower than 750 would

*Risk Based Pricing Notices Must Be Provided to Each Consumer, BUT*:

Can Be a Single Risk-Based Pricing Notice if: - *Addressed to Both Consumers*; And - *They are at the Same Address.*

Banks can determine who should get the Risk-Based Pricing Notice on a:

Case-by-Case Basis by Comparing Material terms to other Consumers for a specific type of Credit product (used for similar purposes).

Risk-Based Pricing Notice *Does NOT Apply to*:

Consumer Lease transactions

If they are at Different Addresses:

Each consumer *MUST BE MAILED* Separate notices.

Consumer Reports for Employment Purposes:

FCRA requires *WRITTEN PERMISSION* from the consumer to Obtain a Consumer Report for Employment Purposes. *(A clear and conspicuous disclosure that a consumer report MAY BE OBTAINED in writing before Obtaining a report)*

A "Short"(first front page of main promotional document) and "Long" Notice (PRE-SCREEN & OPT-OUT NOTICE - underlined, bolded, colored, or italicized) is REQUIRED:

For EVERY Offer made to a consumer from a Pre-Screened list. (12 point font or above for Short and 8 point or above for Long)

Violations of the FCRA may also be considered as a UDAP.

For example, obtaining and using unsolicited medical information (outside of the exceptions provided by the rule) to make credit decisions may also be considered as *UNFAIR.*

Adverse Action:

Has the same meaning as ECOA. - Denial or Revocation of credit, - Change in Terms of an Existing Credit Arrangement, or - Refusal to grant credit in substantially the same amount or on terms substantially similar to those requested. *(Does not Include refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where additional credit would exceed a previously established credit limit.)*

FCRA also requires any Prospective "User" of a Consumer Report (Lender, Insurer, Landlord, or Employer) to:

Have Legally Permissable Purpose to Obtain a Report.

FCRA allows AFFILIATES to share Directly or Indirectly through a Central Database *Non-Transaction and Non-Experience Information* (application info, credit reports):

IF a: - Clear and Conspicuous Disclosure; and - An Opt-Out Notice is provided.

***A Bank CANNOT Share Medical Information with Affiliates:***

If the Bank does Share this information then they become a Consumer Reporting Agency.

(MEDICAL INFORMATION CAN BE USED) *If Reactivation of a Credit Insurance Product*:

If the Triggering Event for the Benefit under the product.

Constructive Sharing:

Is when a bank does not make a solicitation for marketing purposes. *(Notice and Opt-Out DO NOT APPLY)*

Active Duty Alert:

Members of the armed services who are Called to Active Duty may also request that *Active Duty Alerts* be placed in their consumer reports. Active Duty Alerts *MUST REMAIN in the Servicemembers files for NO LESS THAN 12 MONTHS*

Multiple Credit Scores:

Must be used Consistently Across All Similar Joint Borrowers

The Risk-Based Pricing Notice MUST BE PROVIDED:

Orally, in Writing, or Electronically (can use Model Forms) - *Closed-End credit it must be provided After the Decision to Approve the Application and before Consummation* - *Open-End Credit it must be provided after the decision to approve the application but BEFORE the FIRST TRANSACTION*; - *ACCOUNT REVIEWS: At the time the decision is made to increase the APR or NO LATER THAN 5 DAYS after the effective date of the change*; - Auto Lending through a dealer SAME as CLOSED-END, but the bank can have the dealer provide the notice in specified time frames (Bank still liable) - Instant credit for OPEN-END CREDIT by telephone or In Person SHOULD BE PROVIDED at the earlier of: - the mailing to the customer after the decision to approve the application; or - Within 30 days after the decision to approve is made.

Banks that accept Debit and Credit Cards for Transaction of Business are:

PROHIBITED from issuing a RECEIPT with: - *Electronic receipts that contain MORE THAN the LAST FIVE DIGITS of the CARD NUMBER*, And - *The Card Expiration Date* *(ONLY APPLIES TO ATM and POS RECEIPTS) not hand written receipts*

The Negative Information Notice Can be:

Provided within a - Notice of Default; - Billing Statement; or - Any Materials provided to the customer *(as long as it is clear and conspicuous and Not TILA docs)* (They can provide to all customers if they want)

Pre-Exisiting Business Relationship:

Relationship between a Bank and a Consumer BASED ON: - Financial Contract between the person and the consumer which is *IN FORCE on the DATE on which the consumer is sent a solicitation covered by the affiliate marketing regulation*; - The purchase, rental, or lease by the consumer of the Bank's goods or services, or Financial Transaction Between the Bank and the consumer *DURING THE 18 MONTH PERIOD immediately Preceding the date on the solicitation is sent*; - An Inquiry or application by the consumer regarding the product or service offered by that person *DURING the 3 MONTH period preceding the date on which the solicitation is sent*.

*Original Creditor* is responsible for the:

Risk-Based Pricing notice even if they aren't funding the loan

If a *Credit Score Exception Notice* is Mailed:

Separate Notices *MUST BE MAILED* regardless of the whether they are at the same address.

FCRA pre-empts:

State Law.

If a Consumer Report Shows an *Active Duty Alert*:

The Bank *MUST* Take Reasonable Steps to Verify the Consumer's Identity by *Calling the phone number listed or by taking other reasonable steps*

When a Consumer Report provided is to a Bank:

The Nationwide Credit Reporting Agency *MUST* provide a notice of address discrepancy to the bank if the address "Substantially Differs" from the NCRA's address on file

If an Adverse Action Notice is Sent in connection with the transaction:

The Risk-Based Pricing Notice is *NOT NEEDED*

The Records Include:

The application and Business Transaction Records under control of the bank (no matter who it is serviced by) and should be *PROVIDED TO*: - Victim; - Federal, State, or Local government law enforcement agency or officer specified by the victim in the request; OR - Law enforcement agency investigating the ID Theft that was authorized by the victim to take receipt of these records.

If Medical Information is OBTAINED by a BANK in connection with any Determination of a Consumer's Eligibility and it was *NOT SPECIFICALLY REQUESTED*

The bank *DOES NOT Violate the Prohibition*

If Adverse Action is taken based on information obtained from an Affiliate:

The bank MUST NOTIFY the CUSTOMER that the INFORMATION: - Is furnished to the bank by common ownership; - Bears upon the creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; - Is not information solely involving transactions or experiences between the consumer and the person furnishing the information (because it involved an affiliate); AND - Is not information in a consumer report. *Also that the consumer may obtain a disclosure of the nature of the information if they make a written request within 60 days of the adverse action. If the customer makes the written request the Bank must disclose the INFORMATION was from the AFFILIATE not later than 30 DAYS after receiving the request.*

If they use the aforementioned methods:

The bank must recalculate the score EVERY 2 YEARS.

The opt-out right required by this section must be contained in:

The bank's Privacy Notice.

For Example: A consumer includes on an application for credit information about two $20,000 debts. One debt is to a hospital; the other is to a retailer.

The creditor may use and consider the debt to the hospital in the same manner in which they consider the debt to the retailer, such as including the debts in the calculation of the consumer's proposed debt-to-income ratio. In addition, the consumer's PAYMENT HISTORY of the debt to the hospital may be considered in the same manner as the debt to the retailer. For example, if the creditor does not grant loans to applicants who have debts that are 90-days past due, the creditor could consider the past-due status of a debt to the hospital, *IN THE SAME MANNER* as the Retailer Past-Due.

For example, a consumer has a homeowner's insurance policy with an insurance company. The insurance company shares eligibility information about the consumer with its affiliated depository institution. Based on that eligibility information, the depository institution wants to make a solicitation to the consumer about its home equity loan products. The depository institution does not have a pre-existing business relationship with the consumer and none of the other exceptions apply.

The depository institution may not use eligibility information it received from its insurance affiliate to make solicitations to the consumer about its home equity loan products unless the *INSURANCE COMPANY* gave the consumer a notice and opportunity to opt out and the consumer does not opt-out.

For example, at the Consumer's Request, *a creditor may grant an exception to its ordinary policy to accommodate a medical condition that the consumer has experienced*

This exception allows a creditor to consider medical information in this context, BUT *It does not require a creditor to make such an accommodation nor does it require a creditor to grant a loan that is Unsafe or Unsound.*

Banks *MUST employ procedures, controls, or other safeguards*:

To Ensure that *Consumer Reports are OBTAINED and USED ONLY in SITUATIONS for which there are PERMISSIBLE purposes*. (Certification is typically within contracts with Credit Reporting Agencies)

(MEDICAL INFORMATION CAN BE USED) If Consumer's Legal Representative requests that the Creditor Use Medical Information to determine eligibility:

To accommodate for the consumer's particular circumstances.

To Identify a Victim of Identity Theft's Identity when they request records, the Bank must:

Use: - A valid driver's license; - An ID Theft Affidavit; and - Copy of the Police Report

There also *MUST BE Policies and Procedures for Furnishing the Address of the Consumer that has been REASONABLY CONFIRMED*, to the NCRA:

Address is considered Reasonably Confirmed if: (1) Can form a reasonable belief that the report relates to the consumer whose report was requested; (2) Establishes a continuing relationship with the consumer (in connection with a new account); and (3) Regularly furnishes information to the NCRA that provided the notice of address discrepancy. *The confirmed address MUST BE FURNISHED to the NCRA as a part of the regular information furnished.*

FCRA requirements ALSO apply to Banks that Operate in the Following Capacities:

(1) *Obtaining and users of Information* (Example: Credit grantors, purchasers of dealer paper, or when opening deposit accounts); (2) *Furnishers and Transmitters of Information* (by reporting information to consumer reporting agencies or other 3rd parties or affiliates); (3) *Marketers of credit or insurance products*; OR (4) *Employers*

Prior to TAKING ADVERSE ACTION involving Employment *based whole or in part on the consumer report*, The report user must generally provide:

(1) A copy of the report; AND (2) Description in writing of the rights of the consumer. (At the time of the adverse action, the bank must provide a adverse action notice)

Under FCRA adverse action means:

(1) A denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance; (2) Denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee; (3) Denial or cancellation of, an increase in any charge for, or any other adverse or unfavorable change in the terms of, any license or benefit; (4) Action taken or determination that is: - Made in connection with an application made by, or transaction initiated by, any consumer, or in connection with a review of an account to determine whether the consumer continues to meet the terms of the account; AND - Adverse to the interests of the consumer.

The *ONLY LEGALLY PERMISSIBLE* reasons to Furnish a Consumer Report are:

(1) In response to a *COURT ORDER or FEDERAL GRAND JURY Subpoena*; (2) In accordance to *WRITTEN instructions of a Consumer*; (3) Bank which it has *REASON TO BELIEVE Intend to use the Report*: - In Connection with a Credit Transaction (Extending, Renewing, and Collecting Credit); - For Employment Purposes (Hiring, Promotion, Reassignment or Retention); - Underwriting Insurance; - Determine Eligibility for License or Benefit Granted by Government; - Valuation of Credit or Prepayment Risks Associated with a Credit Obligation; - Otherwise has a legitimate business need for the information; - Business transaction that is initiated by the consumer; OR - Review an account to determine whether the consumer continues to meet the terms of the account. (4) Response to a Request from the HEAD of STATE or LOCAL Child Support Enforcement Agency(DOES NOT IMPACT a BANK that is not a credit reporting agency) ***(FCRA covers credit primarily for PERSONAL, FAMILY, or HOUSEHOLD PURPOSES)***

The Card User MUST not Issue an Additional or Replacement Card Until They Assess the Validity of the Change of Address by:

(1) Notifying the cardholder of the request for an additional or replacement card - at the cardholder's former address; or - by any other means of communication that the card issuer and the cardholder have previously agreed to use; AND (2) Provide to the cardholder a *REASONABLE* means of promptly reporting incorrect address changes; OR (3) Assess the validity of the change of address according to procedures the card issuer has established as apart of its Identity Theft Program. (The Bank can Satisfy the requirements if they Verify an Address when it receives an address change notification.) (Form of notice can be written or electronic and provided separately from regular correspondence)

When an ADVERSE ACTION is taken in Whole or in Part Due to Any Information contained in a Consumer Report, THE BANK MUST:

(1) Provide ORAL, WRITTEN, or ELECTRONIC NOTICE of the Adverse Action to the Consumer; (2) Provide Orally, in Writing or Electronically: -name, address, and toll-free telephone number from agency; - statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide specific reasons why the adverse action was taken (3) Provide the consumer an oral, written, or electronic notice of the consumer's right to obtain a free copy of the consumer report from the consumer reporting agency WITHIN 60 CALENDAR DAYS of receiving the notice of adverse action, and the Consumer's right to dispute the accuracy or completeness of any information in the consumer report with the consumer reporting agency.

Notice to the Home Loan Applicant Must be Provided:

*Regardless of the Credit Decision*. The notice *MUST INCLUDE*: - name; - address; and - telephone numbers of all credit reporting agencies that provided a credit score

MODULE 2: Banks have a *SIGNIFICANT AMOUNT of INFORMATION that could CONSTITUTE a Consumer Report*:

*THUS communication of this information could CAUSE THE BANK to become a CONSUMER REPORTING AGENCY*

For example, if a creditor has a policy of delaying foreclosure in cases where a consumer is experiencing a medical hardship, this exception allows the creditor to use medical information to determine if the policy would apply to the consumer.

*This exception Does Not require a creditor to grant forbearance, it merely provides an exception so that a creditor may*

Medical Information Can be Obtained and Used Also To:

*AT THE CONSUMER'S REQUEST*, Determine whether the Customer qualifies for a Legally Permissible Special Credit Program or Credit Related Assistance Program that is: - Designed to meet the special needs of consumers with medical conditions; And - Established and administered pursuant to a written plan that: (a) Identifies the class of persons designed to benefit; and (b) Sets forth procedures and standards for extending credit or providing other credit-related assistance under the program.

Consumer Report:

*Any Written, Oral, or Other Communication* of *ANY INFORMATION by a Consumer Reporting Agency that bears on a consumer's*: - Creditworthiness; - Credit Standing; - Credit Capacity; - Character; - General Reputation; - Personal Characteristics; or - Mode of Living.

When there is a Fraud Alert or Active Duty Alert a Bank:

*CANNOT (Unless they know the person's identity)*: - Establish a New Loan in the name of the consumer; - Issue an Additional Card on an Existing Account; or - Increase a Credit Limit.

Consumers can ELECT to OPT-OUT of PRE-SCREENED LISTS by:

*Calling a Toll-Free Number*

*Negative Information*:

*Delinquencies, Late Payment, Insolvency, or any form of Default*

A creditor can also use MEDICAL INFORMATION in a manner that is:

*MORE FAVORABLE* to the consumer.

Banks that furnish information to Credit Reporting Agencies about delinquent accounts being placed for collection, charged off, or subject to similar action MUST:

*Not later than 90 Days after furnishing information to a Credit Reporting Agency, Must notify the Credit Reporting Agency of the MONTH and YEAR of the START of Delinquency that Immediately Preceded the Action*

If a Bank Make MORTGAGES (Closed-End and Open-End for Consumer Purpose 1-4 family) using Credit Scores MUST PROVIDE:

*Notice to the Home Loan Applicant must be given AS SOON as PRACTICABLE after using the credit report*

The bank MUST MAINTAIN a list of CRITERIA used for the product (pre-screened and other underwriting criteria) for a:

*PERIOD of 3 YEARS Beginning the date the offer was made to the consumer.*

Investigative Consumer Reports

*Personal Interviews with neighbors, friends, or associates.* (However, such information does not include specific factual information on a consumer's credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when such information was obtained directly from a creditor of the consumer or from the consumer.)

An entity *MAY NOT* use Information Received from an Affiliate to Market its Products or Services to a Consumer:

*UNLESS* the Consumer is given *NOTICE and REASONABLE Opportunity and Simple Method to Opt-Out of Such Solicitations* ***This APPLIES to Transaction, Experience, and Other Information (such as Credit Reports or Applications).***

The following situations qualify as Constructive Sharing:

- Bank provides criteria for consumers to whom it would like its affiliate to market on the bank's behalf. The affiliate uses the eligibility information obtained in connection with its own pre-existing business relationship with the consumer to market the bank's products. (bank using affiliate to market bank's products) - Service Provider, APPLYING BANK'S CRITERIA, uses information from an AFFILIATE, to market the Bank's Products or Services to the Customer, So long as it meets certain requirements: (a) Affiliate controls access to and use of its eligibility information by the service provider under a written agreement between the affiliate and the service provider; (b) Affiliate establishes in WRITING, specific terms and conditions under which the service provider may access and use the affiliate's eligibility information to market the bank's products and services to the consumer; (c) The affiliate requires the service provider, Under Written Agreement, to implement reasonable policies and procedures designed to ensure that the service provider uses the affiliate's eligibility information in accordance with the terms and conditions established by the affiliate relating to the marketing of the bank's products and services; (d) The affiliate is identified on or with the marketing materials provided to the consumer; and (e) The bank does not directly use its affiliates eligibility information in a manner described in "Making Solicitations"

The Financial Information Exception ALLOWS banks to:

- Consider Medical Debts and Expenses; - Consider Disability Income; - Workers Compensation Income; or - Other benefits related to medical condition.

Other than for Financial Reasons, Medical Information can be used when:

- Determining whether the use of a Power of Attorney or Legal Representative that is triggered by a medical condition or event is necessary and appropriate, OR - Whether the consumer has the legal capacity to contract when a person seeks to exercise a Power of Attorney or act as a Legal Representative for a consumer based on medical condition or event.

Consumer Report *DOES NOT* Include:

- Soley *TRANSACTIONS or EXPERIENCES between the Consumer and the Bank* making the report *(Transactions (payment history) and Experiences can be shared with Third Parties) Subject to Privacy rules though* - Communication of that *TRANSACTION or EXPERIENCE information to entities with COMMON OWNERSHIP or AFFILIATED BY CORPORATE CONTROL*; - Communication of *"Other Information"* among persons related by Common Ownership or Affiliated by Corporate Control if: (a) clearly and conspicuously disclosed to consumer that information can be communicated among such persons; and (b) *Customer is given the opportunity to direct that information not be communicated to such persons.* "Other Information" - Application form information with other banks *SUCH As* Consumer Credit Scores obtained from credit reporting agencies. (allows to share consumer report data without becoming a Consumer Reporting Agency) ***If the notice and opt-out is NOT provided then the bank is a reporting agency for Other Information*** - Communication of an Authorization (through a credit card network) of a specific *EXTENSION OF CREDIT* directly or indirectly by the issuer of a *CREDIT CARD or SIMILAR DEVICE* to complete a purchase using the credit card; - A Bank requested (by a 3rd party) to make a specific extension of credit directly or indirectly to a consumer, such as a lender who has received a request broker *(This exception allows a lender to communicate to a Car Dealer who is arranging financing for a consumer)*; and - *Joint-User Rule: Users of consumer reports, (including Banks), can share information if they are jointly involved in the decision to approve a consumer's request for a product or service (example: if PMI is required and an outside company administers PMI), Applies to BOTH Affiliated and Non-Affiliated, (Joint-User Rule may potential violate Privacy rules)*

*Renewal Notice* may be provided to the customer and can be provided either *reasonably before the opt-out period or any time after the expiration from*:

- The affiliate that provided the previous opt-out notice (or its successor); - Jointly from 2 or more members of an affiliated group of companies (or their successors); that jointly approved the opt-put notice.

If a Consumer is Denied or Charge for Credit is Increased based on Information OTHER THAN a Consumer Reporting Agency:

- The bank MUST communicate AT THE TIME OF ADVERSE ACTION, clearly and conspicuously the right to file Written Request for the reasons for the adverse action; and - If the bank receives a request within 60 Days after the consumer learns of the adverse action, the bank must disclose, within a REASONABLE period of time, the nature of the adverse information. (THE SOURCE DOES NOT NEED TO BE DISCLOSED, BUT IT CAN BE.)

In addition to the *Notice to the Home Loan Applicant*:

- The credit score; - A range of possible scores; and - *Key factors that go into the score (Not exceed 4) Must be Disclosed.*

A renewal notice MUST be Clear, Conspicuous, and Concise, and must Disclose most of the Original Elements of the Opt-Out Notice as well as:

- The customer previously elected to Limit the use of certain information to make solicitations to the consumer; - The consumer's election has expired or is about to expire; - The consumer may elect to renew the consumer's previous election, AND - If applicable; that the consumer's election to renew will apply for the specified period of time state in the notice and that the consumer will be allowed to renew the election once that period expires.

After an *Opt-Out Period EXPIRES a Bank CANNOT make solicitations based on Eligibility Information it receives from an affiliate to a customer that previously opted-out UNLESS*:

- The customer receives a *RENEWAL NOTICE and Opportunity to Opt-Out*, and the Customer does not renew the opt-out; - An exception to the notice and opt-out requirements applies.

Consumer Reporting Agency:

Any Person which, *FOR MONETARY FEES, DUES, or on a COOPERATIVE Non-Profit Basis*, Regularly Engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers *for purposes of furnishing CONSUMER REPORTS to 3rd Parties*; AND - Which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

A card issuer *MUST ESTABLISH* Policies and Procedures to assess the validity of a:

Change in address for a Consumer's Debit or Credit Card IF *WITHIN the first 30 days after the change the card issuer RECEIVES a request for an ADDITIONAL or REPLACEMENT card for the same card user*

FCRA contains *SEVERAL EXCEPTIONS* that enable Banks to:

Communicate this information, *WITHIN STRICT GUIDELINES*, without becoming a Consumer Reporting Agency.

FOR EXAMPLE, Assume a home mortgage lender obtains a list from a consumer reporting agency of everyone in County X, with a current home mortgage loan and a credit score of 700. The lender will use this list to market a 2nd lien home equity loan product. The lender's other non-consumer report criteria, in addition to those used in the prescreened list for this product, include a maximum total debt-to-income ratio (DTI) of 50% or less. Some of the criteria can be screened by the consumer reporting agency, but others, such as the DTI, must be determined individually when consumers respond to the offer.

If a consumer responds to the offer, but already has a DTI of 60%, the lender does not have to grant the loan.

Access to information to determine creditworthiness for loan and deposit account, utility services:

Is governed by FCRA to *ENSURE that information is obtained for permissible purposes and NOT EXPLOITED for illegitimate purposes*

(MEDICAL INFORMATION CAN BE USED) If Debt Cancellation or Debt Suspension Contract:

Is triggered by a Medical Condition (Benefits the Customer)

FOR EXAMPLE, On January 1st a credit card lender OBTAINS a list from a consumer reporting agency of consumers in Allen County with *credit scores of 720, and no previous Bankruptcy* The lender mails solicitations offering a Pre-Approved credit card to everyone on the list on January 2nd

On January 31, a consumer responds to the offer and the lender obtains and reviews a full consumer report which shows that a bankruptcy record was added on January 15. Since this consumer no longer meets the Criteria, the lender is *NOT REQUIRED* to issue the credit card.

Nationwide Consumer Reporting Agency (NCRA):

One that Compiles and maintains files on consumers on a nationwide basis and regularly enagages in the practice of assembling or evaluating and maintaining: - Public Record Information; and - Credit Account Information from Banks(and others) who furnish that information regularly and in the ordinary course of business.

If a Bank receives a Credit Request with an *EXTENDED ALERT*:

The Bank MUST Contact the Consumer *IN PERSON* or *By Method Listed by Consumer in the Alert prior to*: - Establish a *New Loan* in the name of the consumer; - Issue an *Additional Card* on an Existing Account; or - *Increase a Credit Limit*

If a Bank Obtains or Causes an *INVESTIGATIVE CONSUMER REPORTS* to be used (information obtained in whole or in part through personal interviews with neighbors, friends, or associates of the consumer):

The Bank MUST: (1) *Clearly and accurately Disclose to the Customer that an Investigative Consumer Report may be obtained*; (2) That disclosure *MUST* contain a statement of the consumer's right to request other information about the report, AND a *SUMMARY of the consumer's RIGHTS under FCRA*; (3) That disclosure *MUST be in WRITING and MAILED or DELIVERED.. NO LATER THAN 3 BUSINESS DAYS after the date on which the report was FIRST REQUESTED*; AND (4) The Bank Procuring the Report *CERTIFIES* to Consumer Reporting Agency that it has complied with the Disclosure Requirements and Will Comply in the event the consumer requests additional disclosures about the report.

Whenever a Bank Receives a *Notice of Dispute from a Credit Reporting Agency* regarding the accuracy and completeness of Any Information provided by the Bank to a Credit Reporting Agency:

The Bank Must: - *Conduct an Investigation (must be made within 30 days but can be extended to 45 days)*; - Review all relevant information; - Report the Results to the Credit Reporting Agency; - If the Disputed Information is Incomplete or Inaccurate, the should Report those to ALL nationwide credit reporting agencies to which they previously provided information; and - Bank must promptly Fix the issue.

It is *GENERALLY PROHIBITED* to Obtain and Use Medical Information In any determination of a consumer's eligibility or continued eligibility for credit.

There is *NO PROHIBITION on Creditors Obtaining and Using Medical Information for other purposes NOT IN CONNECTION with ELIGIBILITY*

If Gramm-Leach-Bliley (Privacy) permits a bank to *share a list of its customers and information such as their credit scores with another financial institution to Jointly Market or sponsor other financial products or services*.

This communication may be considered a consumer report under the FCRA and could potentially cause the sharing financial institution to become a consumer reporting agency. (FCRA and Privacy govern different information)