Fair Credit Reporting Act

What are the prescreening rules?

1. A notice is required when members are offered credit based on prescreened lists 2. Members must be able to opt out 3. Must make firm offer of credit to all members who pass the pre-screening process, but it does not have to be unconditional. 4. Retain prescreened criteria for three years

What are the exceptions to the risk based pricing requirements?

1. Application for specific terms exception 2. Adverse action exception 3. Prescreened solicitations exception 4. Credit score disclosure exception for non-mortgage credit 5. Credit score disclosure exception for mortgage loans 6. Credit score disclosure exception when no credit score is available for the consumer

What are the requirements for the prescreen and opt out notice longform?

1. Clear and conspicuous, anywhere in the solicitation 2. Type size is no smaller than the principal text on the page 3. It must begin with the heading "Prescreen and opt out notice" 4. Type style is distinct from the principal type style (e.g. bold, italicized, underlined etc.) 5. Set apart from other text on the page

What are the methods for determining who receives a risk based pricing notice?

1. Consumer to consumer comparison 2. Credit score proxy method 3. Tiered pricing method 4. The special method for credit cards that allows the card issuer to determine which consumers must receive the notice on an offer-by-offer basis

What language is to be included in the notice to home loan applicant?

1. Consumers credit score 2. Range of possible scores 3. Date consumers score was created 4. Key factors influencing the score

What are the permissible purposes for pulling a credit report?

1. Court order or federal jury subpoena 2. Consumers written instruction 3. Credit transactions 4. Employment purposes 5. Underwriting insurance 6. Business transaction initiated by consumer 7. Review of existing accounts 8. Prescreened offers of credit

Under the Fair Credit Reporting Act, what five components must be included on an adverse action notice?

1. Credit score 2. Range of possible scores 3. Key factors 4. Date created 5. The entity that provided the score

When adverse action is taken this will trigger an adverse action notice. What must be included in this notice?

1. Credit score used in decision 2. Range of possible scores 3. Key factors influencing the score 4. Date score was created 5. Name of person or entity that provided the score 6. Statement at the credit score takes into account credit report information

What is the definition of adverse action?

1. Denial or revocation of credit 2. Change in terms of existing credit arrangement 3. Refusal to grant credit on requested terms

What are the permissible uses for consumer reports under the FCRA?

1. Determining an applicants eligibility for credit 2. Employment purposes 3. Review of existing account 4. Collection of a members account 5. In response to a court order or subpoena 6. Prescreened offers of credit 7. Written instructions of the consumer 8. Underwriting insurance 9. Business transaction initiated by the consumer

What is the purpose of the fair credit reporting act?

1. Enacted to promote the accuracy, fairness, and privacy of consumer information contained in the files of consumer reporting agencies. 2. It is intended to protect consumers from the willful and or negligent inclusion of an accurate information on their credit reports 3. Regulates the collection, dissemination and use of consumer information, including consumer credit information

How should a credit union respond when it finds a fraud alert on the members credit report?

1. For initial active duty alerts, if the consumer has specified a telephone number in the alert, the credit union cannot extend any credit until it contacts the consumer using that number, or takes other reasonable steps to verify the persons identity and confirm that the application for credit is not the result of ID theft. 2. For extended alerts, the credit union must contact the consumer in person at the telephone number indicated in the alert, or other reasonable contact method specified by the consumer before credit is granted, additional cards are sent, etc.

What are the identity theft requirements?

1. Have reasonable procedures in place to respond to any notification for my credit bureau that the information furnished was the result of identity theft and to prevent refurnishing that same information in the future. 2. Do not furnish information the member has identified as resulting from ID theft unless the credit union knows or is informed by the member that the information is correct. If the credit union learns that it has furnished inaccurate information due to ID theft, each consumer reporting agency that received that information must be notified that it is incorrect and then report only complete and accurate information. 3. If the credit union is notified that a debt was a result of identity theft. The loan cannot be sold, transferred, or placed for collection. (However, there are very limited exceptions, for example, if a debt is transferred as a result of a merger or re-purchased because the credit union found out the debt resulted from ID theft.)

If you use a prescreened list of members to offer credit, you must make that offer to all members who pass the selection process. List the five disclosures that must be made to those members.

1. Information from the members consumer report was used in connection with the offer 2. That the member satisfied the criteria to determine credit worthiness 3. That the member may still not qualify for the credit if it is determined after receipt of acceptance of the offer that they no longer qualify 4. The member has the right to prohibit the information obtained from the credit reporting agency from being used in connection with the credit transaction the member did not initiate 5. The member may contact the credit reporting agency to prohibit the use of the information.

What are the red flag identity theft rules?

1. Must adopt a written identity theft protection program appropriate to the institution size, complexity, and nature and scope of its activities 2. The required components of the identity theft protection program include reasonable policies and procedures, staff training, oversight of service providers, and oversight of Board of Directors

When must the member be notified of the furnishing of negative information to a credit reporting agency?

1. Must be provided to the member before furnishing information to the CRA's 2. Or must be provided to the member within 30 days after furnishing the information to CRA's

The red flag regulations also require credit and debit card issuers to assess the validity of change of address request. What steps can the card issuer take to assess whether the change of address is valid?

1. Notify the card holder at the old address 2. Notify the card holder through some other means of communication that the cardholder has previously agreed to 3. Use another method of assessing the validity of the change of address that the credit union has included in its red flag program.

What are the requirements for the prescreen and opt out notice short form?

1. Prominence, clear and conspicuous 2. The font must be larger than the rest of the text, at least 12 pt. 3. It must be located on the front side of the first page of the principal promotional document in the solicitation 4. The format must be distinct from other text, and a type style distinct from principal type on the page (e.g. inside a border)

Under the affiliate marketing rules, and affiliate cannot use shared member information for marketing purposes unless what three conditions are met?

1. Provide consumer with a notice that the information may be used for marketing solicitations 2. The consumer has been given a reasonable opportunity to opt out of these solicitations 3. The consumer does not opt out.

What is the duty of a credit union upon discovering that incorrect information has been given to consumer reporting agencies?

1. Provide the complete and accurate information to the credit reporting agency 2. Notify each credit reporting agency to whom the incorrect or incomplete information was given to.

What are the three principal purposes the fair credit reporting act has enacted to serve?

1. Regulate the consumer reporting industry and to ensure that the issuers of consumer reports provide information that is fair and equitable to members and fair and accurate to report users 2. Prohibit consumer reporting agencies from taking actions that are unfair or that adversely affect a members credit and ability to obtain credit 3. Restrict the availability and use of consumer reports

What are the credit unions obligations under the fair credit reporting act?

1. Report accurate information (accuracy & integrity policy) 2. Update information is necessary 3. If disputed by the member, notify CRA or correct the information 4. If notified of dispute by CRA, conduct investigation within 30 days 5. Report voluntary credit account closings 6. Report dates of delinquencies

When information obtained from a credit bureau has any bearing on a credit decision, what information must be disclosed to the member?

1. That information from a credit bureau was used in the credit decision 2. The name, address, and Telephone number of the credit bureau used 3. Statement that the credit bureau did not make the decision to take the adverse action 4. Notice of the members right to get a free copy of their credit report from the bureau upon written request within 60 days 5. Notice of the members right to dispute with the bureau the accuracy or completeness of any information in the report. You do not have to include the nature of the information in the report.

List three exceptions to the affiliate marketing rule.

1. The affiliate receiving the information has a pre-existing business relationship with the consumer, which may include CUSO's that provide mortgage or other financial services. 2. Using the information to communicate with an individual for whose benefit the affiliate provides services on behalf of the individuals employee. 3. The information is used to perform services on behalf of an affiliate, although solicitations may not be sent if that affiliate is not permitted to send solicitations because the consumer elected to opt out. 4. The information is used in response to a communication about products and services initiated by the consumer. Requests for information not related to products or services would not be sufficient, and a consumer responding to a message left by the affiliate would also not be sufficient. Solicitation of additional products and services, as part of that communication, would also not be permitted. 5. The information is used to make a solicitation that has been authorized or requested by the consumer. A preselected checkbox or boiler plate language in a disclosure will not be sufficient. The authorization terminates if it is revoked by the consumer. 6. If compliance with these provisions would prevent the affiliate from complying with state insurance laws pertaining to unfair discrimination.

When must a credit union provide a risk based pricing notice?

1. When the credit union uses a consumer report in connection with a consumers credit application or extension and 2. Based at least in part on that report, grants or extends credit to the consumer on "material terms" that are "materially less favorable" (higher cost for credit) than the most favorable terms available to a substantial portion of the credit union's members.

When must the risk-based pricing notice be provided?

1. When the creditor uses consumer report and connection with application or extension of credit 2. Based on that report, grants or extends credit to the consumer on material terms that are materially less favorable than the most favorable terms available to a substantial portion of consumers by that creditor. (I.e. lower credit scores resulting in higher rates)

How much credit unions respond to members direct disputes under the new FACTA furnisher regulations?

A credit union will only be required to investigate a direct dispute if a consumer submits a dispute notice to the credit union at: 1. An address provided by the credit union and set forth on the consumer report relating to that consumer 2. An address clearly and conspicuously specified by the credit union for submitting direct disputes that is provided to the consumer in writing or electronically, if the consumer has agreed to electronic delivery 3. Any credit Union address if the credit union has not otherwise specified an address for submitting direct disputes Credit unions will have 30 days to complete a reasonable investigation and report the results to the consumer. The 30 days begins from the date the credit union receives the notice of dispute. If the investigation finds that the information in the report was an accurate, the credit union must correct the error and provide accurate information to the credit bureau.

What is the definition of consumer reporting agency?

Any person who, for monetary fees, dues, we're on a cooperative nonprofit basis, regularly assembles or evaluate consumer credit information or other consumer information to furnish consumer reports to third parties, and uses any means of interstate commerce to prepare or furnish consumer reports.

Who has the general rule-making authority under FCRA?

CFPB, but NCUA and FTC (Federal Trade Commission) also have some authority

Both the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act set standards for the types of non-public personal information that credit unions can disclose to third parties. What is the only type of information the FCRA allows credit unions to disclose without limitation?

Credit unions can only share "experience"information without limitations.

What are the key elements of an ID theft prevention program?

Every program must contain" reasonable policies and procedures" to: 1. IDENTIFY relevant red flags and incorporate them into the program 2. DETECT red flags that have been incorporated into the program 3. RESPOND appropriately to any red flags that are detected to prevent and mitigate identity theft 4. ENSURE the program is updated periodically to reflect changes in risks to members or to the safety and soundness of the credit union for ID theft.

True or False: A credit union can require member to remove the fraud alert from their report before extending you credit.

False

True or False: A credit union has no obligation to correct inaccurate information it has previously reported to credit reporting agencies.

False

What is the notice to home loan applicant?

It is a disclosure that is required when a credit score is used in connection with mortgage loan applications.

What is the definition of red flag program?

It is a written, risk based program designed to detect, prevent and mitigate identity theft when opening accounts or for existing accounts. It should contain policies and procedures to identify red flags and incorporate them in the program, detect incorporated red flags, respond to red flags to prevent and mitigate identity theft, and update the program periodically.

What is the definition of pre-screening?

Pre-screening is the process by which a CRA either compiles or edits a list of consumers who meet specific credit criteria and then provides that list directly to a creditor or to a third-party who sells the list to a creditor who then uses it to market credit products to consumers.

What is the credit union required to provide a loan applicant if it uses credit scores in connection with making mortgage loans?

The credit union must provide a "Notice to Home Loan Applicants" and the credit score (along with the key factors associated with the score).

What must credit unions do to comply with the FCRA's furnisher regulations with regard to ensuring the accuracy and integrity of information provided to credit bureaus?

The furnisher regulations require a credit union to establish and implement reasonable written policies and procedures to ensure the accuracy and integrity of information that it furnishes to credit bureaus. The regulations include guidelines that credit union should used to develop these policies and procedures. The policies and procedures must be appropriate to the size, complexity and scope of the credit unions business operations and should address: 1. Using standard data reporting formats and standard procedures for compiling and furnishing data to credit reporting agencies 2. Maintaining records for a reasonable period of time (not less than any applicable recordkeeping requirement) in order to substantiate the accuracy of any information at furnishes that is subject to a direct dispute. 3. Establishing and implementing appropriate internal controls regarding the accuracy and integrity of information about consumers furnished to consumer reporting agencies, such as by implementing standard procedures and verifying random samples of information provided to consumer reporting agencies. 4. Training staff that participates in activities related to the furnishing of information to the credit reporting agencies to implement the policies and procedures 5. Providing for appropriate and effective oversight of relevant service providers whose activities may affect the accuracy or integrity of information furnished to credit reporting agencies 6. Furnishing information to credit reporting agencies following mergers, portfolio acquisitions or sales, or other acquisitions or transfers of accounts or other obligations in a manner that prevents re-aging of information, duplicates of reporting, or other problems that may similarly affect the accuracy or integrity of the information furnished 7. Deleting, updating, and collecting information in the credit unions records, as appropriate, to avoid furnishing in accurate information 8. Conducting reasonable investigations of disputes 9. Designing technological and other means of communication with credit reporting agencies to prevent duplicates of reporting of accounts, erroneous association of information with the wrong consumers, and other occurrences that may compromise the accuracy or integrity of information provided to credit reporting agencies. 10. Providing credit reporting agencies with sufficient identifying information to enable the consumer reporting agency properly to identify the consumer.

When should you notify your member that negative information would be reported to the credit bureau?

The notice must be provided either prior to, or no later than 30 days after the negative information is furnished to the credit bureau. It may be combined with any notice of default, any billing statement, or any other materials provided to the member, as long as the notice is "clear and conspicuous". The credit union may not, however, combine the notice with the initial Truth in Lending disclosures.

True or False: A credit union can become a consumer reporting agency if it provides member transaction information that it received from a third-party.

True

True or False: If there is a fraud or active duty alert on a consumers credit report creditors may not extend new credit unless safeguards are in place to verify the identity of the consumer by contacting the consumer by method specified.

True

True or False: When issuing an adverse action notice, you must include the contact information for the credit reporting agency or affiliate agency used.

True

What requirements must be met before a credit union obtains and uses medical information in determining credit eligibility?

Under the "financial information exception", credit unions may obtain and use medical information and determine credit eligibility if the following three requirements are met: 1. The information relates to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of the proceeds. 2. The credit union uses the information in a manner and to an extent no less favorable than it would use comparable information that is not medical information in a credit transaction. (medical expenses or income may be treated more favorably.) 3. The credit union does not take the consumers physical, mental, or behavioral condition or history, type of treatment, or prognosis into account as part of any credit eligibility determination.

Obtaining credit reports under false pretenses or knowingly without a permissible purpose can result in how much of a fine?

Up to $1,000

How should a credit union handle frivolous disputes from consumers?

Upon making a determination that a dispute is frivolous or irrelevant, the credit union must notify the consumer not later than five business days after making the determination, by mail (or other means if authorized for that purpose by the consumer). The notice to the consumer must explain the reasons for the credit unions determination that the dispute was frivolous.

How long to creditors have to issue an adverse action notice?

Within 30 days of application

Under what circumstances would your credit union become a consumer reporting agency?

Your credit union could become a consumer reporting agency if you report to others information you gather from sources other than through your own experience with the member.