FCRA

Requirements and controls

• Users Obtaining and using consumer reports

  • 1681b(f) Permissible purpose and certification

    A consumer report is obtained or used only for a purpose the Act allows, and that purpose is certified to the consumer reporting agency.

    • Consumer Report Permissible Purpose & Authorization

  • 1681q No obtaining information under false pretences

    Information about a consumer is never obtained from a consumer reporting agency under false pretences.

    • Consumer Report Permissible Purpose & Authorization
    • Code of Business Conduct

  • 1681b(g) Limits on medical information

    Creditors do not obtain or use medical information to decide credit eligibility except where the rules allow it, and medical information received is not passed on beyond the purpose for which it was disclosed.

    • Consumer Report Permissible Purpose & Authorization
    • Data Protection Policy & Procedure

• Employment Consumer reports for employment purposes

  • 1681b(b)(1) Certification for employment reports

    Before an employment report is furnished, the employer certifies to the agency that it gave the required disclosure, obtained authorization, will follow the pre-adverse action steps and will not use the report against equal employment opportunity law.

    • Consumer Report Permissible Purpose & Authorization

  • 1681b(b)(2) Standalone disclosure and written authorization

    Applicants and employees receive a clear written disclosure, in a document that contains only that disclosure, and give written authorization before a report is obtained, with an oral or electronic route for certain transport roles applied for remotely.

    • Consumer Report Permissible Purpose & Authorization
    • Personnel Screening

  • 1681b(b)(3) Pre-adverse action notice

    Before taking adverse employment action based in whole or part on a report, the employer gives the person a copy of the report and the summary of consumer rights so they can respond.

    • Adverse Action Notices

  • 1681d(a) Disclosure of investigative consumer reports

    When an investigative report on someone's character, reputation or way of living is requested, the person is told in writing within three days, including their right to ask about the nature and scope of the investigation, and this is certified to the agency.

    • Consumer Report Permissible Purpose & Authorization

  • 1681d(b) Nature and scope of the investigation on request

    When the person asks in writing, a complete description of the nature and scope of the investigation is sent within five days.

    • Consumer Report Permissible Purpose & Authorization

• Notices Adverse action and other notices to consumers

  • 1681m(a) Adverse action notice

    After adverse action based on a consumer report, the person is told of the action, any credit score used, the agency's contact details, that the agency did not make the decision, and their rights to a free report within 60 days and to dispute its accuracy.

    • Adverse Action Notices

  • 1681m(b) Adverse action based on other third-party or affiliate information

    When consumer credit is denied or made more expensive because of information from a third party other than an agency, or from an affiliate, the consumer is told and can request the nature of that information.

    • Adverse Action Notices

  • 1681m(h) Risk-based pricing notice

    When credit is offered on materially less favourable terms based on a consumer report, a risk-based pricing notice or a credit score disclosure is given as Regulation V requires (12 CFR 1022.72 to 1022.74).

    • Adverse Action Notices

  • 1681m(d) Prescreened offers of credit or insurance

    Firm offers made from prescreened lists carry a clear notice explaining the selection and how to opt out of future prescreened offers (12 CFR 1022.54), and the selection criteria are kept on file.

    • Adverse Action Notices
    • Consent Management

• Identity theft Identity theft safeguards for users of reports

  • 1681c(h) Address discrepancies

    Users who receive a notice of address discrepancy follow procedures to confirm that the report relates to the consumer and, when opening an account, give the agency an address they have confirmed (12 CFR 1022.82).

    • Identity Theft Red Flags & Address Discrepancies

  • 1681c-1(h) Fraud and active duty alerts

    When a report carries a fraud or active duty alert, the user verifies the consumer's identity, or calls the number provided, before extending new credit or raising a limit.

    • Identity Theft Red Flags & Address Discrepancies

  • 1681m(e) Identity theft prevention program

    Financial institutions and creditors with covered accounts run a written, board-approved program that identifies, detects and responds to identity theft red flags, trains staff, oversees service providers and is updated periodically (16 CFR 681.1).

    • Identity Theft Red Flags & Address Discrepancies

• Furnishers Responsibilities of furnishers of information

  • 12 CFR 1022.42 Accuracy and integrity policies

    Furnishers have written policies and procedures, suited to their size and activities and reviewed periodically, that keep the information they report accurate and complete.

    • Furnisher Accuracy & Dispute Handling
    • Information Security & Privacy Policies

  • 1681s-2(a)(1) No knowingly inaccurate information

    Information is not furnished when the furnisher knows or has reasonable cause to believe it is inaccurate, or after a consumer has shown it to be inaccurate.

    • Furnisher Accuracy & Dispute Handling

  • 1681s-2(a)(2) Correcting and updating furnished information

    Regular furnishers who find that reported information is incomplete or inaccurate promptly send corrections to each agency and stop reporting the inaccurate data.

    • Furnisher Accuracy & Dispute Handling

  • 1681s-2(a)(3) Dispute, closure and delinquency notices

    Reported information flags any dispute raised by the consumer and voluntary account closures, and, within 90 days, the date of first delinquency for accounts placed for collection or charged off.

    • Furnisher Accuracy & Dispute Handling

  • 1681s-2(a)(6) Identity theft blocks

    Furnishers have reasonable procedures so that information blocked as resulting from identity theft is not reported again, and information a consumer reports as identity theft is not furnished unless known to be accurate.

    • Furnisher Accuracy & Dispute Handling
    • Identity Theft Red Flags & Address Discrepancies

  • 1681s-2(a)(7) Notice of negative information

    Financial institutions tell customers in writing, before or within 30 days after, when they first report negative information about them to a nationwide agency.

    • Furnisher Accuracy & Dispute Handling

  • 1681s-2(a)(8) Disputes received directly from consumers

    Disputes sent directly to the furnisher are investigated, the information provided is reviewed, results are reported to the consumer within the agency deadline, and corrections go to every agency that received the data (12 CFR 1022.43).

    • Furnisher Accuracy & Dispute Handling

  • 1681s-2(b) Disputes forwarded by an agency

    When an agency forwards a dispute, the furnisher investigates, reviews the information, reports the results, and corrects, deletes or blocks inaccurate information with every nationwide agency it reported to.

    • Furnisher Accuracy & Dispute Handling

• Affiliates Affiliate sharing

  • 1681s-3 Affiliate marketing opt-out

    Eligibility information received from an affiliate is not used to send marketing solicitations unless the consumer received a clear notice and a simple way to opt out and did not opt out (12 CFR 1022.21).

    • Consent Management
    • Published Privacy Policy

• Disposal Disposal of consumer information

  • 1681w Disposal of records

    Consumer report information and records derived from it are disposed of under the rules the regulators issue, without changing any other duty to keep or destroy records.

    • Media Disposal Policy
    • Data Retention Policy

  • 16 CFR 682.3 Proper disposal measures

    Anyone holding consumer report information for a business purpose disposes of it with reasonable measures against unauthorised access, such as shredding paper, wiping or destroying electronic media, and using a vetted disposal company under contract.

    • Media Disposal Policy
    • Data Retention Policy
    • Third-Party Criticality Assessments
    • Vendor Management Policy & Procedure