Compliance Blog

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel, NAFCU

Section 301 of S.2155 amends section 605 of the Fair Credit Reporting Act (FCRA) (codified at 15 USC §1681c). Section 605 establishes requirements regarding the information in consumer reports and disclosures regarding them. S.2155 adds subsection 605(i) and (j) establishing requirements regarding security freezes. These changes will primarily affect consumer reporting agencies (CRAs) rather than credit unions.

One change adds a required notice for whenever a summaries of rights is required by FCRA’s section 609. While section 609 contains a lot of disclosure requirements, only subsections 609(c) and (d) specifically reference a “summary of rights.” Last week, the BCFP issued an interim final rule updating the Summary of Consumer Rights in Appendix K to Part 1022 and the Summary of Consumer Identity Theft Rights in Appendix I. These are required under section 609(c) and (d), respectively (codified at 15 USC §1681g (c) and (d)).

The Summary of Consumer Rights must be provided by a CRA whenever it makes a written disclosure of information to the consumer. Also, it may need to be provided by employers taking adverse employment actions in connection with a credit report. The Summary of Consumer Identity Theft Rights must be provided by the CRA when a consumer reports that they are a victim of identity theft. In the interim final rule, the Bureau specified that it is soliciting commentary to determine how to proceed regarding other model forms.

While these forms would not typically be provided by a credit union, understanding the changes to the environment of regulatory requirements around credit reports may be helpful to credit unions assisting members attempting to apply for credit or coping with identity theft. New 605(i) mandates procedures for CRAs in placing credit freezes on consumer files upon the consumer’s request. The freeze must be done free of charge and within 1 business day of receiving a request by phone or within 3 business days of receiving a request by mail. The CRA must confirm the freeze and provide instructions on removing it within 5 business days thereafter. Subsection 605(j) provides separate requirements for freezes regarding more vulnerable consumers, specifically those who are under the age of 16 or legally incapacitated.

A few pieces of the rule may be of particular interest to credit unions:

• The CRA is able to confirm to third parties that a security freeze has been placed on the file.
• If a consumer (who is able to confirm their identity) calls the CRA to have the freeze removed, it must do so within one hour of the phone call.
• Consumers can request a “temporary removal” of the freeze for a specified period of time.
• If a credit application is made, but the credit report cannot be provided due to the freeze and the consumer will not have the freeze removed, new section 605(i)(3)(D) specifies that the credit union may treat the application as incomplete.
• Under new section 605(i)(4), requests for a consumer report in connection with certain permissible purposes are not subject to a credit freeze. These may include reviewing certain existing accounts, prescreens under section 604(c), and background screening for employees and volunteers.

These provisions become effective on September 21, 2018 and conforming regulations may be issued by the BCFP and the FTC. While these changes do not require much on the part of credit unions, they could represent some slight changes to the operating environment in the context of loan applications and assisting members who have been affected by identity theft.