Compliance Blog

Last Friday’s blog looked at some of the Regulation E issues that came up in the Consumer Financial Protection Bureau’s (CFPB) Summer 2020 Supervisory Highlights. The Supervisory Highlights document some of the CFPB’s findings “in the areas of consumer reporting, debt collection, deposits, fair lending, and mortgage servicing that were completed between September 2019 and December 2019.” Today’s blog will focus on one of the findings relating to consumer reporting.

Permissible Purpose Violations

The CFPB explained it found at least one lender pulled the credit report of a consumer without making sure a permissible purpose existed under the Fair Credit Reporting Act (FCRA). The CFPB noted at least one lender revised its policies and procedures to require documenting the consumer’s consent to pull a credit report even though the consumer’s express consent was not required by the FCRA.

What Does the FCRA Require?

Section 604 of the FCRA describes when a credit union has a permissible purpose to obtain a consumer report from a consumer reporting agency. Under section 604(a), consumer reporting agencies can provide consumer reports:

1. To respond to a court order or a Federal grand jury subpoena;
2. To comply with the written instructions of a consumer;
3. To a person who intends to use the consumer report in connection with a credit transaction initiated by a consumer;
4. To a person who intends to use the consumer report in connection with the review or collection of a consumer’s account;
5. To a person who intends to use the consumer report for employment purposes;
6. To a person who intends to use the consumer report to underwrite insurance involving the consumer;
7. To a person who intends to use the consumer report to determine whether the consumer is eligible “for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status;”
8. To a person who intends to use the consumer report “as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation;”
9. To a person who has a legitimate business need for the consumer report related to a consumer initiated business transaction;
10. To a person who has a legitimate business need for the consumer report to see whether a consumer continues to satisfy certain criteria require to hold an account;
11. To “executive departments and agencies in connection with the issuance of government-sponsored individually-billed travel charge cards[;]”
12. To respond to a child support enforcement agency when certain conditions are satisfied; and
13. To the FDIC or NCUA in their preparation to act as a conservator, receiver, or liquidating agent for an insured bank or insured credit union.

The permissible purposes under section 604(a) that might be most relevant to a credit union are numbers two, three, four and ten in the list above.

To get a better sense of what might satisfy those particular requirements, credit unions can look to the FTC’s 40 Years of Experience with the FCRA staff report. The FTC’s guidance indicates that a consumer’s written instruction could be satisfied through a written statement like “‘I authorize you to procure a consumer report on me[.]’” The submission of a credit application could provide a permissible purpose under the credit transaction initiated by a consumer prong. A permissible purpose might exist under the collection or review of a consumer account prong if a credit union intended to use a consumer report solely for the purpose of determining whether to modify the terms of an existing open-end credit account. Finally, a credit union might have a legitimate business need and a permissible purpose to obtain a consumer report if it needs to review a consumer report to see if it should amend the terms of the consumer’s share or share draft account.

A separate permissible purpose may exist under section 604(c) of the FCRA for credit transactions that are not initiated by a consumer if the credit union will provide an unsolicited firm offer of credit. Under the FCRA, a firm offer of credit is one that will be honored by the credit union as long as the consumer continues to satisfy the specific criteria used to identify the consumer for the offer. This process is also known as prescreening, and you can review these NAFCU Compliance blogs for more information about firm offers of credit and prescreening:

• Fair Credit Reporting Act—Warning: Permissible Purpose Does Not Include Cross-Selling; and
• Prescreening Opt-Out Notices.

While authority to regulate the FCRA has been transferred from the FTC to the CFPB and previous FTC guidance can be useful, it is important to note the FTC formally rescinded all of its FCRA guidance. Absent any new guidance from the CFPB, credit unions may continue to refer to FTC advisory letters and other guidance such as the 40 Years of Experience with the FCRA staff report. However, it is important to keep in mind that this information, while helpful, is not binding.

With all of the credit reporting protections provided in the CARES Act, credit reporting is likely to continue to be an area of scrutiny for credit unions and other financial institutions. Your credit union may want to review its policies, procedures and training materials to ensure the credit union does not violate the FCRA and obtain consumer reports without a permissible purpose.