Compliance Blog

Written by Shereefat Balogun, Regulatory Compliance Counsel

Last week I wrote about permissible purposes under the Fair Credit Reporting Act (FCRA), and generally stated that a credit union may not use a consumer report obtained with a permissible purpose to later cross-sell other products or services absent a separate permissible purpose.  Since then, I have received a lot of feedback and thought it may be necessary to clarify a few points.

• Point #1: Section 604 of the FCRA provides the permissible purposes for which a consumer report may be obtained and used. Cross-selling, by itself, is not listed as a permissible purpose under the FCRA. 

• Point #2: One key permissible purpose under section 604(a)(2) of the FCRA is where the credit union acts in accordance with the written instructions of the consumer to whom [the consumer report] relates under section 604(a)(2). This allows credit unions that obtain written authorization from the member to use the report which could include cross-selling activities. 

• Point #3: When obtaining a consumer report, the FCRA generally requires credit unions to certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.  See, 15 U.S.C. 1681e(a).

• Point #4: While authority to regulate the FCRA has been transferred from the FTC to the CFPB, and previous FTC guidance can be useful, it is important to note that the FTC formally rescinded all of its FCRA guidance. Absent any new guidance from the CFPB, credit unions often continue to refer to FTC advisory letters, including the Gowen Letter, and other guidance such as 40 Years of Experience with the Fair Credit Reporting Act. However it is important to keep in mind that this information, while helpful, is not binding.

Points #1 and #2 generate a lot of discussion. The FCRA generally requires credit unions to have a permissible purpose in order to access a consumer report. The definition of permissible purpose in the statute does not include things like cross-selling using a consumer report that the credit union previously obtained for a permissible purpose.

However, one permissible purpose is having the member's written instructions, or authorization to access their consumer report. This means that the credit union may be able to obtain the member's written authorization that grants the ability to cross-sell.  For example, some credit unions obtain a separate written authorization from members specifically for cross-marketing activities.  Other credit unions have built in some form of written authorization in their membership applications or loan applications.  Others use a separate disclosure and authorization form that is maintained in the member's file. Overall, many credit unions have worked with outside counsel to develop acceptable written authorizations that address cross-selling or other purposes. In any event, past FTC guidance, which again is not binding but informative, indicates that written authorization should be clear and have a certain degree of specificity.  Credit unions considering adding such language to their agreements may need to consult with local counsel regarding the specific verbiage needed to be compliant.

Cross-selling products and services can mutually benefit members and the credit union.  Indeed, credit unions pride themselves in their ability to offer members better terms and rates. A carefully constructed process for obtaining written authorizations can accomplish these goals while remaining within the parameters established by the FCRA. 

As always, if you have any questions relating to this article or any other FCRA issues, please contact NAFCU's regulatory compliance team.  We're here for you!