FCRA Permissible Purpose and Consumer Reports
There are many reasons why a financial institution may need to obtain a report from a consumer reporting agency (CRA), including evaluating a loan applicant’s credit history or credit score, evaluating a depositor’s request for a new account, or investigating the background of an applicant for employment. The Fair Credit Reporting Act (FCRA) requires an institution to have a permissible purpose to access information from a CRA, but that sometimes involves navigating a lot of operational gray areas.
This quarter, we address key questions about operationalizing permissible purpose.
Not all consumer report requests require written authorization from the consumer, so what key controls should the institution implement to comply with and demonstrate the permissible purpose requirement?
While the FCRA does not require written consumer authorization for every consumer report request, institutions must be able to demonstrate that each report was obtained for a valid permissible purpose under FCRA Section 604. The key compliance objective is not simply to obtain consent when required, but rather to maintain strong controls that verify, document, and monitor the legitimacy of every CRA inquiry.
As with any element of an effective compliance program, the foundation is sound policies and procedures that:
- Clearly define permissible-purpose categories and require employees or system users to identify the specific business purpose for each consumer report request.
- Capture and retain supporting documentation demonstrating the relationship between the consumer and the institution, such as an application, account review activity, collection efforts, or other qualifying transaction.
- Require explicit verification of entity structure and legal liability before any credit check is ordered for business-purpose credit requests, as permissible purpose only extends to those who will be personally liable for the credit.
- Limit access to consumer reporting systems through role-based permissions and user authentication controls so that only authorized personnel can obtain consumer reports.
- Establish exception management and escalation procedures for situations where the permissible purpose is unclear or insufficiently documented.
- Maintain detailed audit trails that record who accessed a report, when it was accessed, and the stated business purpose for the inquiry.
- Include periodic monitoring and reviews to confirm that report requests align with documented permissible purposes and to identify any unauthorized or unsupported inquiries.
The compliance training program should include periodic employee training on FCRA requirements, including the institution’s permissible purpose policies and procedures, and emphasize that obtaining or using a consumer report without a permissible purpose is prohibited.
What rules apply when pulling consumer reports for employment purposes?
Consumer reports used for employment purposes are subject to some of the FCRA’s most stringent requirements. Unlike standard credit inquiries, employers must provide a clear, standalone disclosure to the applicant or employee and secure their written authorization before obtaining a consumer report for employment purposes.
To minimize regulatory risk, institutions should establish distinct workflows, authorization protocols, and recordkeeping practices that separate employment screening from credit underwriting, account review, or collection activities. A frequent compliance pitfall is assuming that an existing customer relationship or prior consent extends to employment screening. Every employment-related consumer report must independently satisfy its own strict disclosure, authorization, and adverse action requirements.
When using a consumer report for hiring, promotion, retention, reassignment, or other employment decisions, institutions should:
- Provide a standalone disclosure informing the individual that a consumer report may be obtained for employment purposes.
- Obtain written authorization from the applicant or employee before requesting the report.
- Certify to the CRA that the institution has met applicable requirements, including providing the required disclosures and obtaining written authorization.
- Follow adverse action procedures if information in the report may negatively affect an employment decision, including providing the individual with required notifications and an opportunity to review the report before a final adverse decision is made.
- Maintain appropriate safeguards and confidentiality controls for consumer report information and limit access to individuals with a legitimate business need.
What are the risks of pulling a credit report during a loan “prequalification”?
Loan prequalification can present FCRA compliance challenges because the institution must be able to demonstrate a valid permissible purpose before obtaining a consumer report. The fact that a consumer is exploring financing options does not automatically establish a permissible purpose for a credit inquiry. A key consideration is whether the consumer has initiated a transaction or otherwise authorized the institution to obtain the report under an applicable FCRA provision.
The primary risks include:
- Lack of a documented permissible purpose. If the institution cannot demonstrate that the consumer initiated the credit transaction or otherwise authorized the inquiry, regulators, auditors, or CRAs may question whether the report was obtained lawfully.
- Consumer complaints. Consumers may dispute inquiries they did not expect, particularly when they believe they were only seeking general information or rate estimates rather than formally applying for credit.
- Potential impact on the consumer’s credit file. If a lender initiates an inquiry that the consumer did not expect, the institution may face customer dissatisfaction and increased complaint volume. Institutions should clearly disclose their practices before obtaining a report.
- Inconsistent prequalification practices. When policies do not clearly distinguish between marketing discussions, prequalification requests, and formal applications, employees may inadvertently request consumer reports without sufficient documentation or approval.
- Examination and audit findings. Weak documentation, unclear procedures, or an inability to demonstrate the consumer’s role in initiating the transaction can lead to compliance concerns during internal audits or regulatory examinations.
Financial institutions should establish clear procedures defining:
- When a prequalification inquiry may be obtained;
- What consumer actions constitute initiation of a credit transaction;
- What disclosures should be provided to the consumer; and
- What documentation must be retained to support the inquiry.
Compliance Check is CrossCheck’s compliance-focused quarterly Q&A series, where our experts take a deeper dive into a topic facing the industry, offering clarity and best practices for your institution’s compliance management efforts.
To receive Compliance Check via email or sign up for CrossCheck’s other publications, visit our subscriptions page.
Grappling with a regulatory compliance issue? Submit your question for future issues.
