As published in ABA Risk and Compliance, May/June 2024
Financial institutions (FIs) regularly work with consumer reporting agencies (CRAs) to identify qualified consumers to whom they can send firm offers of credit or insurance (prescreened solicitations). Under the Fair Credit Reporting Act (FCRA), FIs are able to request from a CRA, a list of consumers meeting certain defined criteria in order to market their products to them, such as mortgage loans or credit cards. FIs are required to adhere to FCRA rules when utilizing prescreened lists.
This column will focus on the FCRA rules that apply to obtaining prescreened lists, delivering firm offers of credit or insurance to consumers, and handling consumers who respond to the offer. There are other relevant regulations that may apply when sending prescreened solicitations, including Unfair, Deceptive, or Abusive Acts or Practices (UDAAP), Truth in Lending Act, and fair lending-related regulations. Although FIs need to be concerned about these additional regulations when delivering firm offers to consumers, this article will focus only on the FCRA requirements.
Prescreening is an exception to the general FCRA permissible purpose rule. The FCRA protects consumer privacy by prohibiting CRAs from providing a consumer report unless the recipient has a permissible purpose to use it, and prohibiting a recipient from using a consumer report without a permissible purpose. FCRA identifies a list of permissible purposes for which CRAs may provide consumer reports, including for credit, employment, or insurance purposes (604(a)), provided the consumer initiates the transaction. However, the FCRA also states a permissible purpose exists when the consumer does not initiate the transaction if the credit report is to be used in connection with a firm offer of credit—commonly referred to as prescreening. CRAs are required to exclude consumers under age 21 from prescreening lists unless the consumer has consented to be included to the CRA (604(c)).
When considering the use of prescreened lists, an FI’s business-line management typically works with the marketing department to determine the criteria for identifying qualified consumers based on information on their consumer reports, such as the number of active accounts and 30-day delinquencies in the last 12 months, and the credit score. The list can be obtained in a couple of ways. The CRA can furnish the FI with a list of consumers who meet the stated criteria included in the FI’s request. Institutions can also provide the CRA with a list of potential customers and ask the CRA to identify ones that meet the defined criteria.
Once an FI obtains a list of qualified consumers, it is required to make firm offers to all consumers on the list (604(c)); FIs are not allowed to choose which qualified consumers receive the firm offer. If an FI fails to deliver a firm offer to a consumer included on the list, then the FI is deemed not to have had a permissible purpose. The only information that FIs are allowed to receive about the qualified consumers is their name, address, and other information that does not allow the FI to identify the consumer’s experience with other FIs.
Defining a Firm Offer
A firm offer of credit is any offer of credit or insurance to a consumer that will be honored if the consumer is determined to continue to meet the specified criteria used to originally select the consumer for the offer (603(l)). Institutions are required to extend the credit, as defined in the offer, to all consumers on the list. Consumers only need to respond to the offer and continue to meet the established criteria. Additional screening of consumers who respond to the firm offer is not permitted beyond verifying that the consumer continues to meet the requirements upon which the offer was based.
The firm offer of credit needs to describe clearly the terms that are being offered to the consumer. If the terms included in the offer are vague or unclear, then this could lead to consumer confusion or to regulators questioning whether a true firm offer was made to the consumer. Some FIs tier the offer so that each consumer receives a specific offer that is based on their creditworthiness. Existing regulatory guidance by the Federal Trade Commission (FTC) does permit obtaining separate or tiered lists for consumers who meet different credit criteria. FTC guidance also states that firm offers of credit may not be sham offers used to potentially deceive consumers into thinking they qualify for credit or insurance when in reality they will not be granted the offer listed in the solicitation. Therefore, FIs should exercise care when developing the firm offer to ensure consumers will actually be qualified for the credit or insurance product offered. Management may want to consult with legal counsel to review the language used in the offer, the terms offered, and the procedures to be followed when handling consumer responses to avoid any potential regulatory concerns.
FCRA requires that the firm offer of credit must contain clear and conspicuous language including a statement that information from a consumer reporting agency was used in making the offer, the consumer met the criteria used in developing the offer, the consumer must continue to meet the criteria to qualify, and the consumer has the opportunity to opt out of receiving prescreened offers in the future.
Opt-Out Requirements
The firm offer is required to contain both a short notice and a long notice advising the consumer of their right to opt out of receiving prescreened offers in the future (Regulation V, implementing 615(d)). The short notice is required to be displayed conspicuously and advise consumers of their ability to opt out of receiving prescreened offers, along with a toll-free number for the consumer to communicate their desire to be excluded from future prescreening campaigns. The firm offer must also direct consumers to the long notice for additional information regarding their ability to opt out from these types of offers.
The long notice can be included on the back of the offer if there is not sufficient space on the first page, but it must include certain information, including:
- A statement that a consumer report was used, and that the consumer received the offer because they met the criteria for the product included in the offer,
- A statement that the consumer may not receive the credit offered if the consumer no longer meets the criteria used to make the offer,
- Advise the consumer that they may prohibit the use of their credit information to generate future offers and contact information for the consumer to communicate her opt out request.
- Appendix D of Regulation V includes model disclosure language that can be used when sending firm offers to consumers and using the model language does offer safe harbor protections to FIs.
Considerations for Examination Management
Examiners assess FCRA compliance risk as part of the FI’s compliance examination. This includes reviewing policies and procedures related to creating and delivering prescreened solicitations to consumers to determine whether they are consistent with FCRA requirements.
A strong FCRA compliance management system (CMS) is critical to ensuring regulatory requirements are met and in avoiding potential examiner criticism. Demonstration of a strong FCRA CMS includes establishing policies and procedures that include the following elements:
- A description of the prescreening activities that are permitted, such as the products to be offered and the language to be included in prescreened solicitations.
- Identification of FI personnel responsible for overseeing prescreening activities.
- Detailed procedures supporting prescreened solicitation activities.
- FCRA training requirements that are consistent with the FI’s overall training program.
- Applicable documentation retention requirements for prescreening activities under FCRA.
- Version control that retains a brief history of revisions made to the FCRA Policy.
- Board or management committee approval of the FCRA Policy.
To complement the FCRA Policy, implementing comprehensive procedures to provide detailed guidance to personnel engaging in prescreening activities is very beneficial. The FI should consider procedures that incorporate guidance on developing prescreening criteria, determining the types of products to be offered, specifying the necessary information required to be included, and outlining the processes to be followed when reviewing consumers who have responded to the offer.
FCRA does require FIs to maintain on file the criteria used for the product offered, including the criteria used to generate the prescreened report and other criteria used such as collateral requirements, for a period of three years. It is beneficial to document evidence that firm offers were provided to all consumers on the prescreening report and that all consumers who requested the product and continued to meet the criteria were granted the product offered.
Providing training is beneficial for employees who are responsible for developing and delivering prescreened solicitations and processing consumer requests for the product(s) offered. Be sure to retain documentation to evidence that these employees were assigned FCRA training, that they successfully completed the training, and that they understood the topics covered, such as by receiving a satisfactory score on the quiz that follows the training.
It is also beneficial to test prescreened campaigns as part of the compliance monitoring program, to confirm adherence to established policies and procedures and FCRA requirements. This includes confirming that the FI granted the offer to all consumers meeting the eligibility criteria and that consumers were denied the offer only if they no longer met those criteria. Again, be sure to retain documentation showing what prescreening activities the FI has reviewed through its compliance monitoring program. Also include the results of the review, and management’s responses on any issues noted. The results of the compliance monitoring procedures should also be presented to the board or appropriate management committee to ensure they are aware of the errors noted and comfortable with the action taken to mitigate those errors.
Any consumer complaints received regarding prescreened offers need to be tracked and monitored to ensure that the FI is complying with FCRA requirements and that all such complaints are properly investigated and resolved. Any negative trends noted in these types of complaints could indicate the prescreened solicitations did not include terms or language that were clear, or that consumers may not have received the product even though they met the offer requirements.
Management also needs to confirm that any third-party vendors who assist with developing prescreened solicitations or delivering them to consumers are acting consistent with the FI’s policies and procedures, and in compliance with all applicable consumer financial regulatory requirements. Having good vendor oversight will also help to ensure the vendor continues to be qualified to perform the services rendered, and the risks related to using the vendor remain acceptable.
Lastly, it is important for management to be aware of any recent examination findings noted at other FIs regarding prescreening activities, including the finding noted by the Federal Deposit Insurance Corporation (FDIC) in its Consumer Compliance Supervisory Highlights from the March 2023. The FDIC noted that FIs were failing to provide firm offers of credit when using “trigger leads.” An FI can purchase trigger leads from a CRA that identify when individuals meeting specific criteria are shopping for credit based on their report being “pulled,” which “triggers” the CRA to send the leads to the FI for the purpose of contacting those consumers with prescreened credit offers.
As discussed above, FCRA requires FIs to provide firm offers of credit to any qualified consumers who appear on a list provided by a CRA and meet established criteria. This requirement applies to trigger leads.
Furthermore, it’s essential that these offers clearly state they are guaranteed, provided the consumer satisfies the predetermined criteria, and that they have been pre-screened based on the individual’s credit report. Additionally, it must be communicated to consumers that they have the right to opt out of receiving future prescreened offers, as outlined in section 615(d)(1) of the FCRA.
However, in 2022, based on examining recorded phone calls, consumer complaints, and official sales scripts, the FDIC noted instances where FIs that purchased trigger leads contacted consumers but failed to provide key disclosures required for firm offers of credit. Specifically, the FDIC identified instances when FIs did not inform consumers that they were receiving firm offers, nor that these offers were guaranteed provided they continued to meet the predetermined criteria. Additionally, the FDIC identified instances when FIs did not inform consumers that the offers were derived from information in the consumers’ credit reports, and did not inform consumers about their right to opt out of receiving such prescreened offers in the future.
FIs must provide the consumer all these disclosures when making a firm offer of credit, regardless of whether the offer is in writing or given verbally. The FDIC noted that implementing an effective CMS that has all the elements described above would have averted the issues.
Conclusion
FCRA continues to be an area of focus for bank regulators, including prescreening solicitations by FIs. To reduce potential regulatory criticism, management should ensure the FI’s CMS includes all required elements and adequately mitigates risks related to providing prescreened firm offers to consumers.
