The Fair Credit Reporting Act (FCRA) includes various responsibilities that financial institutions (FIs) must comply with to ensure accurate information is being provided to consumer reporting agencies (CRAs). These responsibilities apply throughout the lifecycle of the relationship with the consumer. This article will discuss the various responsibilities that apply if an institution is furnishing information to CRAs.
Furnishing accurate information to CRAs
Furnishers of information to CRAs are required to establish written policies and procedures to ensure the accuracy and integrity of the consumer information reported to CRAs.[i] These policies and procedures must be appropriate given the nature, size, complexity, and scope of the furnisher’s activities, and must be updated periodically to ensure they are reflective of the FI’s current practices.
Applicable Interagency Guidelines must also be considered when developing policies and procedures on furnishing consumer information to CRAs. The Guidelines provide guidance on the factors to be considered when determining the nature, scope, and objectives of the FI’s policies and procedures, including the types of business activities in which the FI engages, the nature and frequency of the information furnished to the CRAs, and the technology used by the FI to provide information to the CRA.
These objectives include:
- Furnishing accurate information about accounts or other relationships with a consumer, including information that:
- Identifies the consumer,
- Reflects the terms of the relationship, and
- Reflects the consumer’s performance and other conduct with respect to the account relationship.
- Furnishing information in a form or manner that is designed to minimize the likelihood that the information may be reported incorrectly.
- Conducting reasonable investigations of consumer disputes and taking appropriate action based on the conclusions of those investigations.
- Updating the information as necessary to reflect the current status of the consumer’s account relationship.
Many FIs rely on vendors to assist in producing data files that are sent to CRAs (normally each month). The FI’s procedures should include guidance to personnel on the data format to be used and ensure that any error or exception reports available from the vendor or CRA are reviewed so these issues can be properly investigated and addressed to ensure the information sent to CRAs is complete and accurate. Failing to review exceptions also has the potential to be cited as a deficiency during regulatory examinations and compliance audits.
Duties upon notice of a credit reporting dispute
There are two options for consumers to dispute information that has been reported to a CRA. Consumers can contact the furnisher of the credit information (such as a bank) directly to dispute the information, or consumers can also contact the CRA that reported the disputed information. For direct disputes, if the FI requires credit reporting disputes to be sent to a specific address, then the FI is required to disclose that address in a clear and conspicuous manner to the consumer so they are aware of the location to send the dispute.
Within 30 days from the date a direct credit reporting dispute is received from the consumer, FIs are required to perform certain duties, including:
- Conducting an investigation to determine whether the dispute is valid.
- Reviewing all relevant information provided by the consumer.
- Completing the investigation of the dispute within 30 days of receiving the dispute and reporting the results of the investigation to the consumer (can be extended to 45 days in certain situations).
- If the investigation finds the credit information reported is incomplete or inaccurate, reporting corrected information to the CRAs to which the FI previously provided the original information by either modifying, deleting, or permanently blocking the reporting of that information.
The FCRA defines the types of disputes furnishers are required to investigate, as well as provisions regarding the consumer’s liability, the terms of the account, the consumer’s performance on the account, and any other information contained in a consumer report that bears on the consumer’s creditworthiness. Furnishers are not required to investigate disputes related to matters other than these, such as a dispute regarding the identity of current or past employers or inquiries or requests for a consumer report, for instance.
A furnisher is also not required to investigate a dispute if the FI has determined that the dispute is frivolous, such as when the dispute from the consumer does not contain enough information to review the dispute, or provides a dispute that is substantially the same as a dispute that was previously reported by the consumer and resolved.
The furnisher also has the responsibility to investigate indirect disputes that were sent to CRAs regarding information the furnisher previously provided to the CRA. Furnishers are required to investigate the dispute, review all information provided by the CRA, and report the results of the investigation to the CRA. Similar to direct disputes, furnishers have 30 days from the date the consumer filed the dispute with the CRA to complete its investigation, although this can be extended not more than 15 additional days if the CRA receives information from the consumer during the 30-day period that is relevant to the investigation.
Prevention of re-pollution of consumer reports
FIs are also required to have policies and procedures in place for the handling of notices from CRAs that consumer information previously reported may be fraudulent due to identity theft. After receiving this notice, FIs are required to follow reasonable procedures to ensure that this information is not refurnished to the CRA, as it would “re-pollute” the victim’s consumer report. In addition, FIs are prohibited from selling or transferring debt that was alleged to have been caused by identity theft.
If a furnisher is contacted by the consumer who reports that they have been a victim of identity theft, the furnisher must not re-report the information related to the identity theft unless the furnisher subsequently verifies that the information is correct.
Investigating and resolving address discrepancies
CRAs must provide a notice of address discrepancy to an FI if the address submitted with the request for a consumer report substantially differs from the address the CRA has in the consumer file. FIs are required to have reasonable policies and procedures for investigating and resolving the discrepancies that appear on a consumer report. These policies and procedures must include a process that enables personnel to form a reasonable belief that the consumer report relates to the consumer about whom the report has been requested. Procedural examples provided in the regulation include obtaining and verifying information as required by the Bank Secrecy Act’s Customer Identification Program (CIP) rule, its own records related to change of address notifications, or obtaining address information from third party sources.
Voluntary account closures
FIs that regularly furnish information to a CRA on accountholders are required to notify the CRA of the consumer’s voluntary closing of the account. This notice is to be furnished to the CRA as part of the regularly furnished information for the period in which the account was closed.
Delinquent accounts/Negative information notices
FIs that furnish information to a nationwide CRA about a delinquent account, charged off account, or account subjected to similar action, must, no later than 90 days after furnishing the information to the CRA, report to the CRA the month and year of the commencement of the delinquency.
The FCRA also requires that consumers are to receive this so-called “negative information” notice either before the FI provides negative information to a nationwide CRA or within 30 days after reporting the negative information. Several options are available for providing this notice as it can be sent with a notice of default, billing statement, or other materials provided to the consumer, as long as it is clear and conspicuous. FIs can also provide the notice to all customers out of an abundance of caution; however, FIs cannot include this notice in the same document as initial disclosures required for open-end consumer credit plans under the Truth in Lending Act.
The negative information notice requirements also apply to deposit accounts if the FI has reported negative information to a national CRA, such as reporting that the deposit account has been charged off. Similar to the above, FIs have options for delivering this notice to consumers as it can be provided with a notice of deposit account closure or the final statement delivered to the consumer. Failing to provide the negative information notice on these deposit accounts has been an issue cited by examiners and auditors.
Common examination/Audit findings related to FCRA
Bank examiners and independent compliance audits of FIs have recently identified additional issues regarding the requirements to furnish accurate information to CRAs. These issues include:
- Failing to complete investigations into credit reporting disputes and/or to respond to the CRA or consumer with the results of the investigation into the dispute within regulatory timeframes: As mentioned above, FIs generally have 30 days to investigate disputes and provide the results to the consumer or CRA. To avoid this type of error, it is critical to track the disputes received and have compliance monitoring in place to help ensure the disputes are addressed timely.
- Record retention: The FCRA requires that FIs are to maintain records for a reasonable period of time in order to substantiate the accuracy of any information about consumers it furnishes that is subject to a direct dispute. It is recommended that FIs include record retention requirements in its FCRA policies and procedures. Having record retention requirements related to disputes in these procedures is also critical to ensure the FI can demonstrate that disputes were resolved appropriately.
- Failing to investigate address discrepancies appearing on a consumer report as required by the FCRA: Even if the discrepancy appears to have been caused by a typing error when ordering the credit report or a long address mismatch due to formatting issues, clear documentation should be retained to show that each address discrepancy alert was resolved prior to originating a loan with a consumer and to demonstrate that no identity theft was detected.
Considerations for examination management
Examiners regularly assess FCRA compliance risk, including reviewing policies and procedures related to complying with FCRA requirements when furnishing credit information to CRAs and responsibilities associated with this reporting.
A strong FCRA compliance management system (CMS) is critical in ensuring regulatory requirements are met and to avoid potential regulatory issues. An FI should consider establishing its FCRA CMS to include the following elements:
- Effective policies and procedures for furnishing complete and accurate credit information to CRAs, as required by Appendix E of FCRA.
- Designated FI personnel who are assigned responsibility to investigate and resolve disputes received and to appropriately resolve address discrepancy alerts that appear on consumer reports, as well as to provide negative information notices when required.
- Regular compliance monitoring to ensure that personnel are complying with established procedures when performing FCRA furnishing related duties.
- Regular review of consumer complaints for any potential negative trends regarding furnishing accurate information to CRAs or credit reporting dispute resolution.
- FCRA training within the FI’s framework to cover the requirements for furnishing accurate information to CRAs.
- Board or management committee approval of the FCRA Policy.
Conclusion
FCRA continues to be an area of focus for bank regulators, including the processes implemented for furnishing credit reporting to CRAs. FIs need to ensure that all aspects of their CMS related to furnishing credit information to CRAs are functioning properly to avoid potential FCRA concerns.
[i] 1. 12 C.F.R. § 1022.42
As published in ABA Risk and Compliance, March/April 2025
