Fair Credit Reporting Act (FCRA) Overview Glory LeDu Director of League System Relations Glory.LeDu@mcul.org

Agenda Credit Report – Permissible Purpose Prescreen Offers Accuracy and Integrity of Information Credit Report Disputes Adverse Action Notices Risk Based Pricing Notices Identity Theft Red Flags Mortgage Lending Disclosures Notice for Furnishing Negative Information Record Retention

Fair Credit Reporting Act (FCRA) Regulation V implements the FCRA and applies to credit unions that use information about consumers to determine eligibility for products, services, or employment and furnish information to consumer reporting agencies (CRAs). The banking system is dependent on fair and accurate credit reporting. Therefore, the FCRA provides requirements for CRAs and users of consumer information to properly investigate disputes and maintain the accuracy and integrity of information. Was enacted in 1970 because of concern over unknown files that were used to make important decision. Needed to provide consumers with rights to access and correct data and imposed obligations and users of that information

Do credit unions have a permissible purpose to pull credit? The credit union has to certify to the credit bureaus the purposes they are pulling credit and that information will not be used for any other purpose.

FCRA – Permissible Purpose What is a permissible purpose? The CRA is permitted to share a consumer report with the credit union if it believes the credit union intends to use the information: In connection with a credit transaction, including the associated review or collection of a credit account; For employment purposes; In connection with a business transaction initiated by the consumer; To review an account to determine the consumer still meets the terms of the account; or In accordance with written instructions of the consumer. The credit union needs to make sure that EVERY time they are pulling credit, they have a permissible purpose to do so! Federal Trade Commission Opinion - “Your questions raise the issue of whether a creditor in a closed end credit transaction may exploit consumer reports obtained for "review" purposes in order to market its products or services. In the circumstances you described, we believe the answer is "no.".”

FCRA – Permissible Purpose Member Authorization - Documentation If the credit union is relying on the permissible purpose to be associated with a credit transaction and the associated review and collection of that transaction, the loan application and disclosures should provide the necessary authorization. If the credit union is pulling credit for new members, the permissible purpose is related to the business transaction being initiated by the consumer. The membership account agreement and application/signature card should indicate this authorization. So, what about using the credit report for cross-selling? Need written authorization from the member. So, if you’ve pulled credit for a permissible purpose – it is NOT permissible to use that same report to cross sell your members. There is no permissible purpose for marketing to your members. So, how are credit unions doing it? Obtain proper written authorization from the consumer. Should be very close to the signature line, not buried deep in your 20 page disclosures. Legal Opinion Letter out there from the FTC on this topic: https://www.ftc.gov/policy/advisory-opinions/advisory-opinion-gowen-04-29-99 The Gowan Letter.

Prescreen Offers

FCRA – Prescreened Offers Prescreen Offers A marketing approach for credit unions. Credit unions approach a CRA with specific credit criteria to have a list created in order to market specific loan products to potential members. Requires specific disclosures, including the ability for the consumer to “opt-out.” Also requires the credit union to make a firm offer of credit. You must honor that firm offer of credit – except for the ability to “verify” that the potential member still meets the requirements.

FCRA – Prescreened Offers Prescreen Opt Out Notice Unsolicited “firm offer” of credit must be “clear and conspicuous” and include: Information contained in the consumer’s credit report was used in the transaction. The consumer received the credit or insurance offer because he or she met certain criteria for creditworthiness or insurability. The offer may not be extended after the consumer responds to the offer if he or she does not meet the applicable criteria, including providing acceptable property as collateral. The consumer has the right to prohibit credit report information from being used with credit or insurance transactions not initiated by the consumer. The consumer may exercise the right to opt out of future offers by using the notification system established by the credit bureaus. There has been a few court cases as to what meets the “firm offer” requirement of the FCRA. The offer must have “value” to the consumer. How is value determined? Credit unions can not use internal credit scores (from a previous pull) to market it’s members. This is a violation of one of the “permissible purposes” under the FCRA. Credit unions can purchase lists from the credit bureau and this would be an exception to the law. Prescreening is the only exception. While the Fair Credit Reporting Act (FCRA) does not expressly authorize it, prescreening is permissible if the institution follows certain rules. The act permits prescreening if the institution makes a firm offer of credit to each consumer whose name appears on the prescreened list. To obtain a consumer report, the institution must have a "permissible purpose" under the FCRA. Section 604(3)(A) of the FCRA permits an institution to obtain a consumer report if it intends to use the information in connection with a credit transaction involving the extension of credit to the consumer. (Prescreening cannot be used to solicit responses for insurance, employment or other purposes.) Therefore, an institution cannot use a prescreened list solely to send promotional material.

Prescreen Opt Out Notice FCRA – Prescreened Offers Prescreen Opt Out Notice Credit unions engaged in prescreening are required to provide consumers with a statement, both long and short notice. Short notice: You can choose to stop receiving “prescreened” offers of [credit or insurance] from this and other companies by calling toll-free [toll-free number]. See PRESCREEN & OPT-OUT NOTICE on other side [or other location] for more information about prescreened offers. The Fair Credit Reporting Act (FCRA) allows creditors to obtain credit reports for transactions not initiated by the member - called prescreened offers of credit. In order to provide a prescreened offer, the credit union must be able to extend a firm offer of credit.

FCRA – Prescreened Offers Prescreen Opt Out Notice Short notice must direct consumer to longer notice and must be: Prominent, clear, and conspicuous. In a type size larger than the text of the page, but no smaller than 12-point type. On the front side of the first page of the “principal promotional document” in the solicitation (e.g., document designed to be seen first by the consumer, like the cover letter). In a format distinct from other text and in a type style that is distinct from the principal type style on the same page. The Fair Credit Reporting Act (FCRA) allows creditors to obtain credit reports for transactions not initiated by the member - called prescreened offers of credit. In order to provide a prescreened offer, the credit union must be able to extend a firm offer of credit.

FCRA – Prescreened Offers Prescreen Opt Out Notice The long notice shall: Appear in the solicitation; Be in a type size that is no smaller than the type size of the principal text on the same page, and, for solicitations provided other than by electronic means, the type size shall never be smaller than 8-point type; Begin with a heading in capital letters and underlined, and identifying the long notice as the “PRESCREEN & OPT-OUT NOTICE”; If a dealer sends out a mailing making an unsolicited “firm offer” of credit to a consumer, the dealer is required to make certain “clear and conspicuous” disclosures to the consumer that: information in the consumer’s consumer report was used in making the offer; the consumer received the offer because the dealer was satisfied that the consumer met certain criteria and the offer may be withdrawn if the consumer no longer meets such criteria; the consumer has the right to prohibit the use of his/her consumer report in any transaction not initiated by the consumer; and an address and toll-free telephone number to notify consumer reporting agencies of this option.6 We have all seen this information footnoted at the bottom of mailers. The Court in its decision in Cole made clear that not just any offer will do to meet the “firm offer” requirement of the FCRA. The offer must have “value” to the consumer. The next question, how do you determine “value”? In agreeing with Ms. Cole that the offer made to her was a “sham,” the Court gave its reasoning but left no clear guidelines on what “value” means:

FCRA – Prescreened Offers Prescreen Opt Out Notice The long notice shall (cont’d): Be in a type style that is distinct from the principal type style used on the same page, such as bolded, italicized, underlined, and/or in a color that contrasts with the color of the principal text on the page, if the solicitation is in more than one color; and Be set apart from other text on the page, such as by including a blank line above and below the statement, and by indenting both the left and right margins from other text on the page.

FCRA – Prescreened Offers Prescreen Opt Out Notice Long Notice: PRESCREEN & OPT-OUT NOTICE: This “prescreened” offer of [credit or insurance] is based on information in your credit report indicating that you meet certain criteria. This offer is not guaranteed if you do not meet our criteria [including providing acceptable property as collateral]. If you do not want to receive prescreened offers of [credit or insurance] from this and other companies, call the consumer reporting agencies [or name of consumer reporting agency] toll-free, [toll-free number]; or write: [consumer reporting agency name and mailing address].

Accuracy and Integrity of Information Furnished to a CRA

FCRA – Furnished Information Accuracy and Integrity of Furnished Information CFPB Compliance Bulletin (2016-01) “The supervisory experience of the CFPB suggests that some financial institutions are not compliant with their obligations under Regulation V with regard to furnishing to specialty CRAs.” Policies and procedures must encompass reporting to ALL types of CRAs! Furnishers’ establishment and implementation of reasonable policies and procedures regarding the accuracy and integrity of information are essential components of a fair and accurate credit reporting system. Such policies and procedures protect against the furnishing of inaccurate information that could potentially cause adverse consequences for consumers when included in a credit report, such as being denied a loan at a more favorable interest rate or being unable to open a transaction account.

FCRA – Furnished Information Accuracy and Integrity of Furnished Information What are specialty CRAs? According to the CFPB: Specialty consumer reporting agencies collect and share information about the consumer’s transaction history with a business or using a specific product or service. This is unlike the big three consumer reporting agencies – Experian, Equifax, and TransUnion. The information which specialty consumer reporting agencies collect depends on the agency and its specialty industry. Does anyone use ChexSystems and report information to them regarding their members? Policies and procedures must address the accuracy and integrity of information provided to them as well.

FCRA – Furnished Information Accuracy and Integrity of Furnished Information The credit union is required to have policies and procedures regarding the accuracy and integrity of the information relating to consumers that it furnishes to a CRA. Regulation V contains guidelines for these requirements in Appendix E. Credit unions should cross check their policies/procedures to make sure they include all appropriate information. For example, if an institution furnishes both credit information to nationwide CRAs and deposit account information to nationwide specialty CRAs, that institution must consider the appropriate approach to each type of furnishing in its policies and procedures in order to comply with Regulation V The fear is that the inaccurate reporting of information may be limiting consumers access to deposit accounts. Using standard reporting formats and standard procedures for compiling and furnishing data, where feasible, such as electronic transmission of information about consumers to CRAs; Maintaining records for a reasonable period of time, not less than recordkeeping requirements to substantiate the accuracy of information furnished; and Training staff that participates in activities related to the furnishing of information about consumers to CRAs.

Credit Report Disputes

Disputes Received From Credit Reporting Agencies FCRA –Dispute from CRA Disputes Received From Credit Reporting Agencies Are typically sent via E-OSCAR in an automated fashion (the CRA must notify the credit union within five days after they receive the dispute). The credit union has to conduct a “reasonable investigation” and report results back to the CRA. If information was incorrect, the credit union must notify all CRAs who received the incorrect information. Generally, the credit union has 30 days from when the CRA received the dispute to respond. Credit union is required to have policies and procedures in place to ensure the accuracy and integrity of information relating to consumers that it furnishes to a CRA. Need to be reviewed periodically to ensure effectiveness. Sometimes may get 3 of the same dispute because the member is reporting the error to all three bureaus – respond to each.

FCRA – Direct Dispute Direct Disputes A dispute submitted directly to a credit union by a consumer regarding the accuracy of any information contained in a consumer report and pertaining to an account or other relationship that the credit union has with the consumer. Credit union is required to have policies and procedures in place to ensure the accuracy and integrity of information relating to consumers that it furnishes to a CRA. Need to be reviewed periodically to ensure effectiveness.

Direct Disputes – Contents FCRA – Direct Dispute Direct Disputes – Contents The direct dispute notice must contain: Sufficient information to identify the account or other relationship that is in dispute such as an account number and the name, address and telephone number of the consumer; The specific information that the consumer is disputing and an explanation of the basis for the dispute; and All supporting documentation or other information reasonably required by the credit union to substantiate the basis of the dispute (copy of the relevant portion of the consumer report that contains allegedly inaccurate information, a police report, a fraud or identify theft affidavit, a court order, account statements). Remember, the credit union is only required to investigate of the dispute notice if it is received at any business address of the credit union or any designated electronic location for delivery.olous

Direct Disputes - Exceptions FCRA – Direct Dispute Direct Disputes - Exceptions If the direct dispute relates to: The consumer’s identifying information (name, address, date of birth, social security number, etc.); The identity of past or present employers; Inquiries or requests for a consumer report; Information derived from public records (judgments, liens, bankruptcies, or other legal matters); Information related to fraud alerts or active duty alerts; Information provided to a CRA by another furnisher; or The credit union has a reasonable belief that the direct dispute is submitted by, or prepared on behalf of the consumer, or is submitted on a form supplied to the consumer by a credit repair organization or an entity that would be a credit repair organization.

Direct Disputes – Frivolous or Irrelevant FCRA – Direct Dispute Direct Disputes – Frivolous or Irrelevant The credit union is not required to investigate a direct dispute if the credit union has reasonably determined that the dispute is frivolous or irrelevant: The consumer didn’t provide sufficient information to investigate the disputed information; The dispute is substantially the same as a dispute previously submitted by or on behalf of the consumer, either directly to the credit union or through a CRA and the credit union has already satisfied the applicable requirements under the FCRA; or The credit union is not required to investigate the dispute because one or more of the exceptions applies. The credit union must notify the consumer if it determines the dispute is frivolous or irrelevant no later than 5 business days after making the determination. We are hearing from a number of credit unions of such disputes. There are companies around that are submitting these disputes based on credit report information they have obtained. They are trying to get credit unions (and banks alike) because if they do not respond to the dispute the institution can be fined.

Direct Disputes – Timeframes FCRA – Direct Dispute Direct Disputes – Timeframes Investigation must occur within 30 days after receiving notice. Info was inaccurate – promptly notify all CRAs the credit union notified and any correction that is necessary to make the information accurate. Frivolous or irrelevant – must notify consumer not later than 5 business days after making that determination by mail (or other means if authorized). Can extend the period for an additional 15 days if the CRA receives information from the consumer that is relevant to the investigation Must include the reasons for the dispute being frivolous or irrelevant.

Adverse Action

FCRA – Adverse Action Adverse Action When the credit union denies or increases the cost of a member’s loan or deposit account based on a consumer report, an adverse action notice must be provided. Both the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA) impact adverse action requirements.

Adverse Action – who receives notice? FCRA – Adverse Action Adverse Action – who receives notice? FCRA requires that if there is more than one applicant, adverse action notices need to be provided to all applicants (if the credit report was used in making that decision). Separate notice should be provided with credit score information specific to each applicant. ECOA indicates that if there is more than one applicant, adverse action notice only needs to be provided to the primary applicant. Section 615(a) of the FCRA requires notice to “any consumer” against whom adverse action is taken if the adverse action is based in whole or in part on information from a consumer report. The Federal Reserve Board has interpreted this to apply to co-applicants. See 76 Fed. Reg at 41,596-97.

FCRA – Adverse Action Adverse Action – When? FCRA doesn’t have timing requirements – follow ECOA. ECOA timing requirements: 30 days after receiving a complete application for credit; 30 days after receiving an incomplete application; 30 days after taking action on an existing credit account; 90 days after making a counteroffer if the applicant does not accept the counteroffer.

FCRA – Adverse Action Consumer Compliance Outlook Second Quarter 2013

FCRA – Adverse Action Adverse Action – What? Since there are separate requirements under ECOA and FCRA, Appendix C of Regulation B which implements ECOA, contains model forms that include required disclosures under each Act. Credit unions should always use model forms when they are provided within Regulation in order to obtain a compliance safe harbor.

Risk Based Pricing Notices

FCRA – Risk Based Pricing Notice Risk Based Pricing Notices – Why? Credit unions are required to provide risk based pricing notices to members if they used a credit report in connection with an application (personal, family or household purposes) and based on that report, grant, extend or provide credit on material terms that are materially less favorable than the most favorable material terms available to a substantial proportion of consumers. Designed to improve the accuracy of the consumer reports by alerting consumers to the existence of negative information in their consumer reports so that the consumers can check their reports for accuracy and correct any incorrect information. Materially less favorable means that the terms granted differ from the terms granted to another consumer such that the cost of credit would be significantly greater than the cost of credit otherwise provided to the other consumer.

FCRA – Risk Based Pricing Notice Risk Based Pricing Notices – Who? Credit score proxy method Tiered pricing method The credit union must use the same method to evaluate all members receiving the same type of loan, but can vary the methods across loan products. You would use one method for all auto loans and another method for all mortgage loans, etc.

FCRA – Risk Based Pricing Notice Credit Score Proxy Method Determine the credit score (cutoff score) that represents the point at which 40% of the consumers having higher scores and the other 60% have lower scores; and Provide a risk-based pricing notice to each consumer whom it grants or provides credit whose score is lower than the cutoff score. Cutoff score must be recalculated no less than every two years. Sampling approach. A person that currently uses risk-based pricing with respect to the credit products it offers must calculate the cutoff score by considering the credit scores of all or a representative sample of the consumers to whom it has granted, extended, or provided credit for a specific type of credit product. For new credit unions/lenders can use market research to determine cutoff.

FCRA – Risk Based Pricing Notice Tiered Pricing Method If the credit union uses four of fewer pricing tiers (A, B, C and D) the credit union would comply with the FCRA by providing the risk based pricing notice to all applicants who are not in the top tier (B,C and D). For five or more pricing tiers, a risk based pricing notice should be provided to all applicants not in the top two tiers. Sampling approach. A person that currently uses risk-based pricing with respect to the credit products it offers must calculate the cutoff score by considering the credit scores of all or a representative sample of the consumers to whom it has granted, extended, or provided credit for a specific type of credit product. For new credit unions/lenders can use market research to determine cutoff. There is also an alternative approach for credit cards. Model forms are in Appendix H of Regulation V.

FCRA – Risk Based Pricing Notice Risk Based Pricing Notice – When? For closed-end transactions, notice must be provided after the decision to approve a credit request is communicated, but before consummation; or For open-end transactions, notice must be provided after the decision to grant credit is communicated, but before the first transaction under the plan has been made; For credit reviews (existing credit – open-end), notice must be provided at the time the decision to increase the APR is communicated or if no notice of the APR increase is provided to the consumer prior to the effective date of the change, the notice must be provided no later than 5 days after the effective date of the APR change. (ii) Arranges to have the auto dealer or other party provide a notice described in §§1022.72(a), 1022.74(e), or 1022.74(f) to the consumer on its behalf within the time periods set forth in paragraph (c)(1)(i) of this section, §1022.74(e)(3), or §1022.74(f)(4), as applicable, and maintains reasonable policies and procedures to verify that the auto dealer or other party provides such notice to the consumer within the applicable time periods. If the person arranges to have the auto dealer or other party provide a notice described in §1022.74(e), the person's obligation is satisfied if the consumer receives a notice containing a credit score obtained by the dealer or other party, even if a different credit score is obtained and used by the person on whose behalf the notice is provided.

Identity Theft Red Flags

FCRA – Identity Theft Red Flags Identity Theft Prevention Programs Credit unions are required to have written Identity Theft Programs that detect, prevent and mitigate identity theft. Risk based approach, approved by the Board of Directors that contains policies and procedures to: Identify relevant red flags and incorporate them into the program; Detect red flags that have been incorporated into the program; Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and Ensure the program is updated “periodically” to reflect changes in risks to members of the safety and soundness of the credit union from identity theft.

FCRA – Identity Theft Red Flags Identity Theft Prevention Programs Address Discrepancies – program needs to address response to notices of address discrepancies from CRAs and must require the credit union to form a reasonable belief that the consumer report pulled actually pertains to that consumer. The credit union’s program should also address the furnishing of a confirmed accurate address to the CRA. Comparing information in the consumer report with the information the user: Has obtained and used to verify the consumer’s identity as required by CIP; Maintains in its records or obtains from a third party, or verifying the information in the consumer report directly with the consumer.

FCRA – Identity Theft Red Flags Identity Theft Prevention Programs Fraud and Active Duty Alerts – If there is an alert on the credit report, unless the credit union has reasonable policies and procedures to form a “reasonable belief” that it knows the identity of the person making the request, the credit union cannot: Open any new credit; Issue additional cards on an existing account; or Increase any credit limit in the name of the member.

FCRA – Identity Theft Red Flags Identity Theft Prevention Programs Initial Alerts (90 days) – if there is a phone number included in the alert, the credit union cannot extend credit until it contacts the member using that number or takes other steps to verify and confirm that the application for credit is not identity theft. Extended Alerts (up to 7 years) – the credit union must communicate with the member either in person or at the number indicated in the alert, or another reasonable method specified by the member, before activity takes place related to a loan or additional cards, etc. Active duty alerts must remain in service members’ files for no less than 12 months. For extended alerts, the consumer is required to submit identify theft reports and appropriate proof of identity to the CRAs.

Mortgage Lending Disclosures

FCRA – Mortgage Lending Disclosures If the credit union uses a credit score in connection with a closed-end loan or establishment of an open-end loan for a consumer purpose secured by 1 to 4 units of residential real property, the credit union is required to provide certain disclosures. “Notice to home loan applicants” disclosure.

FCRA – Mortgage Lending Disclosures The notice should also include the name, address and telephone number of each CRA providing a credit score that was used. In addition to the notice, the credit union should disclose the credit score, range of possible scores, date score was created and key factors used in the score calculation. Provided to applicants as soon as “reasonably practicable.” This disclosure requirement applies in any application for a covered transaction, regardless of the final action the lender takes on the application. Credit score and key factors disclosed In addition to the notice, a creditor, such as a financial institution, must also disclose the credit score, the range of possible scores, the date that the score was created, and the “key factors” used in the score calculation. “Key factors” are all relevant elements or reasons adversely affecting the credit score for the particular individual, listed in the order of their importance, and based on their effect on the credit score. The total number of factors to be disclosed must not exceed four. However, if one of the key factors is the number of inquiries into a consumer’s credit information, then the total number of factors must not exceed five. These key factors come from information the consumer reporting agencies supplied with any consumer report that was furnished containing a credit score (Section 605(d)(2)).

Notice for Furnishing Negative Information

FCRA – Notice for furnishing negative information Notice Requirements If the credit union extends credit regularly and in the ordinary course of business furnishes information to a CRA regarding that credit, it must provide a “clear and conspicuous” notice about furnishing negative information in writing to the member. Make sure that you are using one of these disclosures depending on when it is provided. B-1 is used if you provide the disclosure prior to furnishing negative information, B-2 is used if notice is provided after negative information is reported to the CRA.

Record Retention

FCRA – Record Retention How long do I keep it? If the credit union is using a prescreened list and making offers of credit based on that list, the credit union needs to retain: Record of the criteria used to select the members who received the offer; and Any requirements for furnishing collateral as a condition. Information should be maintained 3 years, beginning on the date the offer of credit is made. The FCRA provides no other specific record retention requirement, although it relieves a credit union from liability for certain violations if it can show that at the time the alleged violation occurred, the credit union maintained reason‑ able procedures to ensure compliance with the requirements of these sections. Therefore, it is recommended that each credit union maintain written procedures and retain copies of written notices given to members, as well as notations of any telephone or other verbal communications.

Questions?