Compliance Corner: First Quarter 2004

As a Matter of FACT...Amendments to the Fair Credit Reporting Act

by Robert W. Snarr, Jr., Supervising Examiner

By now, most bankers are likely aware that on December 4, 2003, President Bush signed into law the Fair and Accurate Credit Transactions Act (FACT).¹ The enactment of FACT permanently authorizes the federal preemption contained in the Fair Credit Reporting Act (FCRA), precluding states from adopting separate laws to govern credit reporting. The existing preemption contained in the FCRA had been scheduled to expire on December 31, 2003, prompting Congress to enact FACT before that date. FACT's permanent preemption allows for uniformity in the governance and regulation of the reporting of consumer credit transactions nationwide. In addition, FACT amends FCRA significantly to address consumer protection concerns, and identity theft in particular.

The primary purpose of FCRA, which became effective on April 25, 1971, is to regulate the consumer reporting industry to ensure fair, timely, and accurate reporting of credit information. Since its enactment more than 30 years ago, FCRA has been amended numerous times, mostly with minor revisions. FACT provides the most extensive revisions to FCRA to date.

Historically, the Federal Trade Commission (FTC) and the Federal Reserve Board of Governors (FRB) were authorized to issue interpretations of FCRA. However, no regulations were established to implement FCRA. With the passage of FACT, the FTC and the FRB have been charged with issuing joint regulations to implement FACT's provisions, including the Act's notification provisions. In addition, other agencies—including the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, the Office of Thrift Supervision, the National Credit Union Administration, and the Securities and Exchange Commission—are required to develop and establish regulations to implement FACT, as appropriate. The Act directs the agencies to communicate and coordinate with one another during the rulemaking process to ensure consistency among the regulations being developed.

Shortly after FACT's passage on December 4, 2003, the FRB and the FTC issued for public comment interim final rules and proposed dates for covered institutions to comply with FACT's expanded provisions.² As proposed, those provisions that would not entail substantive operational changes for an institution would become effective on March 31, 2004. Provisions that would require an institution to make substantive operational changes would become effective on December 1, 2004. On February 5, 2004, the FRB and FTC approved the final rules, formalizing the March 31, 2004 and December 1, 2004 effective dates.³

Because of FACT's permanent preemption to state law, the seven most important provisions of FCRA, which had been scheduled to expire at the end of 2003, will remain in effect, along with FCRA's other existing provisions. These seven key provisions of FCRA address the following:

The nature and extent of information that a consumer credit report may contain.
The duties of financial institutions or other parties that furnish information to a consumer reporting agency (RA).⁴
The duties of financial institutions and other parties to provide a notice of action taken to consumers in connection with the use of a consumer credit report.
The procedures that an RA must follow should a consumer dispute the accuracy of information in a consumer credit report.
The activities that involve the use of consumer credit reports for credit or insurance transactions that are not initiated by a consumer.
The exchange of information among affiliated institutions.
The form of content of the summary of a consumer's rights that an RA must provide to a consumer when the RA provides the consumer with information in the consumer's credit file.

The new preemptive provisions of FACT cover the following:

Expanded obligations of financial institutions that furnish credit information to RAs.
Notification to consumers of reports of negative information.
Risk-based credit pricing programs.
Marketing solicitations that involve information from an affiliate.
Prevention of identity theft.
Other provisions, including the availability of free credit reports and disclosures of credit scores to consumers.

Expanded Obligations of Financial Institutions or Others that Furnish Credit Information to RAs
The FCRA prohibits a creditor or furnisher from reporting information to an RA with knowledge that the data was inaccurate. FACT expands that prohibition by modifying FCRA's language from "knows or consciously avoids knowing that the information is inaccurate" to "knows or has reasonable cause to believe that the information is inaccurate." This change in language is significant because the latter clause includes having specific knowledge other than allegations by the consumer that would cause a reasonable person to have substantial doubts about the accuracy of the information. Thus, a furnisher of information to RAs should have procedures in place to ensure that it does not report inaccuracies that it becomes aware of from any source—consumer or otherwise.

Also, FACT requires furnishers of information to RAs to establish reasonable policies and procedures to investigate consumer disputes or allegations of inaccurate credit data previously reported to RAs, including disputes that a furnisher receives directly from a consumer. Previously, under FCRA, furnishers were only required to investigate disputes or allegations that they received through a RA. Thus, with respect to allegations received directly from consumers, furnishers must now have procedures to:

Conduct an investigation of the disputed information provided by the consumer.
Review all relevant information provided by the consumer.
Report the results of the investigation to the RA.

Should an investigation of a dispute or allegation find inaccuracies, then the furnisher must promptly notify each RA to which the furnisher supplied information and provide any correction necessary to make the information accurate.

Notification to Consumers of Reports of Negative Information
FACT requires that financial institutions and other furnishers that report negative information to RAs provide the consumer with written notification that it has or will report negative information. The furnisher need provide only one notice to a consumer once it reports negative information. After that, a creditor or furnisher may submit additional negative information regarding the same account, same extension of credit, same transaction, or same customer without providing additional notices. The notice must be provided before or no later than 30 days after reporting the negative information to the RA.

Pending the issuance of final regulations, FACT appears to permit creditors and furnishers to comply with the negative information notification provision through a one-time standardized notice to all consumers prior to the reporting of negative information. However, creditors and furnishers should note that if the requisite notice is provided in advance, FACT stipulates that the notice may not be included with the initial Truth in Lending Act disclosure statement provided to the consumer.

Risk-Based Credit Pricing Programs
In addition to the notification requirement regarding negative information, FACT includes a notification requirement for financial institutions that use information in consumer credit reports in conjunction with risk-based pricing programs.⁵ The notice, which may be provided orally, should inform the consumer that information in his or her credit report has resulted in a higher cost of credit and should encourage the consumer to contact either the creditor or RA regarding the report. However, the notice need not be provided if (i) the consumer applied for material credit terms and was granted those terms or (ii) the financial institution or creditor has provided or will provide an adverse action notice pursuant to FCRA's existing provision regarding notice of adverse action.

Like the notification requirement regarding negative information, FACT appears to permit financial institutions to comply with the notification requirements through a one-time standardized notice to all consumer credit applicants during the application process.

Marketing Solicitations that Involve Information from an Affiliate
FCRA provides that affiliates may share non-experience information, including information in a credit report, with one another if such sharing is disclosed to a consumer and the consumer is provided a means to opt-out of such information sharing. FACT does not change this existing FCRA notice and opt-out provision.

However, FACT amends FCRA to restrict the use of marketing solicitations that are based on information received from an affiliate. Such information would include both non-experience information and experience information, including information in consumer credit reports, application information, and historical transaction information. The added restriction prevents an affiliate that receives information from using the information to make marketing solicitations without first providing the consumer with a notice, opportunity, and a relatively simple means to opt-out of receiving any marketing solicitations.

The restriction does not apply in the following circumstances:

A financial institution has a pre-existing business relationship with a consumer.
A financial institution's affiliate receives and uses information to perform servicing functions for the financial institution and the institution has an existing customer relationship with the consumer.
A financial institution receives a request from a consumer for information about products or services, or for solicitations from the institution regarding products or services.

Under FACT, the notice of a consumer's right to opt-out must meet the following standards:

The method for providing the notice must be simple.
The notice must be clear, conspicuous, and concise.
The notice must allow the consumer to prohibit all solicitations for marketing purposes.

If a consumer chooses to opt-out of receiving solicitations, then the financial institution must honor the consumer's request for a period of at least five years. After the five-year period has expired, and if the institution wants to begin sending the consumer solicitations, then the institution must provide the consumer with another notice and another opportunity to opt-out for another five-year period.

Prevention of Identity Theft
As already noted, FACT significantly amends FCRA to include several provisions to help prevent identity theft. Although the additional duties to comply with FACT's identity theft provisions fall largely to RAs, financial institutions that furnish information to RAs must perform additional duties as well.

FACT contains four provisions to help prevent identity theft.

Placing fraud alerts and other alerts on consumer credit report files.
Establishing red flag guidelines to identify possible identity theft.
Investigating changes of address.
Blocking information resulting from identity theft.

Placing Fraud Alerts. FACT stipulates that an RA must place a fraud alert on a consumer's credit report file at the request of a consumer. The fraud alert consists of a statement in the consumer's file that the consumer may be a victim of identity theft or other fraud.

The Act provides for two types of fraud alerts—initial alerts and extended alerts—as well as an active duty alert for military personnel.

An initial alert can last up to 90 days, and must be placed by an RA upon its receipt of a request from a consumer who asserts, in good faith, a suspicion that he or she has been or is about to become a victim of identity theft. FACT allows a consumer to specify a telephone number where the consumer may be contacted. Thereafter, any financial institution or other party that uses information in the consumer's credit report must contact the consumer at the telephone number specified and (i) verify the consumers identity and (ii) confirm that the credit application is not the result of identity theft.

Whenever an RA places an initial fraud alert on a consumer's credit report file, it must inform the consumer that he or she may request a free copy of his or her credit report within 12 months of the date of the alert.

An extended alert can last up to seven years, and must be placed by an RA upon its receipt of an identity theft report filed by the consumer with an appropriate federal, state, or local law enforcement authority, together with valid proof of the consumer's identity. Financial institutions or other users of information must, without fail, contact the consumer by telephone or another method designated by the consumer before using the information. Similar to an initial alert, the financial institution or other user contacting the consumer must verify the consumer's identity prior to a new extension of credit or other business transaction in the name of the consumer.

When an extended alert is placed on a consumer's record, RAs must inform the consumer of his or her right to two free copies of a credit report within a 12-month period. Also, FACT requires that a consumer who has an extended fraud alert on his or her consumer credit report file be excluded for five years from lists used to make prescreened offers of credit or insurance, unless the consumer requests otherwise.

FACT also provides for active duty alerts. An active duty alert, which has a minimum duration of one year, must be placed by an RA upon receipt of a request by and valid proof of identification of a consumer who is an active duty member of the military. A consumer with an active duty alert must be excluded for two years from lists used to make prescreened offers of credit or insurance.

Establishing Red Flag Guidelines. FACT directs the FRB, FTC, and other appropriate federal agencies to jointly establish guidelines for use in identifying patterns, practices, and forms of activity that indicate possible identity theft—so called "red flag" guidelines and regulations. The agencies should cooperate with one another to develop regulations that would require their supervised institutions to establish policies and procedures to implement the red flag guidelines.

In connection with the development of the red flag guidelines, the FRB, FTC, and other appropriate federal agencies also must consider a requirement that a consumer be given notice when a transaction occurs on a consumer account that has been inactive for more than two years.

Investigating Changes of Address. FACT directs the FRB, FTC, and other appropriate federal agencies to develop regulations that would require financial institutions and others that issue payment cards to investigate changes of address. Such investigations would address those instances when a card issuer receives a notice of a change of address for an existing account, and, within a relatively short period thereafter, receives a request for an additional replacement card.

Blocking Information Resulting From Identity Theft. Under FACT, RAs must block the reporting of information that a consumer identifies as having resulted from identity theft. In requesting an information block, the consumer must provide the RA with:

Valid proof of the consumer's identity.
A copy of an identity theft report filed with an appropriate law enforcement agency.
Identification of the information that resulted from the identity theft.

Upon receiving the consumer's notification, the RA must notify the furnisher of the information that:

The information may be the result of identity theft.
An identity theft report has been filed.
The RA has placed a block on the information.
The block was placed on the specified date.

Pending the issuance of final regulations, the financial institution that furnished the information to the RA has a duty and responsibility to modify, delete, or block the future reporting of information as appropriate. In particular, FACT contains provisions that require furnishers of information to RAs to have procedures in place to prevent so-called "re-pollution."

Other Provisions
In addition to the preceding provisions, FACT contains other provisions addressing:

The improvement of consumer credit report files.
The sharing of medical information by and among financial institutions.
The improvement of financial literacy.
The need for additional federal studies of credit reporting activities.

Noteworthy among these other provisions are requirements for each of the nationwide RAs to provide consumers with a free credit report annually and with credit score information upon request. In addition, FACT directs the FRB, FTC, and other appropriate federal agencies to issue regulations regarding proper disposal of consumer credit report information.

FACT also directs merchants and other parties that accept payment cards to truncate the account numbers on point-of-sale receipts given to account holders and not to show card expiration dates on the receipts. Financial institutions will also have to implement procedures to comply with FACT's provisions that require data records to be made available to victims of identity theft. In particular, an institution that extends credit to or transacts with an identity thief must, upon request, provide the victim of the theft with copies of transaction records, including any credit applications(s), evidencing unauthorized transactions under the institution's control.

Final Thoughts
The passage of FACT comes after many months of efforts by consumer groups and the financial services industry to have legislators address their concerns over credit reporting and identity theft issues. FACT provides consumers with expanded protections by improving access to and control over credit report information. Also, by generally preventing states from taking their own legislative action regarding identity theft issues and other credit reporting issues, FACT ensures consistent nationwide consumer protection in this emerging risk area. FACT's amendments to FCRA are considerable, placing many new responsibilities and duties on financial institutions, RAs, and others. While the federal agencies are currently in the process of writing rules and regulations to implement FACT's amendments, financial institutions should be as proactive as possible in their efforts to comply with the Act's expanded requirements.

If you have any questions about this article or FACT, please contact Supervising Examiner Robert W. Snarr, Jr. or Supervising Examiner John D. Fields through the Regulations Assistance Line at 215-574-6568.

¹ The Fair and Accurate Credit Transactions Act (Public Law No: 108-159).
² See Federal Reserve press release dated December 16, 2003.
³ See Federal Reserve press release dated February 5, 2004.
⁴ Other commentary about the Fair Credit Reporting Act may refer to a consumer reporting agency as a "CRA." Given the use of "CRA" to refer to the Community Reinvestment Act elsewhere in this publication, references to consumer reporting agencies in this article will use the acronym "RA."
⁵ Section 311(a) of FACT provides, in part, that "if any person uses a consumer report in connection with an application for, or a grant, extension, or other provision of credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person, based in whole or in part on a consumer report, the person shall provide an oral, written, or electronic notice to the consumer in the form and manner required by regulations prescribed in accordance with this subsection."

The views expressed in this article are those of the author and are not necessarily those of this Reserve Bank or the Federal Reserve System.

Compliance Corner: First Quarter 2004

As a Matter of FACT...Amendments to the Fair Credit Reporting Act

In This Issue

Contact Us