Compliance Corner: First Quarter 2005

Is Your Financial Institution Ready for Compliance with the FACT Act? Get the "FACTS"

by Eddie L. Valentine, Supervising Examiner

The Fair and Accurate Credit Transactions Act of 2003 (the FACT Act) amended the Fair Credit Reporting Act (FCRA) and created many provisions that impact the compliance examination process. To date, only one regulation related to the consumer compliance examination provisions in the FACT Act has been finalized. The FACT Act provision involving the notice of furnishing negative information had an effective date for compliance of December 1, 2004, and model notices have been issued under Regulation V, Fair Credit Reporting, to facilitate compliance. In addition, several other provisions of the FACT Act that do not require implementing regulations had effective dates of December 1, 2004 or earlier.

During 2005, the interagency FFIEC FCRA Examination Procedures will be substantively updated to reflect the new FACT Act requirements, including the self-executing provisions of the FACT Act. Until the FFIEC procedures are finalized, examiners will use the following interim guidance for reviewing compliance with the provisions that became effective on December 1, 2004. This guidance will be replaced with the formal FFIEC FCRA Examination Procedures upon their completion.

Interim Examination Procedures
Provisions that became effective on December 1, 2004 or earlier appear below in order of the FCRA section. Examination guidance for each provision appears in italics.

Protection of Medical Information (FCRA §604(g)(4); FACT Act §411). A financial institution that has received medical information shall not redisclose it to any other person, except as necessary to carry out the purpose for which the information was initially disclosed.

Ensure that the financial institution does not redisclose medical information except as allowed by the statute. This should be coordinated with the evaluation of the institution’s compliance with Regulation P, Privacy of Consumer Financial Information.

Fraud and Active Duty Alerts (FCRA §605A(h)(2)(B); FACT Act §112). Consumers who suspect that they may be the victims of identity theft may place initial or extended fraud alerts on their consumer reports. Members of the armed services that are called to active duty may also place active duty alerts on their accounts. These alerts are designed to prevent identity theft. No prospective user of a consumer report that includes an alert may establish a new credit plan or extension of credit in the name of the consumer, issue an additional card on an existing account, or increase a credit limit, unless the user follows effective policies and procedures to verify the consumer’s identity.
Review the financial institution’s procedures to ensure that when a consumer report containing such an alert is obtained, appropriate steps are taken to verify the consumer’s identity.
Rights for Identity Theft Victims (FCRA §609(e); FACT Act §151). Within 30 days after receiving a request from an identity theft victim, a business entity that has entered into a transaction with a person who has allegedly made an unauthorized use of the victim’s identity must provide copies of the application and the transaction records to the victim; federal, state, and/or local authorities specified by the victim; or any law enforcement agency investigating the identity theft and authorized by the victim to obtain such records. Prior to disclosing this information, the business entity generally must ensure that the person making the request provides appropriate identification to ensure that the business entity is disclosing this information to the actual victim.
Review the financial institution’s practices and procedures to ensure that information about fraudulent accounts or transactions is appropriately disclosed upon request and after submission of appropriate documentation by the requestor.
Disclosure of Credit Scores (FCRA §609(g); FACT Act §212). Any person who makes or arranges loans using consumer credit scores in connection with an application for a loan that is secured by 1-to-4 units of residential real property shall provide the following as soon as reasonably practicable: the exact text of the required notice found in FCRA §609(g)(1)(D) and FACT Act §212(c); the credit score and certain information about the score; and the name, address, and telephone number of each consumer reporting agency that provided a credit score used by the person in the transaction. This requirement applies only to loans that are for consumer purposes.
Ensure that the financial institution provides the appropriate credit score notice to consumers.
Notice by Debt Collectors Regarding Fraudulent Information (FCRA §615(g); FACT Act §155). This section applies to financial institutions that collect debts for third parties. If the collecting financial institution is notified that any information relating to the subject debt may be fraudulent or the result of identity theft, it must notify the third party of this fact and, upon request of the consumer, provide the consumer with all of the information to which the consumer would be entitled to dispute the debt.
Determine if the financial institution collects debts for third parties. If applicable, ensure policies and procedures are in place to notify third parties when the financial institution learns that the debt in question may be the result of identity theft.
Prevention of Re-Pollution of Consumer Reports (FCRA §§623(a)(6) and 615(f); FACT Act §154). Victims of identity theft may block a consumer reporting agency from including information about allegedly fraudulent accounts on their consumer reports. In turn, the consumer reporting agency will inform the furnisher of this information about the block. Furnishers must establish and follow reasonable procedures to ensure that this information is not refurnished to the consumer reporting agency, thus “re-polluting” the victim’s consumer report. This section of the FACT Act also prohibits a financial institution from selling, transferring, or placing for debt collection a debt caused by an identity theft.

Review the financial institution’s policies and procedures regarding (1) the furnishing of information to consumer reporting agencies to ensure that items disputed based on identity theft are not reported to the consumer reporting agency again and (2) the selling, transferring, or placing for debt collection debts that are caused by identity theft.

Notice of Furnishing Negative Information (FCRA §623(a)(7); FACT Act §217; 12 CFR 222). Financial institutions must provide consumers with a disclosure either before negative information is reported to a nationwide consumer reporting agency (Model Notice B-1) or within 30 days after reporting the negative information (Model Notice B-2). The disclosure need not be given each time negative information is provided, so long as it has been provided to the consumer at least once. The notice may not be included in the initial disclosures provided under Section 127(a) of the Truth in Lending Act.
Although use of model notices is not required, a financial institution is deemed to be in compliance with this section of the Act if the institution properly uses the notices set forth below.

Model Notice B–1
We may report information about your account to credit bureaus. Late payments, missed payments, or other defaults on your account may be reflected in your credit report.

Model Notice B–2
We have told a credit bureau about a late payment, missed payment, or other default on your account. This information may be reflected in your credit report.

Ensure that the required negative information notice is provided to consumers. Financial institutions have flexibility in complying with this provision by either providing an advance notice to consumers or notifying the consumer within 30 days after providing negative information to a nationwide consumer reporting agency. Some institutions may choose to provide the advance notice to all customers as an abundance of caution; however, the statute only requires that the notice be given to consumers about whom negative information is reported. Violations will only be cited if the institution reported negative information about a consumer after December 1, 2004, without providing the appropriate notice to the consumer.

Disclosure of Reinvestigation Results (FCRA §623(b); FACT Act §314(b)). Financial institutions must investigate errors that are reported by consumers regarding information that the financial institution has provided to a consumer reporting agency. If the financial institution cannot verify the accuracy of the information, then it must delete, modify, or block the information from reporting.
Ensure that the financial institution’s policies and procedures for furnishing data to consumer reporting agencies include provisions for prompt investigation of disputes and reporting of the outcome of investigations.

Final Remarks
Provisions of the FACT Act that do not require implementing regulations and the provision requiring the furnishing of negative information became effective December 1, 2004. Going forward, examinations will include reviews for compliance with those provisions.

Other FACT Act provisions require additional guidance that has not been finalized. Compliance examinations will not include reviews of these provisions until after the mandatory compliance dates, which will be set forth when the guidance is issued.

If you have any questions about the FACT Act, please contact either Supervising Examiner Eddie L. Valentine or Supervising Examiner John D. Fields through the Regulations Assistance Line at (215) 574-6568.

The views expressed in this article are those of the author and are not necessarily those of this Reserve Bank or the Federal Reserve System.

Compliance Corner: First Quarter 2005

Is Your Financial Institution Ready for Compliance with the FACT Act? Get the "FACTS"

In This Issue

Contact Us