2019-26669. Supervisory Highlights Consumer Reporting Special Edition, Issue 20 (Fall 2019)

AGENCY:

Bureau of Consumer Financial Protection.

ACTION:

Supervisory highlights.

SUMMARY:

The Bureau of Consumer Financial Protection (Bureau) is issuing its twentieth edition of its Supervisory Highlights. In this special issue of Supervisory Highlights, we report examination findings in the areas of consumer reporting and furnishing of information to consumer reporting companies, pursuant to the Fair Credit Reporting Act and Regulation V. The report does not impose any new or different legal requirements, and all violations described in the report are based only on those specific facts and circumstances noted during those examinations.

DATES:

The Bureau released this edition of the Supervisory Highlights on its website on December 9, 2019.

FOR FURTHER INFORMATION CONTACT:

David Wake, Senior Counsel, Office of Supervision Policy, at [phone]. If you require this document in an alternative electronic format, please contact [e-mail].

SUPPLEMENTARY INFORMATION:

1. Introduction

The Consumer Financial Protection Bureau (CFPB or Bureau) is committed to a consumer financial marketplace that is free, innovative, competitive, and transparent, where the rights of all parties are protected by the rule of law, and where consumers are free to choose the products and services that best fit their individual needs. To effectively accomplish this, the Bureau remains committed to sharing with the public key findings from its supervisory work to help industry limit risks to consumers and comply with Federal consumer financial law.

The findings included in this report cover examinations in the areas of consumer reporting and furnishing of information to consumer reporting companies (CRCs),^[1] pursuant to the Fair Credit Reporting Act (FCRA) and Regulation V.^[2] In March 2017, the CFPB published its first special edition of Supervisory Highlights dedicated to consumer reporting issues.^[3] This special edition of Supervisory Highlights reports on more recent supervisory findings in this area.

Recent supervisory reviews of compliance with the FCRA and Regulation V have identified new violations and compliance management system (CMS) weaknesses at institutions within the CFPB's supervisory authority. These institutions include CRCs that are larger participants in the consumer reporting market ^[4] as well as furnishers subject to the Bureau's supervisory authority. These furnishers include banks, mortgage servicers, auto loan servicers, student loan servicers, and debt collectors.

The information contained in Supervisory Highlights is disseminated to communicate the Bureau's supervisory expectations to CRCs and furnishers that those institutions comply with the applicable provisions of the FCRA and Regulation V. This document does not impose any new or different legal requirements. In addition, the legal violations described in this and previous issues of Supervisory Highlights are based on the particular facts and circumstances reviewed by the Bureau as part of its examinations. A conclusion that a legal violation exists on the facts and circumstances described here may not lead to such a finding under different facts and circumstances.

We invite readers with questions or comments about the findings and legal analysis reported in Supervisory Highlights to contact us at [e-mail].

2. Supervisory Observations at Furnishers

Furnishers of information play a crucial role in the accuracy and integrity of consumer reports when they provide information to CRCs. Inaccurate information from furnishers can lead to inaccurate reports and consumer and market harm. For example, inaccurate information on a consumer report can impact a consumer's ability to obtain credit or open a new deposit or savings account at a bank. Moreover, furnishers have an important role in the dispute process when consumers dispute the accuracy of information in their consumer reports. Consumers may dispute information that appears on their consumer report directly to furnishers (“direct disputes”) or indirectly through CRCs (“indirect disputes”). When furnishers receive direct or indirect disputes, they are required to investigate the disputes to verify the accuracy of the information furnished.^[5] A timely and responsive reply to a consumer dispute may reduce the impact inaccurate negative information in a consumer report may have on the consumer. The FCRA and Regulation V set forth requirements for furnishers concerning both accuracy and dispute handling. To ensure compliance with these requirements, Supervision regularly conducts reviews at furnishers subject to its supervisory authority.

In recent supervisory reviews, examiners found CMS weaknesses and violations of the FCRA and Regulation V. In such cases, the furnisher(s) have taken or are taking corrective action.

2.1 Reasonable, Written Policies and Procedures

Regulation V requires furnishers to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of the information relating to consumers that they provide to CRCs.^[6] Such policies and procedures must be appropriate to the nature, size, complexity, and scope of each furnisher's activities.^[7] Furnishers must consider and incorporate, as appropriate, the guidelines of appendix E to Regulation V when developing their policies and procedures.^[8] In a previous issue of Supervisory Highlights, we described supervisory findings of furnishers that violated these requirements.^[9] In recent supervisory reviews, we have identified further violations of the Regulation V requirement for reasonable written policies and procedures. In the section below, we have highlighted key findings according to the products for which information is being furnished, in keeping with the Regulation V requirement that the procedures be “appropriate to the nature, size, complexity, and scope of the furnisher's activities.”

2.1.1 Mortgage Furnishers

In one or more reviews of furnishers of mortgage loans, examiners found that the furnishers' policies and procedures were not appropriate to the nature, size, complexity, and scope of the furnisher's activities. For example, one or more furnishers maintained general FCRA-related policies and procedures that did not provide sufficient guidance for responding to disputes in a timely manner or reporting credit reporting changes in furnished accounts when the status of such accounts had changed. As a result of these findings, one or more furnishers are developing and implementing reasonable furnishing procedures governing the accurate reporting of accounts designed to ensure the timely update of information to reflect the current status of consumer accounts.

2.1.2 Auto Loan Furnishers

In one or more reviews of furnishers of auto loans, examiners found that the furnishers' policies and procedures did not provide sufficient guidance for conducting reasonable investigations of indirect disputes that contain allegations of identity theft. For example, the furnishers' policies and procedures did not specify that agents investigating disputes alleging identity theft should review internal records of fraud investigations before completing dispute investigations and responding to CRCs. As a result of these findings, one or more furnishers are developing and implementing policies and procedures with respect to identity theft disputes to ensure the furnisher conducts its investigation, including review of internal records, prior to responding to the CRC.

2.1.3 Debt Collection Furnishers

In one or more reviews of debt collection furnishers, examiners found that the furnishers' policies and procedures did not differentiate between FCRA disputes, FDCPA disputes, or validation requests. In this regard, the furnishers categorized and handled direct FCRA disputes, FDCPA disputes, and validation requests the same way and without consideration for the applicable regulatory requirements. Furthermore, the policies and procedures did not address the regulatory timeframes for conducting reasonable investigations of disputes, or for reporting the results of the investigations to the consumers or to CRCs, as appropriate. Instead, the policies and procedures provided general instructions on how to indicate that accounts are disputed and how to label dispute-related correspondence from consumers. The policies and procedures did not contain any substantive instructions on how to conduct investigations of disputed accounts. Following these findings, one or more furnishers are developing and implementing reasonable policies and procedures covering the steps necessary to conduct reasonable and timely investigations of disputes, as that term is defined in Regulation V.

2.1.4 Deposit Account Furnishers

Examiners found that one or more furnishers of deposit account information to specialty CRCs had no written policies or procedures for furnishing such information to specialty CRCs. In response to this finding, one or more deposit account furnishers are developing and implementing reasonable written policies and procedures regarding furnishing to specialty deposit CRCs.

Examiners also found that one or more deposit account furnishers did not have reasonable written policies and procedures regarding deposit account information. For example, policies and procedures did not require that the furnishers validate the data furnished to specialty deposit CRCs, causing the furnisher to inaccurately furnish consumers' account status information to one or more specialty CRCs. One or more deposit account furnishers are evaluating the effectiveness of existing policies and procedures regarding the accuracy and integrity of information furnished to nationwide specialty CRCs and develop new written policies where appropriate.

2.1.5 Improvements in Furnishing Policies and Procedures

In follow-up reviews at furnishers previously examined, examiners found that one or more furnishers had made significant improvements in furnishing policies and procedures. For example, one or more furnishers updated their policies and procedures to incorporate specific requirements to ensure dispute investigation agents conduct reasonable dispute investigations and document their work. Revised dispute investigation procedures include an extensive list of internal systems and sources that dispute agents must research when investigating a dispute. Updated procedures also dictate that the furnisher retains dispute investigation documentation and records, including imaged screenshots, for a minimum of seven years.

In another example of improved furnishing policies and procedures, examiners found that one or more deposit furnishers documented improved quality monitoring procedures to impose enhanced sampling and oversight procedures regarding furnished deposits information. Additionally, one or more furnishers improved procedures governing when to delete, update, and correct information in its records to avoid furnishing inaccurate information to specialty CRAs. One such new procedure required the furnisher to conduct a root-cause analysis of dispute results to ensure that when dispute investigations identify systemic errors, the furnisher corrects furnished data about other accounts that were also affected by similar errors.

2.2 Prohibition of Reporting Information With Actual Knowledge of Errors

The FCRA prohibits furnishers from furnishing any information relating to a consumer to any CRC if the furnisher “knows or has reasonable cause to believe that the information is inaccurate.” ^[10] However, a furnisher is not subject to this prohibition if it “clearly and conspicuously specifies to the consumer an address” at which consumers can send notices that specific information reported by the furnisher is inaccurate.^[11] CFPB examiners found that one or more furnishers furnished information they knew or had reasonable cause to believe was inaccurate. One or more furnishers reported thousands of accounts to one or more CRCs with inaccurate derogatory status codes. The accounts were furnished inaccurately because of coding errors. The furnishers had reasonable cause to believe the information was inaccurate because consumers filed disputes with one or more CRCs identifying the errors, and those disputes were forwarded to the furnishers for investigation. The furnishers, in investigating the disputes, failed to conduct root-cause analysis that would have identified the issue as a systemic source of inaccuracy. Further, the furnishers did not clearly and conspicuously specify to consumers an address at which consumers could send notices that furnished information was inaccurate. The furnishers provided an address to consumers for direct disputes, but that address was provided on the last page of lengthy consumer disclosures under a heading of “Additional Information and Use Disclosures” that followed topics such as “General Terms,” “Arbitration,” and “Privacy Notice.” Examiners concluded that these notices did not qualify as “clear and conspicuous.” After discovery of these inaccuracies, one or more furnishers implemented a program fix for the inaccurate coding issue and conducted a review of all furnished accounts to identify and correct the furnishing of all affected consumers.

2.3 Duty To Correct and Update Information

If a furnisher who “regularly and in the ordinary course of business furnishes information to one or more [CRCs] about the person's transactions or experiences with any consumer” has furnished to a CRC information that the furnisher determines is not complete or accurate, it shall promptly notify the CRC of that determination and provide to the CRC any corrections to that information, or any additional information, that is necessary to make the information provided to the CRC complete and accurate, and shall not thereafter furnish to the CRC any of the information that remains not complete or accurate.^[12]

The CFPB has identified violations of this provision in one or more recent furnisher reviews. For example, in one or more reviews of auto loan furnishers, examiners found that the furnishers failed to provide prompt notifications to CRCs of their determinations that information they had previously furnished was inaccurate because the furnishers had found that the loans had been opened as a result of identity theft. In such cases, the furnishers recorded the results of their investigations internally, but failed to make the corrections necessary to make the furnished information accurate. In response to these findings, one or more auto furnishers are developing and implementing policies and procedures to ensure that they promptly notify CRCs and/or correct information furnished, as appropriate, if they find that information they had previously furnished is inaccurate.

As another example, in one or more reviews of deposit account furnishers, examiners found that the furnishers failed to promptly correct and update deposit account information reported to nationwide specialty CRCs that the furnishers determined was not complete or accurate. Examiners identified several situations where the furnishers failed to promptly update or correct information. These situations included when consumers' charged-off balances had been discharged in bankruptcy, and when consumers paid their charged-off balances in full. In both situations, the furnishers updated their systems of record to indicate that the status of the accounts had changed but failed to update and correct the information furnished to CRCs about these accounts. In response to these findings, one or more furnishers are updating account information with the relevant CRCs for all impacted accounts and enhancing furnishing procedures.

In one or more follow up deposit account furnisher reviews to address the furnishers' prior failure to update and correct information when consumers paid-in-full or settled-in-full, examiners found one or more deposit account furnishers had improved furnishing activities to address the failure to correct and update information required by the FCRA. To address this violation and the matters requiring attention from the prior exam, one or more furnishers of deposit account information took several actions, including:

System changes that included the creation of coding processes to automated systems to identify consumers who paid in-full, and where appropriate, notification to CRCs of the corrected status of affected consumers;

Notification to CRCs of the correct status of paid-in-full and settled-in-full consumer accounts;

Improved tracking of paid-in-full and settled-in-full consumers and the establishment of a trigger to update the CRCs once final payment is made without requiring consumer to notify the furnisher;

Enhanced policies and procedures and new policies and procedures to adhere to the requirements of the FCRA and Regulation V, including modification of standards for reporting fraud or account abuse and use of appropriate closure codes; and

Improved dispute monitoring and tracking, as well as analysis of disputes to improve the accuracy and integrity of information furnished to CRCs.

One or more deposit account furnishers adequately addressed the matters requiring attention from the prior exam(s) and properly notified CRCs of the correct status of all paid in full and settled in full accounts.

2.4 Duty To Provide Notice of Delinquency of Accounts

The date of first delinquency is important for CRCs, creditors, and consumers because it determines when information on a consumer report becomes obsolete and may no longer be reported.^[13] The FCRA requires furnishers of information regarding delinquent accounts to report the date of delinquency to the CRC within 90 days.^[14] The FCRA specifies that the date of first delinquency reported by the furnisher “shall be the month and year of the commencement of the delinquency on the account that immediately preceded the action.” ^[15]

In one or more reviews, furnishers reported the incorrect date of first delinquency. For example, one or more furnishers of auto loans furnished the date of repossession of the collateral vehicle, rather than the date of first delinquency. The date of repossession at this furnisher was several months after the date of first missed payment.

2.5 Obligations Upon Notice of Dispute

Pursuant to the FCRA and Regulation V, consumers can file disputes concerning the accuracy of information contained in a consumer report with the CRCs as well as directly with the furnisher of that information.^[16] Whether filed directly with the furnisher or indirectly through a CRC, the furnisher must conduct a reasonable investigation of the dispute.^[17] Further, for direct disputes, the furnisher must complete its investigation of the dispute and respond to the consumer before the expiration of the time period under section 611(a)(1) of the FCRA.^[18] Finally, if the furnisher determines that a direct dispute is frivolous or irrelevant, it must provide notice of that determination to the consumer.^[19]

2.5.1 Duty To Conduct Reasonable Investigation of Dispute

For disputes filed directly with furnishers, Regulation V requires furnishers to conduct a reasonable investigation with respect to the disputed information and review all relevant information provided by the consumer with the dispute notice.^[20] Examiners found one or more furnishers violated these provisions when the furnishers failed to investigate disputes submitted by consumers. At one or more furnishers, backlogs of thousands of direct disputes accumulated in document processing queues and were not investigated or responded to at all. When the furnishers discovered the backlogs, the furnishers responded to the disputes pursuant to methodologies that broadly categorized the backlogged account correspondence, which resulted in the furnishers failing to undertake individual investigation of the disputes in the backlogs.

For indirect disputes filed with CRCs, the FCRA requires that, upon receiving notice of the dispute from the CRC, the furnisher must conduct an investigation with respect to the disputed information and review all relevant information provided by the CRC.^[21] The standard for investigation of indirect disputes is, like direct disputes, that the furnisher's investigation must be reasonable.^[22] Examiners found one or more furnishers violated these provisions when the furnishers responded to CRC notices of disputes without verifying the accuracy of the disputed information but instead with instructions to the CRC that the consumer should contact the furnisher directly and that the disputed information should not be deleted. In response to these findings, one or more furnishers are developing dispute handling policies and procedures to ensure the investigation of disputes is in accordance with the requirements of the FCRA.

In another example, one or more furnishers failed to conduct reasonable investigations of indirect disputes where the disputes alleged identity theft. The furnishers responded to such disputes and verified the disputed information as accurate without reviewing their own system records as part of the investigation. Had the furnishers reviewed their own records, examiners found, they would have seen that some of the disputed accounts were, in fact, the result of identity theft. In response to these findings, one or more furnishers are developing and implementing policies and procedures with respect to indirect identity theft disputes to ensure that the furnishers conduct their investigation of the dispute, including a review of internal records, prior to responding to the CRC.

2.5.2 Duty To Complete Dispute Investigations Timely

After receiving a dispute notice from a consumer, a furnisher is required under Regulation V to complete a reasonable investigation and report the results of the investigation to the consumer within the timeframe required, which is generally 30 days but can be extended up to 45 days in limited circumstances.^[23]

One or more furnishers failed to complete dispute investigations within this timeframe, resulting in delayed notice to consumers of dispute results as well as delayed deletion of delinquencies from consumers' credit reports. In one or more examinations, examiners found system design flaws—including coding errors and poor work stream management that resulted in a backlog of complaints that were not investigated or responded to in a timely manner. At one or more furnishers, examiners also identified inadequate control policies, poor resource allocation, and weak oversight that led to the results of dispute investigations not being sent to consumers. In response to these findings, one or more furnishers are updating policies and procedures, improving staff training, and implementing software enhancements.

2.5.3 Duty To Notify Consumer of Determination That Dispute Is Frivolous or Irrelevant

When consumers file disputes directly with a furnisher, Regulation V allows the furnisher to decline to investigate the dispute if the furnisher has “reasonably determined that the dispute is frivolous or irrelevant.” ^[24] A dispute qualifies as “frivolous or irrelevant” if (i) the consumer did not provide sufficient information to investigate the disputed information, (ii) the consumer's dispute is substantially the same as a dispute previously submitted by the consumer, and the furnisher has already investigated the dispute and responded as required, or (iii) an exception applies to the dispute investigation requirement.^[25] If a furnisher determines that the dispute is frivolous or irrelevant, the furnisher must provide notice to consumers of its determination (“frivolousness notices”).^[26] Furnishers must notify the consumers of such determinations no later than five business days after the furnishers made the determination by mail or, if authorized by the consumer for that purpose, by any other means available to the furnisher.^[27]

Examiners found that one or more furnishers failed to provide frivolousness notices to consumers when the furnisher determined that the consumers' disputes were frivolous or irrelevant when the furnisher believed the disputes were from credit repair organizations. When agents for one or more furnishers determined that disputes were sent by a credit repair agency, the disputes would be discarded as frivolous. Although these disputes were considered frivolous, no frivolousness notices were sent to consumers.

Examiners also found one or more furnishers failed to send frivolousness notices for consumer disputes when they believed the disputes were the same as another previously submitted dispute by or on behalf of consumers that had already been investigated and addressed. Although one or more furnishers had a policy stating that consumers must be notified within five days of determining that the dispute is frivolous, one or more furnishers failed to provide such notifications to consumers.

In addition to requiring that the furnisher send frivolousness notices, Regulation V also requires furnishers to include the reasons for determinations that disputes are frivolous and identify any information required to investigate the disputed information.^[28] Examiners found that one or more furnishers failed to consistently send frivolousness notices and failed to communicate the reasons for such determinations to the consumers. Instead, one or more furnishers simply provided consumers with letters stating that there would be no further correspondence unless the consumers provided new information. The letters did not include the reason for the frivolousness determination and did not identify information required to investigate the disputed information as required by Regulation V. In response to these findings, one or more furnishers updated, documented and implemented policies and procedures to ensure they respond to all disputes, including those determined to be frivolous, to ensure compliance with legal requirements.

3. Supervisory Observations at Consumer Reporting Companies

Participants in the larger participant market for consumer reporting include nationwide consumer reporting companies as well as some consumer report resellers and specialty consumer reporting companies.^[29] Recent supervisory reviews of CRCs have evaluated compliance with FCRA provisions regarding the CRC's procedures to ensure maximum possible accuracy of information, as well as provisions regarding permissible purpose, restriction of information resulting from identity theft, and dispute investigation obligations.^[30] Examiners identified violations and weaknesses in procedures associated with these FCRA provisions.

As a result of these reviews, CRCs have continued to make improvements to procedures regarding the accuracy of information contained in consumer reports. CRCs have also improved procedures to monitor users to help ensure that consumer reports are not furnished to users when the CRC has reasonable grounds for believing the user lacks a permissible purpose. CRCs have also implemented improvements in procedures to block information that a consumer has identified as resulting from an alleged identity theft and reasonably to investigate and respond to disputes from consumers regarding the accuracy or completeness of information in consumer files. The following sections discuss the observations in these areas at CRCs and the improvements made by these entities following these reviews.

3.1 Reasonable Procedures To Assure Maximum Possible Accuracy

The FCRA states that “Inaccurate credit reports directly impair the efficiency of the banking system. . .” and that CRCs “have assumed a vital role in assembling and evaluating consumer credit and other information on consumers.” ^[31] In recognition of this core concern with accuracy in consumer reports, the FCRA requires that, “[w]henever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” ^[32]

Examiners found that one or more nationwide specialty CRCs failed to follow reasonable procedures to assure maximum possible accuracy by exempting certain furnishers from a data validation testing procedure without a valid basis. The CRCs had implemented an accuracy procedure under which the CRCs validated the data reported by direct furnishers on an annual basis. However, the CRCs' procedure exempted from this validation procedure smaller direct furnishers that contributed low volume of data. Further, the CRCs procedure also exempted all indirect furnishers, who contributed data to the CRCs through a reseller. Examiners concluded that the exemption of these low-volume direct furnishers and indirect furnishers posed an unreasonable risk of producing errors in consumer reports. In response to these findings, one or more CRCs are conducting data validation testing on all direct and indirect furnishers, without exceptions, and will be reporting the results of such testing to the CFPB.

Examiners also found that one or more nationwide specialty CRCs failed to follow reasonable procedures to assure maximum possible accuracy by failing to properly process files furnished to the CRCs by certain furnishers. The CRCs failed to fully process incoming data files from multiple data furnishers on several occasions. The files that were not properly processed resulted in the inclusion of inaccurate, derogatory information in consumer reports. Further, for a period of more than 12 months, the CRCs failed to receive any data from one or more furnishers because the furnishers had applied an incorrect technology parameter, preventing the furnishers' data files from reaching the CRCs. This failure to receive updated data resulted in inaccurate, derogatory information being included in consumer reports. Subsequent to the discovery of these errors, one or more CRCs have implemented data monitoring procedures that are designed to notify furnishers of such data processing errors.

3.2 Duty To Limit the Furnishing of Consumer Reports to Permissible Purposes

The FCRA states that “there is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy.” ^[33] The FCRA protects consumers' privacy, in part, by stating that CRCs may furnish consumer reports only to persons who have a permissible purpose to use or obtain the information in the report.^[34] Further, the FCRA requires CRCs to maintain reasonable procedures designed to limit the furnishing of consumer reports to users with a permissible purpose.^[35]

Supervision conducted one or more reviews of CRCs to evaluate the entities' permissible purpose procedures. In these reviews, examiners found that one or more CRCs have procedures to verify the identity and permissible purposes of new prospective users, which one or more CRCs refer to as “credentialing.” Further, examiners found that one or more CRCs have procedures to monitor that users have a permissible purpose when users obtain consumer reports.

However, examiners also found CMS weaknesses in one or more CRCs' permissible purpose procedures. For example, one or more CRCs lacked procedures to conduct proactive re-credentialing reviews of its users. Under such a re-credentialing review, the CRCs review existing users to confirm that the user continues to have a permissible purpose to use and obtain consumer reports. Examiners found that the CRCs had procedures to conduct re-credentialing reviews of users only when users notified the CRCs of a change in ownership, name, status, or nature of business or if the CRCs' monitoring identified a specific potential permissible purpose violation by a user. The CRCs did not, however, have a procedure to review the credentialing of users based on the length of time since the user was previously reviewed. As a result of these findings, one or more CRCs are implementing proactive re-credentialing policies and procedures that consider factors such as the time since a user was last credentialed for permissible purpose.

Examiners also found CMS weaknesses in the monitoring procedures at one or more CRCs regarding permissible purpose. For example, one or more CRCs failed to monitor users or resellers that requested the CRCs delete large numbers of hard inquiry records from consumer reports. When users obtain consumer reports from CRCs, the CRCs document that event by entering an inquiry record in the relevant consumer's file. Depending on the user's permissible purpose, the inquiry may be visible for up to a year to other users/creditors that obtain the consumer's report as well as being visible to the consumer; or instead it may be visible only to the consumer.³⁶ When a record of an inquiry is visible to other creditors, it is known as a “hard inquiry” and when it is visible only to the consumer, it is known as a “soft inquiry.” One or more CRCs have procedures that allow users to request that the CRCs delete hard inquiries from consumer reports, usually by converting them into soft inquiries. Users may request such deletions to protect consumers who may be victims of identity theft. For example, if a consumer notifies a creditor that an account was opened in his or her name due to fraud or identity theft, the creditor may, in addition to closing the account, contact the CRCs and request that the CRCs delete the hard inquiry from the consumers' credit report. But users may also ask that inquiries be deleted because the user did not have a permissible purpose to obtain the report. Examiners found that one or more CRCs had no procedure for monitoring the users who requested such deletions at higher rates than usual, which may be a risk indicator that a user is obtaining consumer reports without any permissible purpose. As a result of these findings, one or more CRCs are enhancing permissible purpose monitoring systems to include user inquiry change or deletion request volume as a potential risk area for investigation of user permissible purpose.

3.3 Blocking Information Resulting From Identity Theft

The FCRA requires that, unless an exception applies, a CRC must “block the reporting of any information in the file of a consumer that the consumer identifies as information that resulted from an alleged identity theft” provided that the consumer provides required information.^[37] The CRC is then required to promptly notify the furnisher of the information identified by the consumer.^[38] The CRC may decline to block the information, or may rescind a block, if the CRC “reasonably determines” that the consumer requested the block in error, based on a material misrepresentation of the facts, or the consumer obtained goods, services, or money as a result of the transaction.^[39] Finally, if the CRC determines to decline to block the information requested by the consumer, the CRC must notify the consumer promptly of the determination in writing or, if authorized by the consumer for that purpose, by any other means available to the CRC.^[40]

Examiners found that one or more nationwide specialty CRCs violated the requirements of this provision of the FCRA. When consumers submitted an identity theft block request with all required underlying documentation, the CRCs forwarded the information to furnishers and relied on the furnishers' response without making an independent determination, even in cases where the furnisher stated no block should be applied. Therefore, examiners concluded that the CRCs did not reasonably determine to decline the block and on what basis, as required by the statute. Following this finding, one or more nationwide specialty CRCs are changing procedures to the identity-theft block provisions of the FCRA. These changes include adopting new policies and procedures that require that the CRCs block the identified information within four business days of receiving a valid identity theft report. Revised procedures also included that for any identity theft block request that the CRCs declines or rescinded, the CRCs includes documentation of the rationale for denying or rescinding the block to ensure that decisions can be monitored and audited for compliance with the FCRA.

3.4 Dispute Investigation

Supervision has continued its focus on reviewing CRCs' compliance with the provisions of the FCRA governing consumer disputes. In previous issues of Supervisory Highlights, we discussed findings at one or more CRCs regarding violations of several provisions in this area.^[41] The FCRA right to dispute inaccurate information and have that dispute be reasonably investigated by the CRC and relevant furnisher is a key consumer protection in the statute. These protections recognize that consumers may identify inaccuracies in their own reports and sets out procedures that CRCs must follow before allowing such information to continue to be reported.

In recent reviews, examiners have identified new violations of several sub-sections of this area of the FCRA. These new violations include failures by CRCs to conduct reasonable dispute investigations, breakdowns in the required notification procedures to furnishers about disputes, failures of CRCs to provide notices of results to consumers, and failure of resellers to convey notice of disputes to CRCs that provided the disputed information.

3.4.1 Duty To Conduct a Reasonable Reinvestigation

The FCRA requires that when a consumer disputes the completeness or accuracy of an item of information in their file, the CRC must “conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item from the file. . . .” ^[42]

Examiners found that one or more CRCs systematically violated this requirement by failing to initiate investigations after notice of the dispute. When the CRCs received disputes related to identity theft or fraud via telephone, they instructed consumers to submit the dispute in writing and did not initiate investigations until the consumer resubmitted in written form. Examiners concluded that the FCRA does not permit a CRC to decline to investigate disputes in this manner. According to the FCRA, the CRC must conduct a dispute investigation when it receives notice of the dispute information. As a result of these findings, one or more CRCs enhanced their dispute resolution process by updating policies, procedures, and training materials, and requiring agents to initiate investigations of all disputes received via telephone.

The FCRA also requires that, in conducting its dispute investigation, the CRC must “review and consider all relevant information submitted by the consumer . . . with respect to such disputed information.” ^[43] Examiners found that one or more CRCs failed to review and consider all such relevant information. The CRCs relied on the furnisher's response in validating information from a dispute, without independently considering the relevant information or documentation provided by the consumer when that information called into question the accuracy or validity of the information provided by the furnishers. In response to these findings, one or more CRCs updated procedures to more clearly describe that agents must review all relevant information the consumer provided. However, in a follow-up review at one or more CRCs, examiners found that these revised procedures were not fully implemented, causing the CRCs to continue to fail to review and consider all relevant information provided by consumers in support of disputes. The Bureau will continue to monitor compliance in this area.

The FCRA generally requires that the CRCs' dispute investigations must be completed “before the end of the 30-day period beginning on the date on which the agency receives the notice of dispute from the consumer or reseller.” ^[44] Examiners found that one or more CRCs failed to complete the investigation within this 30-day timeframe. The CRCs incorrectly recorded the date of disputes filed on weekends, holidays, and after-hours. These disputes were incorrectly recorded in systems as being filed the next business day. As a result of these findings, one or more CRCs took action to correct the system logic and reassess those disputes.

3.4.2 Duty To Provide Prompt Notice of Dispute to Furnisher

The FCRA requires that when a CRC receives a notice of a dispute from a consumer, the CRC must “provide notification of the dispute to any person who provided any item of information in dispute. . . .” ^[45] This notice must be provided “[b]efore the expiration of the 5-business-day period beginning on the date on which a [CRC] receives notice of the dispute. . . .” ^[46]

Examiners found that one or more CRCs violated this provision of the FCRA when they failed to notify furnishers of a consumer's dispute within five business days of receiving a dispute. This violation occurred in thousands of disputes over several months. This violation was caused by lack of adequate staffing at the CRCs and was not detected by the CRCs' compliance monitoring. As a result of the examination findings, the CRCs developed and implemented dispute investigation procedures to ensure agents provide required notices to furnishers and forward all relevant information regarding the dispute within the mandatory time periods.

3.4.3 Duty To Notify Furnisher That Inaccurate, Incomplete, or Unverified Information Has Been Modified or Deleted

When a CRC has completed its dispute investigation, if the CRC finds that any disputed information is inaccurate or incomplete or unable to be verified, the FCRA requires the CRC to “promptly notify the furnisher of that information that the information has been modified or deleted from the file of the consumer.” ^[47]

In one or more reviews of nationwide specialty CRCs, examiners identified instances where one or more specialty CRCs failed to notify furnishers that information from the consumer's file had been modified or deleted after an investigation. In these instances, one or more CRCs were informed by the furnisher that a modification or deletion was necessary. One or more specialty CRCs investigation agents then modified or deleted the incorrect information but failed to inform the furnisher of the action taken, as required by the FCRA. In other instances, the information was internally resolved in the consumer's favor by one or more specialty CRCs but either the CRCs did not provide the notice to the furnishers of the modification or deletion, or they did not provide “prompt” notice to the furnisher required by the FCRA. As a result of these findings, one or more specialty CRCs developed and implemented dispute investigation procedures to ensure agent provide the required notice consistent with the requirements in the FCRA.

Additionally, examiners found that one or more CRCs failed to promptly send furnishers notices when investigations found that information was not accurate and information was changed in the consumer's file. One or more CRCs admitted that they failed to transmit approximately 2.7 million notices over a period of approximately two months. The cause for the failure was a programming error. This failure primarily affected consumers who submitted direct disputes to furnishers but some consumers who submitted indirect disputes to CRCs were also affected. As a result of this finding, one or more CRCs are fixing the programming error and enhancing their internal monitoring to avoid future issues of this type.

3.4.4 Duty To Provide Consumer With Written Notice of Results of Reinvestigation

The FCRA requires that, upon completion of the reasonable reinvestigation, the CRC must provide written notice of the results to the consumer not later than five business days after completion of the reinvestigation.^[48] Examiners found that one or more CRCs failed to send consumers results notices as required when the consumer sent the CRCs a dispute that was not accompanied by a consumer identification and certification form. In such cases, the CRCs resolved the dispute and, where necessary updated its records, but did not send the consumer the required notice of results. In response to these findings, one or more CRCs are developing and implementing policies and procedures to send consumers notifications of the results of disputes even when the consumer did not provide a consumer identification and certification form with the dispute.

3.4.5 Duty of Reseller To Convey Notice of Dispute to the CRC That Provided the Reseller With the Information That Is Subject of the Dispute

The FCRA dispute provisions provide direction to resellers upon receipt of a dispute from a consumer. These requirements include, where applicable, providing notice of the dispute to the CRC that provided the reseller with the disputed information. “If a reseller receives a notice from a consumer of a dispute concerning the completeness or accuracy of any item of information contained in a consumer report on such consumer produced by the reseller, the reseller shall” determine whether the item of information is incomplete or inaccurate as a result of an act or omission of the reseller within five business days.^[49] If the reseller determines that the disputed information is not incomplete or inaccurate as a result of an act or omission of the reseller, the reseller must convey the notice of the dispute, together with all relevant information provided by the consumer, to each CRC that provided the reseller with the information that is the subject of the dispute.^[50]

Examiners found that one or more resellers, after determining that disputed information was not incomplete or inaccurate as a result of an act or omission of the resellers, failed to convey to the CRCs that provided the information the notice of the dispute together with all relevant information provided by the consumer. In response to these findings, one or more resellers developed and implemented dispute investigation procedures designed to ensure agents provide required notice of disputes to CRCs that provided the information to the reseller.

In follow-up reviews, examiners found that one or more resellers developed and implemented enhanced procedures designed to ensure that the reseller(s) promptly conveyed notice of disputes the reseller received to the CRC that provided the reseller with the disputed information.

4. Conclusion

The Bureau will continue to publish Supervisory Highlights to aid Bureau-supervised entities in their efforts to comply with Federal consumer financial law. The report shares information regarding general supervisory and examination findings regarding the FCRA and Regulation V (without identifying specific institutions). This information is shared, in part, to communicate the Bureau's supervisory expectations to CRCs and furnishers that those institutions comply with the applicable provisions of the FCRA and Regulation V.

Supervision's work in the consumer reporting market is ongoing and remains a high priority. As detailed in this report, CFPB examiners have continued to identify violations and CMS weaknesses regarding critical FCRA and Regulation V protections. However, examiners have also observed significant improvements in these areas, including continued investment in FCRA-related CMS. Supervision will continue to conduct reviews at CRCs, including resellers, as well as at furnishers and users of consumer reports within our supervisory jurisdiction.

Dated: November 30, 2019.

Kathleen L. Kraninger,

Director, Bureau of Consumer Financial Protection.

Footnotes

1.  The term “consumer reporting company” means the same as “consumer reporting agency,” as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x).

2.  15 U.S.C. 1681 et seq. and 12 CFR part 1022.

3.  CFPB, Supervisory Highlights (Winter 2017), available at https://files.consumerfinance.gov/​f/​documents/​201703_​cfpb_​Supervisory-Highlights-Consumer-Reporting-Special-Edition.pdf.

4.  Larger participants in the consumer reporting market are defined in 12 CFR 1090.104.

5.  15 U.S.C. 1681s-2(a)(8), 15 U.S.C. 1681s-2(b); 12 CFR 1022.43.

6.  12 CFR 1022.42(a).

7.  Id.

8.  12 CFR 1022.42(b).

9.  CFPB, Supervisory Highlights, Winter 2017, at 13-17 (March 2017).

10.  15 U.S.C. 1681s-2(a)(1)(A).

11.  15 U.S.C. 1681s-2(a)(1)(C).

12.  15 U.S.C. 1681s-2(a)(2)(B).

13.  15 U.S.C. 1681c(a)-(b). Information may be reported if certain exceptions specified in the statute apply.

14.  15 U.S.C. 1681s-2(a)(5)(A). This provision applies to accounts being placed for collection, charged to profit or loss, or subjected to similar action.

15.  Id.

16.  Disputes filed with CRCs are governed by 15 U.S.C. 1681i and 1681s-2(b). Disputes filed directly with the furnisher are governed by 15 U.S.C. 1681s-2(a)(8) as implemented by Regulation V, 12 CFR 1022.43.

17.  15 U.S.C. 1681s-2(b)(1)(A) (indirect disputes); 12 CFR 1022.43(e)(1) (direct disputes).

18.  15 U.S.C. 1681s-2(a)(8)(E)(iii). See also 15 U.S.C. 1681i(a)(1).

19.  15 U.S.C. 1681s-2(a)(F)(ii); 12 CFR 1022.43(f)(2).

20.  12 CFR 1022.43(e)(1-2).

21.  15 U.S.C. 1681s-2(b)(1)(A)-(B).

22.  See, e.g., Johnson v. MBNA Am. Bank, 357 F.3d 426, 430-31 (4th Cir. 2004) (holding that the furnisher, after receiving notice of a consumer dispute, must conduct a reasonable investigation to determine whether the disputed information can be verified).

23.  15 U.S.C. 1681s-2(a)(8)(E)(iii); 12 CFR 1022.42(e)(3). See also 15 U.S.C. 1681i(a)(1).

24.  15 U.S.C. 1681s-2(a)(8)(F); 12 CFR 1022.43(f)(1).

25.  15 U.S.C. 1681s-2(a)(8)(F)(i); 12 CFR 1022.43(f)(1)(i)-(iii).

26.  15 U.S.C. 1681s-2(a)(8)(F)(ii); 12 CFR 1022.43(f)(2).

27.  Id.

28.  15 U.S.C. 1681s-2(a)(8)(F)(iii); 12 CFR 1022.43(f)(3).

29.  The term “consumer reporting company” means the same as “consumer reporting agency,” as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x). The term “reseller” is defined in 15 U.S.C. 1681a(u).

30.  FCRA obligations regarding accuracy procedures are detailed at 15 U.S.C. 1681e(b); the permissible purpose provisions are detailed at 15 U.S.C. 1681b and 15 U.S.C. 1681e(a); the ID theft block provisions are detailed at 15 U.S.C. 1681c-2; and the dispute process requirements applicable to CRCs are detailed at 15 U.S.C. 1681i.

31.  15 U.S.C. 1681(a)(1)-(3).

32.  15 U.S.C. 1681e(b).

33.  15 U.S.C. 1681(a)(4).

34.  15 U.S.C. 1681b(a).

35.  15 U.S.C. 1681e(a).

36.  The CRC must disclose to the consumer the identity of all users who obtained that consumer's report, pursuant to 15 U.S.C. 1681g(a)(3). For more information about the differences between hard inquiries and soft inquiries, see CFPB, Key Dimensions and Processes in the U.S. Credit Reporting System, at 9 (Dec. 2012).

37.  15 U.S.C. 1681c-2(a).

38.  15 U.S.C. 1681c-2(b).

39.  15 U.S.C. 1681c-2(c).

40.  15 U.S.C. 1681c-2(c)(2).

41.  See, e.g., CFPB, Supervisory Highlights, Winter 2017, at 9-11 (March 2017).

42.  15 U.S.C. 1681i(a)(1)(A).

43.  15 U.S.C. 1681i(a)(4).

44.  15 U.S.C. 1681i(a)(1)(A). Note that the 30-day period may be extended for an additional 15 days if the CRC receives information from the consumer during the 30-day period that is relevant to the reinvestigation. 15 U.S.C. 1681i(a)(1)(B).

45.  15 U.S.C. 1681i(a)(2)(A).

46.  Id.

47.  15 U.S.C. 1681i(a)(5)(A)(ii).

48.  15 U.S.C. 1681i(a)(6)(A).

49.  15 U.S.C. 1681i(f)(2)(A).

50.  15 U.S.C. 1681i(f)(2)(B)(ii).