2024-09712. Supervisory Highlights, Issue 32, Spring 2024

AGENCY:

Consumer Financial Protection Bureau.

ACTION:

Supervisory Highlights.

SUMMARY:

The Consumer Financial Protection Bureau (CFPB or Bureau) is issuing its thirty-second edition of Supervisory Highlights.

DATES:

The findings in this report cover select examinations in connection with credit reporting and furnishing that were completed from April 1, 2023, through December 31, 2023.

FOR FURTHER INFORMATION CONTACT:

Jaclyn Sellers, Senior Counsel, at [phone]. If you require this document in an alternative electronic format, please contact [e-mail].

SUPPLEMENTARY INFORMATION:

1. Introduction

Credit reporting is critical to consumers' ability to access credit and other products and services and often is used as a factor in rental and employment determinations. Accuracy in consumer reports is of vital importance to the credit reporting system and to consumers. Inaccurate information on a consumer report can have significant consequences for consumers and may, among other things, lead them to receive products or services on less favorable terms or impede their ability to access credit or open a bank account.

Inaccuracy in the credit reporting system is a long-standing issue that remains a problem today. Accordingly, the CFPB continues to prioritize examinations of consumer reporting companies (CRCs) and furnishers. CRCs are companies that regularly engage in whole or in part in the practice of assembling or evaluating information about consumers for the purpose of providing consumer reports to third parties.^[1] Furnishers are entities, such as banks, loan servicers, and others, that furnish information to the CRCs for inclusion in consumer reports.

CRCs and furnishers play a crucial role in ensuring the accuracy and integrity of information contained in consumer reports. They also have an important role in the investigation of consumer disputes relating to the accuracy of information in consumer reports. The Fair Credit Reporting Act (FCRA) ^[2] and its implementing regulation, Regulation V,^[3] subject CRCs and furnishers to requirements relating to their roles in the credit reporting system, including the requirement to reasonably investigate disputes and certain accuracy-related requirements. The FCRA and Regulation V also impose obligations in connection with, among other things, consumer-alleged identity theft and—most recently—adverse information resulting from human trafficking including on consumer reports of human-trafficking victims.

In recent reviews of CRCs, examiners have continued to find deficiencies in CRCs' compliance with the accuracy and identity theft requirements of the FCRA and Regulation V.^[4] For example, examiners found some CRCs were engaged in the practice of automatically declining to implement identity theft blocks upon receipt of the requisite documentation based on overbroad disqualifying criteria and without an individualized determination that there is a statutory basis to decline the block, in violation of the FCRA. Examiners also found some CRCs violated Regulation V's human trafficking requirements, effective as of July 25, 2022, by failing to timely block, or in some cases failing to block all, adverse items of information identified by the consumer as resulting from human trafficking.

In recent reviews of furnishers, examiners have continued to find deficiencies in furnishers' compliance with the accuracy and dispute investigation requirements of the FCRA and Regulation V. Examiners found several furnishers violated the FCRA duty to promptly update or correct information determined to be incomplete or inaccurate, including, for example, by continuing to report fraudulent accounts to CRCs as valid ( i.e., non-fraudulent) accounts for several years after determining the accounts were fraudulent. Examiners also found that some furnishers violated the FCRA, after receiving an identity theft report from a consumer at the appropriate address, by continuing to furnish information identified in the report as resulting from identity theft without the furnishers knowing or being informed by the consumer that the information was, in fact, correct. The findings in this report cover select examinations in connection with credit reporting and furnishing that were completed from April 1, 2023, through December 31, 2023. To maintain the anonymity of the supervised institutions discussed in Supervisory Highlights, references to institutions generally are in the plural and related findings may pertain to one or more institutions.

2. Supervisory Observations

2.1 Consumer Reporting Companies

In recent reviews of CRCs, examiners found deficiencies in CRCs' compliance with FCRA and Regulation V identity theft block, human trafficking submission and accuracy requirements.

2.1.1 CRC Duty To Block the Reporting of Information Resulting From an Alleged Identity Theft

The FCRA requires CRCs to block the reporting of any information in a consumer's file that the consumer identifies as information that resulted from an alleged identity theft not later than four business days after the CRC receives certain documentation relating to the alleged identity theft. Such documentation includes appropriate proof of the consumer's identity, a copy of an identity theft report, identification of the information that resulted from the alleged identity theft, and a statement by the consumer that such information does not relate to any transaction by the consumer.^[5] A CRC may decline to block, or rescind any block of, information if the CRC reasonably determines that: the information was blocked in error or a block was requested by the consumer in error; the information was blocked, or the block was requested, on the basis of a material misrepresentation of fact by the consumer relevant to the request to block; or the consumer obtained possession of goods, services or money as a result of the blocked transaction(s).^[6]

In recent reviews of CRCs, examiners found that CRCs failed to timely implement blocks of information after receiving the requisite documentation relating to an alleged identity theft, without otherwise making a reasonable determination with respect to one of the statutory bases for declining to block such information. Examiners found that the CRCs instead maintained policies pursuant to which the CRCs automatically declined to block information if the associated account(s) of the consumer met any one of a set of overbroad disqualifying criteria that were not sufficiently tailored to support a reasonable determination regarding any of the statutory declination bases.

In response to these findings, CRCs were directed to cease the practice of automatically declining to implement blocks based on overbroad disqualifying criteria without an individualized determination that there is a statutory basis to decline. CRCs also were directed to implement revisions to the CRCs' policies to ensure compliance with FCRA identity theft block obligations, including any circumstances in which the CRCs may reasonably request additional information or documentation to determine the validity of an alleged identity theft and any circumstances in which there is a valid basis to decline to block.

2.1.2 CRC Duty To Promptly Notify Consumers After Declining To Implement, or Rescind, an Identity Block

The FCRA requires CRCs to promptly notify the affected consumer if the CRC declines to block, or rescinds a block of, information that the consumer identifies as information resulting from an alleged identity theft.^[7] CRCs must notify the consumer in the same manner as CRCs are required to notify consumers of a reinsertion of information into a consumer's file— i.e., in writing within five business days and by providing certain information, including the name and address of the furnisher of the identified information if reasonably available and a notice that the consumer has the right to add a statement to the consumer's file disputing the accuracy or completeness of such information.^[8]

In recent reviews of CRCs, examiners found that CRCs failed to provide the requisite notice within five business days of declining to block information—in some instances due to system issues and in others due to human error. Examiners also found that CRCs systematically failed to timely provide consumers with the relevant furnisher's contact information and/or notice regarding the consumer's right to add a statement to the consumer's file disputing the accuracy or completeness of the furnished information.

In response to these findings, CRCs were directed to revise their policies to ensure compliance with FCRA identity theft block notice obligations and update notice templates to include the requisite information for consumers.

2.1.3 CRC Duty To Provide Victims of Identity Theft With Summaries of Rights

The FCRA requires CRCs, upon a consumer contacting the CRC and expressing a belief that they are a victim of fraud or identity theft, to provide the consumer with a summary of rights containing all of the information required by the CFPB in its model summary of rights,^[9] along with information about how to request more detailed information from the CFPB.^[10] In recent reviews of CRCs, examiners found that CRCs failed to comply with this provision, either by failing to include required information in summaries of rights or by failing to provide the summary of rights to eligible consumers entirely.

In response to these findings, CRCs are updating their systems to ensure that they provide the required summary of rights.

2.1.4 CRC Duty To Block Adverse Information Resulting From Human Trafficking

Regulation V requires CRCs to block adverse items of information identified by a consumer or their representative as resulting from a severe form of trafficking in persons or sex trafficking, as defined in the regulation.^[11] CRCs must block such items within four business days of receiving a consumer's submission, except in limited circumstances where additional information is necessary to complete the submission.^[12] In recent reviews of CRCs, examiners found that CRCs failed to timely block identified adverse items of information within the applicable four business days. CRCs blocked some but not all items identified in a qualifying consumer submission and in other instances failed to implement a block entirely.

In response to these findings, CRCs were directed to revise their compliance processes to ensure that they process all human trafficking block requests in accordance with the requirements of Regulation V.

2.1.5 CRC Duty To Follow Reasonable Procedures To Assure Maximum Possible Accuracy

The FCRA requires that, wherever a CRC “prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” ^[13] In recent reviews of CRCs, examiners found that CRCs' accuracy procedures failed to comply with this obligation because the CRCs (1) failed to adequately monitor dispute metrics that would suggest a furnisher may no longer be a source of reliable, verifiable information about consumers, and (2) continued to include information in consumer reports that was provided by unreliable furnishers without implementing procedures to assure the accuracy of information provided by unreliable furnishers. Specifically, the CRCs did not monitor metrics and thresholds tied to objective measures of inaccuracy or unreliability. Moreover, the CRCs maintained data from furnishers that responded to disputes in ways that suggested that the furnishers were no longer sources of reliable, verifiable information about consumers. For example, CRCs received furnisher dispute response data indicating that, for several months, furnishers failed to respond to all or nearly all disputes, or responded to all disputes in the same manner. Despite observing this dispute response behavior by these furnishers, CRCs continued to include information from these furnishers in consumer reports.

In response to these findings, CRCs were directed to revise their accuracy procedures to identify and monitor furnishers and take corrective action regarding data from furnishers whose dispute response behavior indicates the furnisher is not a source of reliable, verifiable information about consumers.

2.2 Furnishers

In recent reviews of furnishers, examiners found deficiencies in furnishers' compliance with FCRA and Regulation V accuracy, dispute investigation and identity theft requirements.

2.2.1 Furnisher Duty to Promptly Correct and Update Information Determined To Be Incomplete or Inaccurate

Examiners are continuing to find that furnishers are violating the FCRA duty to promptly correct and update furnished information after determining that such information is incomplete or inaccurate.^[14] Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers continued to furnish incomplete or inaccurate information for several months, and in some cases years, after the furnishers determined, through either dispute handling or identification of systemic issues, the information was furnished incompletely or inaccurately. For example, examiners found that furnishers continued to report dates of first delinquency inaccurately for several months after determining that they were reporting inaccurately due to various system coding issues. Examiners also found that after determining accounts were in a bankruptcy status and therefore should have been reported as current with dates of first delinquency that reflect the bankruptcy filing dates, furnishers failed to update the dates of first delinquency for the accounts to the bankruptcy filing dates. By failing to update the dates of first delinquency for the accounts in bankruptcy when they determined the accounts were in bankruptcy, the furnishers failed to promptly update or correct information they had determined to be incomplete or inaccurate. In response to these findings, furnishers are updating their internal controls related to promptly correcting or updating furnished information after determining it is incomplete or inaccurate and engaging in lookbacks to remediate the furnishing of the previously impacted accounts.

Examiners also found that auto loan furnishers did not promptly send corrections or updates to CRCs after determining that accounts with lease returns were paid-in-full. When leased cars were returned to dealerships, furnishers updated their systems of record to reflect that the accounts had been paid-in-full. However, examiners found that the furnishers failed to update the information furnished to CRCs to reflect that the accounts were paid-in-full. In response to these findings, furnishers are conducting lookbacks to ensure that corrections or updates are furnished for impacted accounts and are implementing internal controls to ensure they promptly correct or update furnished information after determining it is incomplete or inaccurate.

In addition, in reviews of deposit furnishers, examiners found that furnishers continued to report fraudulent accounts to CRCs for several years after determining the accounts were fraudulent. While, in some instances, furnishers closed the accounts determined to be fraudulent, they continued to furnish the accounts as valid ( i.e., non-fraudulent) accounts and failed to notify CRCs that the accounts should be deleted because they were fraudulent. By not instructing CRCs to delete the accounts promptly after determining they were fraudulent, the furnishers failed to promptly correct or update furnished information determined to be inaccurate or incomplete.

In response to these findings, furnishers conducted lookbacks to ensure they deleted all accounts they determined to be opened fraudulently and updated their policies and procedures related to notifying CRCs when accounts are determined to be fraudulent to ensure the accounts are deleted.

2.2.2 Furnisher Duty To Notify CRCs of Direct Disputes

Examiners are continuing to find that furnishers are violating the FCRA duty to notify CRCs that the accuracy or completeness of items being furnished by them are subject to dispute.^[15] Specifically, in recent reviews of deposit furnishers, examiners found that furnishers who received direct disputes from consumers were continuing to furnish the disputed information to CRCs without notifying the CRCs that the information was subject to dispute.

In response to these findings, furnishers are updating their policies to make clear that they will provide notices of direct disputes to CRCs.

2.2.3 Furnisher Duty To Conduct Reasonable Investigations of Direct Disputes

Examiners are continuing to find that furnishers are violating the Regulation V duty to conduct a reasonable investigation of direct disputes.^[16] Specifically, in recent reviews of auto loan furnishers, examiners found evidence that furnishers failed to investigate direct disputes that did not satisfy those furnishers' extraneous identity verification requirements. Regulation V specifically defines what a consumer must include in a dispute notice to trigger a furnisher's duty to investigate. Although these disputes met the Regulation V requirements for a direct dispute, examiners found evidence that the furnishers did not investigate the disputes because the consumer had not satisfied additional identity verification requirements of the furnisher. However, Regulation V does not permit a furnisher to establish additional requirements beyond what the regulation requires in order to initiate a direct dispute investigation by the furnisher.

Also, in recent reviews of debt collection furnishers, examiners found that when the furnishers received a direct dispute, they simply deleted the tradeline, rather than conducting an investigation. As the Bureau has previously explained, simply deleting tradelines in response to a direct dispute does not satisfy furnishers' responsibility to conduct a reasonable investigation with respect to the disputed information.^[17] After identification of these issues, furnishers were directed to update their policies and procedures to ensure they conduct reasonable investigations of direct disputes.

2.2.4 Furnisher Duty To Provide Notice of Delinquency of Accounts

Examiners are continuing to find that furnishers are violating the FCRA duty to notify CRCs of the dates of first delinquency on applicable accounts.^[18] Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers inaccurately reported dates of first delinquency to CRCs due to various coding issues. For example, examiners found that coding errors resulted in furnishers inaccurately reporting dates of first delinquency as the first day of the statement cycle following the consumer's missed payment, rather than 30 days after the missed payment due date. Examiners also found that auto loan furnishers reported inaccurate dates of first delinquency for accounts by reporting the dates of first delinquency as more recent than they should have been, including by changing the dates of first delinquency for accounts that remained delinquent month after month ( i.e., accounts for which the dates of first delinquency should not have been changed).

In response to these findings, furnishers are conducting lookbacks to identify and remediate impacted accounts and updating their policies and procedures to ensure that they report dates of first delinquency accurately.

2.2.5 Furnisher Duty Not To Furnish Information That Purports To Relate to a Consumer Upon Receipt of an Identity Theft Report

Examiners are continuing to find that furnishers are violating the FCRA's requirement that if a consumer submits an identity theft report at the address specified by the furnisher for receiving such reports stating that information maintained by that furnisher that purports to relate to the consumer resulted from identity theft, the furnisher may not furnish such information to any CRC, unless the furnisher subsequently knows or is informed by the consumer that the information is correct.^[19] Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers who received identity theft reports at a qualifying address continued to furnish information identified in the report before knowing or being informed by the consumer that the information was correct.

In response to these findings, furnishers are updating their policies and procedures to ensure that information subject to this requirement is not furnished prior to the completion of an investigation and determination of validity.

3. Supervisory Program Developments

3.1 Recent CFPB Supervisory Program Developments

Set forth below are select supervision program developments including advisory opinions, that have been issued regarding credit reporting since our last regular edition of Supervisory Highlights.

3.1.1 CFPB Issued Advisory Opinion on Fair Credit Reporting: Background Screening

On January 11, 2024, the CFPB issued an advisory opinion to affirm that, when preparing consumer reports, a CRC that reports public record information is not using reasonable procedures to assure maximum possible accuracy under the FCRA if it does not have procedures in place that: (1) prevent reporting information that is duplicative or that has been expunged, sealed, or otherwise legally restricted from public access; and (2) include any existing disposition information if it reports arrests, criminal charges, eviction proceedings, or other court filings.^[20] The advisory opinion also highlights that, when CRCs include adverse information in consumer reports: (1) the occurrence of the adverse event starts the running of the reporting period for adverse items under FCRA section 605(a)(5); (2) that period is not restarted or reopened by the occurrence of subsequent events; and (3) a non-conviction disposition of a criminal charge cannot be reported beyond the seven-year period that begins to run at the time of the charge. CRCs thus must ensure that they do not report adverse information beyond the reporting period in FCRA section 605(a)(5) and must at all times have reasonable procedures in place to prevent reporting of information that is duplicative or legally restricted from public access and to ensure that any existing disposition information is included if court filings are reported.

3.1.2 CFPB Issues Advisory Opinion on File Disclosures

On January 11, 2024, the CFPB issued an advisory opinion to address certain obligations that CRCs have under section 609(a) of the FCRA.^[21] The advisory opinion underscores that, to trigger a CRC's file disclosure requirement under FCRA section 609(a), a consumer does not need to use specific language, such as “complete file” or “file.” The advisory opinion also highlights the requirements regarding the information that must be disclosed to a consumer under FCRA section 609(a). In addition, the advisory opinion affirms that CRCs must disclose to a consumer both the original source and any intermediary or vendor source (or sources) that provide the item of information to the CRC under FCRA section 609(a).

4. Remedial Actions

4.1 Public Enforcement Actions

The CFPB's supervisory actions resulted in and supported the below enforcement actions related to credit reporting or furnishing.

4.1.1 Toyota Motor Credit Corporation

On November 20, 2023, the CFPB issued an order against Toyota Motor Credit Corporation (Toyota Motor Credit), which is the United States-based auto-financing arm of Toyota Motor Corporation and one of the largest indirect auto lenders in the country. Toyota Motor Credit provides financing for vehicles and optional “add-on” products and services sold with the vehicles. These add-ons include Guaranteed Asset Protection, which can waive some of a consumer's remaining loan balance if their car is totaled, stolen or damaged when they still owe money on the loan even with car insurance, and Credit Life and Accidental Health, which is designed to pay a remaining balance if the consumer dies or becomes disabled. The CFPB found that Toyota Motor Credit violated the Consumer Financial Protection Act of 2010 by: (1) unfairly and abusively making it unreasonably difficult for consumers to cancel unwanted add-ons, including when consumers complained that dealers had forced add-ons on consumers without their consent; (2) unfairly failing to ensure consumers received refunds of unearned Guaranteed Asset Protection and Credit Life and Accidental Health premiums when they paid off their loans early or ended lease agreements early, making the products no longer of any value to consumers; and (3) unfairly failing to provide accurate refunds to consumers who canceled their vehicle service agreements as a result of flawed system logic. The CFPB also found that Toyota Motor Credit violated the FCRA and its implementing Regulation V by (1) failing to promptly correct negative information it had sent to CRCs, where the negative information was falsely reporting customer accounts as delinquent even though customers had already returned their vehicles; and (2) failing to maintain reasonable policies and procedures to ensure related payment information it sent to CRCs was accurate. The order requires Toyota Motor Credit to pay $48 million in consumer redress and a $12 million civil money penalty.^[22] The order also requires Toyota Motor Credit to stop its unlawful practices and come into compliance with the law and prohibits incentive-based employee compensation or performance measurements in relation to add-on products.

4.1.2 TransUnion, Trans Union LLC, and TransUnion Interactive, Inc.

On October 12, 2023, the CFPB issued an order against TransUnion, parent company of one of the three nationwide CRCs, and two of its subsidiaries, Trans Union LLC, and TransUnion Interactive, Inc. (collectively, TransUnion), which are headquartered in Chicago, Illinois. Security freezes and locks block certain third parties, such as lenders, from accessing consumers' credit reports to prevent a potential identity thief from obtaining new credit in those consumers' names. Starting in September 2018, Federal law has required nationwide CRCs to provide security freezes as a free service, whereas locks are a feature of certain paid products. The CFPB found that TransUnion, from as early as 2003, failed to timely place or remove security freezes and locks on the credit reports of tens of thousands of consumers who requested them, including certain vulnerable consumers; in some cases, those requests were left unmet for months or years. The CFPB found TransUnion's failure to place or remove security freezes in a timely manner occurred as a result of problems, including systems issues, that TransUnion knew about but failed to address for years. The CFPB found that TransUnion's failure to place or remove security freezes in a timely manner violated the FCRA, and TransUnion's failure to place or remove both security freezes and locks in a timely manner was unfair in violation of the Consumer Financial Protection Act of 2010. Further, the CFPB found that TransUnion engaged in deceptive acts and practices by falsely telling certain consumers that their requests had been successful when they had not. In addition, the CFPB found that from about 2016 to 2020, TransUnion failed to exclude certain consumers, including active-duty military and other potential victims of identity theft, from pre-screened solicitation lists in violation of FCRA. The CFPB's order requires TransUnion to pay $3 million to consumers in redress and $5 million in civil penalties.^[23] TransUnion must also take steps to address and prevent unlawful conduct, including convening a committee to identify and address technology problems that can affect consumers.

Rohit Chopra,

Director, Consumer Financial Protection Bureau.

Footnotes

1.  The term “consumer reporting company” as used in this publication means the same as “consumer reporting agency,” as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x).

2.  15 U.S.C. 1681 et seq.

3.  12 CFR part 1022.

4.  If a supervisory matter is referred to the Office of Enforcement, Enforcement may cite additional violations based on these facts or uncover additional information that could impact the conclusion as to what violations may exist.

5.  15 U.S.C. 1681c-2(a); see15 U.S.C. 1681a(q)(4) and 12 CFR 1022.3(i)(1) (defining “identity theft report”).

6.  15 U.S.C. 1681c-2(c).

7.  15 U.S.C. 1681c-2(c)(2).

8.   Id. (referencing the notice requirements of 15 U.S.C. 1681i(a)(5)(B)).

9.  Consumer Fin. Prot. Bureau, Appendix I to part 1022—Summary of Consumer Identity Theft Rights, https://www.consumerfinance.gov/​rules-policy/​regulations/​1022/​i.

10.  15 U.S.C. 1681g(d)(2).

11.  12 CFR 1022.142(c).

12.  12 CFR 1022.142(e)(1).

13.  15 U.S.C. 1681e(b).

14.  15 U.S.C. 1681s-2(a)(2).

15.  15 U.S.C. 1681s-2(a)(3).

16.  12 CFR 1022.43(e)(1).

17.  CFPB Bulletin 2014-01 (Feb. 27, 2014).

18.  15 U.S.C. 1681s-2(a)(5).

19.  15 U.S.C. 1681s-2(a)(6)(B).

20.  The advisory opinion is available at: cfpb_fair-credi-reporting-background-screening_2024-01.pdf ( consumerfinance.gov).

21.  The advisory opinion is available at: cfpb_fair-credit-reporting-file-disclosure_2024-01.pdf ( consumerfinance.gov).

22.  The Order is available at: cfpb_toyota-motor-credit-corporation-consent-order_2023-11.pdf ( consumerfinance.gov).

23.  A copy of the Consent Order is available at: https://www.consumerfinance.gov/​enforcement/​actions/​transunion-trans-union-llc-and-transunion-interactive-inc/​.