All Users Ofconsumerreportsmust Comply Withall Applicable Regulations. Informationabout

All users ofconsumerreportsmust comply withall applicable regulations. Informationabout applicable regulations currently ineffect can befoundat theConsumerFinancial Protection Bureau’s website,

NOTICE TO USERSOFCONSUMER REPORTS: OBLIGATIONSOFUSERSUNDER THEFCRA

The FairCredit ReportingAct (FCRA), 15 U.S.C.§1681-1681y,requires that this notice beprovided to inform users of consumer reports oftheirlegal obligations. Statelaw mayimpose additional requirements. Thetext ofthe FCRA is set forth in full at theBureau ofConsumer Financial Protection’s website at At the end ofthis document is alist ofUnited States Code citations forthe FCRA. Otherinformation about user duties is also available attheBureau’s website. Usersmust consult the relevantprovisions of theFCRA fordetails about theirobligations under theFCRA.

The first section ofthis summarysets forth theresponsibilities imposed bythe FCRA on all users of consumer reports. Thesubsequent sections discuss theduties ofusers ofreports that contain specifictypes ofinformation, orthat areused forcertain purposes,and thelegal consequences ofviolations. Ifyou area furnisherofinformation to a consumer reportingagency (CRA),you have additional obligations and will receiveaseparatenoticefrom theCRA describingyourduties asa furnisher.

I.OBLIGATIONSOFALLUSERSOFCONSUMER REPORTS A. UsersMustHaveaPermissiblePurpose

Congress has limited theuseof consumerreports to protect consumers’privacy. All

users must haveapermissiblepurposeunderthe FCRA to obtain a consumer report. Section 604 contains alist ofthepermissiblepurposes underthelaw. These are:

•As ordered bya court ora federalgrand jurysubpoena.

Section 604(a)(1)

•As instructed bythe consumerin writing.

Section 604(a)(2)

•Forthe extension of credit as a result of anapplication from a consumer, orthe review or

collection ofa consumer’s account.

Section 604(a)(3)(A)

•For employment purposes, includinghiringand promotion decisions, wherethe consumer

has givenwritten permission.

Sections 604(a)(3)(B) and 604(b)

•Fortheunderwritingofinsuranceas aresult of anapplication from aconsumer.

604(a)(3)(C)

Section

•When thereis alegitimatebusiness need, in connection with abusiness transaction that is initiatedbythe consumer. Section 604(a)(3)(F)(i)

•To reviewa consumer’saccount to determinewhetherthe consumer continues to meet

theterms oftheaccount.

Section 604(a)(3)(F)(ii)

•To determineaconsumer’s eligibilityforalicenseorotherbenefit granted bya governmental instrumentalityrequired bylaw toconsider an applicant’s financial

responsibilityorstatus.

Section 604(a)(3)(D)

•Forusebyapotential investororservicer, or current insurer, in avaluationor assessment

ofthe credit orprepayment risks associated with an existingcredit obligation.

604(a)(3)(E)

Section

•Forusebystate and localofficials in connection with thedetermination ofchild support

payments, ormodifications and enforcement thereof.

Sections 604(a)(4) and 604(a)(5)

Inaddition, creditors andinsurers mayobtain certain consumerreport information forthe purposeofmaking“prescreened”unsolicited offers of credit orinsurance. Section 604(c). The particularobligations ofusers of “prescreened”information aredescribed in Section VIIbelow.

B. UsersMustProvideCertifications

Section 604(f)prohibits anyperson from obtainingaconsumerreport from a consumer reportingagency(CRA)unless theperson hascertified to theCRA thepermissiblepurpose(s) forwhich thereport is beingobtainedand certifiesthat the report will not beused foranyother purpose.

C. UsersMustNotify ConsumersWhenAdverseActions AreTaken

Theterm “adverse action”is defined verybroadlybySection 603. “Adverse actions” include all business, credit, and employment actions affecting consumers that can beconsidered to haveanegativeimpactas defined bySection 603(k)oftheFCRA – suchas denying or canceling credit orinsurance, ordenying employment orpromotion. No adverseaction occurs in a credit transaction wherethe creditormakes acounterofferthat is accepted bytheconsumer.

1. AdverseActions BasedonInformationObtainedFromaCRA

Ifausertakes anytypeof adverse action as defined bytheFCRA that is based at least in part on information contained in a consumerreport, Section 615(a)requirestheuserto notifythe consumer. Thenotification maybedonein writing, orally, orbyelectronicmeans. It must includethe following:

•Thename, address, and telephonenumberofthe CRA (includingatoll-freetelephone number, ifit is anationwideCRA)that provided the report.

•A statement that theCRA did not makethe adversedecision and is not ableto explain whythedecision was made.

•A statement settingforththe consumer’sright to obtain a freedisclosureofthe consumer’s filefrom the CRA ifthe consumermakes a request within 60 days.

•A statement settingforththe consumer’sright to disputedirectlywith theCRA the accuracyor completeness of anyinformation provided bytheCRA.

2. AdverseActions BasedonInformationObtainedFromThirdPartiesWho AreNot

ConsumerReporting Agencies

Ifaperson denies (orincreases thecharge for)credit forpersonal, family, orhousehold purposes basedeitherwhollyorpartlyupon information from aperson otherthan aCRA, and theinformation is thetypeof consumerinformation covered bythe FCRA,Section 615(b)(1) requires that theuser clearlyandaccuratelydiscloseto the consumerhis orher right to betold

thenatureoftheinformation that was relied upon ifthe consumermakes awritten request within

60 days ofnotification. Theusermust providethedisclosurewithin areasonableperiod oftime followingthe consumer’swritten request.

3. AdverseActions BasedonInformationObtainedFromAffiliates

Ifaperson takes an adverse action involvinginsurance,employment, oracredit transaction initiated bythe consumer, based on information ofthetype covered bytheFCRA, and this information wasobtained from anentityaffiliated with theuseroftheinformation by common ownership or control, Section 615(b)(2)requires theuserto notifythe consumerofthe adverseaction. Thenoticemust inform the consumerthat heorshemayobtain adisclosureof

thenatureoftheinformation relied upon bymakingawritten request within 60 days of receiving the adverse action notice. Ifthe consumermakes such a request, theusermust disclosethe

natureoftheinformationnot laterthan 30 days after receivingtherequest. Ifconsumerreport information is shared amongaffiliates and then used for anadverseaction, theusermust make an adverseaction disclosure as set forth inI.C.1 above.

D. UsersHaveObligations WhenFraudandActiveDuty MilitaryAlerts are inFiles

When a consumerhas placeda fraud alert, includingonerelatingto identifytheft, or an activedutymilitaryalertwith anationwide consumer reportingagencyasdefined in Section

603(p) and resellers, Section 605A(h)imposes limitations on users of reports obtained from the consumer reporting agencyincertaincircumstances, includingtheestablishment ofanewcredit plan and theissuanceofadditional credit cards. Forinitial fraud alerts andactivedutyalerts, the usermust havereasonablepolicies and proceduresin placeto form abeliefthat theuserknows theidentityoftheapplicant or contact the consumer at atelephonenumberspecified bythe consumer; in the caseofextended fraud alerts, theusermust contact the consumerin accordance with the contact information provided in the consumer’s alert.

E. UsersHaveObligations WhenNotifiedofanAddress Discrepancy

Section 605(h) requires nationwideCRAs, as defined in Section 603(p), tonotifyusers that request reports whenthe address foraconsumerprovided bytheuserin requestingthe report is substantiallydifferent from the addressesin the consumer’s file. When this occurs, users must complywith regulations specifyingtheprocedures to be followed. Federal regulations are available at

F. Users HaveObligations WhenDisposing ofRecords

Section 628 requires thatall users of consumer report information havein place procedures to properlydisposeof records containingthis information. Federal regulations have been issued that cover disposal.

II.CREDITORSMUSTMAKEADDITIONALDISCLOSURES

Ifaperson uses aconsumer report in connectionwith an application for, oragrant, extension, orprovision of, credit to aconsumeronmaterial terms that aremateriallyless favorablethan themost favorableterms availableto asubstantial proportion of consumers from orthrough that person, based in wholeorin part on a consumerreport, theperson must providea risk-based pricingnoticeto the consumerin accordancewith regulations prescribed bythe Consumer Financial Protection Bureau.

Section 609(g) requires adisclosurebyall personsthat makeorarrangeloans secured by residential real property(oneto fourunits) and that use credit scores. Thesepersons must provide credit scores andotherinformation aboutcredit scores to applicants, includingthe disclosureset forth in Section 609(g)(1)(D)(“Noticeto theHomeLoanApplicant”).

III.OBLIGATIONSOFUSERSWHEN CONSUMER REPORTSAREOBTAINED FOR EMPLOYMENTPURPOSES

A. EmploymentOtherThanintheTruckingIndustry

Iftheinformation from a CRA is used for employment purposes, theuserhas specific duties, which areset forth in Section 604(b)ofthe FCRA. Theusermust:

•Makea clearand conspicuous written disclosureto the consumerbeforethe report is obtained, in adocument that consists solelyofthedisclosure, that a consumer report may beobtained.

•Obtain from the consumerpriorwritten authorization. Authorization to access reports duringtheterm of employment maybeobtained at thetimeof employment.

•Certifyto theCRA that the abovesteps havebeenfollowed, that theinformation being obtained will not beused in violation of anyfederal orstate equal opportunitylaw or regulation, and that, if anyadverseaction is to betaken based onthe consumer report,a copyofthereport and asummaryofthe consumer’s rights will beprovidedto the consumer

•Beforetaking an adverseaction, theusermust providea copyofthereportto the

consumer as well as thesummaryof consumer’s rights. (Theusershould receivethis summaryfrom theCRA.)A Section 615(a) adverse action noticeshould besent afterthe adverseaction is taken

An adverse action noticealso is required in employment situations if credit information (otherthan transactions and experiencedata)obtained from anaffiliateis used to deny employment. Section 615(b)(2)

Theprocedures forinvestigative consumer reports and employeemisconduct investigations areset forth below.

B. EmploymentintheTruckingIndustry

Special rules applyfortruck drivers wheretheonlyinteraction between theconsumer and thepotential employeris bymail, telephone, or computer. In this case, theconsumermay

provide consent orallyorelectronically,and an adverseaction maybemadeorally, in writing, or electronically. The consumermayobtain a copyof anyreport relied upon bythetrucking companybycontactingthe company.

IV.OBLIGATIONSWHEN INVESTIGATIVECONSUMER REPORTSAREUSED

Investigative consumer reports areaspecial typeof consumerreport in which

information about a consumer’s character,general reputation, personalcharacteristics, and mode oflivingis obtained through personal interviewsbyanentityorperson that is a consumer reportingagency. Consumers who arethesubjects ofsuch reports aregiven special rights under the FCRA. Ifauserintends to obtain an investigative consumer report, Section 606 requires the following:

•Theusermust disclosetothe consumerthat an investigativeconsumerreport maybe obtained. This must bedonein awritten disclosurethat is mailed, orotherwisedelivered, to the consumer at sometimebeforeornot laterthan threedays afterthedateon which

the report was first requested. Thedisclosuremust includeastatement informingthe consumerofhis orher right to request additional disclosures ofthenatureand scopeof theinvestigation as described below, and thesummaryof consumer rights required by Section 609 ofthe FCRA. (Thesummaryofconsumer rights will beprovided bythe CRA that conducts theinvestigation.)

•Theusermust certifyto theCRA that thedisclosures set forth abovehavebeen madeand that theuserwill makethedisclosuredescribed below.

•Upon thewritten request ofa consumermadewithin a reasonableperiod oftime afterthe disclosures required above, theusermust makeacompletedisclosureofthenature and scopeoftheinvestigation. This must bemadein awritten statement that is mailed or otherwisedelivered, to the consumerno laterthanfivedays afterthedateon which the request wasreceived from the consumerorthereport was first requested,whicheveris laterin time.

V. SPECIALPROCEDURESFOR EMPLOYEEINVESTIGATIONS

Section 603(x)provides special proceduresforinvestigations ofsuspectedmisconduct by an employeeorfor compliancewith Federal, stateorlocal laws andregulations orthe rules ofa self-regulatoryorganization, and compliancewith written policies ofthe employer. These investigations arenot treated as consumer reports so longas theemployerorits agent complies with theprocedures set forth in Section 603(x), and asummarydescribing thenature and scope

oftheinquiryis madeto the employeeif anadverse action is taken based on theinvestigation.

VI.OBLIGATIONSOFUSERSOFMEDICALINFORMATION

Section 604(g)limits theuseofmedical information obtained from consumer reporting agencies(otherthan payment information that appears in acoded form that does not identifythe medical provider). Iftheinformation is to beused for an insurancetransaction, the consumer must give consent to theuserofthereport ortheinformation must be coded. Ifthe report is to

beused foremploymentpurposes – orin connection with a credit transaction (except as provided in regulations issued bythebankingand credit union regulators)– theconsumermust provide specificwrittenconsent and themedical information must be relevant. Anyuserwho receives medical information shall not disclosetheinformation to anyotherperson (except where necessaryto carryout thepurpose forwhich theinformation was disclosed,orapermitted by statute, regulation, ororder).

VII.OBLIGATIONSOFUSERSOF“PRESCREENED” LISTS

The FCRA permits creditors and insurers to obtainlimited consumer reportinformation forusein connection with unsolicited offers ofcredit orinsuranceundercertain circumstances. Sections 603(1), 604(c),604(e), and 614(d). Thispracticeis knownas “prescreening” and typicallyinvolves obtainingalist of consumers from aCRA who meet certain pre-establishedcriteria. Ifanyperson intends to useprescreened lists, that person must (1)beforetheofferis made, establish the criteriathat will be relied upon to maketheoffer andgrant credit or insurance,and (2)maintain such criteriaonfile forathree-yearperiod beginningon thedateon which theofferis madeto eachconsumer. Inaddition, anyusermust providewith each written solicitation a clear andconspicuous statement that:

•Information contained ina consumer’s CRA filewas used in connection with the transaction.

•The consumerreceived theofferbecauseheorshesatisfied thecriteria forcredit worthiness orinsurabilityused to screen fortheoffer.

•Credit orinsurancemaynot be extended if, afterthe consumerresponds, it is determined that the consumerdoes not meet the criteriaused forscreeningor anyapplicablecriteria bearingon credit worthiness orinsurability, ortheconsumerdoes not furnish required collateral.

•The consumermayprohibit theuseofinformationin his orher filein connection with futureprescreened offers of credit orinsurancebycontactingthenotification system

established bytheCRA that provided thereport. Thestatement must includethe address and toll-freetelephonenumberofthe appropriatenotification system.

Inaddition, theConsumer Financial Protection Bureau hasestablished theformat, type size, and mannerofthedisclosure required bySection 615(d), with which users must comply. Therelevant regulation is 12 CFR1022.54.

VIII.OBLIGATIONSOFRESELLERS

A. Disclosure andCertificationRequirements

Section 607(e)requires anyperson who obtains aconsumer report forresaleto takethe followingsteps:

•Disclosetheidentityofthe end-userto thesource CRA.

•Identifyto thesourceCRA each permissiblepurpose forwhich the report will be furnished to the end-user.

•Establish and follow reasonableprocedures to ensurethat reports areresoldonlyfor permissiblepurposes, includingprocedures to obtain:

(1)theidentifyof all end-users;

(2)certifications from all users ofeach purpose for which reports will beused;and

(3)certifications that reportswill not beused for anypurposeotherthan thepurpose(s) specified to thereseller. Resellers must make reasonable efforts to verifythis information beforesellingthereport.

B. Reinvestigations by Resellers

UnderSection 611(f), ifa consumerdisputes theaccuracyor completeness of information in a report prepared byareseller, theresellermust determinewhetherthis is a result of an action oromissionon its part and, ifso, correct ordeletetheinformation. Ifnot, the

resellermust send thedisputeto thesourceCRA for reinvestigation. When anyCRA notifies the resellerofthe results ofan investigation, theresellermust immediatelyconveytheinformation

to the consumer.

C. FraudAlerts andResellers

Section 605A(f)requiresresellers whoreceivefraud alerts oractivedutyalerts from another consumer reportingagencyto includethesein their reports.

IX.LIABILITY FOR VIOLATIONSOFTHEFCRA

Failureto complywith the FCRA canresult in stategovernment orfederalgovernment enforcement actions, as well as privatelawsuits. Sections 616, 617, and 621. Inaddition, any person who knowinglyand willfullyobtains a consumer report underfalsepretenses mayface criminal prosecution. Section 619.

The CFPB’s website, has more information about the FCRA, including publications for businesses and the full text of the FCRA.

Citations for FCRA sections in the U.S. Code, 15 U.S.C. § 1681 et seq.:

Section 602

Section 603

Section 604

Section 605

Section 605A

Section 605B

Section 606

Section 607

Section 608

Section 609

Section 610

Section 611

Section 612

Section 613

Section 614

15 U.S.C. 1681

15 U.S.C. 1681a

15 U.S.C. 1681b

15 U.S.C. 1681c

15 U.S.C. 1681cA

15 U.S.C. 1681cB

15 U.S.C. 1681d

15 U.S.C. 1681e

15 U.S.C. 1681f

15 U.S.C. 1681g

15 U.S.C. 1681h

15 U.S.C. 1681i

15 U.S.C. 1681j

15 U.S.C. 1681k

15 U.S.C. 1681l

Section 615

Section 616

Section 617

Section 618

Section 619

Section 620

Section 621

Section 622

Section 623

Section 624

Section 625

Section 626

Section 627

Section 628

Section 629

15 U.S.C. 1681m

15 U.S.C. 1681n

15 U.S.C. 1681o

15 U.S.C. 1681p

15 U.S.C. 1681q

15 U.S.C. 1681r

15 U.S.C. 1681s

15 U.S.C. 1681s-1

15 U.S.C. 1681s-2

15 U.S.C. 1681t

15 U.S.C. 1681u

15 U.S.C. 1681v

15 U.S.C. 1681w

15 U.S.C. 1681x

15 U.S.C. 1681y

[77 FR 67754, Nov. 14, 2012]