Supervisory Highlights Consumer Reporting Special Edition, Issue 20 (Fall 2019)
| Published date | 11 December 2019 |
| Citation | 84 FR 67725 |
| Record Number | 2019-26669 |
| Section | Notices |
| Court | Consumer Financial Protection Bureau |
Federal Register, Volume 84 Issue 238 (Wednesday, December 11, 2019)
[Federal Register Volume 84, Number 238 (Wednesday, December 11, 2019)]
[Notices]
[Pages 67725-67732]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-26669]
[[Page 67725]]
=======================================================================
-----------------------------------------------------------------------
BUREAU OF CONSUMER FINANCIAL PROTECTION
Supervisory Highlights Consumer Reporting Special Edition, Issue
20 (Fall 2019)
AGENCY: Bureau of Consumer Financial Protection.
ACTION: Supervisory highlights.
-----------------------------------------------------------------------
SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is
issuing its twentieth edition of its Supervisory Highlights. In this
special issue of Supervisory Highlights, we report examination findings
in the areas of consumer reporting and furnishing of information to
consumer reporting companies, pursuant to the Fair Credit Reporting Act
and Regulation V. The report does not impose any new or different legal
requirements, and all violations described in the report are based only
on those specific facts and circumstances noted during those
examinations.
DATES: The Bureau released this edition of the Supervisory Highlights
on its website on December 9, 2019.
FOR FURTHER INFORMATION CONTACT: David Wake, Senior Counsel, Office of
Supervision Policy, at (202) 435-9613. If you require this document in
an alternative electronic format, please contact
[email protected].
SUPPLEMENTARY INFORMATION:
1. Introduction
The Consumer Financial Protection Bureau (CFPB or Bureau) is
committed to a consumer financial marketplace that is free, innovative,
competitive, and transparent, where the rights of all parties are
protected by the rule of law, and where consumers are free to choose
the products and services that best fit their individual needs. To
effectively accomplish this, the Bureau remains committed to sharing
with the public key findings from its supervisory work to help industry
limit risks to consumers and comply with Federal consumer financial
law.
The findings included in this report cover examinations in the
areas of consumer reporting and furnishing of information to consumer
reporting companies (CRCs),\1\ pursuant to the Fair Credit Reporting
Act (FCRA) and Regulation V.\2\ In March 2017, the CFPB published its
first special edition of Supervisory Highlights dedicated to consumer
reporting issues.\3\ This special edition of Supervisory Highlights
reports on more recent supervisory findings in this area.
---------------------------------------------------------------------------
\1\ The term ``consumer reporting company'' means the same as
``consumer reporting agency,'' as defined in the Fair Credit
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide
specialty consumer reporting agencies as defined in 15 U.S.C.
1681a(x).
\2\ 15 U.S.C. 1681 et seq. and 12 CFR part 1022.
\3\ CFPB, Supervisory Highlights (Winter 2017), available at
https://files.consumerfinance.gov/f/documents/201703_cfpb_Supervisory-Highlights-Consumer-Reporting-Special-Edition.pdf.
---------------------------------------------------------------------------
Recent supervisory reviews of compliance with the FCRA and
Regulation V have identified new violations and compliance management
system (CMS) weaknesses at institutions within the CFPB's supervisory
authority. These institutions include CRCs that are larger participants
in the consumer reporting market \4\ as well as furnishers subject to
the Bureau's supervisory authority. These furnishers include banks,
mortgage servicers, auto loan servicers, student loan servicers, and
debt collectors.
---------------------------------------------------------------------------
\4\ Larger participants in the consumer reporting market are
defined in 12 CFR 1090.104.
---------------------------------------------------------------------------
The information contained in Supervisory Highlights is disseminated
to communicate the Bureau's supervisory expectations to CRCs and
furnishers that those institutions comply with the applicable
provisions of the FCRA and Regulation V. This document does not impose
any new or different legal requirements. In addition, the legal
violations described in this and previous issues of Supervisory
Highlights are based on the particular facts and circumstances reviewed
by the Bureau as part of its examinations. A conclusion that a legal
violation exists on the facts and circumstances described here may not
lead to such a finding under different facts and circumstances.
We invite readers with questions or comments about the findings and
legal analysis reported in Supervisory Highlights to contact us at
[email protected].
2. Supervisory Observations at Furnishers
Furnishers of information play a crucial role in the accuracy and
integrity of consumer reports when they provide information to CRCs.
Inaccurate information from furnishers can lead to inaccurate reports
and consumer and market harm. For example, inaccurate information on a
consumer report can impact a consumer's ability to obtain credit or
open a new deposit or savings account at a bank. Moreover, furnishers
have an important role in the dispute process when consumers dispute
the accuracy of information in their consumer reports. Consumers may
dispute information that appears on their consumer report directly to
furnishers (``direct disputes'') or indirectly through CRCs (``indirect
disputes''). When furnishers receive direct or indirect disputes, they
are required to investigate the disputes to verify the accuracy of the
information furnished.\5\ A timely and responsive reply to a consumer
dispute may reduce the impact inaccurate negative information in a
consumer report may have on the consumer. The FCRA and Regulation V set
forth requirements for furnishers concerning both accuracy and dispute
handling. To ensure compliance with these requirements, Supervision
regularly conducts reviews at furnishers subject to its supervisory
authority.
---------------------------------------------------------------------------
\5\ 15 U.S.C. 1681s-2(a)(8), 15 U.S.C. 1681s-2(b); 12 CFR
1022.43.
---------------------------------------------------------------------------
In recent supervisory reviews, examiners found CMS weaknesses and
violations of the FCRA and Regulation V. In such cases, the
furnisher(s) have taken or are taking corrective action.
2.1 Reasonable, Written Policies and Procedures
Regulation V requires furnishers to establish and implement
reasonable written policies and procedures regarding the accuracy and
integrity of the information relating to consumers that they provide to
CRCs.\6\ Such policies and procedures must be appropriate to the
nature, size, complexity, and scope of each furnisher's activities.\7\
Furnishers must consider and incorporate, as appropriate, the
guidelines of appendix E to Regulation V when developing their policies
and procedures.\8\ In a previous issue of Supervisory Highlights, we
described supervisory findings of furnishers that violated these
requirements.\9\ In recent supervisory reviews, we have identified
further violations of the Regulation V requirement for reasonable
written policies and procedures. In the section below, we have
highlighted key findings according to the products for which
information is being furnished, in keeping with the Regulation V
requirement that the procedures be ``appropriate to the nature, size,
complexity, and scope of the furnisher's activities.''
---------------------------------------------------------------------------
\6\ 12 CFR 1022.42(a).
\7\ Id.
\8\ 12 CFR 1022.42(b).
\9\ CFPB, Supervisory Highlights, Winter 2017, at 13-17 (March
2017).
---------------------------------------------------------------------------
2.1.1 Mortgage Furnishers
In one or more reviews of furnishers of mortgage loans, examiners
found that the furnishers' policies and procedures
[[Page 67726]]
were not appropriate to the nature, size, complexity, and scope of the
furnisher's activities. For example, one or more furnishers maintained
general FCRA-related policies and procedures that did not provide
sufficient guidance for responding to disputes in a timely manner or
reporting credit reporting changes in furnished accounts when the
status of such accounts had changed. As a result of these findings, one
or more furnishers are developing and implementing reasonable
furnishing procedures governing the accurate reporting of accounts
designed to ensure the timely update of information to reflect the
current status of consumer accounts.
2.1.2 Auto Loan Furnishers
In one or more reviews of furnishers of auto loans, examiners found
that the furnishers' policies and procedures did not provide sufficient
guidance for conducting reasonable investigations of indirect disputes
that contain allegations of identity theft. For example, the
furnishers' policies and procedures did not specify that agents
investigating disputes alleging identity theft should review internal
records of fraud investigations before completing dispute
investigations and responding to CRCs. As a result of these findings,
one or more furnishers are developing and implementing policies and
procedures with respect to identity theft disputes to ensure the
furnisher conducts its investigation, including review of internal
records, prior to responding to the CRC.
2.1.3 Debt Collection Furnishers
In one or more reviews of debt collection furnishers, examiners
found that the furnishers' policies and procedures did not
differentiate between FCRA disputes, FDCPA disputes, or validation
requests. In this regard, the furnishers categorized and handled direct
FCRA disputes, FDCPA disputes, and validation requests the same way and
without consideration for the applicable regulatory requirements.
Furthermore, the policies and procedures did not address the regulatory
timeframes for conducting reasonable investigations of disputes, or for
reporting the results of the investigations to the consumers or to
CRCs, as appropriate. Instead, the policies and procedures provided
general instructions on how to indicate that accounts are disputed and
how to label dispute-related correspondence from consumers. The
policies and procedures did not contain any substantive instructions on
how to conduct investigations of disputed accounts. Following these
findings, one or more furnishers are developing and implementing
reasonable policies and procedures covering the steps necessary to
conduct reasonable and timely investigations of disputes, as that term
is defined in Regulation V.
2.1.4 Deposit Account Furnishers
Examiners found that one or more furnishers of deposit account
information to specialty CRCs had no written policies or procedures for
furnishing such information to specialty CRCs. In response to this
finding, one or more deposit account furnishers are developing and
implementing reasonable written policies and procedures regarding
furnishing to specialty deposit CRCs.
Examiners also found that one or more deposit account furnishers
did not have reasonable written policies and procedures regarding
deposit account information. For example, policies and procedures did
not require that the furnishers validate the data furnished to
specialty deposit CRCs, causing the furnisher to inaccurately furnish
consumers' account status information to one or more specialty CRCs.
One or more deposit account furnishers are evaluating the effectiveness
of existing policies and procedures regarding the accuracy and
integrity of information furnished to nationwide specialty CRCs and
develop new written policies where appropriate.
2.1.5 Improvements in Furnishing Policies and Procedures
In follow-up reviews at furnishers previously examined, examiners
found that one or more furnishers had made significant improvements in
furnishing policies and procedures. For example, one or more furnishers
updated their policies and procedures to incorporate specific
requirements to ensure dispute investigation agents conduct reasonable
dispute investigations and document their work. Revised dispute
investigation procedures include an extensive list of internal systems
and sources that dispute agents must research when investigating a
dispute. Updated procedures also dictate that the furnisher retains
dispute investigation documentation and records, including imaged
screenshots, for a minimum of seven years.
In another example of improved furnishing policies and procedures,
examiners found that one or more deposit furnishers documented improved
quality monitoring procedures to impose enhanced sampling and oversight
procedures regarding furnished deposits information. Additionally, one
or more furnishers improved procedures governing when to delete,
update, and correct information in its records to avoid furnishing
inaccurate information to specialty CRAs. One such new procedure
required the furnisher to conduct a root-cause analysis of dispute
results to ensure that when dispute investigations identify systemic
errors, the furnisher corrects furnished data about other accounts that
were also affected by similar errors.
2.2 Prohibition of Reporting Information With Actual Knowledge of
Errors
The FCRA prohibits furnishers from furnishing any information
relating to a consumer to any CRC if the furnisher ``knows or has
reasonable cause to believe that the information is inaccurate.'' \10\
However, a furnisher is not subject to this prohibition if it ``clearly
and conspicuously specifies to the consumer an address'' at which
consumers can send notices that specific information reported by the
furnisher is inaccurate.\11\ CFPB examiners found that one or more
furnishers furnished information they knew or had reasonable cause to
believe was inaccurate. One or more furnishers reported thousands of
accounts to one or more CRCs with inaccurate derogatory status codes.
The accounts were furnished inaccurately because of coding errors. The
furnishers had reasonable cause to believe the information was
inaccurate because consumers filed disputes with one or more CRCs
identifying the errors, and those disputes were forwarded to the
furnishers for investigation. The furnishers, in investigating the
disputes, failed to conduct root-cause analysis that would have
identified the issue as a systemic source of inaccuracy. Further, the
furnishers did not clearly and conspicuously specify to consumers an
address at which consumers could send notices that furnished
information was inaccurate. The furnishers provided an address to
consumers for direct disputes, but that address was provided on the
last page of lengthy consumer disclosures under a heading of
``Additional Information and Use Disclosures'' that followed topics
such as ``General Terms,'' ``Arbitration,'' and ``Privacy Notice.''
Examiners concluded that these notices did not qualify as ``clear and
conspicuous.'' After discovery of these inaccuracies, one or more
furnishers implemented a program fix for the inaccurate coding issue
and
[[Page 67727]]
conducted a review of all furnished accounts to identify and correct
the furnishing of all affected consumers.
---------------------------------------------------------------------------
\10\ 15 U.S.C. 1681s-2(a)(1)(A).
\11\ 15 U.S.C. 1681s-2(a)(1)(C).
---------------------------------------------------------------------------
2.3 Duty To Correct and Update Information
If a furnisher who ``regularly and in the ordinary course of
business furnishes information to one or more [CRCs] about the person's
transactions or experiences with any consumer'' has furnished to a CRC
information that the furnisher determines is not complete or accurate,
it shall promptly notify the CRC of that determination and provide to
the CRC any corrections to that information, or any additional
information, that is necessary to make the information provided to the
CRC complete and accurate, and shall not thereafter furnish to the CRC
any of the information that remains not complete or accurate.\12\
---------------------------------------------------------------------------
\12\ 15 U.S.C. 1681s-2(a)(2)(B).
---------------------------------------------------------------------------
The CFPB has identified violations of this provision in one or more
recent furnisher reviews. For example, in one or more reviews of auto
loan furnishers, examiners found that the furnishers failed to provide
prompt notifications to CRCs of their determinations that information
they had previously furnished was inaccurate because the furnishers had
found that the loans had been opened as a result of identity theft. In
such cases, the furnishers recorded the results of their investigations
internally, but failed to make the corrections necessary to make the
furnished information accurate. In response to these findings, one or
more auto furnishers are developing and implementing policies and
procedures to ensure that they promptly notify CRCs and/or correct
information furnished, as appropriate, if they find that information
they had previously furnished is inaccurate.
As another example, in one or more reviews of deposit account
furnishers, examiners found that the furnishers failed to promptly
correct and update deposit account information reported to nationwide
specialty CRCs that the furnishers determined was not complete or
accurate. Examiners identified several situations where the furnishers
failed to promptly update or correct information. These situations
included when consumers' charged-off balances had been discharged in
bankruptcy, and when consumers paid their charged-off balances in full.
In both situations, the furnishers updated their systems of record to
indicate that the status of the accounts had changed but failed to
update and correct the information furnished to CRCs about these
accounts. In response to these findings, one or more furnishers are
updating account information with the relevant CRCs for all impacted
accounts and enhancing furnishing procedures.
In one or more follow up deposit account furnisher reviews to
address the furnishers' prior failure to update and correct information
when consumers paid-in-full or settled-in-full, examiners found one or
more deposit account furnishers had improved furnishing activities to
address the failure to correct and update information required by the
FCRA. To address this violation and the matters requiring attention
from the prior exam, one or more furnishers of deposit account
information took several actions, including:
[ssquf] System changes that included the creation of coding
processes to automated systems to identify consumers who paid in-full,
and where appropriate, notification to CRCs of the corrected status of
affected consumers;
[ssquf] Notification to CRCs of the correct status of paid-in-full
and settled-in-full consumer accounts;
[ssquf] Improved tracking of paid-in-full and settled-in-full
consumers and the establishment of a trigger to update the CRCs once
final payment is made without requiring consumer to notify the
furnisher;
[ssquf] Enhanced policies and procedures and new policies and
procedures to adhere to the requirements of the FCRA and Regulation V,
including modification of standards for reporting fraud or account
abuse and use of appropriate closure codes; and
[ssquf] Improved dispute monitoring and tracking, as well as
analysis of disputes to improve the accuracy and integrity of
information furnished to CRCs.
One or more deposit account furnishers adequately addressed the
matters requiring attention from the prior exam(s) and properly
notified CRCs of the correct status of all paid in full and settled in
full accounts.
2.4 Duty To Provide Notice of Delinquency of Accounts
The date of first delinquency is important for CRCs, creditors, and
consumers because it determines when information on a consumer report
becomes obsolete and may no longer be reported.\13\ The FCRA requires
furnishers of information regarding delinquent accounts to report the
date of delinquency to the CRC within 90 days.\14\ The FCRA specifies
that the date of first delinquency reported by the furnisher ``shall be
the month and year of the commencement of the delinquency on the
account that immediately preceded the action.'' \15\
---------------------------------------------------------------------------
\13\ 15 U.S.C. 1681c(a)-(b). Information may be reported if
certain exceptions specified in the statute apply.
\14\ 15 U.S.C. 1681s-2(a)(5)(A). This provision applies to
accounts being placed for collection, charged to profit or loss, or
subjected to similar action.
\15\ Id.
---------------------------------------------------------------------------
In one or more reviews, furnishers reported the incorrect date of
first delinquency. For example, one or more furnishers of auto loans
furnished the date of repossession of the collateral vehicle, rather
than the date of first delinquency. The date of repossession at this
furnisher was several months after the date of first missed payment.
2.5 Obligations Upon Notice of Dispute
Pursuant to the FCRA and Regulation V, consumers can file disputes
concerning the accuracy of information contained in a consumer report
with the CRCs as well as directly with the furnisher of that
information.\16\ Whether filed directly with the furnisher or
indirectly through a CRC, the furnisher must conduct a reasonable
investigation of the dispute.\17\ Further, for direct disputes, the
furnisher must complete its investigation of the dispute and respond to
the consumer before the expiration of the time period under section
611(a)(1) of the FCRA.\18\ Finally, if the furnisher determines that a
direct dispute is frivolous or irrelevant, it must provide notice of
that determination to the consumer.\19\
---------------------------------------------------------------------------
\16\ Disputes filed with CRCs are governed by 15 U.S.C. 1681i
and 1681s-2(b). Disputes filed directly with the furnisher are
governed by 15 U.S.C. 1681s-2(a)(8) as implemented by Regulation V,
12 CFR 1022.43.
\17\ 15 U.S.C. 1681s-2(b)(1)(A) (indirect disputes); 12 CFR
1022.43(e)(1) (direct disputes).
\18\ 15 U.S.C. 1681s-2(a)(8)(E)(iii). See also 15 U.S.C.
1681i(a)(1).
\19\ 15 U.S.C. 1681s-2(a)(F)(ii); 12 CFR 1022.43(f)(2).
---------------------------------------------------------------------------
2.5.1 Duty To Conduct Reasonable Investigation of Dispute
For disputes filed directly with furnishers, Regulation V requires
furnishers to conduct a reasonable investigation with respect to the
disputed information and review all relevant information provided by
the consumer with the dispute notice.\20\ Examiners found one or more
furnishers violated these provisions when the furnishers failed to
investigate disputes submitted by consumers. At one or more furnishers,
backlogs of thousands of direct disputes accumulated in document
processing queues and were not investigated or responded to at all.
When the furnishers discovered the
[[Page 67728]]
backlogs, the furnishers responded to the disputes pursuant to
methodologies that broadly categorized the backlogged account
correspondence, which resulted in the furnishers failing to undertake
individual investigation of the disputes in the backlogs.
---------------------------------------------------------------------------
\20\ 12 CFR 1022.43(e)(1-2).
---------------------------------------------------------------------------
For indirect disputes filed with CRCs, the FCRA requires that, upon
receiving notice of the dispute from the CRC, the furnisher must
conduct an investigation with respect to the disputed information and
review all relevant information provided by the CRC.\21\ The standard
for investigation of indirect disputes is, like direct disputes, that
the furnisher's investigation must be reasonable.\22\ Examiners found
one or more furnishers violated these provisions when the furnishers
responded to CRC notices of disputes without verifying the accuracy of
the disputed information but instead with instructions to the CRC that
the consumer should contact the furnisher directly and that the
disputed information should not be deleted. In response to these
findings, one or more furnishers are developing dispute handling
policies and procedures to ensure the investigation of disputes is in
accordance with the requirements of the FCRA.
---------------------------------------------------------------------------
\21\ 15 U.S.C. 1681s-2(b)(1)(A)-(B).
\22\ See, e.g., Johnson v. MBNA Am. Bank, 357 F.3d 426, 430-31
(4th Cir. 2004) (holding that the furnisher, after receiving notice
of a consumer dispute, must conduct a reasonable investigation to
determine whether the disputed information can be verified).
---------------------------------------------------------------------------
In another example, one or more furnishers failed to conduct
reasonable investigations of indirect disputes where the disputes
alleged identity theft. The furnishers responded to such disputes and
verified the disputed information as accurate without reviewing their
own system records as part of the investigation. Had the furnishers
reviewed their own records, examiners found, they would have seen that
some of the disputed accounts were, in fact, the result of identity
theft. In response to these findings, one or more furnishers are
developing and implementing policies and procedures with respect to
indirect identity theft disputes to ensure that the furnishers conduct
their investigation of the dispute, including a review of internal
records, prior to responding to the CRC.
2.5.2 Duty To Complete Dispute Investigations Timely
After receiving a dispute notice from a consumer, a furnisher is
required under Regulation V to complete a reasonable investigation and
report the results of the investigation to the consumer within the
timeframe required, which is generally 30 days but can be extended up
to 45 days in limited circumstances.\23\
---------------------------------------------------------------------------
\23\ 15 U.S.C. 1681s-2(a)(8)(E)(iii); 12 CFR 1022.42(e)(3). See
also 15 U.S.C. 1681i(a)(1).
---------------------------------------------------------------------------
One or more furnishers failed to complete dispute investigations
within this timeframe, resulting in delayed notice to consumers of
dispute results as well as delayed deletion of delinquencies from
consumers' credit reports. In one or more examinations, examiners found
system design flaws--including coding errors and poor work stream
management that resulted in a backlog of complaints that were not
investigated or responded to in a timely manner. At one or more
furnishers, examiners also identified inadequate control policies, poor
resource allocation, and weak oversight that led to the results of
dispute investigations not being sent to consumers. In response to
these findings, one or more furnishers are updating policies and
procedures, improving staff training, and implementing software
enhancements.
2.5.3 Duty To Notify Consumer of Determination That Dispute Is
Frivolous or Irrelevant
When consumers file disputes directly with a furnisher, Regulation
V allows the furnisher to decline to investigate the dispute if the
furnisher has ``reasonably determined that the dispute is frivolous or
irrelevant.'' \24\ A dispute qualifies as ``frivolous or irrelevant''
if (i) the consumer did not provide sufficient information to
investigate the disputed information, (ii) the consumer's dispute is
substantially the same as a dispute previously submitted by the
consumer, and the furnisher has already investigated the dispute and
responded as required, or (iii) an exception applies to the dispute
investigation requirement.\25\ If a furnisher determines that the
dispute is frivolous or irrelevant, the furnisher must provide notice
to consumers of its determination (``frivolousness notices'').\26\
Furnishers must notify the consumers of such determinations no later
than five business days after the furnishers made the determination by
mail or, if authorized by the consumer for that purpose, by any other
means available to the furnisher.\27\
---------------------------------------------------------------------------
\24\ 15 U.S.C. 1681s-2(a)(8)(F); 12 CFR 1022.43(f)(1).
\25\ 15 U.S.C. 1681s-2(a)(8)(F)(i); 12 CFR 1022.43(f)(1)(i)-
(iii).
\26\ 15 U.S.C. 1681s-2(a)(8)(F)(ii); 12 CFR 1022.43(f)(2).
\27\ Id.
---------------------------------------------------------------------------
Examiners found that one or more furnishers failed to provide
frivolousness notices to consumers when the furnisher determined that
the consumers' disputes were frivolous or irrelevant when the furnisher
believed the disputes were from credit repair organizations. When
agents for one or more furnishers determined that disputes were sent by
a credit repair agency, the disputes would be discarded as frivolous.
Although these disputes were considered frivolous, no frivolousness
notices were sent to consumers.
Examiners also found one or more furnishers failed to send
frivolousness notices for consumer disputes when they believed the
disputes were the same as another previously submitted dispute by or on
behalf of consumers that had already been investigated and addressed.
Although one or more furnishers had a policy stating that consumers
must be notified within five days of determining that the dispute is
frivolous, one or more furnishers failed to provide such notifications
to consumers.
In addition to requiring that the furnisher send frivolousness
notices, Regulation V also requires furnishers to include the reasons
for determinations that disputes are frivolous and identify any
information required to investigate the disputed information.\28\
Examiners found that one or more furnishers failed to consistently send
frivolousness notices and failed to communicate the reasons for such
determinations to the consumers. Instead, one or more furnishers simply
provided consumers with letters stating that there would be no further
correspondence unless the consumers provided new information. The
letters did not include the reason for the frivolousness determination
and did not identify information required to investigate the disputed
information as required by Regulation V. In response to these findings,
one or more furnishers updated, documented and implemented policies and
procedures to ensure they respond to all disputes, including those
determined to be frivolous, to ensure compliance with legal
requirements.
---------------------------------------------------------------------------
\28\ 15 U.S.C. 1681s-2(a)(8)(F)(iii); 12 CFR 1022.43(f)(3).
---------------------------------------------------------------------------
3. Supervisory Observations at Consumer Reporting Companies
Participants in the larger participant market for consumer
reporting include nationwide consumer reporting companies as well as
some consumer report resellers and specialty consumer reporting
companies.\29\ Recent
[[Page 67729]]
supervisory reviews of CRCs have evaluated compliance with FCRA
provisions regarding the CRC's procedures to ensure maximum possible
accuracy of information, as well as provisions regarding permissible
purpose, restriction of information resulting from identity theft, and
dispute investigation obligations.\30\ Examiners identified violations
and weaknesses in procedures associated with these FCRA provisions.
---------------------------------------------------------------------------
\29\ The term ``consumer reporting company'' means the same as
``consumer reporting agency,'' as defined in the Fair Credit
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide
specialty consumer reporting agencies as defined in 15 U.S.C.
1681a(x). The term ``reseller'' is defined in 15 U.S.C. 1681a(u).
\30\ FCRA obligations regarding accuracy procedures are detailed
at 15 U.S.C. 1681e(b); the permissible purpose provisions are
detailed at 15 U.S.C. 1681b and 15 U.S.C. 1681e(a); the ID theft
block provisions are detailed at 15 U.S.C. 1681c-2; and the dispute
process requirements applicable to CRCs are detailed at 15 U.S.C.
1681i.
---------------------------------------------------------------------------
As a result of these reviews, CRCs have continued to make
improvements to procedures regarding the accuracy of information
contained in consumer reports. CRCs have also improved procedures to
monitor users to help ensure that consumer reports are not furnished to
users when the CRC has reasonable grounds for believing the user lacks
a permissible purpose. CRCs have also implemented improvements in
procedures to block information that a consumer has identified as
resulting from an alleged identity theft and reasonably to investigate
and respond to disputes from consumers regarding the accuracy or
completeness of information in consumer files. The following sections
discuss the observations in these areas at CRCs and the improvements
made by these entities following these reviews.
3.1 Reasonable Procedures To Assure Maximum Possible Accuracy
The FCRA states that ``Inaccurate credit reports directly impair
the efficiency of the banking system. . .'' and that CRCs ``have
assumed a vital role in assembling and evaluating consumer credit and
other information on consumers.'' \31\ In recognition of this core
concern with accuracy in consumer reports, the FCRA requires that,
``[w]henever a consumer reporting agency prepares a consumer report it
shall follow reasonable procedures to assure maximum possible accuracy
of the information concerning the individual about whom the report
relates.'' \32\
---------------------------------------------------------------------------
\31\ 15 U.S.C. 1681(a)(1)-(3).
\32\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------
Examiners found that one or more nationwide specialty CRCs failed
to follow reasonable procedures to assure maximum possible accuracy by
exempting certain furnishers from a data validation testing procedure
without a valid basis. The CRCs had implemented an accuracy procedure
under which the CRCs validated the data reported by direct furnishers
on an annual basis. However, the CRCs' procedure exempted from this
validation procedure smaller direct furnishers that contributed low
volume of data. Further, the CRCs procedure also exempted all indirect
furnishers, who contributed data to the CRCs through a reseller.
Examiners concluded that the exemption of these low-volume direct
furnishers and indirect furnishers posed an unreasonable risk of
producing errors in consumer reports. In response to these findings,
one or more CRCs are conducting data validation testing on all direct
and indirect furnishers, without exceptions, and will be reporting the
results of such testing to the CFPB.
Examiners also found that one or more nationwide specialty CRCs
failed to follow reasonable procedures to assure maximum possible
accuracy by failing to properly process files furnished to the CRCs by
certain furnishers. The CRCs failed to fully process incoming data
files from multiple data furnishers on several occasions. The files
that were not properly processed resulted in the inclusion of
inaccurate, derogatory information in consumer reports. Further, for a
period of more than 12 months, the CRCs failed to receive any data from
one or more furnishers because the furnishers had applied an incorrect
technology parameter, preventing the furnishers' data files from
reaching the CRCs. This failure to receive updated data resulted in
inaccurate, derogatory information being included in consumer reports.
Subsequent to the discovery of these errors, one or more CRCs have
implemented data monitoring procedures that are designed to notify
furnishers of such data processing errors.
3.2 Duty To Limit the Furnishing of Consumer Reports to Permissible
Purposes
The FCRA states that ``there is a need to insure that consumer
reporting agencies exercise their grave responsibilities with fairness,
impartiality, and a respect for the consumer's right to privacy.'' \33\
The FCRA protects consumers' privacy, in part, by stating that CRCs may
furnish consumer reports only to persons who have a permissible purpose
to use or obtain the information in the report.\34\ Further, the FCRA
requires CRCs to maintain reasonable procedures designed to limit the
furnishing of consumer reports to users with a permissible purpose.\35\
---------------------------------------------------------------------------
\33\ 15 U.S.C. 1681(a)(4).
\34\ 15 U.S.C. 1681b(a).
\35\ 15 U.S.C. 1681e(a).
---------------------------------------------------------------------------
Supervision conducted one or more reviews of CRCs to evaluate the
entities' permissible purpose procedures. In these reviews, examiners
found that one or more CRCs have procedures to verify the identity and
permissible purposes of new prospective users, which one or more CRCs
refer to as ``credentialing.'' Further, examiners found that one or
more CRCs have procedures to monitor that users have a permissible
purpose when users obtain consumer reports.
However, examiners also found CMS weaknesses in one or more CRCs'
permissible purpose procedures. For example, one or more CRCs lacked
procedures to conduct proactive re-credentialing reviews of its users.
Under such a re-credentialing review, the CRCs review existing users to
confirm that the user continues to have a permissible purpose to use
and obtain consumer reports. Examiners found that the CRCs had
procedures to conduct re-credentialing reviews of users only when users
notified the CRCs of a change in ownership, name, status, or nature of
business or if the CRCs' monitoring identified a specific potential
permissible purpose violation by a user. The CRCs did not, however,
have a procedure to review the credentialing of users based on the
length of time since the user was previously reviewed. As a result of
these findings, one or more CRCs are implementing proactive re-
credentialing policies and procedures that consider factors such as the
time since a user was last credentialed for permissible purpose.
Examiners also found CMS weaknesses in the monitoring procedures at
one or more CRCs regarding permissible purpose. For example, one or
more CRCs failed to monitor users or resellers that requested the CRCs
delete large numbers of hard inquiry records from consumer reports.
When users obtain consumer reports from CRCs, the CRCs document that
event by entering an inquiry record in the relevant consumer's file.
Depending on the user's permissible purpose, the inquiry may be visible
for up to a year to other users/creditors that obtain the consumer's
report as well as being visible to the consumer; or instead it may be
visible only to the consumer.\36\
[[Page 67730]]
When a record of an inquiry is visible to other creditors, it is known
as a ``hard inquiry'' and when it is visible only to the consumer, it
is known as a ``soft inquiry.'' One or more CRCs have procedures that
allow users to request that the CRCs delete hard inquiries from
consumer reports, usually by converting them into soft inquiries. Users
may request such deletions to protect consumers who may be victims of
identity theft. For example, if a consumer notifies a creditor that an
account was opened in his or her name due to fraud or identity theft,
the creditor may, in addition to closing the account, contact the CRCs
and request that the CRCs delete the hard inquiry from the consumers'
credit report. But users may also ask that inquiries be deleted because
the user did not have a permissible purpose to obtain the report.
Examiners found that one or more CRCs had no procedure for monitoring
the users who requested such deletions at higher rates than usual,
which may be a risk indicator that a user is obtaining consumer reports
without any permissible purpose. As a result of these findings, one or
more CRCs are enhancing permissible purpose monitoring systems to
include user inquiry change or deletion request volume as a potential
risk area for investigation of user permissible purpose.
---------------------------------------------------------------------------
\36\ The CRC must disclose to the consumer the identity of all
users who obtained that consumer's report, pursuant to 15 U.S.C.
1681g(a)(3). For more information about the differences between hard
inquiries and soft inquiries, see CFPB, Key Dimensions and Processes
in the U.S. Credit Reporting System, at 9 (Dec. 2012).
---------------------------------------------------------------------------
3.3 Blocking Information Resulting From Identity Theft
The FCRA requires that, unless an exception applies, a CRC must
``block the reporting of any information in the file of a consumer that
the consumer identifies as information that resulted from an alleged
identity theft'' provided that the consumer provides required
information.\37\ The CRC is then required to promptly notify the
furnisher of the information identified by the consumer.\38\ The CRC
may decline to block the information, or may rescind a block, if the
CRC ``reasonably determines'' that the consumer requested the block in
error, based on a material misrepresentation of the facts, or the
consumer obtained goods, services, or money as a result of the
transaction.\39\ Finally, if the CRC determines to decline to block the
information requested by the consumer, the CRC must notify the consumer
promptly of the determination in writing or, if authorized by the
consumer for that purpose, by any other means available to the CRC.\40\
---------------------------------------------------------------------------
\37\ 15 U.S.C. 1681c-2(a).
\38\ 15 U.S.C. 1681c-2(b).
\39\ 15 U.S.C. 1681c-2(c).
\40\ 15 U.S.C. 1681c-2(c)(2).
---------------------------------------------------------------------------
Examiners found that one or more nationwide specialty CRCs violated
the requirements of this provision of the FCRA. When consumers
submitted an identity theft block request with all required underlying
documentation, the CRCs forwarded the information to furnishers and
relied on the furnishers' response without making an independent
determination, even in cases where the furnisher stated no block should
be applied. Therefore, examiners concluded that the CRCs did not
reasonably determine to decline the block and on what basis, as
required by the statute. Following this finding, one or more nationwide
specialty CRCs are changing procedures to the identity-theft block
provisions of the FCRA. These changes include adopting new policies and
procedures that require that the CRCs block the identified information
within four business days of receiving a valid identity theft report.
Revised procedures also included that for any identity theft block
request that the CRCs declines or rescinded, the CRCs includes
documentation of the rationale for denying or rescinding the block to
ensure that decisions can be monitored and audited for compliance with
the FCRA.
3.4 Dispute Investigation
Supervision has continued its focus on reviewing CRCs' compliance
with the provisions of the FCRA governing consumer disputes. In
previous issues of Supervisory Highlights, we discussed findings at one
or more CRCs regarding violations of several provisions in this
area.\41\ The FCRA right to dispute inaccurate information and have
that dispute be reasonably investigated by the CRC and relevant
furnisher is a key consumer protection in the statute. These
protections recognize that consumers may identify inaccuracies in their
own reports and sets out procedures that CRCs must follow before
allowing such information to continue to be reported.
---------------------------------------------------------------------------
\41\ See, e.g., CFPB, Supervisory Highlights, Winter 2017, at 9-
11 (March 2017).
---------------------------------------------------------------------------
In recent reviews, examiners have identified new violations of
several sub-sections of this area of the FCRA. These new violations
include failures by CRCs to conduct reasonable dispute investigations,
breakdowns in the required notification procedures to furnishers about
disputes, failures of CRCs to provide notices of results to consumers,
and failure of resellers to convey notice of disputes to CRCs that
provided the disputed information.
3.4.1 Duty To Conduct a Reasonable Reinvestigation
The FCRA requires that when a consumer disputes the completeness or
accuracy of an item of information in their file, the CRC must
``conduct a reasonable reinvestigation to determine whether the
disputed information is inaccurate and record the current status of the
disputed information, or delete the item from the file. . . .'' \42\
---------------------------------------------------------------------------
\42\ 15 U.S.C. 1681i(a)(1)(A).
---------------------------------------------------------------------------
Examiners found that one or more CRCs systematically violated this
requirement by failing to initiate investigations after notice of the
dispute. When the CRCs received disputes related to identity theft or
fraud via telephone, they instructed consumers to submit the dispute in
writing and did not initiate investigations until the consumer
resubmitted in written form. Examiners concluded that the FCRA does not
permit a CRC to decline to investigate disputes in this manner.
According to the FCRA, the CRC must conduct a dispute investigation
when it receives notice of the dispute information. As a result of
these findings, one or more CRCs enhanced their dispute resolution
process by updating policies, procedures, and training materials, and
requiring agents to initiate investigations of all disputes received
via telephone.
The FCRA also requires that, in conducting its dispute
investigation, the CRC must ``review and consider all relevant
information submitted by the consumer . . . with respect to such
disputed information.'' \43\ Examiners found that one or more CRCs
failed to review and consider all such relevant information. The CRCs
relied on the furnisher's response in validating information from a
dispute, without independently considering the relevant information or
documentation provided by the consumer when that information called
into question the accuracy or validity of the information provided by
the furnishers. In response to these findings, one or more CRCs updated
procedures to more clearly describe that agents must review all
relevant information the consumer provided. However, in a follow-up
review at one or more CRCs, examiners found that these revised
procedures were not fully implemented, causing the CRCs to continue to
fail to review and consider all relevant information provided by
[[Page 67731]]
consumers in support of disputes. The Bureau will continue to monitor
compliance in this area.
---------------------------------------------------------------------------
\43\ 15 U.S.C. 1681i(a)(4).
---------------------------------------------------------------------------
The FCRA generally requires that the CRCs' dispute investigations
must be completed ``before the end of the 30-day period beginning on
the date on which the agency receives the notice of dispute from the
consumer or reseller.'' \44\ Examiners found that one or more CRCs
failed to complete the investigation within this 30-day timeframe. The
CRCs incorrectly recorded the date of disputes filed on weekends,
holidays, and after-hours. These disputes were incorrectly recorded in
systems as being filed the next business day. As a result of these
findings, one or more CRCs took action to correct the system logic and
reassess those disputes.
---------------------------------------------------------------------------
\44\ 15 U.S.C. 1681i(a)(1)(A). Note that the 30-day period may
be extended for an additional 15 days if the CRC receives
information from the consumer during the 30-day period that is
relevant to the reinvestigation. 15 U.S.C. 1681i(a)(1)(B).
---------------------------------------------------------------------------
3.4.2 Duty To Provide Prompt Notice of Dispute to Furnisher
The FCRA requires that when a CRC receives a notice of a dispute
from a consumer, the CRC must ``provide notification of the dispute to
any person who provided any item of information in dispute. . . .''
\45\ This notice must be provided ``[b]efore the expiration of the 5-
business-day period beginning on the date on which a [CRC] receives
notice of the dispute. . . .'' \46\
---------------------------------------------------------------------------
\45\ 15 U.S.C. 1681i(a)(2)(A).
\46\ Id.
---------------------------------------------------------------------------
Examiners found that one or more CRCs violated this provision of
the FCRA when they failed to notify furnishers of a consumer's dispute
within five business days of receiving a dispute. This violation
occurred in thousands of disputes over several months. This violation
was caused by lack of adequate staffing at the CRCs and was not
detected by the CRCs' compliance monitoring. As a result of the
examination findings, the CRCs developed and implemented dispute
investigation procedures to ensure agents provide required notices to
furnishers and forward all relevant information regarding the dispute
within the mandatory time periods.
3.4.3 Duty To Notify Furnisher That Inaccurate, Incomplete, or
Unverified Information Has Been Modified or Deleted
When a CRC has completed its dispute investigation, if the CRC
finds that any disputed information is inaccurate or incomplete or
unable to be verified, the FCRA requires the CRC to ``promptly notify
the furnisher of that information that the information has been
modified or deleted from the file of the consumer.'' \47\
---------------------------------------------------------------------------
\47\ 15 U.S.C. 1681i(a)(5)(A)(ii).
---------------------------------------------------------------------------
In one or more reviews of nationwide specialty CRCs, examiners
identified instances where one or more specialty CRCs failed to notify
furnishers that information from the consumer's file had been modified
or deleted after an investigation. In these instances, one or more CRCs
were informed by the furnisher that a modification or deletion was
necessary. One or more specialty CRCs investigation agents then
modified or deleted the incorrect information but failed to inform the
furnisher of the action taken, as required by the FCRA. In other
instances, the information was internally resolved in the consumer's
favor by one or more specialty CRCs but either the CRCs did not provide
the notice to the furnishers of the modification or deletion, or they
did not provide ``prompt'' notice to the furnisher required by the
FCRA. As a result of these findings, one or more specialty CRCs
developed and implemented dispute investigation procedures to ensure
agent provide the required notice consistent with the requirements in
the FCRA.
Additionally, examiners found that one or more CRCs failed to
promptly send furnishers notices when investigations found that
information was not accurate and information was changed in the
consumer's file. One or more CRCs admitted that they failed to transmit
approximately 2.7 million notices over a period of approximately two
months. The cause for the failure was a programming error. This failure
primarily affected consumers who submitted direct disputes to
furnishers but some consumers who submitted indirect disputes to CRCs
were also affected. As a result of this finding, one or more CRCs are
fixing the programming error and enhancing their internal monitoring to
avoid future issues of this type.
3.4.4 Duty To Provide Consumer With Written Notice of Results of
Reinvestigation
The FCRA requires that, upon completion of the reasonable
reinvestigation, the CRC must provide written notice of the results to
the consumer not later than five business days after completion of the
reinvestigation.\48\ Examiners found that one or more CRCs failed to
send consumers results notices as required when the consumer sent the
CRCs a dispute that was not accompanied by a consumer identification
and certification form. In such cases, the CRCs resolved the dispute
and, where necessary updated its records, but did not send the consumer
the required notice of results. In response to these findings, one or
more CRCs are developing and implementing policies and procedures to
send consumers notifications of the results of disputes even when the
consumer did not provide a consumer identification and certification
form with the dispute.
---------------------------------------------------------------------------
\48\ 15 U.S.C. 1681i(a)(6)(A).
---------------------------------------------------------------------------
3.4.5 Duty of Reseller To Convey Notice of Dispute to the CRC That
Provided the Reseller With the Information That Is Subject of the
Dispute
The FCRA dispute provisions provide direction to resellers upon
receipt of a dispute from a consumer. These requirements include, where
applicable, providing notice of the dispute to the CRC that provided
the reseller with the disputed information. ``If a reseller receives a
notice from a consumer of a dispute concerning the completeness or
accuracy of any item of information contained in a consumer report on
such consumer produced by the reseller, the reseller shall'' determine
whether the item of information is incomplete or inaccurate as a result
of an act or omission of the reseller within five business days.\49\ If
the reseller determines that the disputed information is not incomplete
or inaccurate as a result of an act or omission of the reseller, the
reseller must convey the notice of the dispute, together with all
relevant information provided by the consumer, to each CRC that
provided the reseller with the information that is the subject of the
dispute.\50\
---------------------------------------------------------------------------
\49\ 15 U.S.C. 1681i(f)(2)(A).
\50\ 15 U.S.C. 1681i(f)(2)(B)(ii).
---------------------------------------------------------------------------
Examiners found that one or more resellers, after determining that
disputed information was not incomplete or inaccurate as a result of an
act or omission of the resellers, failed to convey to the CRCs that
provided the information the notice of the dispute together with all
relevant information provided by the consumer. In response to these
findings, one or more resellers developed and implemented dispute
investigation procedures designed to ensure agents provide required
notice of disputes to CRCs that provided the information to the
reseller.
In follow-up reviews, examiners found that one or more resellers
developed and implemented enhanced procedures designed to ensure that
the reseller(s) promptly conveyed notice of
[[Page 67732]]
disputes the reseller received to the CRC that provided the reseller
with the disputed information.
4. Conclusion
The Bureau will continue to publish Supervisory Highlights to aid
Bureau-supervised entities in their efforts to comply with Federal
consumer financial law. The report shares information regarding general
supervisory and examination findings regarding the FCRA and Regulation
V (without identifying specific institutions). This information is
shared, in part, to communicate the Bureau's supervisory expectations
to CRCs and furnishers that those institutions comply with the
applicable provisions of the FCRA and Regulation V.
Supervision's work in the consumer reporting market is ongoing and
remains a high priority. As detailed in this report, CFPB examiners
have continued to identify violations and CMS weaknesses regarding
critical FCRA and Regulation V protections. However, examiners have
also observed significant improvements in these areas, including
continued investment in FCRA-related CMS. Supervision will continue to
conduct reviews at CRCs, including resellers, as well as at furnishers
and users of consumer reports within our supervisory jurisdiction.
Dated: November 30, 2019.
Kathleen L. Kraninger,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2019-26669 Filed 12-10-19; 8:45 am]
BILLING CODE 4810-AM-P
