What Authorization is Required to Obtain a Business Credit Report?

Question.

Bank obtains written authorizations from individuals to run credit reports. It asks whether such an authorization is necessary to obtain business credit reports on such business entities as corporations and limited liability companies.

Summary.

FCRA allows a bank to obtain a consumer report upon the written request of a consumer or when it has a legitimate business need initiated by the consumer. The consensus of Federal regulatory bodies is that, with regards business transactions, a bank has a legitimate business need to obtain a consumer report for a consumer who may be a guarantor or co-signer for a loan, or who will be liable for a loan made to a sole proprietorship or business. The ECOA and FCRA have complementary notification requirements when a consumer report is used as a basis for turning down a credit request, and Regulation B distinguishes businesses with gross annual revenues in excess of $1 million from consumers or businesses with gross annual revenues less than $1 million with regards its notification requirements. These requirements do not concern authorization to obtain a consumer report, however. FCRA does not cover credit reports for business entities such as corporations or limited liability companies. Business practice allows credit reports to be obtained for a business without providing authorization from the business.

ANALYSIS.

Fair Credit Reporting Act

The Fair Credit Reporting Act (“FCRA”) allows a bank to obtain a consumer report for any legitimate business need that is initiated by the consumer or upon the consumer’s written authorization. 15 USC §644(a)(2), (a)(3)(F)(i). The Federal regulatory agencies, including the OCC, are of the opinion that a business transaction, in which an individual has accepted personal liability for the business debt, involves a consumer in such a way as to provide a permissible purpose for the lender to obtain a consumer report. Thus, where the individual would guarantee or co-sign a loan to a business entity such as a corporation, or is a sole proprietor or partner liable for the loan, the bank would have a legitimate business need to obtain a consumer report without obtaining the consumer’s written authorization to do so. On the other hand, if the consumer was an officer or director of the business entity and would not be personally liable for the loan, the bank could not obtain a consumer report on that consumer without first obtaining the consumer’s written authorization. FTC, Advisory Opinion to Tatelbaum, (O6-22-01).

While FCRA allows a bank to obtain a consumer report without the consumer’s permission or signature, when there is a legitimate business need that is initiated by the consumer, it is better practice to have written authorization, in the event the consumer later contends that obtaining the report was unauthorized and did not concern a legitimate business need.

Equal Credit Opportunity Act

The Equal Credit Opportunity Act (“ECOA”), which is implemented by Regulation B, relates to and differs from certain requirements of FCRA with regards the use of consumer reports. The ECOA requires the disclosure of the principal reasons for denying or taking other adverse action on an application for an extension of credit. FCRA also requires a bank to disclose when it has based its decision in whole or in part on information from a source other than the applicant or its own files. When that source is a consumer report, the bank is required to make certain disclosures regarding the contents of the consumer report and from where it was obtained. The disclosures required by the ECOA and FCRA can be combined in one notice. There is a question, however, as to whether the FCRA disclosure is required for an adverse action notice given under Regulation B in response to a request for business credit. There is also a distinction drawn by Regulation B between businesses having gross annual revenues in excess of $1 million and consumers or businesses with gross annual revenues of $1 million or less, as to the timing and contents of the notice of adverse action. However, a review of these differences and distinctions indicates that they do not concern the question of the authorization for a consumer report, and so need not be considered here. 12 CFR §202.9; Regulation B – Supplement I (Official Staff Interpretations, ¶9(b)(2)-9; FRB, Consumer Compliance Outlook (Second Quarter, 2013).

Business Credit Reports

FCRA does not apply to credit information obtained for business entities. The purpose of FCRA is to require consumer reporting agencies to adopt reasonable procedures for furnishing consumer credit reports. A “consumer report” is a communication bearing on a consumer’s credit worthiness. A “consumer” is an individual. 12 USC §§602(b); 603(c), (d), and (f). Thus, the restrictions and limitations on obtaining credit reports, including those pertaining to authorization, are not applicable with regards business entities such as corporations or limited liability companies.

Business credit reporting companies such as Dun & Bradstreet and Equifax Business Credit offer credit reports on businesses which can be obtained without the need of the bank providing proof of authorization by a business. This indicates the prevailing business practice, when the information in the business credit report is publicly available, voluntarily provided by creditors, or provided to the business credit reporting company by the business itself. Such reports are obtained not only in response to an application for credit, but by other business entities seeking to solicit business from a company, when there has been no prior contact between the two, let alone authorization from one of them.

An application for an extension of credit by a business carries with it implicit permission to verify the credit information it provides. Nevertheless, when a bank is verifying the business’s credit worthiness, the better practice is to obtain written authorization, especially when the bank will be contacting references provided by the applicant.

This entry was posted on Saturday, June 14th, 2014 at 12:28 pm.