FCRA and Authorization for Obtaining Credit Report

Issue/Inquiry

The Bank is updating its internal procedures for requesting credit reports. When is written authorization required in order to do so? When is an oral request acceptable?

Response Summary

Under the Fair Credit Reporting Act (“FCRA”), a lender can obtain a consumer report without the signature of the consumer if the consumer has requested an extension of credit. However, as a best practice, the lender should obtain a signed application or authorization in order to reduce its liability, if the consumer contends that they had not requested credit or that the Bank did not have a legitimate business need initiated by the consumer.

Federal regulatory bodies have found that a bank has a legitimate business need to obtain a consumer report for a consumer who may be a guarantor or cosigner for a business transaction, or who will be liable for a loan made to a sole proprietorship or business.

The FCRA does not cover credit reports for business entities such as corporations or limited liability companies. Business practice allows credit reports to be obtained for a business without providing authorization from the business.

Response Detail

Consumer Transactions

Under the FCRA, a consumer report can be obtained in accordance with the “written instructions of the consumer to whom it relates.” 15 U.S. Code §1681b(a)(2).

A consumer report can also be obtained without the written instructions of the consumer for other purposes specified by the FCRA, including using the information in connection with:

• A credit transaction involving the consumer for whom the information is to be furnished, and involving an extension of credit to, or review or collection of an account of, the consumer
• A legitimate business need for the information in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet the terms of the account. 15 U.S. Code §1681b(a)(3)(A) & (F).

This means that the FCRA does not require the signature of the consumer to obtain a credit report if it has a valid reason to do so. For example, an oral application for credit would be a sufficient reason for obtaining a credit report. If there is not such a reason, the lender would need the consumer’s written instructions prior to doing so. One exception is that a consumer report obtained for employment purposes can only be obtained upon the written authorization of the consumer. 15 U.S. Code §1681b(b)(1)(A)(i).

As a matter of best practice, however, the Bank should obtain a signed application or authorization from the consumer in order to reduce its exposure to liability, should the consumer contend that the consumer had not applied for credit, or that the Bank did not have a legitimate business purpose initiated by the consumer.

Business Transactions

The purpose of the FCRA is to require consumer reporting agencies to adopt reasonable procedures for furnishing consumer credit reports. A “consumer report” is a communication bearing on a consumer’s creditworthiness. A “consumer” is an individual. 12 USC §§602(b); 603(c), (d), and (f).

When an individual has accepted personal liability for the business debt, the federal regulatory agencies have interpreted the FCRA as providing a permissible purpose for the lender to obtain a consumer report on that individual, since it is a “credit transaction involving a consumer”. In such case, the requirements for obtaining a credit report for an individual would also apply when that individual is involved in a business transaction.

For example, where an individual would guarantee or cosign a loan to a business entity, such as a corporation, or is a sole proprietor or partner liable for the loan, the lender would have a legitimate business need to obtain a consumer report without obtaining the consumer’s written authorization to do so. On the other hand, if the consumer was an officer or director of the business entity and would not be personally liable for the loan, the Bank could not obtain a consumer report on that consumer without first obtaining the consumer’s written authorization. FDIC, FIL-61-2001;  FTC, Advisory Opinion to Tatelbaum, (O6-22-01).

The FCRA does not apply to credit information obtained for business entities. Therefore, the restrictions and limitations on obtaining credit reports, including those pertaining to authorization, are not applicable with respect to business entities such as corporations or limited liability companies.

Business credit reporting companies, such as Dun & Bradstreet and Equifax Business Credit, offer credit reports on businesses that can be obtained without the need of the lender to provide proof of authorization by a business. This indicates the prevailing business practice for when the information in the business credit report is publicly available, voluntarily provided by creditors, or provided to the business credit reporting company by the business itself. Such reports are obtained, not only in response to an application for credit, but also by other business entities seeking to solicit business from a company, when there has been no prior contact between the two, and no authorization from either one of them.

An application by a business for an extension of credit carries with it implicit permission to verify the credit information that it provides. Nevertheless, when a lender is verifying the business’s creditworthiness, the best practice is to obtain written authorization, especially when the lender will be contacting references provided by the applicant.

This entry was posted on Monday, February 26th, 2018 at 6:00 am.