Credit reports can be invaluable sources of information for a financial institution. They can help you determine a person's eligibility for a deposit account, show you how a loan applicant has handled credit in the past, and even provide useful insight about applicants for employment. They can also be a source for compliance violations if you don't strictly abide by the guidelines in the Fair Credit Reporting Act ("FCRA") for when, and under what circumstances, it is permissible to obtain a credit report. Some changes to the law in recent years, coupled with Federal Trade Commission interpretations, have made this area especially tricky for compliance officers.
Under the FCRA, a credit report (also called "consumer report") may only be acquired for a "permissible purpose". Section 604 of the FCRA sets forth circumstances that are considered permissible purposes. Many of the ones listed will not directly affect a financial institution. Let's take a look at the ones that do.
It is permissible for a credit report to be obtained in accordance with the "written instructions of the consumer to whom it relates." Therefore, in circumstances where you do not otherwise have a permissible purpose, you can still obtain a credit report if the consumer authorizes you, in writing, to do so.
You may obtain a consumer report if you intend to use it in connection with a credit transaction involving the consumer on whom the information is to be furnished. If Joe Blow applies for a loan, you can pull a credit report on him. The credit transaction must "involve" the person who is the subject of the credit report.
You may also obtain a credit report in connection with a review or collection of an account of the consumer. Perhaps Joe is late on some payments and you're concerned about whether his financial circumstances have changed. You can use his credit report for that determination. Or, if you are in the process of collecting on his delinquent obligation, you can procure a credit report to help you.
How and when is an individual "involved" when the credit applicant is a business? To pull a credit report on an individual in a business credit situation, do you always have to have the written authorization of the individual? New light has been shed on this subject in recent weeks. But first, a little history. . .
Many bankers were stunned in July, 2000 when the Federal Trade Commission ("FTC") issued its "Tatelbaum letter" (so named because of the recipient's last name). In it, the FTC responded to an inquiry regarding whether a permissible purpose exists under the FCRA for a business credit grantor to obtain a consumer report on an individual who is a principal, owner, or officer of a commercial loan applicant (a sole proprietorship, partnership, or corporation), or who signs a personal guarantee in connection with a commercial credit application by a third party. FTC said that there was no permissible purpose in those situations!
The FTC reasoned as follows:
The report on the individual would be a "consumer report";
To obtain the consumer report, the lender must have a permissible purpose;
A commercial transaction does not provide a "permissible purpose" for a consumer report because this is not an "extension of credit to ... the consumer" nor is it a situation where the lender has a legitimate business need for the information in connection with a business transaction that is initiated by the consumer.
Of course, with the individual's written consent, the lender could obtain the credit report, but that would require, in most cases, changes in procedures and forms, and many lenders objected to the increased hassle.
Tons of issues were raised by the opinion, from "Is the FTC's opinion binding upon insured financial institutions?" to "Is the opinion well-reasoned and a valid interpretation of the law?"
Fast forward to the end of May, 2001. At that time, the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation and Office of Thrift Supervision submitted a powerful and well-reasoned letter to the FTC expressing concerns about the Tatelbaum letter and requesting reconsideration of its conclusions. The regulators stated that they believe section 604(a)(3)(A) of the FCRA authorizes lenders to obtain a consumer report in circumstances where the individual is personally liable on business credit, such as in the case of an individual proprietor, co-signer, or guarantor.
The regulators reasoned that if a consumer is a signatory and party to the transaction, either as legal obligor (in the case of a sole proprietorship) or joint obligor (in the case in which the individual co-signs the loan), then such a credit transaction involves an extension of credit to the consumer who is the subject of the report because that consumer is legally liable for repayment of the credit.
The regulators further argued that in the case of guarantors, there is also a sound legal basis for concluding that the transaction involves an "extension of credit to ... the consumer," noting that a guarantor of the credit is obligated on the extension of credit.
And on existing loans under review or collection, the regulators claimed a similar analysis of section 604(a)(3)(A) shows that a lender would have a permissible purpose to obtain a credit report about an individual who has guaranteed, or is otherwise personally obligated to repay, a business loan.
The FTC issued a new letter (referred to in banking circles as "Tatelbaum2") in reply. In it, FTC said "We agree that it is reasonable to view a business transaction in which an
individual has accepted personal liability for the business debt as involving the consumer, thus providing a permissible purpose for the lender to obtain a consumer report under Section 604(a)(3)(A)."
Thus, under the revised opinion letter, if an individual is going to guarantee or co-sign the business loan, the new opinion clarifies that it would be permissible to obtain a credit report on the individual. If the consumer is merely a principal, owner, or officer of a commercial loan applicant/borrower and is not guaranteeing or co-signing on the debt, the original Tatelbaum opinion still stands. (Presumably, in a sole proprietorship situation where the individual is synonymous with the business, a credit report on the sole proprietor could be obtained because the sole proprietor would be legally obligated to pay the debt.)
Legitimate Business Need
It is also considered a "permissible purpose" if you obtain a consumer report when you have a legitimate business need for the information
in connection with a business transaction that is initiated by the consumer, or
to review an account to determine whether the consumer continues to meet the terms of the account.
The first hurdle you must surmount here is the requirement that there be a "legitimate business need". Then, you must either be reviewing an account to determine continued eligibility, or the business need must be in connection with a business transaction that the consumer has initiated.
If, for example, an individual applies to open a deposit account, you would have a legitimate business need in connection with a business transaction the consumer has initiated. This section of the law would not allow you to embark upon an information fishing expedition, however. It does not mean that you could call up a credit report on any customer at any time. You must satisfy the criteria for it to be a permissible purpose.
Under the FCRA, it is permissible to pull a credit report on an individual if you intend to use the information for employment purposes, but you must follow a specific procedure outlined in the Act. The term "employment purposes" when used in connection with a consumer report means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee. This means that you may obtain a report not only in connection with your initial hiring decision, but during the course of employment as you evaluate the individual for promotion, reassignment, or retention.
When you procure a consumer report on a consumer for employment purposes, however, you must first:
Make a clear and conspicuous disclosure in writing to the consumer before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes; and
Obtain the consumer's written authorization for you to procure the report.
Three important points to note:
This is one of the few instances where a disclosure is required to be in a stand-alone document. You cannot use a disclosure that is incorporated into some other form. The disclosure that you intend to procure a credit report on the individual for employment purposes must be in writing and must be in a document containing only that disclosure.
The clear and conspicuous disclosure you are required to make to the individual before obtaining their credit report for employment purposes may be made at any time - so long as it is before the credit report is obtained. This means that you could make the disclosure at the time someone becomes an employee, for example, and if you obtain authorization at that time, you can rely upon that disclosure and authorization throughout the course of their employment to continue pulling credit reports.
The disclosure itself is not enough. The consumer must authorize you in writing to procure the report for employment purposes. The authorization may be made on the disclosure itself. There is no requirement that the disclosure be given in a form the consumer can keep, so they could simply sign the authorization part of the disclosure and hand it back to you. Keep it on file to document your compliance.
Has it always been like this? No. This is one of the FCRA changes made around 1997. There's no grandfathering either, so just because you've been pulling credit reports on existing employees doesn't mean you can continue to do so. Unless you have made the required disclosure in a separate document, and obtained the written consent of the individual, you cannot pull a credit report for employment purposes.
Make sure this disclosure and consent procedure is incorporated into your employment application process for prospective employees. To cover existing employees, if you haven't already done so, you may want to provide a disclosure to all current employees, along with a cover memo requesting they sign and return the consent form. Word the authorization in such a way that it makes it clear you have a continuing right to pull the report during the course of the individual's employment.
Keep in mind that if you obtain a consumer report for employment purposes, before taking any adverse action based in whole or in part on the report, you must provide to the individual to whom the report relates--
a copy of the report; and
a description in writing of the rights of the consumer under section 609(c)(3) of the FCRA.
Make sure everyone within your institution understands the limitations on pulling credit reports and does not deviate from your procedures.
Be sure the permissible purpose for pulling a credit report is apparent from your documentation.
To guard against fraud or violations of FCRA, compare the list of credit reports you are billed for with those that you know were requested.
Determine how you can modify your procedures to obtain written consent to pull credit reports on individuals who are the principal, owner, or officer of a business credit applicant if you believe that information would aid you in your decision-making.
BankersOnline is a free service made possible by the generous support of our advertisers and sponsors. Advertisers and sponsors are not responsible for site content. Please help us keep BankersOnline FREE to all banking professionals. Support our advertisers and sponsors by clicking through to learn more about their products and services.