This may be easier to analyze if you classify the Chexsystems (or its successor) report to be a consumer report, which it is. In other words, if you have the right to pull that type of report then you have the right to pull one from Equifax, etc.
Your responsibilty for notifying a consumer that she was turned down based on information provided by a third party is the same. As noted, only the name of the CRA would change.
_________________________
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.