It's been a number of years, but my contract with the CRAs specifically stated that the information I received was for bank use only and our contract prohibited us from disclosing to the consumer anything more than the adverse action notice.
Check with your vendor representative and have legal counsel review your vendor contract. If there's no prohibition in there, then it is a business decision.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com