You need the customer's permission. You are looking into her/his credit history. Yes, you would need an adverse action notice for denying based on information in the credit report.
_________________________
Hello, triple a? I got locked out of my mind...