Not necessarily - You can communicate your decision on whether or not the customer is approved for the loan or not without turning yourself into a credit reporting agency. This however, is only as long as the dealer has previously informed the customer that their application was going to be specifically forwarded to your bank (this is why dealer agreements are so important)
According to the old FCRA commentary - The exemption is not limited to a simple "yes'' or "no'' response, but includes the information constituting the basis for the credit denial, because it applies to "any report."
As far as how is any of this communicated - I would make sure that it is only over secure channels.
The opinions expressed here should not be construed to be those of my employer: PPDocs.com