In OCC's new procedures, Page 9 Paragraph 1: It states in part that the FCRA may restrict activities that the GLBA permits. And the example given is ...the GLBA permits a financial institution to share a list of its customers and information such as credit scores with another financial institution to jointly market financial products/services. This communication may be considered a consumer report under the FCRA and could potentially cause the sharing financial institution to become a consumer reporting agrency. I am baffled by this...can't think through what OCC means. Can anyone provide some clarity/understanding?

I think the gist of it is that most marketing lists like this are sold by credit reporting agencies directly to the bank. Having one bank share the list with another makes that bank a CRA.

If both banks got the same list from the same agency and then collaborated, that may be allowed.

I would call your OCC regulator to be sure.

A credit score in itself is a form of a credit report. If you pass anything on but your own transaction history you would be turning yourself into a CRA from a FCRA perspective.

Thanks for the response. Banking scenario: Bank and Insurance Company jointly market mortgage life insurance to bank's mortgage customers. (Privacy reg is followed....for example, the marketing letter is sent by the insurance company to customer with both the bank and the insurance company prominently identified.) Bank gives the insurance company the mortgage customer's information which may include more than transaction experience. Based on OCC's comment, the bank would be a consumer reporting agency?

It depends on exactly what information they are providing to the insurance company. And then the follow-up question is also - why??

Is disclosing a customers age to an affilate considered personal characteristics thus making the disclosure a consumer report? Ex. Providing affilate a marketing list based on customers in a certain age group over a certain dollar amount?

I hope that one of the gurus respond to this because my institution believes that it can share this information as being based on our transactions and experiences with the customer.

The sharing of the age of a customer would not make this a consumer report - however, the age of the customer has absolutely nothing to do with transactions and experiences and would absolutely trigger the FCRA opt-out requirements.