I am trying to find a way to comply with reg requirements for obtaining customer authorization when pulling credit reports as well as certifying that they intend to apply for joint credit. Obviously, our applications usually take care of this problem except for the isolated times that the customer doesn't sign the application or the lender takes the request over the phone and the borrower never sends the application back. Does anyone have any input on how you handle these instances? (surely I'm not the only institution with these exceptions).

Would a form signed by the lender certifying that they obtained authorization be in compliance?

There is no regulatory requirement to obtain a written authorization if you have an application for credit.

In regard to intent to apply...you could use a form..state that the application was taken over phone and verify each intended applicant.

You cannot pull credit for guarantors without written authorization because they have not applied for credit (they are not borrowers).
Our commercial loan applications include authorization for credit investigation for guarantors, officers, partners, etc. so we ask guarantors to sign the application and fax it back prior to pulling credit.

§615(c)(2) of the FCRA states:
The section does not require that the user provide any kind of advanced notification to consumers before a consumer report is obtained.

Also, review §604 [Permissible purposes of reports]. A bank can obtain a consumer report for any legitimate business need that is initiated by the consumer or to review an account to determine whether the consumer continues to meet the terms of the account.

Quote:

---

You cannot pull credit for guarantors without written authorization because they have not applied for credit (they are not borrowers).

---

That is not a correct statement. You need to read the FTC's Tatelbaum II letter - excerpt below.

"Your letter advocates an alternative interpretation of Section 604(a)(3)(A), concluding that "the FCRA would permit a lender to obtain a consumer report in connection with a business credit transaction where the consumer in question is or will be personally liable on the loan, such as in the case of an individual proprietor, co-signer, or guarantor." We agree that it is reasonable to view a business transaction in which an individual has accepted personal liability for the business debt as involving the consumer, thus providing a permissible purpose for the lender to obtain a consumer report under Section 604(a)(3)(A)."

Thank you both for the correction and the references!
Long live BOL!

Yes - it is true for opening deposit accounts:

§ 604. Permissible purposes of consumer reports [15 U.S.C. § 1681b]
(a) In general. Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:
(3) To a person which it has reason to believe
(F) otherwise has a legitimate business need for the information
(i) in connection with a business transaction that is initiated by the consumer;

Adverse action is defined in the FCRA to include any action taken or determination that is adverse to the interests of the consumer. Once that happens, it triggers the FCRA Adverse Action Notification requirements.

I probably should have phrased that second part better. The notice i'm referring to in 606 is the following...

a) A person may not procure or cause to be prepared an investigative consumer report on any consumer unless--
(1) it is clearly and accurately disclosed to the consumer that an investigative consumer report including information as to his character, general reputation, personal characteristics, and mode of living, whichever are applicable, may be made, and such disclosure (A) is made in a writing mailed, or otherwise delivered, to the consumer, not later than three days after the date on which the report was first requested, and (B) includes a statement informing the consumer of his right to request the additional disclosures provided for under subsection (b) of this section and the written summary of the rights of the consumer prepared pursuant to section 609(c);

We disclose this on our deposit account information sheet filled out after the CB is pulled. If the individual is declined for an account because of the CB they wouldn't fill out the deposit account information sheet and therefore wouldn't receive the notification. In the case of a decline would we still have to issue this notification in writing separately? Or would the adverse action letter serve this function if mailed within three days?

You perform "investigative consumer reports" on all your deposit accounts? That is highly unusual and has to be awful expensive.

Your comment promted me to look up the difference between an investigative and regular consumer report. We pull a consumer report versus investigative consumer report. Thanks for the help.

Hi Kids,

Welcome back from 2006. We've recently received a number of spot-check audits from our credit vendor requesting evidence of written authorizations before pulling credit. This has been on new credits as well as renewals and modifications.

While we always obtain an application on consumer credit, it's sometimes via email (I need a loan) or another form for commercial or renewal credits.

I've always hung my hat on the "permissible purpose" rule, but the vendor is hammering us for written authorization.

Any thoughts?

Since there doesn't need to be a written application for many transactions that might involve a consumer report (including consumer loans), a written authorization to pull credit is an overreach by your vendor. Certainly, a written authorization satisfies the law, but all that is required (FCRA §604(a)(3)) is that the CRA has reason to believe that you

(A) intend to use the info in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; or
* * * *
(F) otherwise have a legitimate business need for the information

(i) in connection with a business transaction that is initiated by the consumer; or

(ii) to review an account to determine whether the consumer continues to meet the terms of the account.

Thus, there doesn't even have to be a consent by the consumer for the pulling of the report for such purposes, assuming the record isn't frozen or otherwise access-blocked.

Norman - read your CB contract with a fine tooth comb regardless of what the FCRA says.

Thank you both; John I didn't think anything had changed. Randy, that's the tack I'm going to take next.

I want to understand this correctly, the borrower is not required to sign the authorization to pull credit? Therefore if we have an online application when they submit they are not required to "e-sign"?

I have no idea what E-Sign has to do with permissible purposes under the FCRA when someone submits a credit application.

I am referring to when they submit an online application. Currently we have them sign the application as well as the authorization to pull credit and we do that through E-sign.

You do not need a signed authorization to pull credit if the consumer is submitting a loan application, as you have an automatic permissible purpose under 604(a)(3)(A).

Sec. 604. Permissible purposes of consumer reports
(a) In general. Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:

(1) In response to the order of a court having jurisdiction to issue such an order, or a subpoena issued in connection with proceedings before a Federal grand jury.

(2) In accordance with the written instructions of the consumer to whom it relates.

(3) To a person which it has reason to believe

(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer;

There is one place where you might need to address the E-Sign aspect of an online application. Reg B defines an application as a request for credit made in accordance with procedures used by the creditor - 12 CFR 1002.2(f). If your procedures for applications specify that the applications submitted via your online application process must be E-Signed, then you'll need to follow those procedures. But as Randy says, that has nothing to do with having a permissible purpose to obtain a credit report which does not require any signature if being done under 604(a)(3)(A). Now, there are some very good reasons to have them sign (whether in ink or via E-Sign) an application form, including recourse in the event of incorrect information having been provided to induce the making of a loan.

Thank you both. We are looking at switching how we do online applications (we get so few) and this helps a lot.

Can someone tell me what the criteria are for pulling credit reports on existing commercial borrowers. Does there have to be activity or a lack of activity (i.e. non-payment)? Does the collection process give you a permissible purpose to pull? I'm thinking you can't just pull on a loan paying as agreed just because you want to know how John Doan is doing these days.

Thanks. Go easy on me. Back at it after being out of banking for a bit. Previously BOL HRH Okie Banker for many years.

If the individual is personally liable on the debt, then you would have a permissible purpose to pull credit in the collection of the account. You would not be able to pull credit just to see how they were doing, unless it was under some sort of review in determining future eligibility or change in terms. Those would not be possible on a closed-end credit unless you had specific covenants built into the loan agreement.

If they are not personally liable on the debt, then you would need written permission.

Thank you.