Good points, but again IMHO, the bank did not contract with the "big 3" they contracted with (for example Credco), or one of the other providers/resellers. The bank needs to refer the customer to where "THEY - the bank" got the information that was used in the decision making. The bank did not get the info directly from Equifax, Experian or Trans Union, but from the 3rd party service provider, who used information obtained from E, E & TU.
There are mechanisms in place for the applicant to get a copy of the report that was used in underwriting, by asking the provider for it.
If the bank used a tri-merge, writing to one of the Big 3 will not get them the report that was used, and I'm sure that none of the Big 3 would even release it as the bank never ordered a report from them to John Doe. It was ordered from a reseller.
_________________________
Integrity. With it, nothing else matters. Without it, nothing else matters.