Does the FCRA limit what type of deposit account I can pull a "consumer report"(ChexSystems) on? I'm hearing that we can't for a time deposit...? Thanks!

FCRA does not specifically address "deposit accounts" but talks in terms of legitimate business purposes. Who are you hearing this from and on what is it based?

To answer where I heard that from, I received it from the Loan Compliance Officer (I'm Deposits) at our bank. He found this in Kirchman's Orange Book.

Here's what it says on page 4.34 of FCRA: "If a person applies for a checking account or for a point–of–sale card on an existing account, there is the potential that the account could become overdrawn. Thus the bank, in those instances, has a legitimate business purpose in obtaining the person’s credit report. On the other hand, if the person applies to open a time deposit, there is no potential of an overdraft or credit loss and therefore no legitimate business purpose for obtaining a credit report."

I'm concerned that this is correct or is Kirchman's overly conservative?

Actually that was what I was afraid of. I think that it is a conservative approach, but not one that is overly conservative when you come right down to it.

From a techincal reading of the regulation, I have a hard time actually justifying what the legitimate business purpose would be for requesting a credit report on a time deposit customer. Possibly if they were presenting a personal check to open the time deposit I think you have a case. In the case of presenting cash, I can't think of a reason. Since many banks are starting to utilize these CRAs to also perform their OFAC screening, they probably are just beginning to realize this. In the old days, I don't think that a bank would normally run a time deposit customer through the process. It may be an area that some banks need to re-think.

Anyone out there know how to trigger the "legitimate business purpose" with a time deposit customer?

To me, the legitimate business purpose for requesting a credit report (such as Chex Systems) on a savings account customer could be the bank's history of having lost money on savings account scams: customer makes initial deposit (cash or check); a few days later makes a deposit with a check on a closed account at another bank and then later in the day a withdrawal is made on a large portion of the check amount. This may be more apt to happen at a bank with multiple branches where the withdrawal is not made at the branch where account open. Reports from Chex will show this type of activity (overdrawn amount written off) if the other bank(s) reported it.

Oh, I agree with you on a savings account - no question. But I think that we are focusing on certificate of deposits to which you would not contemplate additional transactions.

Oh, sorry. You are correct. The only way you can lose on a CD is when you have an employees who is just **!#@. Had this happen once.

Lois - I think that person works here now.

A good point that rlcarey made is OFAC screening. Using ChexSystems for any new relationships. Time deposit or not, it should be checked against the OFAC list and we rely on ChexSystems for the initial check. But I'm still not sure if Kirchman's interpretation is on the mark?

We run screens on our deposit customers including CD customers as part of our Customer Identification Program. I believe this certainly qualifies as a legitimate business purpose in meeting the requirements under FCRA Section 604. Kirchman's approach is certainly a more conservative one but I think that our responsibilities to identify and verify who our customers are is the better course today.

I disagree. I don't believe that trying to confirm an identity is a legitimmate business purpose under the current FCRA. I think that in order to be in techinical compliance with FCRA you need to be sure to obtain their written permission (Sec.604(a)(2)) before proceeding with pulling a credit report on a customer opening a certificate of deposit. It may be a conservative approach, but that's the way I see it.

Update:
I had emailed Kirchman's about this issue, and questioned their reasoning. I received a called this morning. After discussing it with them, I'd have to agree...I don't like it, but there's hope. We discussed the Patriot Act, and how that will change the answer to one I like.

To satsify the verification piece of the Patriot Act, it could be accomplished by using ChexSystems, which would then fit into the section 604(a)(3)(F) of FCRA, "otherwise has a legitimate business need for the information." So, that should allow us to continue to use ChexSystems on time deposits.

The analysis would be more persuasive if its source were legislative history rather than a vendor's manual - it is someone's opinion, nothing more. Personally, I agree with Ken Babel, the query is permissible.

In its July 1998 "Kaiser" letter the FTC opined that a car dealer could pull a consumer report if it accepted a check from an individual in payment for a car. There is little to argue against the probability that the same rationale would apply to a bank accepting a check in payment for a time deposit or even the rent on a safe deposit box. The Kaiser letter did indicate that the dealer would not have a right to pull the report if the purchaser was paying cash.

On that point, it again comes down to someone's opinion as to whether a bank would have a legitimate business purpose in pulling a consumer report if the time deposit is purchased with cash. In the current environment, my strongly held personal opinion is that verifying a customer's identity by documentary or non documentary methods is a legitimate business need. That opinion loses all flexibility if the customer is paying for a time deposit with cash.

I think that I pointed out that if you took a check for the opening of the time deposit, you could make a case for pulling a credit report back up in my original "opinion". I too based that on the FTC opinion letter that you are referring too. And yes, I agree, it is just one person's opinion.

My response was more to generate some thoughtful discussion on this item than to persuade people to modify thier approach to this subject.

The question really boils down to is verificiation of an individual a legitimate business purpose for pulling a credit report. I would opine no - you need to verify the persons ID long before you pull the report. If there is someone sitting in front of you who says they are me and you pull a credit report on me and that person is not me - what justification under FCRA did you have to really pull a report on me? While I'm not saying you shouldn't use a credit report for part of your ID validation process, you better be 99.9% sure of who you are dealing with before pulling the report.

I would also like to see further discussion; this debate has practical implications. Anyone should feel free to cut in.

Just to clarify: My perspective is that the quote from the vendor manual is not conservative; it is either out of date or simply wrong. In light of the Kaiser letter, pulling a consumer report is obviously permissible if a time deposit is purchased with a check. rlcarey and I seem to agree on that point. We appear to be deadlocked on the issue of whether there is a 604(a)(3)(F)(i) "legitimate business purpose" for pulling the report if a time deposit is purchased with cash. The essence of our disagreement appears to be whether we can pull the consumer report to verify identity or whether we must verify identity to a near certainty, then find justification for pulling a consumer report. Maybe we can stir up the same issue in another FCRA paragraph.

Lenders often take consumer applications from automobile dealers over the phone. Pulling a consumer report under this circumstance comes under 604(a)(3)(A) as "involving an extension of credit." The parallel is that banks use identifying information supplied by a third party to order the report; they do not routinely establish the identity of the person sitting across the desk from the car salesman and then order the report. (Perhaps they believe the car salesman verifies identity on their behalf?) I have never heard the practice criticized as a FCRA violation, nor do I think it should be. Anyone who has might note that below to help focus the debate.

Back to the original fact situation, paying for a car in cash and opening a bank account with cash are two very different things. The car dealer may never see the customer again. In comparison, the bank is establishing an ongoing relationship. A consumer report can verify identity. I believe that fact alone justifies obtaining one in connection with a new account. The counter argument would be that verifying a consumer's identity is not a legitimate business need. Even without the impending customer identification program requirements, I do not think that is correct.

As a footnote, any fact situation where the bank is unable to obtain documentary evidence of identity; e.g. indirect lending, opening accounts over the Internet, etc. facilitates identity theft. Pulling a consumer report and using it as the "control" document for verifying information provided by the consumer in the application or a follow-up contact is one of the most effective means available in preventing identity theft. If, by pulling a consumer report, I establish that the applicant is not who he claims to be and do not make the loan, I do not expect to hear any justifiable complaints from the consumer. The victims of identity theft I have heard speak would have preferred that lenders take every possible step to unmask the fraudster.

Ken, I am going to support your stance on this issue. For our lending operations, we use the customary credit bureau consumer reports. But we also use a positive ID service for all new relationships, regardless of the accounts involved. From a CIP standpoint, I see this as sensible, and it doesn't give us a consumer's credit history where it is not needed.

Is opening a time deposit with cash 'harmless' and 'risk free?' I don't believe it is. Is the depositor laundering money via deposit secured loans or early withdrawals? Many banks do not require a consumer report to book a deposit secured loan, because the collateral is 'foolproof.' Also, it may seem harmless for an imposter to open a certificate with cash using my information. But what happens next year when the IRS tells me that I failed to report my interest earnings? You'd better believe that I'd be going after the bank on that one.

From where I sit, CIP, and AML are legitimate business purposes. After all, our regulators require that we have these programs in place.

I'll chime in on this one. We make it a practice to pull a Chex System Report on ALL clients. We do this because Chex tells us not only if they have been closed by another bank, but if their TIN matches their name (ID theft prevention) and if they have a "retail indicator", meaning they write bad checks at retail establishments. I believe that any of these reasons would be sufficient to establish a justifiable business purpose under FCRA. We would put just as much work into processing a court attachment or subpoena for someone who has a CD as someone who has a checking account, should they be sued by a business they are defrauding. Also, this is one of the few ways we have of establishing that a TIN is legitimate.
In addition, some people may know that Banks pull Chex reports when opening a DDA, but not when opening a CD. This could be a very good way for someone to establish a relationship with a bank, and then come back later to open the DDA account as an "exisiting" customer. We find this happens a lot with UTMA accounts if the CSR does not bother to pull a Chex report on the parent because the funds belong to the child and the account is being opened under the child's TIN. We have had some fraud perpetrated that way.
All things considered - why do we pull credit reports for loans? To ensure that the person we are lending money to is a acceptable risk. Why do we pull Chex reports on potential deposit clients? Same reason. I have no problem stating that we will verify the legitimacy of any person who wishes to bank with us, and Chex is one of the ways we do that. The safety and soundness of the bank is legitimate business purpose enough for me!
Leslie