Some secondary market entities would impose a requirement for a new credit report. However if you are not planning to sell the loan and are only relying on your own underwriting criteria, you have flexibility. That being said, this is an issue of risk. The best place to bring it up is in the context of risk assessment and risk management. Using an out-of-date credit report on a current customer leaves you unaware of what that customer has been doing with other debts. Increasingly, lenders consider it prudent risk management to find out.