They would need an opt-out since this would most likely fall under section 624 - Special Rule for Solicitation for Purposes of Marketing.
Also, check your credit reporting contract also - most would prohibit you from sharing the credit report information in that manner. Additionally, you pull credit reports on all customers every two years? Depending on the account relationship - you may not have a permissible purpose to do that.
_________________________
The opinions expressed here should not be construed to be those of my employer:
PPDocs.com