For question 1 - do you need an application? Yes. But...the application is not required to be in writing except if 1) the credit is covered by Reg B section 1002.13(a) as specified in 1002.4(c); or 2) required by state law. You do need to define your application procedures and define how you take applications for commercial loan renewals, extensions, or change in terms. This then gives you the baseline to determine if you meet the timing and notification requirements for action taken provided in Reg B. In those procedures, specify whether you will require written applications on other types of credit beyond those covered by 1002.13(a).
For question 2 - do you need a permissible purpose to pull a credit report? You ALWAYS need a permissible purpose to pull a credit report. I think your real question is whether the mere application for a renewal, extension, or change in terms in and of itself a permissible purpose. And the answer to that question is, "It depends." (typical compliance answer). If the credit is in the individual's name, then I think it's pretty clear that the application for a renewal, extension, CIT, provides a permissible purpose. If the credit is in a business name, it becomes a little murkier. The FTC Tatelbaum letter gives guidance that a permissible purpose exists for pulling credit on any consumer that will be obligated on the transaction, so if the person you are pulling credit on is a co-borrower or guarantor, then I think you have a permissible purpose. Otherwise, you'd probably want to get a written authorization in connection with the application. I generally like to take that approach anyway, and we've included language in our business application form that gives us specific authorization to pull credit on individuals that will be borrowers or guarantors on the credit and is signed by any such individuals.