What is the ‘FCRA’?

Published in

Golden Data

39 min readMay 18, 2019

The Fair Credit Reporting Act (FCRA) is a U.S. federal law that protects the accuracy, fairness, and privacy of information used to make credit, employment, insurance, and other decisions and to regulate the use and dissemination of ‘consumer reports’ (CRs). The statute establishes requirements on ‘consumer reporting agencies’ (CRAs), ‘users’, ‘furnishes’, and other entities regarding the provision, disclosure, use and disposal of CRs.

In 2003, amendments collectively known as FACTA modified FCRA to enhance consumer protections. Among other things, FACTA authorized new regulations to improve notifications for pre-screened offers of credit or insurance and introduced new restrictions on the use of information for marketing purposes (known as the ‘Affiliate Marketing Rule’), and new provisions to prevent identity theft.

Effective day: 1970 (Full compliance is expected)

Relationship to other laws:

Who is regulated by FCRA (Territorial Scope)?

The FCRA does not specifically address its territorial scope but it applies primarily to ‘consumer reporting agencies’ (CRAs), ‘Users’; and ‘Furnishers’. FCRA also imposes certain obligations on (i) businesses that transact with identity thieves; (ii) card issuers and merchants that accept cards; (iii) businesses that make or arrange loans; and (iv) debt collectors.

(1) ‘Consumer reporting agency’ (CRAs):

A CRA is any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing ‘consumer reports’ to third parties.

National credit reporting bureaus like TransUnion, Experian, and Equifax are leading examples of CRAs but employment/tenant/check and bank screening companies, and data brokers, mobile applications, and data base companies (e.g. LexisNexis, Westlaw, and eFunds if the information they disclosed is provided to insurance companies, banks, or any other entity to make credit eligibility or employment decisions) can also be CRAs.
Banks and other financial institutions are not typically CRAs but are likely to have obligations under FCRA as users or furnishes/marketers of credit or insurance products/employers (see below).
There is no affirmative obligation for an organization to self-identify as a CRA before a governmental agency.

See; 15 U.S.C. § 1681a (f), Case Study: FTC v Spokeo (data brokers are subject to FCRA), Case study: FTC Warns Mobile Apps can be subject to FCRA,

See also; Case study: LexisNexus $13.5M settlement over violations of FCRA; and Case study: ChoicePoint $15M settlement with FTC (database companies liability under FCRA)

See, CFPB’s List of Consumer Reporting Agencies (incomplete list periodically updated based on companies’ own self-descriptions / the list does not reflect a determination by the CFPB that a particular organization is a CRA)

CRA Reseller: a CRA reseller is a CRA that: (i) “assembles and merges information contained in the database of another CRA or multiple CRAs concerning any consumer for purposes of furnishing such information to any third party, to the extent of such activities”; and (ii) “does not maintain a database of the assembled or merged information from which new consumer reports are produced.” See, 15 U.S.C. § 1681a(u).

(2) ‘Users’ fo a consumer report

A ‘user’ is a person that obtains from a CRA (or any other person) a consumer report about a consumer. See, 15 U.S.C. § 1681m

(3) ‘Furnishers’

A ‘furnisher’ is any entity that provides information to CRAs about consumers to be included in consumer reports. See, 15 U.S.C. § 1681s-2

(4) Business that enter into commercial transactions with identity thieves

Businesses that provide credit to, provide for consideration products, goods or services to, accept payment from or otherwise enter into commercial transactions for consideration with identity thieves and that receive requests for pertinent records from the victims are required to comply with certain disclosure requirements to victims of identity theft. See, 15 U.S.C. § 1681g(e)(1)

(5) Card issuers

Credit card and debit card issuers are required to comply with certain address verification requirements. See, 15 U.S.C. § 1681m(e)(1)(c)/ 12 C.F.R. § 222.91)

(6) Merchants that accept credit and debit cards

Merchants that accept credit cards or debit cards for payment and who print electronic receipts are required to comply with certain receipt truncation requirements. See, 15 U.S.C. §§ 1681c(j)(1)-(3)

(7) Businesses that make or arrange loans

Businesses that make or arrange loans and use credit scores in connection with consumer applications for closed-end loans or the establishment of open-end loans secured by certain types of residential property are required to comply with certain disclosure requirements. See, 15 U.S.C. § 1681g(g)

(8) Debt collectors

Debt collectors that are notified by consumers that the debts that the debt collectors are attempting to collect are fraudulent or the result of identity theft are required to comply with certain disclosure requirements. See, 15 U.S.C. § 1681m(g)

What is regulated by FCRA (Material Scope)?

In general, the FCRA regulates the provision, disclosure, use and disposal of ‘consumer reports’ of a ‘consumer’

(1) Provision, disclosure, use and disposal

(2) Consumer report

A “consumer report” is, a communication of information bearing on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for: (i) credit or insurance to be used primarily for personal, family, or household purposes; (ii) employment purposes; or (iii) any other FCRA permissible purpose. See, 15 U.S.C. § 1681a(d)

Investigative consumer report: A CR that pertains to the consumer’s character, general reputation, personal characteristics, or mode of living obtained through interviews with friends, family, neighbors or associates is an ‘investigative consumer report’. See, 15 U.S.C. § 1681a (e)

(3) Consumer

A consumer is an “individual.” The protections of FCRA do not extend to partnerships, corporations, or other business.

See, 15 U.S.C. § 1681a(c)

What rights do individuals have under FCRA (Data subject Rights)?

Right to access

Right to object (dispute and correct information)

Right to limit the sharing

Right to be informed

The FCRA imposes various obligations on CRAs, users of consumer reports, and others to provide notices to individuals, including an “affiliate-sharing notice” (15 U.S.C. § 1681a(d)(2)(A)(iii), an “affiliate-marketing notice” (see, e.g., 12 C.F.R. § 222.23; 16 C.F.R. § 680.23; 12 C.F.R. § 1022.23), an “adverse action” notice (15 U.S.C. § 1681a(k)), a notice in connection with a “prescreened” solicitation for a firm offer for credit or insurance (15 U.S.C. § 1681m(d), 16 C.F.R. pt. 642; 16 C.F.R. pt. 698, App. A), and notice that a consumer report may be obtained for employment purposes (15 U.S.C. § 1681b(b)(2)(A)).

Required Content:

A. Users of Consumer Reports

(1) Affiliate-Sharing Notice. In order to avoid being considered a CRA, before a person can share with its affiliates information that is not based solely on transactions or experiences between the person and the consumer and that otherwise would be a consumer report, the person must provide the consumer with an opportunity to prevent, or “opt-out” of the communication of information among the person’s affiliates and the consumer must not elect to opt out. Specifically, the person (or one of its affiliates) must clearly and conspicuously disclose to the consumer (that is, provide a notice) that “other information” may be communicated among the person’s affiliates. 15 U.S.C. § 1681a(d)(2)(A)(iii).

(2) Affiliate-Marketing Notice.

(a) Notice Requirement. Any person that receives from an affiliate information that would be a consumer report, but for the exclusions from the definition of consumer report that permit affiliate sharing (15 U.S.C. §§ 1681a(d)(2)(A)(i)-(iii)), may not use that information to make a “solicitation” (15 U.S.C. § 1681s-3(d)(2)) for marketing purposes to a consumer about its products or services, unless:

(i) it is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons for purposes of making such solicitations;

(ii) the consumer is provided an opportunity and a simple method to prohibit the making of such solicitations by suchperson; and

(iii) the consumer does not opt out.

15 U.S.C. § 1681s-3(a)(1).

The regulations implementing the statutory provisions require a notice to be “clear, conspicuous, and concise,” and to include the following items:

(i) the name of the affiliate(s) providing the notice, which can be satisfied by using the common name shared by the affiliates (e.g., “all of the ABC companies”);

(ii) a list of the affiliates or types of affiliates whose use of eligibility information is covered by the notice, which also may be satisfied by using a common name shared by the affiliates;

(iii) a general description of the types of eligibility information that may be used to make solicitations to the consumer;

(iv) that the consumer may elect to limit the use of eligibility information to make solicitations to the consumer;

(v) that the consumer’s election will apply for the specified period of time stated in the notice and, if applicable, that the consumer will be allowed to renew the election once that period expires;

(vi) if the notice is provided to consumers who may have previously opted out, such as if a notice is provided to consumers annually, that the consumer who has chosen to limit solicitations does not need to act again until the consumer receives a renewal notice;

(vii) a reasonable and simple method to opt out; and

(viii) if two or more consumers jointly obtain a product or service, a single opt-out notice may be provided and must explain how an opt-out direction by a joint consumer will be treated. If each consumer is permitted to opt out separately, one of the joint consumers must be allowed to opt out on behalf of all of the joint consumers.

See, e.g., 12 C.F.R. § 222.23; 16 C.F.R. § 680.23; 12 C.F.R. § 1022.23.

At the time that a consumer’s opt-out is no longer effective (5 years), a person may not use covered information received from an affiliate to make marketing “solicitations” (15 U.S.C. § 1681s-3(d)(2)) to the consumer, unless the consumer receives a notice and an opportunity, using a simple method, to extend the opt-out for another period of at least 5 years. 15 U.S.C. §§ 1681s-3(a)(3)(A), (B). See, e.g., 12 C.F.R. § 222.27; 16 C.F.R. § 680.27; 12 C.F.R. § 1022.27.

(b) Exceptions. The affiliate marketing notice and opt-out requirements do not apply to a person:

(i) using information to make a marketing “solicitation” (15 U.S.C. § 1681s-3(d)(2)) to a consumer with whom the person has a “pre-existing business relationship” (15 U.S.C. § 1681s-3(d)(1));

(ii) using information to facilitate certain communications relating to employee benefit plans;

(iii) using information to perform services on behalf of an affiliate, except a person may not send solicitations on behalf of an affiliate if the affiliate would not be permitted to send the solicitation on its own behalf as a result of the consumer’s opt-out;

(iv) using information in response to a communication initiated by the consumer;

(v) using information in response to solicitations authorized or requested by the consumer; or

(vi) if compliance with the affiliate-marketing requirements by that person would prevent compliance by the person with a State insurance law pertaining to unfair discrimination in a State in which the person is lawfully doing business.

15 U.S.C. § 1681s-3(a)(4). See, e.g., 12 C.F.R. §§ 222.20(b)(4), 222.21(c)-(d); 16 C.F.R. §§ 680.3(j), 680.21(c)-(d); 12C.F.R. §§ 1022.20(b)(4), 1022.21(c)-(d).

© Combined Notices. An affiliate-marketing notice may be coordinated and consolidated with any other notice required to be provided under other law. 15 U.S.C. § 1681s-3(b). See, e.g., 12 C.F.R. § 222.23; 16 C.F.R. § 680.23; 12 C.F.R. § 1022.23.

(3) Adverse Action Notice.

If a person takes an “adverse action” (15 U.S.C. § 1681a(k)) based in whole or in part on information in a consumer report, the person must provide the consumer with notice of:

(i) the adverse action;

(ii) the contact information for the CRA that furnished the report and a statement that the CRA did not make the decision to take and cannot provide the reasons for the adverse action;

(iii) a disclosure of a numerical credit score used by the person in taking any adverse action and the range of possible credit scores under the scoring model used, the four key factors that adversely affected the credit score (except that if the number of inquiries adversely affected the score, it must be included even if it is a fifth key factor), the date the score was created and the name of the entity that provided the score or the credit file on which the score was created; and

(iv) the consumer’s right to obtain a free consumer report and dispute the accuracy or completeness of any information in that consumer report.

15 U.S.C. § 1681m(a).

(4) Adverse Action Based on Information Obtained from a Person Other Than a CRA. Whenever “credit” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(d)) for personal, family or household purposes involving a consumer is denied or the charge for such credit is increased based on information obtained from a person other than a CRA that bears on the consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living, the person must, at the time such adverse action is communicated to the consumer, inform the consumer of his right to make a written request for the nature of the information upon which the action was based. Upon the consumer’s written request for the reasons for such adverse action received within 60 days after learning of such adverse action, the person must, “within a reasonable period of time,” disclose the nature of the information to the consumer. Other duties apply if the information upon which the determination was based was provided by an affiliate. 15 U.S.C. § 1681m(b).

(5) Risk-Based Pricing Notice.

(a) Notice Requirement. Subject to implementing regulations, if any person uses a consumer report in connection with an application for, or a grant, extension or other provision of, “credit” (15 U.S.C. §§ 1681a(r)(5), 1691a(d)) on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person, based on a consumer report, the person must provide the consumer with a risk-based pricing notice in the form and manner required by the implementing regulations. The notice may be provided orally, in writing or electronically. 15 U.S.C. § 1681m(h).

(b) Exceptions. A person is not required to provide a risk-based pricing notice if:

(i) the consumer applied for specific material terms and was granted those terms, unless those terms were initially specified by the person after the transaction was initiated by the consumer and after the person obtained a consumer report; or

(ii) the person has provided or will provide the consumer with an adverse action notice (15 U.S.C. § 1681m(a)) in connection with the transaction.

15 U.S.C. § 1681m(h)(3).

© Content. Subject to implementing regulations, a risk-based pricing notice, at a minimum, must:

(i) include a statement that the terms offered to the consumer are set based on information from a consumer report;

(ii) identify the CRA furnishing the report;

(iii) include a statement that the consumer may obtain a copy of a consumer report from that CRA without charge;

(iv) include the contact information specified by that CRA for obtaining such consumer reports (including a toll-free telephone number in the case of a “nationwide” CRA (15 U.S.C. § 1681a(p)); and

(v) a statement informing the consumer of a credit score used by the person in making the credit decision and the range of possible credit scores under the scoring model used, the four key factors that adverse affected the credit score (except that if the number of inquiries adverse affected the score, it must be included even if it is a fifth key factor), the date the score was created and the name of the entity that provided the score or the credit file on which the score was created.

15 U.S.C. § 1681m(h)(5).

(6) Prescreening Notice.

If a person uses a consumer report in connection with a prescreened “credit” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(d)) or insurance transaction, the person must provide the consumer, along with each written, prescreened credit or insurance solicitation, with a “clear and conspicuous statement” that:

(i) information in a consumer report was used in connection with the transaction;

(ii) the consumer received the offer because the consumer satisfied the person’s criteria for creditworthiness or insurability under which the consumer was selected;

(iii) if applicable, the credit or insurance may not be extended if, after the consumer responds to the offer, the consumer does not continue to meet the criteria used to select the consumer for the offer or any applicable criteria bearing on creditworthiness or insurability or does not furnish any required collateral; and

(iv) the consumer can opt-out of credit and insurance prescreening and may exercise this right through the opt-out notification system.

15 U.S.C. § 1681m(d), 16 C.F.R. pt. 642; 16 C.F.R. pt. 698, App. A.

This statement must include the address and toll-free telephone number of the appropriate opt-out notification system. 15 U.S.C. § 1681m(d), 16 C.F.R. pt. 642; 16 C.F.R. pt. 698, App. A.

Consumer Reports Used for Employment Purposes.

(a) Disclosure to Consumers. In general, before a person may obtain a consumer report for “employment purposes” (15 U.S.C. § 1681a(h)), the person must provide a “clear and conspicuous” notice to the consumer, at any time before the consumer report is procured or caused to be procured, that a consumer report may be obtained for employment purposes. The notice must be provided in a document that consists solely of the disclosure. 15 U.S.C. § 1681b(b)(2)(A).

In addition, the consumer must authorize the procurement of the consumer report, in writing. This authorization may be made on the notice itself. 15 U.S.C. § 1681b(b)(2)(A)(ii).

(b) Certain Transportation Positions. For certain applications received for certain transportation positions, before a person may obtain a consumer report for “employment purposes” (15 U.S.C. § 1681a(h)), the person must provide the consumer with notice that a consumer report may be obtained and the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K). This notice may be provided orally, in writing or electronically. 15 U.S.C. § 1681b(b)(2)(B).

In addition, the consumer must consent orally, in writing or electronically to the procurement of the consumer report. 15 U.S.C. § 1681b(b)(2)(B)(ii).

© Adverse Action Generally. Before a person may take an “adverse action” (15 U.S.C. § 1681a(k)) based on a consumer report obtained for “employment purposes” (15 U.S.C. § 1681a(h)), the person must provide the individual to whom the consumer report relates with:

(i) a copy of the report; and

(ii) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K).

15 U.S.C. § 1681b(b)(3)(A).

(d) Adverse Action for Certain Transportation Positions. For certain applications received for certain transportation positions in which the person takes “adverse action” (15 U.S.C. § 1681a(k)), the person must provide the consumer with notice:

(i) that adverse action has been taken based on a consumer report received from a CRA;

(ii) the name, address and telephone number of the CRA (including a toll-free telephone number in the case of a “nationwide” CRA (15 U.S.C. § 1681a(p));

(iii) a statement that the CRA did not make the decision to take and cannot provide the reasons for the adverse action; and

(iv) the consumer’s right to obtain a free consumer report and dispute the accuracy or completeness of any information in that consumer report.

15 U.S.C. § 1681b(b)(3)(B).

If the consumer requests a copy of the consumer report from the person who procured the report, the person must provide the consumer with:

(i) a copy of a report; and

(ii) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K).

15 U.S.C. § 1681b(b)(3)(B)(ii).

(e) National Security Investigations. The FCRA provides exceptions to the adverse action notice requirement for consumer reports used for “national security investigations” (15 U.S.C. § 1681b(b)(4)(E)(ii)). However, upon the conclusion of a national security investigation, or upon the determination that an exception is no longer required, the government agency must provide the consumer with:

(i) a copy of the consumer report with any “classified information” (15 U.S.C. § 1681b(b)(4)(E)(i)) redacted as necessary;

(ii) notice of adverse action; and

(iii) an identification with reasonable specificity of the nature of the investigation for which the consumer report was sought.

15 U.S.C. § 1681b(b)(4)(A), (B).

(f) Employee Procurement. A communication of information will not be considered a consumer report if it is a communication:

(i) that, but for 15 U.S.C. § 1681a(d)(2)(D), would be an ICR;

(ii) that is made to a prospective employer for the purpose of procuring:

(a) an employee; or

(b) an opportunity for a natural person to work for the employer;

(iii) that is made by a person who regularly performs such procurement;

(iv) that is not used by any person for any purpose other than procuring an employee for the employer or procuring an opportunity for a natural person to work for the employer; and

(v) with respect to which:

(a) the consumer who is the subject of the communication:

(I) consents orally or in writing to the nature and scope of the communication, before the collection of any information for the purpose of making the communication;

(II) consents orally or in writing to the making of the communication to a prospective employer, before the making of the communication; and

(III) in the case of consent under the previous two clauses given orally, is provided written confirmation of that consent by the person making the communication, not later than 3 business days after the receipt of the consent by that person;

(b) the person who makes the communication does not, for the purpose of making the communication, make any inquiry that if made by the prospective employer would violate any applicable Federal or State equal employment opportunity law or regulation; and

(I) discloses in writing to the consumer, not later than 5 business days after receiving any request from the consumer for such disclosure, the nature and substance of all information in the consumer’s file at the time of the request, except that the sources of any information that is acquired solely for use in making the communication and is actually used for no other purpose, need not be disclosed other than under appropriate discovery procedures in any court of competent jurisdiction in which an action is brought; and

(II) notifies the consumer, in writing, of the consumer’s right to request the information described in the preceding clause.

15 U.S.C. § 1681a(o).

(g) Employee Misconduct Investigations. If a person takes an “adverse action” (15 U.S.C. § 1681a(k)) based on a communication of information that would be a consumer report but for 15 U.S.C. §§ 1681a(d)(2)(D), 1681a(x), the employer must disclose to the consumer a summary containing the nature and substance of the communication, except that the sources of information acquired solely for use in preparing the report need not be disclosed. 15 U.S.C. § 1681a(x)(2).

Investigative Consumer Reports.

(a) Notice Before Obtaining an ICR. A person may not obtain, or cause to be prepared, an ICR (15 U.S.C. § 1681d(e)) unless the person discloses to the consumer that an ICR, including “information as to [the consumer’s] character, general reputation, personal characteristics, and mode of living, whichever are applicable,” may be made. This disclosure must be made “clearly and accurately.” The disclosure must:

(i) be made in writing “mailed, or otherwise delivered,” to the consumer not later than 3 days after the ICR was first requested; and

(ii) include a statement informing the consumer of his right to request additional disclosures (described below) and the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K).

15 U.S.C. § 1681d(a).

(b) Disclosure After Obtaining an ICR. Any person who obtains, or causes to be prepared, an ICR must, upon the consumer’s request, “make a complete and accurate disclosure of the nature and scope of the investigation requested.” The disclosure must be made in “writing mailed, or otherwise delivered,” to the consumer within 5 days after the consumer requests the disclosure or the date that the ICR was first requested, whichever is later. The consumer’s request for such a disclosure must be made in writing and must be received by the person within a “reasonable period of time” after the person provides the notice described above. 15 U.S.C. § 1681d(b).

(9) Credit Score Disclosure by Mortgage Lenders.

Any business that makes or arranges loans and uses a credit score in connection with an application by a consumer for a closed-end loan or the establishment of an open-end loan secured by certain types of residential property must, “as soon as reasonably practicable,” provide the consumer with:

(i) certain information relating to credit scoring; and

(ii) a statutorily specified notice.

15 U.S.C. § 1681g(g).

Different requirements apply if the business uses an “automated underwriting system” or obtains a credit score from an entity other than a CRA. 15 U.S.C. § 1681g(g).

B. Furnishers

(1) Negative Information Notice. If a “financial institution” (15 U.S.C. § 1681s-2(a)(7)(G)(ii), 15 U.S.C. § 6809(3)) that extends “credit” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(d)) and that regularly and in the ordinary course of business furnishes information to a “nationwide” CRA (15 U.S.C. § 1681a(p)) furnishes “negative information” (15 U.S.C. § 1681s-2(a)(7)(G)(i)) to such a CRA regarding credit extended to a customer, the financial institution must provide a one-time, “clear and conspicuous” notice of such furnishing of negative information, in writing, to the customer. Although the notice generally may be included with any materials provided to the consumer, the notice cannot be included with the new account disclosures required by the Truth in Lending Act (15 U.S.C. § 1601 et seq.). 15 U.S.C. § 1681s-2(a)(7); 12 C.F.R. pt. 222, App. B.

(2) Furnisher Notice After Direct Consumer Dispute.

(a) Results of Investigation. After a furnisher completes its investigation of a dispute submitted directly by a consumer, the furnisher must report the results of the investigation to the consumer. 15 U.S.C. § 1681s-2(a)(8)(E)(iii).

(b) Frivolous or Irrelevant Disputes. If a furnisher determines that a consumer’s dispute is “frivolous or irrelevant,” the furnisher must notify the consumer of this determination. This notice must include:

(i) the reasons for the furnisher’s determination; and

(ii) an identification of any information required to investigate the disputed information.

15 U.S.C. §§ 1681s-2(a)(8)(F)(ii), (iii).

C. CRAs

(1) File Disclosure.

(a) Generally. Upon a consumer’s request for a disclosure of the consumer’s “file” (15 U.S.C. § 1681a(g)), a CRA must “clearly and accurately” disclose to the consumer (subject to certain exceptions):

(i) all information in the file at the time of the request;

(ii) the sources of the information in the file;

(iii) an identification of each person that obtained a consumer report relating to the consumer within certain time periods;

(iv) certain information relating to checks;

(v) a record of certain prescreening inquiries received by the CRA; and

(vi) a statement that the consumer can request a credit score, if the consumer did not do so.

15 U.S.C. § 1681g(a).

The CRA also must provide the consumer with:

(i) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K);

(ii) a toll-free telephone number through which the consumer can contact the CRA’s personnel, if the CRA is a “nationwide” CRA (15 U.S.C. § 1681a(p));

(iii) a list of the Federal agencies that enforce the FCRA and the address and an “appropriate” phone number for each agency;

(iv) a statement that the consumer may have additional rights under State law and may wish to contact a State agency regarding those rights; and

(v) a statement that a CRA is not required to remove accurate negative information from a consumer’s file, except in certain circumstances.

15 U.S.C. § 1681g1(c)(2).

(b) Free File Disclosures. A CRA may not charge a consumer for a file disclosure in certain instances. See 15 U.S.C. §§ 1681j(a) (annual disclosure by a “nationwide” CRA (15 U.S.C. § 1681a(p)), 1681j(b) (after adverse action), 1681j(c) (unemployment, public welfare assistance or file with inaccuracies), 1681j(d) (initial and extended fraud alerts). See 16 C.F.R. part 610.

(2) Credit Score Disclosure.

Upon a consumer’s request for a “credit score” (15 U.S.C. § 1681g(f)(2)(A)), a CRA must provide the consumer with (subject to certain conditions):

(i) a statement that the information and credit scoring model used by the CRA may be different than used by the lender; and

(ii) a notice that includes:

(a) a credit score;

(b) the range of possible credit scores under the model used;

(d) the date the score was created; and

(e) the name of the entity that provided the credit score or the credit file upon which the credit score was created.

15 U.S.C. § 1681g(f)(1).

The CRA also must provide the consumer with:

(i) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K);

(ii) a toll-free telephone number through which the consumer can contact the CRA’s personnel, if the CRA is a “nationwide” CRA (15 U.S.C. § 1681a(p));

(iii) a list of the Federal agencies that enforce the FCRA and the address and an “appropriate” phone number for each agency;

(iv) a statement that the consumer may have additional rights under State law and may wish to contact a State agency regarding those rights; and

(v) a statement that a CRA is not required to remove accurate negative information from a consumer’s file, except in certain circumstances.

15 U.S.C. § 1681g(c)(2).

(4) Possible Notice Regarding Public Record Information Included In A Consumer Report for Employment Purposes.

A CRA that furnishes a consumer report for “employment purposes” (15 U.S.C. § 1681a(h)) and that obtains and includes in the consumer report public record information that is likely to have an adverse effect upon a consumer’s ability to obtain employment, the CRA must generally either:

(i) at the time such public record information is reported to the user of such consumer report, notify the consumer of the fact that public record information is being reported by the CRA, together with the name and address of the person to whom such information is being reported; or

(ii) maintain strict procedures to ensure that when public record information that is likely to have an adverse effect on a consumer’s ability to obtain employment is reported it is complete and up to date.

15 U.S.C. § 1681k(a).

Subject to certain conditions, this requirement does not apply in the case of an agency or department of the U.S. Government that seeks to obtain and use a consumer report for employment purposes. 15 U.S.C. § 1681k(a).

(5) Notice of Prescreening Opt-Out System.

Any CRA that furnishes consumer reports in connection with prescreened credit or insurance transactions (15 U.S.C. § 1681b(c)) must:

(i) establish and maintain an opt-out notification system; and

(ii) annually publish in a publication of general circulation in the area served by the CRA:

(a) notice that information in consumer files maintained by the CRA may be used in connection with such transactions; and

(b) the address and toll-free telephone number for consumers to notify the CRA of the consumer’s opt-out.

15 U.S.C. § 1681b(e)(5)(A).

A CRA may establish and maintain a notification system (including a toll-free telephone number) and publish notice, on its own behalf and on behalf of its affiliates. 15 U.S.C. § 1681b(e)(5)(B).

(6) Notice After Consumer Opts Out of Prescreening.

After a consumer opts out of prescreening through the CRA’s opt-out notification system, the CRA must:

(i) inform the consumer that the opt-out is effective only for 5 years if the consumer does not submit a “signed notice of election form”; and

(ii) provide the consumer with the “notice of election form,” if requested by the consumer.

15 U.S.C. § 1681b(e)(3).

If the consumer requests the “notice of election form” at the time the consumer opts out, the CRA must provide the consumer with the form within 5 business days. 15 U.S.C. § 1681b(e)(3).

(7) Initial Fraud Alert.

(a) Right to Free File Disclosure. When a “nationwide” CRA (15 U.S.C. § 1681a(p)) includes an initial fraud alert in a consumer’s file, the CRA must inform the consumer that she may request a free copy of the file. 15 U.S.C. § 1681c-1(a)(2).

(b) File Disclosure. If the consumer makes such a request, the CRA must provide the consumer with (subject to certain exceptions):

(i) all information in the consumer’s file at the time of the request;

(ii) the sources of the information in the consumer’s file;

(iii) an identification of each person that obtained a consumer report relating to the consumer within certain time periods;

(iv) certain information relating to checks;

(v) a record of certain prescreening inquiries received by the CRA; and

(vi) a statement that the consumer can request a credit score, if the consumer did not do so.

15 U.S.C. §§ 1681c-1(a)(2), 1681g(a).

The CRA also must provide the consumer with:

(i) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K);

(ii) a toll-free telephone number through which the consumer can contact the CRA’s personnel, if the CRA is a “nationwide” CRA (15 U.S.C. § 1681a(p));

(iii) a list of the Federal agencies that enforce the FCRA and the address and an “appropriate” phone number for each agency;

(iv) a statement that the consumer may have additional rights under State law and may wish to contact a State agency regarding those rights; and

(v) a statement that a CRA is not required to remove accurate negative information from a consumer’s file, except in certain circumstances.

15 U.S.C. §§ 1681c-1(a)(2), 1681g(c)(2).

(8) Extended Fraud Alerts.

(a) Right to Free File Disclosures. When a “nationwide” CRA (15 U.S.C. § 1681a(p)) includes an extended fraud alert in a consumer’s file, the CRA must inform the consumer that she may request 2 free copies of the file within 12 months. 15 U.S.C. § 1681c-1(b)(2).

(b) File Disclosure. If the consumer makes such a request, the CRA must provide the consumer with (subject to certain exceptions):

(i) all information in the consumer’s file at the time of the request;

(ii) the sources of the information in the consumer’s file;

(iii) an identification of each person that obtained a consumer report relating to the consumer within certain time periods;

(iv) certain information relating to checks;

(v) a record of certain prescreening inquiries received by the CRA; and

(vi) a statement that the consumer can request a credit score, if the consumer did not do so.

15 U.S.C. §§ 1681c-1(b)(2), 1681g(a).

The CRA also must provide the consumer with:

(i) the summary of consumer’s rights under the FCRA (16 C.F.R. pt. 698, App. F; 12 C.F.R. pt. 1022, App. K);

(ii) a toll-free telephone number through which the consumer can contact the CRA’s personnel, if the CRA is a “nationwide” CRA (15 U.S.C. § 1681a(p));

(iii) a list of the Federal agencies that enforce the FCRA and the address and an “appropriate” phone number for each agency;

(iv) a statement that the consumer may have additional rights under State law and may wish to contact a State agency regarding those rights; and

(v) a statement that a CRA is not required to remove accurate negative information from a consumer’s file, except in certain circumstances.

15 U.S.C. §§ 1681c-1(b)(2), 16811(c)(2).

(9) Notice to Identity Theft Victims.

If a consumer contacts a CRA and expresses a belief that the consumer is a victim of fraud or (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3) involving “credit” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(d)), an “electronic fund transfer” (15 U.S.C. § 1681a(r)(4), 15 U.S.C. § 1693a(6)) or an account or transaction at or with a “financial institution” (15 U.S.C. § 1681a(f)) or other “creditor” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(e)), the CRA must provide the consumer with the summary of identity theft victims rights (16 C.F.R. pt. 698, App. E; 12 C.F.R. pt. 1022, App. I) and information on how to contact the Bureau of Consumer Financial Protection (“Bureau”) to obtain more detailed information. 15 U.S.C. § 1681g(d)(2).

If a consumer contacts a CRA that is not a “nationwide” CRA (15 U.S.C. § 1681a(p)) and indicates that the consumer has been a victim of fraud or a related crime, the CRA must provide the consumer with information on how to contact the Bureau and the “nationwide” CRAs to obtain more information. 15 U.S.C. § 1681c-1(g).

(10) Blocking of Information Resulting from Identity Theft.

(a) CRA Notice of Decline or Rescission. If a CRA declines to block information in a consumer’s file that the consumer identifies as having resulted from “identity theft” (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3) or rescinds a block, the CRA must notify the consumer of its decision. 15 U.S.C. § 1681c-2(c)(2).

(b) Notice if Blocking Requirements do not Apply to a Reseller. If a “reseller” (15 U.S.C. § 1681a(u)) receives a blocking request from a consumer, the FCRA blocking requirements do not apply to the reseller if, at the time of the consumer’s request, the reseller is not providing consumer reports that include the information that the consumer requested toblock and the reseller notifies the consumer that the consumer can report the “identity theft” (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3) to the Bureau and obtain information regarding identity theft. 15 U.S.C. § 1681c-2(d)(1).

© Notice if Blocking Requirements Apply to a Reseller. If a “reseller” (15 U.S.C. § 1681a(u)) receives a blocking request from a consumer and the FCRA blocking requirements apply to the reseller, the reseller must block the consumer report maintained by the reseller and provide the consumer with notice of the blocking. This notice must contain the name, address, and telephone number of each CRA from which the blocked information was obtained by the reseller for resale. 15 U.S.C. §§ 1681c-2(d)(2), (3).

D. Other Entities

(1) Business Records for Identity Theft Victims.

Within 30 days after a request by a “victim” (15 U.S.C. § 1681g(e)(11)), a business that has provided “credit” (15 U.S.C. § 1681a(r)(5), 15 U.S.C. § 1691a(d)) to, provided for consideration products, goods, or services to, accepted payment from or otherwise entered into a commercial transaction for consideration with, a person who has allegedly made unauthorized use of the victim’s identification, must provide the victim with application and business transaction records that evidence any transaction alleged to have resulted from “identity theft” (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3). This disclosure is subject to verification of the victim’s identity and the victim’s claim of identity theft. In addition, upon the victim’s request, the business must provide the application and business transaction records to

(i) law enforcement agencies or officers specified by the victim; or

(ii) law enforcement agencies investigating the identity theft and authorized by the victim to receive the records.

15 U.S.C. § 1681g(e)(1).

(2) Possible Card Issuer Notice of Change in Address.

Subject to implementing regulations, if a card issuer (15 U.S.C. § 1681a(r)(1)) receives notice of a change of address for an existing account, and within a short period of time (during at least the first 30 days after such notice is received) receives a request for an additional or replacement card for the same account, the card issuer may not issue the card, unless the card issuer, in accordance with reasonable policies and procedures:

(i) notifies the cardholder of the request at the cardholder’s former address and provides a means of promptly reporting incorrect address changes;

(ii) notifies the cardholder of the request by such other means as the cardholder and the card issuer previously agreed to; or

(iii) uses other means of assessing the validity of the change of address, in accordance with reasonable policies and procedures established by the card issuer in accordance with the red-flag regulations prescribed under 15 U.S.C. § 1681m(e)(1)(B).

15 U.S.C. § 1681m(e)(1)©. See, e.g., 12 C.F.R. § 222.91; 16 C.F.R. § 681.3.

(3) Debt Collector Notice. If a consumer notifies a debt collector that the debt collector is attempting to collect a debt that may be fraudulent or the result of “identity theft” (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3) and the consumer requests, the debt collector must provide the consumer with “all information to which the consumer would otherwise be entitled if the consumer were not a victim of identity theft, but wished to dispute the debt under provisions of law applicable to that person.” 15 U.S.C. § 1681m(g).

(1) Affiliate-Sharing Notice. The notice must be provided before covered information is shared with affiliates. 15 U.S.C. § 1681a(d)(2)(A)(iii).

(2) Affiliate-Marketing Notice. The notice must be provided before covered information is used to make marketing “solicitations” to the consumer (15 U.S.C. § 1681s-3(d)(2)). 15 U.S.C. § 1681s-3. See, e.g., 12 C.F.R. §§ 222.21, 222.24; 16 C.F.R. §§ 680.21, 680.24; 12 C.F.R. §§ 1022.21, 1022.24.

(3) Adverse Action Notice. The statute is silent on timing. See 15 U.S.C. § 1681m(a).

(4) Adverse Action Based on Information Obtained from a Person Other Than a CRA. If a consumer makes a written request for the reasons of the adverse action within 60 days after the consumer is notified of that action, the person must provide such reasons “within a reasonable period of time.” 15 U.S.C. § 1681m(b).

(5) Risk-Based Pricing Notice. Subject to implementing regulations, the notice may be provided “at the time of an application for, or a grant, extension, or other provision of, credit or the time of communication of an approval of an application for, or grant, extension, or other provision of, credit.” 15 U.S.C. § 1681m(h)(2).

(6) Prescreening Notice. The disclosure must be provided “with each written [prescreened] solicitation made to the consumer.” 15 U.S.C. § 1681m(d), 16 C.F.R. pt. 642; 12 C.F.R. § 1022.54(c).

(7) Consumer Reports Used for Employment Purposes.

(a) Disclosure to Consumers. The notice must be provided “at any time before the report is procured or caused to be procured.” 15 U.S.C. § 1681b(b)(2)(A).

(b) Certain Transportation Provisions. The notice must be provided “at any time before the report is procured or caused to be procured.” 15 U.S.C. § 1681b(b)(2)(B).

© Adverse Action Generally. The notice must be provided “before taking any adverse action based in whole or in part on the [consumer] report.” 15 U.S.C. § 1681b(b)(3)(A).

(d) Adverse Action for Certain Transportation Provisions. The notice must be provided “within 3 business days of taking [the adverse] action.” 15 U.S.C. § 1681b(b)(3)(B)(i).

(e) National Security Investigations. The notice must be provided “[u]pon the conclusion of” the investigation or “upon the determination that the exception” for national security investigations no longer applies. 15 U.S.C. § 1681b(b)(4)(B).

(f) Employee Procurement. If a consumer consents orally, the person must provide the consumer with written confirmation of the consent “not later than 3 business days after the receipt of the consent by that person.” 15 U.S.C. § 1681a(o)(5)(iii).

The statute is silent on the timing of the notice of the consumer’s right to request certain disclosures. See 15 U.S.C. § 1681a(o)(5)©(ii).

The disclosure concerning the nature and substance of the information in the consumer’s file must be provided “not later than 5 business days after receiving any request from the consumer for such disclosure.” 15 U.S.C. § 1681a(o)(5)©(i).

(g) Employee Misconduct Investigations. The statute is silent on timing. 15 U.S.C. § 1681a(x)(2).

(8) Investigative Consumer Reports.

(a) Notice Before Obtaining an ICR. The notice must be provided “not later than three days after the date on which the [ICR] was first requested.” 15 U.S.C. § 1681d(a)(1)(A).

(b) Disclosure After Obtaining an ICR. The disclosure must be provided “not later than five days after the date on which the [consumer’s] request for such disclosure was received from the consumer or [the ICR] was first requested, whichever is later.” 15 U.S.C. § 1681d(b).

(9) Credit Score Disclosure by Mortgage Lenders. The disclosure must be made “as soon as reasonably practicable.” 15 U.S.C. § 1681g(g)(1).

B. Furnishers

(1) Negative Information Notice. The notice may be provided “prior to, or no later than 30 days after, furnishing the negative information to a “nationwide” CRA (15 U.S.C. § 1681a(p)). 15 U.S.C. § 1681s-2(a)(7)(B)(i), 12 C.F.R. pt. 222, App. B.

(2) Furnisher Notice After Direct Consumer Dispute.

(a) Results of Investigation. The notice must be provided “before the expiration of the period under [15 U.S.C. § 1681i(a)(1), 30 or 45 days] within which a [CRA] would be required to complete its [reinvestigation] if the consumer had elected to dispute the information” directly with the CRA. 15 U.S.C. § 1681s-2(a)(8)(E)(iii).

(b) Frivolous or Irrelevant Disputes. The notice must be provided “not later than 5 business days after making the determination.” 15 U.S.C. § 1681s-2(a)(8)(F)(ii).

C. CRAs

(1) File Disclosure. The disclosure must be provided “upon [a consumer’s] request.” 15 U.S.C. § 1681g(a).

(2) Credit Score Disclosure. The disclosure must be provided “in the same timeframe” as the file disclosure (15 U.S.C. § 1681g(a)), “upon request”). 15 U.S.C. § 1681g(f)(3).

(3) Consumer Disputes.

(a) Results of Investigation.

The notice relating to the results of the investigation must be provided “not later than 5 business days after the completion of the reinvestigation.” 15 U.S.C. § 1681i(a)(6)(A).

The disclosure relating to the CRA’s procedures must be provided “by not later than 15 days after receiving [the consumer’s] request” for such information. 15 U.S.C. § 1681i(a)(7).

(b) Expedited Dispute Resolution. The notice must be provided:

(i) “prompt[ly]” by telephone; and

(ii) with a written confirmation provided “not later than 5 business days after” the deletion.

© Frivolous or Irrelevant Disputes. The notice must be provided “not later than 5 business days [after the CRA makes its] determination.” 15 U.S.C. § 1681i(a)(3)(B).

(d) Reinsertion of Deleted Information. The notice must be provided “not later than 5 business days after the reinsertion.” 15 U.S.C. § 1681i(a)(5)(B)(ii).

(e) Disputes Received Through Resellers. If a CRA receives a consumer’s dispute through a “reseller” (15 U.S.C. § 1681a(u)), the CRA must provide all notices to the reseller, which in turn must “immediately reconvey” notices to the consumer. 15 U.S.C. § 1681i(f)(3).

(4) Possible Notice Regarding Public Record Information Included in a Consumer Report for Employment Purposes. If a CRA chooses to comply by providing a notice, the notice must be provided “at the time such public record information is reported to the user of such consumer report.” 15 U.S.C. § 1681k(a)(1).

5) Notice of Prescreening Opt-Out System. The notice must be published “not less than annually.” 15 U.S.C. §

1681b(e)(5)(A)(ii).

(6) Notice After Consumer Opts Out of Prescreening.

The notice of the effective date of the consumer’s opt-out must be provided “[u]pon receipt of” the consumer’s opt-out. 15 U.S.C. § 1681b(e)(3)(A).

The disclosure of the notice of election form must be provided, upon the consumer’s request, “not later than 5 business days after” the CRA receives the consumer’s opt-out, if the consumer makes the request “at the time” he or she opts out. 15 U.S.C. § 1681b(e)(3)(B).

(7) Initial Fraud Alert.

(a) Right to Free File Disclosure. The notice must be provided “in any case in which a [“nationwide” CRA (15 U.S.C. § 1681a(p))] includes” an initial fraud alert in a consumer’s file. 15 U.S.C. § 1681c-1(a)(2)(A).

(b) File Disclosure. The disclosure must be provided “not later than 3 business days after” the CRA receives the consumer’s request for the disclosure. 15 U.S.C. § 1681c-1(a)(2)(B).

(8) Extended Fraud Alerts.

(a) Right to Free File Disclosures. The notice must be provided “in any case in which a [“nationwide” CRA (15 U.S.C. § 1681a(p))] includes” an extended fraud alert in a consumer’s file. 15 U.S.C. § 1681c-1(b)(2)(A).

(b) File Disclosure. The disclosure must be provided “not later than 3 business days after” the CRA receives the consumer’s request for the disclosure. 15 U.S.C. § 1681c-1(b)(2)(B).

(9) Notice to Identity Theft Victims. The statute is silent on the timing of both notices. 15 U.S.C. §§ 1681g(d)(2), 1681c-1(g).

(10) Blocking of Information Resulting from Identity Theft.

(a) CRA Notice of Decline or Rescission. The notice must be provided “promptly.” 15 U.S.C. § 1681c-2(c)(2).

(b) Notice if Blocking Requirements do not Apply to a Reseller. The statute is silent on timing. 15 U.S.C. § 1681c-2(d)(1).

© Notice if Blocking Requirements Apply to a Reseller. The notice must be provided “promptly.” 15 U.S.C. § 1681c-2(d)(3).

D. Other Entities

(1) Business Records for Identity Theft Victims. The disclosure must be made “not later than 30 days after the date of receipt of [an appropriate] request from [the identity theft] victim.” 15 U.S.C. § 1681g(e)(1).

(2) Possible Card Issuer Notice of Change in Address. The statute and the regulations are silent on the timing of this notice. However, because the notice is designed to alert a cardholder to a possible incident of fraud, a card issuer should “exercise diligence” commensurate with [its] own experience with identity theft” in sending the notice to the consumer. 15 U.S.C. § 1681m(e)(1)©. See 72 Fed. Reg. 63,718, 63,735 (Nov. 9, 2007).

(3) Debt Collector Notice. The disclosure must be made “upon request of the consumer to whom the debt purportedly relates.” 15 U.S.C. § 1681m(g)(2).

Delivery Method:

A. Users of Consumer Reports

(1) Affiliate-Sharing Notice. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681a(d)(2)(A)(iii).

(2) Affiliate-Marketing Notice. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681s-3. However, the regulations implementing the affiliate-marketing provisions require the opt-out notice to be provided “so that each consumer can reasonably be expected to receive actual notice. For opt-out notices provided electronically, the notice may be provided in compliance with the electronic disclosure provisions of this subpart or the provisions of section 101 of the” E-SIGN Act, 15 U.S.C. 7001. See, e.g., 12 C.F.R. § 222.26; 16 C.F.R. § 680.26; 12 C.F.R. § 1022.26.

(3) Adverse Action Notice. In general, the notice may be provided orally, in writing or electronically. But, the credit score disclosure aspect of the disclosure must be in writing or electronic. 15 U.S.C. § 1681m(a).

(4) Adverse Action Based on Information Obtained from a Person Other Than a CRA. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681m(b).

(5) Risk-Based Pricing Notice. Subject to implementing regulations, the notice may be provided orally, in writing or electronically. 15 U.S.C. § 1681m(h)(1).

(6) Prescreening Notice. The disclosure must be provided “with each written [prescreened] solicitation made to the consumer.” 15 U.S.C. § 1681m(d).

(7) Consumer Reports Used for Employment Purposes.

(a) Disclosure to Consumers. The disclosure must be provided “in writing.” 15 U.S.C. § 1681b(b)(2)(A).

(b) Certain Transportation Positions. The disclosure may be provided orally, in writing or electronically. 15 U.S.C. § 1681b(b)(2)(B).

(d) Adverse Action for Certain Transportation Positions. The notice may be provided orally, in writing or electronically. 15 U.S.C. § 1681b(b)(3)(B)(i).

(e) National Security Investigations. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681b(b)(4)(B).

(f) Employee Procurement. The confirmation of oral consent must be provided in writing. 15 U.S.C. § 1681a(o)(5)(iii).

The disclosure of the consumer’s right to request certain disclosures must be made “in writing.” 15 U.S.C. § 1681a(o)(5)©(ii).

The disclosure concerning the nature and substance of the information in the consumer’s file must be provided “in writing.” 15 U.S.C. § 1681a(o)(5)©(i).

(g) Employee Misconduct Investigations. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681a(x)(2).

(8) Investigative Consumer Reports.

(a) Notice Before Obtaining an ICR. The notice must be “made in a writing mailed, or otherwise delivered.” 15 U.S.C. § 1681d(a)(1)(A).

(b) Disclosure After Obtaining an ICR. The disclosure must “be made in a writing mailed, or otherwise delivered.” 15 U.S.C. § 1681d(b).

(9) Credit Score Disclosure by Mortgage Lenders. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681g(g)(1).

B. Furnishers

(1) Negative Information Notice. The notice must be provided “in writing.” 15 U.S.C. § 1681s-2(a)(7)(A)(ii), 12 C.F.R. pt. 222, App. B.

(2) Furnisher Notice After Direct Consumer Dispute.

(a) Results of Investigation. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681s-2(a)(8)(E)(iii).

(b) Frivolous or Irrelevant Disputes. The notice must be provided “by mail or, if authorized by the consumer for that purpose, any other means available to the person.” 15 U.S.C. §§ 1681s-2(a)(8)(F)(ii), (iii).

C. CRAs

(1) File Disclosure.

(a) Generally. The disclosure generally must be made “in writing.” However, a consumer may specify that the disclosure be made “in person,” “by telephone,” “by electronic means” or “by any other reasonable means that is available from the [CRA].” 15 U.S.C. §§ 1681g(a), 1681h(a)(2), 1681h(b).

(2) Credit Score Disclosure. The disclosure generally must be made “in writing.” However, a consumer may specify that the disclosure be made “in person,” “by telephone,” “by electronic means” or “by any other reasonable means that is available from the [CRA].” 15 U.S.C. §§ 1681g(f)(3), 1681h(a)(2), 1681h(b).

(3) Consumer Disputes.

(a) Results of Investigation.

The notice relating to the results of the investigation must be provided “by mail or, if authorized by the consumer for that purpose, by other means available to the [CRA].” 15 U.S.C. § 1681i(a)(6)(A).

The statute is silent on the delivery mechanism for the disclosure relating to the CRA’s procedures. See 15 U.S.C. § 1681i(a)(7).

(b) Expedited Dispute Resolution. The notice must be provided “by telephone” and followed with a “written confirmation.” 15 U.S.C. §§ 1681i(a)(8)(A), ©.

© Frivolous or Irrelevant Disputes. The notice must be provided “by mail or, if authorized by the consumer for that purpose, by any other means available to the [CRA].” 15 U.S.C. § 1681i(a)(3)(B).

(d) Reinsertion of Deleted Information. The notice must be provided “in writing” or, “if authorized by the consumer for that purpose, by any other means available to the [CRA].” 15 U.S.C. § 1681i(a)(5)(B)(ii).

(e) Disputes Received Through Resellers. The statute does not expressly provide a delivery mechanism. See 15 U.S.C. § 1681i(f)(3).

(4) Possible Notice Regarding Public Record Information Included in a Consumer Report for Employment Purposes. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681k(a).

(5) Notice of Prescreening Opt-Out System. The notice must be published “in a publication of general circulation in the area served by the” CRA. 15 U.S.C. § 1681b(e)(5)(A)(ii).

(6) Notice After Consumer Opts Out of Prescreening. The statute is silent on delivery mechanism. See 15 U.S.C. §§ 1681b(e)(3)(A), (B).

(7) Initial Fraud Alert.

(a) Right to Free File Disclosure. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681c-1(a)(2)(A).

(b) File Disclosure. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681c-1(a)(2)(B).

(8) Extended Fraud Alerts.

(a) Right to Free File Disclosures. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681c-1(b)(2)(A).

(b) File Disclosures. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681c-1(b)(2)(B).

(9) Notice to Identity Theft Victims.

The disclosure to a victim of fraud or “identity theft” (15 U.S.C. § 1681a(q)(3), 16 C.F.R. § 603.2; 12 C.F.R. § 1022.3) must be made “in writing.” However, a consumer may specify that the disclosure be made “in person,” “by telephone,” “by electronic means” or “by any other reasonable means that is available from the” CRA. 15 U.S.C. §§ 1681g(d)(2), 1681h(a)(2), 1681h(b).

The statute is silent on the delivery mechanism for the notice by a CRA that is not a “nationwide” CRA (15 U.S.C. § 1681a(p)) to a victim of fraud or a related crime. 15 U.S.C. § 1681c-1(g).

(10) Blocking of Information Resulting from Identity Theft.

(a) CRA Notice of Decline or Rescission. The notice must be provided “in the same manner as consumers are notified of the reinsertion of information” (15 U.S.C. § 1681i(a)(5)(B)(ii), “in writing” or, “if authorized by the consumer for that purpose, by any other means available to the” CRA). 15 U.S.C. § 1681c-2(c)(2).

(b) Notice if Blocking Requirements do not Apply to a Reseller. The notice may be provided “by any means.” 15 U.S.C. § 1681c-2(d)(1)©.

© Notice if Blocking Requirements Apply to a Reseller. The statute is silent on delivery mechanism. 15 U.S.C. § 1681c-2(d)(3).

D. Other Entities

(1) Business Records for Identity Theft Victims. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681g(e).

(2) Possible Card Issuer Notice of Change in Address.

Subject to implementing regulations, a card issuer may provide the possible notice:

(i) at the former address of the cardholder; or

(ii) by such other means of communication as the cardholder and the card issuer previously agreed to.

(3) Debt Collector Notice. The statute is silent on delivery mechanism. See 15 U.S.C. § 1681m(g)(2).

Right to object

(3) Consumer Disputes.

(a) Results of Investigation. After completing an investigation of a consumer’s dispute, a CRA must provide the consumer with the results of the investigation. This disclosure must include:

(i) a statement that the investigation is complete;

(ii) a copy of the consumer’s file as revised after the investigation;

(iii) notice that the consumer can request a description of the procedures used to determine the accuracy and completeness of the disputed information;

(iv) notice that the consumer may add a statement to the consumer’s file disputing the accuracy or completeness of the information; and

(v) notice that the consumer can request that certain notifications be provided to furnishers.

15 U.S.C. § 1681i(a)(6).

If the consumer requests a description of the procedures used to determine the accuracy and completeness of the disputed information, the CRA must provide this information within 15 days. 15 U.S.C. § 1681i(a)(7).

(b) Expedited Dispute Resolution. If a consumer’s dispute is resolved by deleting the information within 3 business days after the CRA receives the dispute, the CRA can instead:

(i) provide the consumer with “prompt” notice of the deletion by telephone;

(ii) provide notice that the consumer can request that certain notifications be provided to furnishers; and

(iii) provide written confirmation of the deletion and a copy of the consumer’s revised consumer report within 5 business days of the deletion.

15 U.S.C. § 1681i(a)(8).

© Frivolous or Irrelevant Disputes. If a CRA determines that a consumer’s dispute is “frivolous or irrelevant,” the CRA must notify the consumer of its determination, which notice must include:

(i) the reasons for the CRA’s determination; and

(ii) an identification of any information required to investigate the disputed information.

15 U.S.C. § 1681i(a)(3).

(d) Reinsertion of Deleted Information. If disputed information is deleted but later reinserted after certification of the information’s accuracy and completeness by the furnisher, the CRA must notify the consumer of the reinsertion. In addition, the CRA must provide the consumer with:

(i) a statement that the information has been reinserted;

(ii) the name, address and telephone number of any furnisher that contacted the CRA or that the CRA contacted in connection with the reinsertion; and

(iii) a notice that the consumer may add a statement of dispute to the consumer’s file.

15 U.S.C. §§ 1681i(a)(5)(B)(ii), (iii).

(e) Disputes Received Through Resellers. When a CRA completes an investigation of a consumer’s dispute received through a “reseller” (15 U.S.C. § 1681a(u)), the CRA must provide all notices to the reseller, which in turn must provide the notices to the consumer. 15 U.S.C. § 1681i(f)(3).

Resources

Legal citations

15 U.S.C. §§ 1681–1681x (Fair Credit Reporting Act — FCRA)

12 C.F.R. § 222.91 et seq. (FCR Rules)

Governmental Agencies

CFPB’s List of Consumer Reporting Agencies (incomplete list periodically updated based on companies’ own self-descriptions / the list does not reflect a determination by the CFPB that a particular organization is a CRA)

Federal Reserve Division of Consumer and Community ‘Affairs Consumer Compliance Handbook’ (See Section 3 for FCRA)

FTC ‘40 Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations’