Q&A: Here’s a question that a Wisconsin credit union recently asked The League’s Legal Affairs team, along with our answer. Do you have a compliance question? Contact The League’s Compliance Hotline at (800) 242-0833 or email.
Q. A recent issue of CUNA Mutual Group’s LOANLINER Compliance Solutions Quarterly Newsletter discussed Fair Credit Reporting Act restrictions on re-using consumer reports (i.e., credit reports). It said, “The FCRA… does not permit a consumer report obtained for one purpose to be used for a second purpose.” Is that right?
A. Yes, due to FCRA risks and other issues, CUNA Mutual’s assessment makes sense, including when it goes on to say:
- A consumer report obtained for the purpose of evaluating a consumer’s qualification for membership may not be used to also offer them a credit card account.
- A consumer report obtained for the purpose of reviewing an application for a home equity line of credit may not be used to evaluate a subsequent loan application for an auto loan.
FCRA Risks
Much of the concern is with Fair Credit Reporting Act compliance.
It’s hard to talk in absolutes about what is a permitted purpose under the Fair Credit Reporting Act. Unlike many other Acts of Congress, this portion of the FCRA was never subjected to the regulatory process, by which detailed guidance is developed to explain what is permitted and what is not. Instead, we need to look at exactly what the Act itself says and do our best to fill in the blanks.
- The FCRA prohibits anyone from obtaining a consumer report from a credit bureau unless the person has certified a permissible purpose for obtaining the report and certifies that it will not be used for any other purpose.
- The Act requires credit bureaus to have procedures they will follow to enforce the restriction:
“These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.” — FCRA §607. Compliance procedures [15 U.S.C. § 1681e]
Reuse of credit reports for other loans
CUNA Mutual stated:
A consumer report obtained for the purpose of reviewing an application for a home equity line of credit may not be used to evaluate a subsequent loan application for an auto loan.
One permitted purpose under the Act that is commonly relied upon by credit unions as lenders is:
…intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer….
Please note that the above FCRA clause refers to using the information in connection with a credit transaction. That appears to refer to a single transaction, not plural.
CUNA Mutual is not alone in criticizing the reuse of credit reports due to FCRA compliance risk. It has been attacked by compliance experts at Wipfli, NAFCU, Bankers Online.com, and Bankers Compliance Consulting.
Use of credit reports for marketing purposes.
There are some other permitted purposes to obtain a credit report under the FCRA, but none talks about reusing credit reports to market other products or services, such as new loans. They include such reasons as:
- intends to use the information for employment purposes (subject to FCRA rules).
- in accordance with the written instructions of the consumer to whom it relates.
- otherwise has a legitimate business need for the information:
- in connection with a business transaction that is initiated by the consumer; or
- to review an account to determine whether the consumer continues to meet the terms of the account.
When you certify that you are ordering a credit report for a permitted purpose, you are not free to use it for any other purposes, such as to cross-sell other services to the consumer.
That’s why CUNA Mutual stated, in the June 2022 article:
A consumer report obtained for the purpose of evaluating a consumer’s qualification for membership may not be used to also offer them a credit card account.
The FTC compliance staff issued an Advisory Opinion in 1999 to a financial services company that sought to use information in credit reports to market additional credit products to current and former borrowers. The FTC staff stated:
“…the credit bureau must, pursuant to Section 607(a), require the creditor to “certify the purposes for which the information is sought, and certify that the information will be used for no other purpose [emphasis added].” Because Section 604(a) provides no authority for a creditor (or any party) to use a consumer report for marketing purposes, a creditor would violate its certification by using an existing report in such a manner.”
Later, an FTC publication, 40 Years of Experience With The Fair Credit Reporting Act (2011), stated:
Sellers of goods and services do not have a permissible purpose to obtain consumer reports for marketing purposes. But see sections 603(l) and 604(c), which allow CRAs to provide creditors and insurers limited information [i.e., prescreened lists] for firm offers of credit of insurance.
Other concerns with use of stale credit reports to evaluate new credit
Besides the legalities of the Fair Credit Reporting Act, credit unions that rely on older credit reports risk the credit report being out of date. The credit report is not a static report that stays the same for a set period. A credit report is a dynamic report, generated at a given point in time on an individual basis from the database of information (mostly experience data reported by users and public record information) that is constantly being refreshed, and reanalyzed for credit scoring purposes.
It is safe to say, a credit report that is, say, two months old, will never be the same as a fresh credit report.
Even when there is no significant change in the applicant’s credit performance, a current credit report will reflect the aging of that credit performance – for better or worse. A more current credit report will reflect, in our example, two new months of credit experience – whether good or bad. It will also drop off the oldest two months of credit experience.
Take note that those two most recent months of credit experience that the credit union is deliberately choosing not to consider, by not getting the current credit report, may be most important two months in the seven years of credit experience that will be taken into account. Compared to any other two months of history, they seem to be the most predictive of future credit performance. Those two months are, presumably, the most heavily weighted in the credit scoring systems, such as FICO. That could give them a different credit score, and sometimes be enough to change the interest rate they are awarded. It might go higher, might go lower.
Sometimes the credit union could deprive itself of knowledge of a dramatic change in creditworthiness. The consumer may have taken on new credit, paid off old credit, been caught up on a delinquency, or have suddenly lapsed on their payments. They may have been garnished or levied, filed bankruptcy, had a loan charged off, or face tax liens or new judgments.
Credit scores could be outdated and inaccurate. New fraud alerts could be missed. Add to that, the Military Lending Act, where the safe harbor for relying on the credit report for determining military status has specific time limits.
In an industry that uses credit scores to decide so much, including to review applicants in a nondiscriminatory manner, reusing old credit reports and credit scores may be a significant shortcoming. It adds to the credit union’s risk on a loan, so is harmful to the credit union.
Finally, use of a stale credit report can be harmful to the applicant. Not only may they be turned down for a loan they really should have qualified for. They may, alternatively, be approved for a loan they should not have qualified for. They may be overextended by taking on the new credit.