Supervisory Highlights Consumer Reporting Special Edition, Issue 20 (Fall 2019), 67725-67732 [2019-26669]

Download as PDF Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices BUREAU OF CONSUMER FINANCIAL PROTECTION Supervisory Highlights Consumer Reporting Special Edition, Issue 20 (Fall 2019) Bureau of Consumer Financial Protection. ACTION: Supervisory highlights. AGENCY: The Bureau of Consumer Financial Protection (Bureau) is issuing its twentieth edition of its Supervisory Highlights. In this special issue of Supervisory Highlights, we report examination findings in the areas of consumer reporting and furnishing of information to consumer reporting companies, pursuant to the Fair Credit Reporting Act and Regulation V. The report does not impose any new or different legal requirements, and all violations described in the report are based only on those specific facts and circumstances noted during those examinations. DATES: The Bureau released this edition of the Supervisory Highlights on its website on December 9, 2019. FOR FURTHER INFORMATION CONTACT: David Wake, Senior Counsel, Office of Supervision Policy, at (202) 435–9613. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@cfpb.gov. SUPPLEMENTARY INFORMATION: SUMMARY: lotter on DSKBCFDHB2PROD with NOTICES 1. Introduction The Consumer Financial Protection Bureau (CFPB or Bureau) is committed to a consumer financial marketplace that is free, innovative, competitive, and transparent, where the rights of all parties are protected by the rule of law, and where consumers are free to choose the products and services that best fit their individual needs. To effectively accomplish this, the Bureau remains committed to sharing with the public key findings from its supervisory work to help industry limit risks to consumers and comply with Federal consumer financial law. The findings included in this report cover examinations in the areas of consumer reporting and furnishing of information to consumer reporting companies (CRCs),1 pursuant to the Fair Credit Reporting Act (FCRA) and Regulation V.2 In March 2017, the CFPB 1 The term ‘‘consumer reporting company’’ means the same as ‘‘consumer reporting agency,’’ as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x). 2 15 U.S.C. 1681 et seq. and 12 CFR part 1022. VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 published its first special edition of Supervisory Highlights dedicated to consumer reporting issues.3 This special edition of Supervisory Highlights reports on more recent supervisory findings in this area. Recent supervisory reviews of compliance with the FCRA and Regulation V have identified new violations and compliance management system (CMS) weaknesses at institutions within the CFPB’s supervisory authority. These institutions include CRCs that are larger participants in the consumer reporting market 4 as well as furnishers subject to the Bureau’s supervisory authority. These furnishers include banks, mortgage servicers, auto loan servicers, student loan servicers, and debt collectors. The information contained in Supervisory Highlights is disseminated to communicate the Bureau’s supervisory expectations to CRCs and furnishers that those institutions comply with the applicable provisions of the FCRA and Regulation V. This document does not impose any new or different legal requirements. In addition, the legal violations described in this and previous issues of Supervisory Highlights are based on the particular facts and circumstances reviewed by the Bureau as part of its examinations. A conclusion that a legal violation exists on the facts and circumstances described here may not lead to such a finding under different facts and circumstances. We invite readers with questions or comments about the findings and legal analysis reported in Supervisory Highlights to contact us at CFPB_ Supervision@cfpb.gov. 2. Supervisory Observations at Furnishers Furnishers of information play a crucial role in the accuracy and integrity of consumer reports when they provide information to CRCs. Inaccurate information from furnishers can lead to inaccurate reports and consumer and market harm. For example, inaccurate information on a consumer report can impact a consumer’s ability to obtain credit or open a new deposit or savings account at a bank. Moreover, furnishers have an important role in the dispute process when consumers dispute the accuracy of information in their consumer reports. Consumers may dispute information that appears on 3 CFPB, Supervisory Highlights (Winter 2017), available at https://files.consumerfinance.gov/f/ documents/201703_cfpb_Supervisory-HighlightsConsumer-Reporting-Special-Edition.pdf. 4 Larger participants in the consumer reporting market are defined in 12 CFR 1090.104. PO 00000 Frm 00023 Fmt 4703 Sfmt 4703 67725 their consumer report directly to furnishers (‘‘direct disputes’’) or indirectly through CRCs (‘‘indirect disputes’’). When furnishers receive direct or indirect disputes, they are required to investigate the disputes to verify the accuracy of the information furnished.5 A timely and responsive reply to a consumer dispute may reduce the impact inaccurate negative information in a consumer report may have on the consumer. The FCRA and Regulation V set forth requirements for furnishers concerning both accuracy and dispute handling. To ensure compliance with these requirements, Supervision regularly conducts reviews at furnishers subject to its supervisory authority. In recent supervisory reviews, examiners found CMS weaknesses and violations of the FCRA and Regulation V. In such cases, the furnisher(s) have taken or are taking corrective action. 2.1 Reasonable, Written Policies and Procedures Regulation V requires furnishers to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of the information relating to consumers that they provide to CRCs.6 Such policies and procedures must be appropriate to the nature, size, complexity, and scope of each furnisher’s activities.7 Furnishers must consider and incorporate, as appropriate, the guidelines of appendix E to Regulation V when developing their policies and procedures.8 In a previous issue of Supervisory Highlights, we described supervisory findings of furnishers that violated these requirements.9 In recent supervisory reviews, we have identified further violations of the Regulation V requirement for reasonable written policies and procedures. In the section below, we have highlighted key findings according to the products for which information is being furnished, in keeping with the Regulation V requirement that the procedures be ‘‘appropriate to the nature, size, complexity, and scope of the furnisher’s activities.’’ 2.1.1 Mortgage Furnishers In one or more reviews of furnishers of mortgage loans, examiners found that the furnishers’ policies and procedures 5 15 U.S.C. 1681s–2(a)(8), 15 U.S.C. 1681s–2(b); 12 CFR 1022.43. 6 12 CFR 1022.42(a). 7 Id. 8 12 CFR 1022.42(b). 9 CFPB, Supervisory Highlights, Winter 2017, at 13–17 (March 2017). E:\FR\FM\11DEN1.SGM 11DEN1 67726 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices were not appropriate to the nature, size, complexity, and scope of the furnisher’s activities. For example, one or more furnishers maintained general FCRArelated policies and procedures that did not provide sufficient guidance for responding to disputes in a timely manner or reporting credit reporting changes in furnished accounts when the status of such accounts had changed. As a result of these findings, one or more furnishers are developing and implementing reasonable furnishing procedures governing the accurate reporting of accounts designed to ensure the timely update of information to reflect the current status of consumer accounts. lotter on DSKBCFDHB2PROD with NOTICES 2.1.2 Auto Loan Furnishers In one or more reviews of furnishers of auto loans, examiners found that the furnishers’ policies and procedures did not provide sufficient guidance for conducting reasonable investigations of indirect disputes that contain allegations of identity theft. For example, the furnishers’ policies and procedures did not specify that agents investigating disputes alleging identity theft should review internal records of fraud investigations before completing dispute investigations and responding to CRCs. As a result of these findings, one or more furnishers are developing and implementing policies and procedures with respect to identity theft disputes to ensure the furnisher conducts its investigation, including review of internal records, prior to responding to the CRC. 2.1.3 Debt Collection Furnishers In one or more reviews of debt collection furnishers, examiners found that the furnishers’ policies and procedures did not differentiate between FCRA disputes, FDCPA disputes, or validation requests. In this regard, the furnishers categorized and handled direct FCRA disputes, FDCPA disputes, and validation requests the same way and without consideration for the applicable regulatory requirements. Furthermore, the policies and procedures did not address the regulatory timeframes for conducting reasonable investigations of disputes, or for reporting the results of the investigations to the consumers or to CRCs, as appropriate. Instead, the policies and procedures provided general instructions on how to indicate that accounts are disputed and how to label dispute-related correspondence from consumers. The policies and procedures did not contain any substantive instructions on how to conduct investigations of disputed VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 accounts. Following these findings, one or more furnishers are developing and implementing reasonable policies and procedures covering the steps necessary to conduct reasonable and timely investigations of disputes, as that term is defined in Regulation V. 2.1.4 Deposit Account Furnishers Examiners found that one or more furnishers of deposit account information to specialty CRCs had no written policies or procedures for furnishing such information to specialty CRCs. In response to this finding, one or more deposit account furnishers are developing and implementing reasonable written policies and procedures regarding furnishing to specialty deposit CRCs. Examiners also found that one or more deposit account furnishers did not have reasonable written policies and procedures regarding deposit account information. For example, policies and procedures did not require that the furnishers validate the data furnished to specialty deposit CRCs, causing the furnisher to inaccurately furnish consumers’ account status information to one or more specialty CRCs. One or more deposit account furnishers are evaluating the effectiveness of existing policies and procedures regarding the accuracy and integrity of information furnished to nationwide specialty CRCs and develop new written policies where appropriate. 2.1.5 Improvements in Furnishing Policies and Procedures In follow-up reviews at furnishers previously examined, examiners found that one or more furnishers had made significant improvements in furnishing policies and procedures. For example, one or more furnishers updated their policies and procedures to incorporate specific requirements to ensure dispute investigation agents conduct reasonable dispute investigations and document their work. Revised dispute investigation procedures include an extensive list of internal systems and sources that dispute agents must research when investigating a dispute. Updated procedures also dictate that the furnisher retains dispute investigation documentation and records, including imaged screenshots, for a minimum of seven years. In another example of improved furnishing policies and procedures, examiners found that one or more deposit furnishers documented improved quality monitoring procedures to impose enhanced sampling and oversight procedures regarding furnished deposits PO 00000 Frm 00024 Fmt 4703 Sfmt 4703 information. Additionally, one or more furnishers improved procedures governing when to delete, update, and correct information in its records to avoid furnishing inaccurate information to specialty CRAs. One such new procedure required the furnisher to conduct a root-cause analysis of dispute results to ensure that when dispute investigations identify systemic errors, the furnisher corrects furnished data about other accounts that were also affected by similar errors. 2.2 Prohibition of Reporting Information With Actual Knowledge of Errors The FCRA prohibits furnishers from furnishing any information relating to a consumer to any CRC if the furnisher ‘‘knows or has reasonable cause to believe that the information is inaccurate.’’ 10 However, a furnisher is not subject to this prohibition if it ‘‘clearly and conspicuously specifies to the consumer an address’’ at which consumers can send notices that specific information reported by the furnisher is inaccurate.11 CFPB examiners found that one or more furnishers furnished information they knew or had reasonable cause to believe was inaccurate. One or more furnishers reported thousands of accounts to one or more CRCs with inaccurate derogatory status codes. The accounts were furnished inaccurately because of coding errors. The furnishers had reasonable cause to believe the information was inaccurate because consumers filed disputes with one or more CRCs identifying the errors, and those disputes were forwarded to the furnishers for investigation. The furnishers, in investigating the disputes, failed to conduct root-cause analysis that would have identified the issue as a systemic source of inaccuracy. Further, the furnishers did not clearly and conspicuously specify to consumers an address at which consumers could send notices that furnished information was inaccurate. The furnishers provided an address to consumers for direct disputes, but that address was provided on the last page of lengthy consumer disclosures under a heading of ‘‘Additional Information and Use Disclosures’’ that followed topics such as ‘‘General Terms,’’ ‘‘Arbitration,’’ and ‘‘Privacy Notice.’’ Examiners concluded that these notices did not qualify as ‘‘clear and conspicuous.’’ After discovery of these inaccuracies, one or more furnishers implemented a program fix for the inaccurate coding issue and 10 15 11 15 E:\FR\FM\11DEN1.SGM U.S.C. 1681s–2(a)(1)(A). U.S.C. 1681s–2(a)(1)(C). 11DEN1 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices lotter on DSKBCFDHB2PROD with NOTICES conducted a review of all furnished accounts to identify and correct the furnishing of all affected consumers. 2.3 Duty To Correct and Update Information If a furnisher who ‘‘regularly and in the ordinary course of business furnishes information to one or more [CRCs] about the person’s transactions or experiences with any consumer’’ has furnished to a CRC information that the furnisher determines is not complete or accurate, it shall promptly notify the CRC of that determination and provide to the CRC any corrections to that information, or any additional information, that is necessary to make the information provided to the CRC complete and accurate, and shall not thereafter furnish to the CRC any of the information that remains not complete or accurate.12 The CFPB has identified violations of this provision in one or more recent furnisher reviews. For example, in one or more reviews of auto loan furnishers, examiners found that the furnishers failed to provide prompt notifications to CRCs of their determinations that information they had previously furnished was inaccurate because the furnishers had found that the loans had been opened as a result of identity theft. In such cases, the furnishers recorded the results of their investigations internally, but failed to make the corrections necessary to make the furnished information accurate. In response to these findings, one or more auto furnishers are developing and implementing policies and procedures to ensure that they promptly notify CRCs and/or correct information furnished, as appropriate, if they find that information they had previously furnished is inaccurate. As another example, in one or more reviews of deposit account furnishers, examiners found that the furnishers failed to promptly correct and update deposit account information reported to nationwide specialty CRCs that the furnishers determined was not complete or accurate. Examiners identified several situations where the furnishers failed to promptly update or correct information. These situations included when consumers’ charged-off balances had been discharged in bankruptcy, and when consumers paid their charged-off balances in full. In both situations, the furnishers updated their systems of record to indicate that the status of the accounts had changed but failed to update and correct the information furnished to CRCs about these accounts. 12 15 U.S.C. 1681s–2(a)(2)(B). VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 In response to these findings, one or more furnishers are updating account information with the relevant CRCs for all impacted accounts and enhancing furnishing procedures. In one or more follow up deposit account furnisher reviews to address the furnishers’ prior failure to update and correct information when consumers paid-in-full or settled-in-full, examiners found one or more deposit account furnishers had improved furnishing activities to address the failure to correct and update information required by the FCRA. To address this violation and the matters requiring attention from the prior exam, one or more furnishers of deposit account information took several actions, including: D System changes that included the creation of coding processes to automated systems to identify consumers who paid in-full, and where appropriate, notification to CRCs of the corrected status of affected consumers; D Notification to CRCs of the correct status of paid-in-full and settled-in-full consumer accounts; D Improved tracking of paid-in-full and settled-in-full consumers and the establishment of a trigger to update the CRCs once final payment is made without requiring consumer to notify the furnisher; D Enhanced policies and procedures and new policies and procedures to adhere to the requirements of the FCRA and Regulation V, including modification of standards for reporting fraud or account abuse and use of appropriate closure codes; and D Improved dispute monitoring and tracking, as well as analysis of disputes to improve the accuracy and integrity of information furnished to CRCs. One or more deposit account furnishers adequately addressed the matters requiring attention from the prior exam(s) and properly notified CRCs of the correct status of all paid in full and settled in full accounts. 2.4 Duty To Provide Notice of Delinquency of Accounts The date of first delinquency is important for CRCs, creditors, and consumers because it determines when information on a consumer report becomes obsolete and may no longer be reported.13 The FCRA requires furnishers of information regarding delinquent accounts to report the date of delinquency to the CRC within 90 days.14 The FCRA specifies that the date 13 15 U.S.C. 1681c(a)–(b). Information may be reported if certain exceptions specified in the statute apply. 14 15 U.S.C. 1681s–2(a)(5)(A). This provision applies to accounts being placed for collection, PO 00000 Frm 00025 Fmt 4703 Sfmt 4703 67727 of first delinquency reported by the furnisher ‘‘shall be the month and year of the commencement of the delinquency on the account that immediately preceded the action.’’ 15 In one or more reviews, furnishers reported the incorrect date of first delinquency. For example, one or more furnishers of auto loans furnished the date of repossession of the collateral vehicle, rather than the date of first delinquency. The date of repossession at this furnisher was several months after the date of first missed payment. 2.5 Obligations Upon Notice of Dispute Pursuant to the FCRA and Regulation V, consumers can file disputes concerning the accuracy of information contained in a consumer report with the CRCs as well as directly with the furnisher of that information.16 Whether filed directly with the furnisher or indirectly through a CRC, the furnisher must conduct a reasonable investigation of the dispute.17 Further, for direct disputes, the furnisher must complete its investigation of the dispute and respond to the consumer before the expiration of the time period under section 611(a)(1) of the FCRA.18 Finally, if the furnisher determines that a direct dispute is frivolous or irrelevant, it must provide notice of that determination to the consumer.19 2.5.1 Duty To Conduct Reasonable Investigation of Dispute For disputes filed directly with furnishers, Regulation V requires furnishers to conduct a reasonable investigation with respect to the disputed information and review all relevant information provided by the consumer with the dispute notice.20 Examiners found one or more furnishers violated these provisions when the furnishers failed to investigate disputes submitted by consumers. At one or more furnishers, backlogs of thousands of direct disputes accumulated in document processing queues and were not investigated or responded to at all. When the furnishers discovered the charged to profit or loss, or subjected to similar action. 15 Id. 16 Disputes filed with CRCs are governed by 15 U.S.C. 1681i and 1681s–2(b). Disputes filed directly with the furnisher are governed by 15 U.S.C. 1681s– 2(a)(8) as implemented by Regulation V, 12 CFR 1022.43. 17 15 U.S.C. 1681s–2(b)(1)(A) (indirect disputes); 12 CFR 1022.43(e)(1) (direct disputes). 18 15 U.S.C. 1681s–2(a)(8)(E)(iii). See also 15 U.S.C. 1681i(a)(1). 19 15 U.S.C. 1681s–2(a)(F)(ii); 12 CFR 1022.43(f)(2). 20 12 CFR 1022.43(e)(1–2). E:\FR\FM\11DEN1.SGM 11DEN1 67728 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices lotter on DSKBCFDHB2PROD with NOTICES backlogs, the furnishers responded to the disputes pursuant to methodologies that broadly categorized the backlogged account correspondence, which resulted in the furnishers failing to undertake individual investigation of the disputes in the backlogs. For indirect disputes filed with CRCs, the FCRA requires that, upon receiving notice of the dispute from the CRC, the furnisher must conduct an investigation with respect to the disputed information and review all relevant information provided by the CRC.21 The standard for investigation of indirect disputes is, like direct disputes, that the furnisher’s investigation must be reasonable.22 Examiners found one or more furnishers violated these provisions when the furnishers responded to CRC notices of disputes without verifying the accuracy of the disputed information but instead with instructions to the CRC that the consumer should contact the furnisher directly and that the disputed information should not be deleted. In response to these findings, one or more furnishers are developing dispute handling policies and procedures to ensure the investigation of disputes is in accordance with the requirements of the FCRA. In another example, one or more furnishers failed to conduct reasonable investigations of indirect disputes where the disputes alleged identity theft. The furnishers responded to such disputes and verified the disputed information as accurate without reviewing their own system records as part of the investigation. Had the furnishers reviewed their own records, examiners found, they would have seen that some of the disputed accounts were, in fact, the result of identity theft. In response to these findings, one or more furnishers are developing and implementing policies and procedures with respect to indirect identity theft disputes to ensure that the furnishers conduct their investigation of the dispute, including a review of internal records, prior to responding to the CRC. 2.5.2 Duty To Complete Dispute Investigations Timely After receiving a dispute notice from a consumer, a furnisher is required under Regulation V to complete a reasonable investigation and report the results of the investigation to the consumer within the timeframe 21 15 U.S.C. 1681s–2(b)(1)(A)–(B). e.g., Johnson v. MBNA Am. Bank, 357 F.3d 426, 430–31 (4th Cir. 2004) (holding that the furnisher, after receiving notice of a consumer dispute, must conduct a reasonable investigation to determine whether the disputed information can be verified). 22 See, VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 required, which is generally 30 days but can be extended up to 45 days in limited circumstances.23 One or more furnishers failed to complete dispute investigations within this timeframe, resulting in delayed notice to consumers of dispute results as well as delayed deletion of delinquencies from consumers’ credit reports. In one or more examinations, examiners found system design flaws— including coding errors and poor work stream management that resulted in a backlog of complaints that were not investigated or responded to in a timely manner. At one or more furnishers, examiners also identified inadequate control policies, poor resource allocation, and weak oversight that led to the results of dispute investigations not being sent to consumers. In response to these findings, one or more furnishers are updating policies and procedures, improving staff training, and implementing software enhancements. 2.5.3 Duty To Notify Consumer of Determination That Dispute Is Frivolous or Irrelevant When consumers file disputes directly with a furnisher, Regulation V allows the furnisher to decline to investigate the dispute if the furnisher has ‘‘reasonably determined that the dispute is frivolous or irrelevant.’’ 24 A dispute qualifies as ‘‘frivolous or irrelevant’’ if (i) the consumer did not provide sufficient information to investigate the disputed information, (ii) the consumer’s dispute is substantially the same as a dispute previously submitted by the consumer, and the furnisher has already investigated the dispute and responded as required, or (iii) an exception applies to the dispute investigation requirement.25 If a furnisher determines that the dispute is frivolous or irrelevant, the furnisher must provide notice to consumers of its determination (‘‘frivolousness notices’’).26 Furnishers must notify the consumers of such determinations no later than five business days after the furnishers made the determination by mail or, if authorized by the consumer for that purpose, by any other means available to the furnisher.27 Examiners found that one or more furnishers failed to provide frivolousness notices to consumers 23 15 U.S.C. 1681s–2(a)(8)(E)(iii); 12 CFR 1022.42(e)(3). See also 15 U.S.C. 1681i(a)(1). 24 15 U.S.C. 1681s–2(a)(8)(F); 12 CFR 1022.43(f)(1). 25 15 U.S.C. 1681s–2(a)(8)(F)(i); 12 CFR 1022.43(f)(1)(i)–(iii). 26 15 U.S.C. 1681s–2(a)(8)(F)(ii); 12 CFR 1022.43(f)(2). 27 Id. PO 00000 Frm 00026 Fmt 4703 Sfmt 4703 when the furnisher determined that the consumers’ disputes were frivolous or irrelevant when the furnisher believed the disputes were from credit repair organizations. When agents for one or more furnishers determined that disputes were sent by a credit repair agency, the disputes would be discarded as frivolous. Although these disputes were considered frivolous, no frivolousness notices were sent to consumers. Examiners also found one or more furnishers failed to send frivolousness notices for consumer disputes when they believed the disputes were the same as another previously submitted dispute by or on behalf of consumers that had already been investigated and addressed. Although one or more furnishers had a policy stating that consumers must be notified within five days of determining that the dispute is frivolous, one or more furnishers failed to provide such notifications to consumers. In addition to requiring that the furnisher send frivolousness notices, Regulation V also requires furnishers to include the reasons for determinations that disputes are frivolous and identify any information required to investigate the disputed information.28 Examiners found that one or more furnishers failed to consistently send frivolousness notices and failed to communicate the reasons for such determinations to the consumers. Instead, one or more furnishers simply provided consumers with letters stating that there would be no further correspondence unless the consumers provided new information. The letters did not include the reason for the frivolousness determination and did not identify information required to investigate the disputed information as required by Regulation V. In response to these findings, one or more furnishers updated, documented and implemented policies and procedures to ensure they respond to all disputes, including those determined to be frivolous, to ensure compliance with legal requirements. 3. Supervisory Observations at Consumer Reporting Companies Participants in the larger participant market for consumer reporting include nationwide consumer reporting companies as well as some consumer report resellers and specialty consumer reporting companies.29 Recent 28 15 U.S.C. 1681s–2(a)(8)(F)(iii); 12 CFR 1022.43(f)(3). 29 The term ‘‘consumer reporting company’’ means the same as ‘‘consumer reporting agency,’’ as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and E:\FR\FM\11DEN1.SGM 11DEN1 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices supervisory reviews of CRCs have evaluated compliance with FCRA provisions regarding the CRC’s procedures to ensure maximum possible accuracy of information, as well as provisions regarding permissible purpose, restriction of information resulting from identity theft, and dispute investigation obligations.30 Examiners identified violations and weaknesses in procedures associated with these FCRA provisions. As a result of these reviews, CRCs have continued to make improvements to procedures regarding the accuracy of information contained in consumer reports. CRCs have also improved procedures to monitor users to help ensure that consumer reports are not furnished to users when the CRC has reasonable grounds for believing the user lacks a permissible purpose. CRCs have also implemented improvements in procedures to block information that a consumer has identified as resulting from an alleged identity theft and reasonably to investigate and respond to disputes from consumers regarding the accuracy or completeness of information in consumer files. The following sections discuss the observations in these areas at CRCs and the improvements made by these entities following these reviews. lotter on DSKBCFDHB2PROD with NOTICES 3.1 Reasonable Procedures To Assure Maximum Possible Accuracy The FCRA states that ‘‘Inaccurate credit reports directly impair the efficiency of the banking system. . .’’ and that CRCs ‘‘have assumed a vital role in assembling and evaluating consumer credit and other information on consumers.’’ 31 In recognition of this core concern with accuracy in consumer reports, the FCRA requires that, ‘‘[w]henever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.’’ 32 Examiners found that one or more nationwide specialty CRCs failed to follow reasonable procedures to assure maximum possible accuracy by exempting certain furnishers from a data nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x). The term ‘‘reseller’’ is defined in 15 U.S.C. 1681a(u). 30 FCRA obligations regarding accuracy procedures are detailed at 15 U.S.C. 1681e(b); the permissible purpose provisions are detailed at 15 U.S.C. 1681b and 15 U.S.C. 1681e(a); the ID theft block provisions are detailed at 15 U.S.C. 1681c– 2; and the dispute process requirements applicable to CRCs are detailed at 15 U.S.C. 1681i. 31 15 U.S.C. 1681(a)(1)–(3). 32 15 U.S.C. 1681e(b). VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 validation testing procedure without a valid basis. The CRCs had implemented an accuracy procedure under which the CRCs validated the data reported by direct furnishers on an annual basis. However, the CRCs’ procedure exempted from this validation procedure smaller direct furnishers that contributed low volume of data. Further, the CRCs procedure also exempted all indirect furnishers, who contributed data to the CRCs through a reseller. Examiners concluded that the exemption of these low-volume direct furnishers and indirect furnishers posed an unreasonable risk of producing errors in consumer reports. In response to these findings, one or more CRCs are conducting data validation testing on all direct and indirect furnishers, without exceptions, and will be reporting the results of such testing to the CFPB. Examiners also found that one or more nationwide specialty CRCs failed to follow reasonable procedures to assure maximum possible accuracy by failing to properly process files furnished to the CRCs by certain furnishers. The CRCs failed to fully process incoming data files from multiple data furnishers on several occasions. The files that were not properly processed resulted in the inclusion of inaccurate, derogatory information in consumer reports. Further, for a period of more than 12 months, the CRCs failed to receive any data from one or more furnishers because the furnishers had applied an incorrect technology parameter, preventing the furnishers’ data files from reaching the CRCs. This failure to receive updated data resulted in inaccurate, derogatory information being included in consumer reports. Subsequent to the discovery of these errors, one or more CRCs have implemented data monitoring procedures that are designed to notify furnishers of such data processing errors. 3.2 Duty To Limit the Furnishing of Consumer Reports to Permissible Purposes The FCRA states that ‘‘there is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.’’ 33 The FCRA protects consumers’ privacy, in part, by stating that CRCs may furnish consumer reports only to persons who have a permissible purpose to use or obtain the information in the report.34 67729 Further, the FCRA requires CRCs to maintain reasonable procedures designed to limit the furnishing of consumer reports to users with a permissible purpose.35 Supervision conducted one or more reviews of CRCs to evaluate the entities’ permissible purpose procedures. In these reviews, examiners found that one or more CRCs have procedures to verify the identity and permissible purposes of new prospective users, which one or more CRCs refer to as ‘‘credentialing.’’ Further, examiners found that one or more CRCs have procedures to monitor that users have a permissible purpose when users obtain consumer reports. However, examiners also found CMS weaknesses in one or more CRCs’ permissible purpose procedures. For example, one or more CRCs lacked procedures to conduct proactive recredentialing reviews of its users. Under such a re-credentialing review, the CRCs review existing users to confirm that the user continues to have a permissible purpose to use and obtain consumer reports. Examiners found that the CRCs had procedures to conduct recredentialing reviews of users only when users notified the CRCs of a change in ownership, name, status, or nature of business or if the CRCs’ monitoring identified a specific potential permissible purpose violation by a user. The CRCs did not, however, have a procedure to review the credentialing of users based on the length of time since the user was previously reviewed. As a result of these findings, one or more CRCs are implementing proactive re-credentialing policies and procedures that consider factors such as the time since a user was last credentialed for permissible purpose. Examiners also found CMS weaknesses in the monitoring procedures at one or more CRCs regarding permissible purpose. For example, one or more CRCs failed to monitor users or resellers that requested the CRCs delete large numbers of hard inquiry records from consumer reports. When users obtain consumer reports from CRCs, the CRCs document that event by entering an inquiry record in the relevant consumer’s file. Depending on the user’s permissible purpose, the inquiry may be visible for up to a year to other users/creditors that obtain the consumer’s report as well as being visible to the consumer; or instead it may be visible only to the consumer.36 35 15 U.S.C. 1681e(a). CRC must disclose to the consumer the identity of all users who obtained that consumer’s 36 The 33 15 34 15 PO 00000 U.S.C. 1681(a)(4). U.S.C. 1681b(a). Frm 00027 Fmt 4703 Continued Sfmt 4703 E:\FR\FM\11DEN1.SGM 11DEN1 lotter on DSKBCFDHB2PROD with NOTICES 67730 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices When a record of an inquiry is visible to other creditors, it is known as a ‘‘hard inquiry’’ and when it is visible only to the consumer, it is known as a ‘‘soft inquiry.’’ One or more CRCs have procedures that allow users to request that the CRCs delete hard inquiries from consumer reports, usually by converting them into soft inquiries. Users may request such deletions to protect consumers who may be victims of identity theft. For example, if a consumer notifies a creditor that an account was opened in his or her name due to fraud or identity theft, the creditor may, in addition to closing the account, contact the CRCs and request that the CRCs delete the hard inquiry from the consumers’ credit report. But users may also ask that inquiries be deleted because the user did not have a permissible purpose to obtain the report. Examiners found that one or more CRCs had no procedure for monitoring the users who requested such deletions at higher rates than usual, which may be a risk indicator that a user is obtaining consumer reports without any permissible purpose. As a result of these findings, one or more CRCs are enhancing permissible purpose monitoring systems to include user inquiry change or deletion request volume as a potential risk area for investigation of user permissible purpose. promptly of the determination in writing or, if authorized by the consumer for that purpose, by any other means available to the CRC.40 Examiners found that one or more nationwide specialty CRCs violated the requirements of this provision of the FCRA. When consumers submitted an identity theft block request with all required underlying documentation, the CRCs forwarded the information to furnishers and relied on the furnishers’ response without making an independent determination, even in cases where the furnisher stated no block should be applied. Therefore, examiners concluded that the CRCs did not reasonably determine to decline the block and on what basis, as required by the statute. Following this finding, one or more nationwide specialty CRCs are changing procedures to the identitytheft block provisions of the FCRA. These changes include adopting new policies and procedures that require that the CRCs block the identified information within four business days of receiving a valid identity theft report. Revised procedures also included that for any identity theft block request that the CRCs declines or rescinded, the CRCs includes documentation of the rationale for denying or rescinding the block to ensure that decisions can be monitored and audited for compliance with the FCRA. 3.3 Blocking Information Resulting From Identity Theft The FCRA requires that, unless an exception applies, a CRC must ‘‘block the reporting of any information in the file of a consumer that the consumer identifies as information that resulted from an alleged identity theft’’ provided that the consumer provides required information.37 The CRC is then required to promptly notify the furnisher of the information identified by the consumer.38 The CRC may decline to block the information, or may rescind a block, if the CRC ‘‘reasonably determines’’ that the consumer requested the block in error, based on a material misrepresentation of the facts, or the consumer obtained goods, services, or money as a result of the transaction.39 Finally, if the CRC determines to decline to block the information requested by the consumer, the CRC must notify the consumer 3.4 Dispute Investigation Supervision has continued its focus on reviewing CRCs’ compliance with the provisions of the FCRA governing consumer disputes. In previous issues of Supervisory Highlights, we discussed findings at one or more CRCs regarding violations of several provisions in this area.41 The FCRA right to dispute inaccurate information and have that dispute be reasonably investigated by the CRC and relevant furnisher is a key consumer protection in the statute. These protections recognize that consumers may identify inaccuracies in their own reports and sets out procedures that CRCs must follow before allowing such information to continue to be reported. In recent reviews, examiners have identified new violations of several subsections of this area of the FCRA. These new violations include failures by CRCs to conduct reasonable dispute investigations, breakdowns in the required notification procedures to furnishers about disputes, failures of CRCs to provide notices of results to report, pursuant to 15 U.S.C. 1681g(a)(3). For more information about the differences between hard inquiries and soft inquiries, see CFPB, Key Dimensions and Processes in the U.S. Credit Reporting System, at 9 (Dec. 2012). 37 15 U.S.C. 1681c–2(a). 38 15 U.S.C. 1681c–2(b). 39 15 U.S.C. 1681c–2(c). VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 U.S.C. 1681c–2(c)(2). e.g., CFPB, Supervisory Highlights, Winter 2017, at 9–11 (March 2017). consumers, and failure of resellers to convey notice of disputes to CRCs that provided the disputed information. 3.4.1 Duty To Conduct a Reasonable Reinvestigation The FCRA requires that when a consumer disputes the completeness or accuracy of an item of information in their file, the CRC must ‘‘conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item from the file. . . .’’ 42 Examiners found that one or more CRCs systematically violated this requirement by failing to initiate investigations after notice of the dispute. When the CRCs received disputes related to identity theft or fraud via telephone, they instructed consumers to submit the dispute in writing and did not initiate investigations until the consumer resubmitted in written form. Examiners concluded that the FCRA does not permit a CRC to decline to investigate disputes in this manner. According to the FCRA, the CRC must conduct a dispute investigation when it receives notice of the dispute information. As a result of these findings, one or more CRCs enhanced their dispute resolution process by updating policies, procedures, and training materials, and requiring agents to initiate investigations of all disputes received via telephone. The FCRA also requires that, in conducting its dispute investigation, the CRC must ‘‘review and consider all relevant information submitted by the consumer . . . with respect to such disputed information.’’ 43 Examiners found that one or more CRCs failed to review and consider all such relevant information. The CRCs relied on the furnisher’s response in validating information from a dispute, without independently considering the relevant information or documentation provided by the consumer when that information called into question the accuracy or validity of the information provided by the furnishers. In response to these findings, one or more CRCs updated procedures to more clearly describe that agents must review all relevant information the consumer provided. However, in a follow-up review at one or more CRCs, examiners found that these revised procedures were not fully implemented, causing the CRCs to continue to fail to review and consider all relevant information provided by 40 15 41 See, PO 00000 Frm 00028 Fmt 4703 Sfmt 4703 42 15 43 15 E:\FR\FM\11DEN1.SGM U.S.C. 1681i(a)(1)(A). U.S.C. 1681i(a)(4). 11DEN1 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices consumers in support of disputes. The Bureau will continue to monitor compliance in this area. The FCRA generally requires that the CRCs’ dispute investigations must be completed ‘‘before the end of the 30-day period beginning on the date on which the agency receives the notice of dispute from the consumer or reseller.’’ 44 Examiners found that one or more CRCs failed to complete the investigation within this 30-day timeframe. The CRCs incorrectly recorded the date of disputes filed on weekends, holidays, and afterhours. These disputes were incorrectly recorded in systems as being filed the next business day. As a result of these findings, one or more CRCs took action to correct the system logic and reassess those disputes. 3.4.2 Duty To Provide Prompt Notice of Dispute to Furnisher The FCRA requires that when a CRC receives a notice of a dispute from a consumer, the CRC must ‘‘provide notification of the dispute to any person who provided any item of information in dispute. . . .’’ 45 This notice must be provided ‘‘[b]efore the expiration of the 5-business-day period beginning on the date on which a [CRC] receives notice of the dispute. . . .’’ 46 Examiners found that one or more CRCs violated this provision of the FCRA when they failed to notify furnishers of a consumer’s dispute within five business days of receiving a dispute. This violation occurred in thousands of disputes over several months. This violation was caused by lack of adequate staffing at the CRCs and was not detected by the CRCs’ compliance monitoring. As a result of the examination findings, the CRCs developed and implemented dispute investigation procedures to ensure agents provide required notices to furnishers and forward all relevant information regarding the dispute within the mandatory time periods. lotter on DSKBCFDHB2PROD with NOTICES 3.4.3 Duty To Notify Furnisher That Inaccurate, Incomplete, or Unverified Information Has Been Modified or Deleted When a CRC has completed its dispute investigation, if the CRC finds that any disputed information is inaccurate or incomplete or unable to be verified, the FCRA requires the CRC to ‘‘promptly notify the furnisher of that 44 15 U.S.C. 1681i(a)(1)(A). Note that the 30-day period may be extended for an additional 15 days if the CRC receives information from the consumer during the 30-day period that is relevant to the reinvestigation. 15 U.S.C. 1681i(a)(1)(B). 45 15 U.S.C. 1681i(a)(2)(A). 46 Id. VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 information that the information has been modified or deleted from the file of the consumer.’’ 47 In one or more reviews of nationwide specialty CRCs, examiners identified instances where one or more specialty CRCs failed to notify furnishers that information from the consumer’s file had been modified or deleted after an investigation. In these instances, one or more CRCs were informed by the furnisher that a modification or deletion was necessary. One or more specialty CRCs investigation agents then modified or deleted the incorrect information but failed to inform the furnisher of the action taken, as required by the FCRA. In other instances, the information was internally resolved in the consumer’s favor by one or more specialty CRCs but either the CRCs did not provide the notice to the furnishers of the modification or deletion, or they did not provide ‘‘prompt’’ notice to the furnisher required by the FCRA. As a result of these findings, one or more specialty CRCs developed and implemented dispute investigation procedures to ensure agent provide the required notice consistent with the requirements in the FCRA. Additionally, examiners found that one or more CRCs failed to promptly send furnishers notices when investigations found that information was not accurate and information was changed in the consumer’s file. One or more CRCs admitted that they failed to transmit approximately 2.7 million notices over a period of approximately two months. The cause for the failure was a programming error. This failure primarily affected consumers who submitted direct disputes to furnishers but some consumers who submitted indirect disputes to CRCs were also affected. As a result of this finding, one or more CRCs are fixing the programming error and enhancing their internal monitoring to avoid future issues of this type. 3.4.4 Duty To Provide Consumer With Written Notice of Results of Reinvestigation The FCRA requires that, upon completion of the reasonable reinvestigation, the CRC must provide written notice of the results to the consumer not later than five business days after completion of the reinvestigation.48 Examiners found that one or more CRCs failed to send consumers results notices as required when the consumer sent the CRCs a dispute that was not accompanied by a 47 15 48 15 PO 00000 U.S.C. 1681i(a)(5)(A)(ii). U.S.C. 1681i(a)(6)(A). Frm 00029 Fmt 4703 Sfmt 4703 67731 consumer identification and certification form. In such cases, the CRCs resolved the dispute and, where necessary updated its records, but did not send the consumer the required notice of results. In response to these findings, one or more CRCs are developing and implementing policies and procedures to send consumers notifications of the results of disputes even when the consumer did not provide a consumer identification and certification form with the dispute. 3.4.5 Duty of Reseller To Convey Notice of Dispute to the CRC That Provided the Reseller With the Information That Is Subject of the Dispute The FCRA dispute provisions provide direction to resellers upon receipt of a dispute from a consumer. These requirements include, where applicable, providing notice of the dispute to the CRC that provided the reseller with the disputed information. ‘‘If a reseller receives a notice from a consumer of a dispute concerning the completeness or accuracy of any item of information contained in a consumer report on such consumer produced by the reseller, the reseller shall’’ determine whether the item of information is incomplete or inaccurate as a result of an act or omission of the reseller within five business days.49 If the reseller determines that the disputed information is not incomplete or inaccurate as a result of an act or omission of the reseller, the reseller must convey the notice of the dispute, together with all relevant information provided by the consumer, to each CRC that provided the reseller with the information that is the subject of the dispute.50 Examiners found that one or more resellers, after determining that disputed information was not incomplete or inaccurate as a result of an act or omission of the resellers, failed to convey to the CRCs that provided the information the notice of the dispute together with all relevant information provided by the consumer. In response to these findings, one or more resellers developed and implemented dispute investigation procedures designed to ensure agents provide required notice of disputes to CRCs that provided the information to the reseller. In follow-up reviews, examiners found that one or more resellers developed and implemented enhanced procedures designed to ensure that the reseller(s) promptly conveyed notice of 49 15 50 15 E:\FR\FM\11DEN1.SGM U.S.C. 1681i(f)(2)(A). U.S.C. 1681i(f)(2)(B)(ii). 11DEN1 67732 Federal Register / Vol. 84, No. 238 / Wednesday, December 11, 2019 / Notices disputes the reseller received to the CRC that provided the reseller with the disputed information. 4. Conclusion The Bureau will continue to publish Supervisory Highlights to aid Bureausupervised entities in their efforts to comply with Federal consumer financial law. The report shares information regarding general supervisory and examination findings regarding the FCRA and Regulation V (without identifying specific institutions). This information is shared, in part, to communicate the Bureau’s supervisory expectations to CRCs and furnishers that those institutions comply with the applicable provisions of the FCRA and Regulation V. Supervision’s work in the consumer reporting market is ongoing and remains a high priority. As detailed in this report, CFPB examiners have continued to identify violations and CMS weaknesses regarding critical FCRA and Regulation V protections. However, examiners have also observed significant improvements in these areas, including continued investment in FCRA-related CMS. Supervision will continue to conduct reviews at CRCs, including resellers, as well as at furnishers and users of consumer reports within our supervisory jurisdiction. Dated: November 30, 2019. Kathleen L. Kraninger, Director, Bureau of Consumer Financial Protection. [FR Doc. 2019–26669 Filed 12–10–19; 8:45 am] BILLING CODE 4810–AM–P CORPORATION FOR NATIONAL AND COMMUNITY SERVICE Agency Information Collection Activities; Submission to the Office of Management and Budget for Review and Approval; Comment Request; Generic Clearance for the Collection of Qualitative Feedback on Agency Service Delivery; Proposed Information Collection; Comment Request Corporation for National and Community Service. ACTION: Notice. lotter on DSKBCFDHB2PROD with NOTICES AGENCY: The Corporation for National and Community Service (CNCS) has submitted a public information collection request (ICR) entitled Generic Clearance for the Collection of Qualitative Feedback on Agency Service Delivery for review and approval in SUMMARY: VerDate Sep<11>2014 16:23 Dec 10, 2019 Jkt 250001 accordance with the Paperwork Reduction Act. DATES: Written comments must be submitted to the individual and office listed in the ADDRESSES section by January 10, 2020. ADDRESSES: Direct written comments and/or suggestions regarding the items contained in this Notice to the Attention: CNCS Desk Officer, Office of Information and Regulatory Affairs, Office of Management and Budget, 725 17th Street NW, Washington, DC 20503 or by fax to (202) 395–5806. Provide written comments within 30 days of Notice publication. FOR FURTHER INFORMATION CONTACT: Copies of this ICR, with applicable supporting documentation, may be obtained by calling the Corporation for National and Community Service, Amy Borgstrom by email to aborgstrom@ cns.gov. The OMB is particularly interested in comments which: • Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of CNCS, including whether the information will have practical utility; • Evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions; • Propose ways to enhance the quality, utility, and clarity of the information to be collected; and • Propose ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology. SUPPLEMENTARY INFORMATION: Comments A 60-day Notice requesting public comment was published in the Federal Register on Monday, September 30 at Vol. 84, Page Number 51524. This comment period ended November 29, 2019. No public comments were received from this Notice. Title of Collection: Generic Clearance for the Collection of Qualitative Feedback on Agency Service Delivery. OMB Control Number: 3045–0137. Type of Review: Renewal. Respondents/Affected Public: Individuals, Households and Organizations. Total Estimated Number of Annual Responses: 15,000. PO 00000 Frm 00030 Fmt 4703 Sfmt 4703 Total Estimated Number of Annual Burden Hours: 2,500. Abstract: The proposed information collection activity provides a means to elicit qualitative customer and stakeholder feedback in an efficient, timely manner. By qualitative feedback we mean information that provides useful insights on perceptions and opinions but are not statistical surveys that yield quantitative results that can be generalized to the population of study. This feedback will provide insights into customer or stakeholder perceptions, experiences and expectations, provide an early warning of issues with service, or focus attention on areas where communication, training, or changes in operations might improve delivery of products or services. These collections will allow for ongoing, collaborative, and actionable communications between the agency and its customers and stakeholders. It will also allow feedback to contribute directly to the improvement of program management. The solicitation of feedback will target areas such as: Timeliness, appropriateness, accuracy of information, courtesy, efficiency of service delivery, and resolution of issues with service delivery. Responses will be assessed to plan and inform efforts to improve or maintain the quality of service offered to the public. If this information is not collected, vital feedback from customers and stakeholders on the agency’s services will be unavailable. CNCS seeks to renew the current information collection. The information collection will be used in the same manner as the existing application. CNCS also seeks to continue using the current application until the revised application is approved by OMB. The current application is due to expire on November 30, 2020. Dated: December 5, 2019. Amy Borgstrom, Associate Director of Policy. [FR Doc. 2019–26632 Filed 12–10–19; 8:45 am] BILLING CODE 6050–28–P DEPARTMENT OF DEFENSE Office of the Secretary [Docket ID: DOD–2019–OS–0133] Proposed Collection; Comment Request Office of the Undersecretary of Defense for Personnel & Readiness, DoD. ACTION: Information collection notice. AGENCY: E:\FR\FM\11DEN1.SGM 11DEN1

Agencies

[Federal Register Volume 84, Number 238 (Wednesday, December 11, 2019)]
[Notices]
[Pages 67725-67732]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-26669]



[[Page 67725]]

=======================================================================
-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION


Supervisory Highlights Consumer Reporting Special Edition, Issue 
20 (Fall 2019)

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Supervisory highlights.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is 
issuing its twentieth edition of its Supervisory Highlights. In this 
special issue of Supervisory Highlights, we report examination findings 
in the areas of consumer reporting and furnishing of information to 
consumer reporting companies, pursuant to the Fair Credit Reporting Act 
and Regulation V. The report does not impose any new or different legal 
requirements, and all violations described in the report are based only 
on those specific facts and circumstances noted during those 
examinations.

DATES: The Bureau released this edition of the Supervisory Highlights 
on its website on December 9, 2019.

FOR FURTHER INFORMATION CONTACT: David Wake, Senior Counsel, Office of 
Supervision Policy, at (202) 435-9613. If you require this document in 
an alternative electronic format, please contact 
[email protected].

SUPPLEMENTARY INFORMATION: 

1. Introduction

    The Consumer Financial Protection Bureau (CFPB or Bureau) is 
committed to a consumer financial marketplace that is free, innovative, 
competitive, and transparent, where the rights of all parties are 
protected by the rule of law, and where consumers are free to choose 
the products and services that best fit their individual needs. To 
effectively accomplish this, the Bureau remains committed to sharing 
with the public key findings from its supervisory work to help industry 
limit risks to consumers and comply with Federal consumer financial 
law.
    The findings included in this report cover examinations in the 
areas of consumer reporting and furnishing of information to consumer 
reporting companies (CRCs),\1\ pursuant to the Fair Credit Reporting 
Act (FCRA) and Regulation V.\2\ In March 2017, the CFPB published its 
first special edition of Supervisory Highlights dedicated to consumer 
reporting issues.\3\ This special edition of Supervisory Highlights 
reports on more recent supervisory findings in this area.
---------------------------------------------------------------------------

    \1\ The term ``consumer reporting company'' means the same as 
``consumer reporting agency,'' as defined in the Fair Credit 
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer 
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide 
specialty consumer reporting agencies as defined in 15 U.S.C. 
1681a(x).
    \2\ 15 U.S.C. 1681 et seq. and 12 CFR part 1022.
    \3\ CFPB, Supervisory Highlights (Winter 2017), available at 
https://files.consumerfinance.gov/f/documents/201703_cfpb_Supervisory-Highlights-Consumer-Reporting-Special-Edition.pdf.
---------------------------------------------------------------------------

    Recent supervisory reviews of compliance with the FCRA and 
Regulation V have identified new violations and compliance management 
system (CMS) weaknesses at institutions within the CFPB's supervisory 
authority. These institutions include CRCs that are larger participants 
in the consumer reporting market \4\ as well as furnishers subject to 
the Bureau's supervisory authority. These furnishers include banks, 
mortgage servicers, auto loan servicers, student loan servicers, and 
debt collectors.
---------------------------------------------------------------------------

    \4\ Larger participants in the consumer reporting market are 
defined in 12 CFR 1090.104.
---------------------------------------------------------------------------

    The information contained in Supervisory Highlights is disseminated 
to communicate the Bureau's supervisory expectations to CRCs and 
furnishers that those institutions comply with the applicable 
provisions of the FCRA and Regulation V. This document does not impose 
any new or different legal requirements. In addition, the legal 
violations described in this and previous issues of Supervisory 
Highlights are based on the particular facts and circumstances reviewed 
by the Bureau as part of its examinations. A conclusion that a legal 
violation exists on the facts and circumstances described here may not 
lead to such a finding under different facts and circumstances.
    We invite readers with questions or comments about the findings and 
legal analysis reported in Supervisory Highlights to contact us at 
[email protected].

2. Supervisory Observations at Furnishers

    Furnishers of information play a crucial role in the accuracy and 
integrity of consumer reports when they provide information to CRCs. 
Inaccurate information from furnishers can lead to inaccurate reports 
and consumer and market harm. For example, inaccurate information on a 
consumer report can impact a consumer's ability to obtain credit or 
open a new deposit or savings account at a bank. Moreover, furnishers 
have an important role in the dispute process when consumers dispute 
the accuracy of information in their consumer reports. Consumers may 
dispute information that appears on their consumer report directly to 
furnishers (``direct disputes'') or indirectly through CRCs (``indirect 
disputes''). When furnishers receive direct or indirect disputes, they 
are required to investigate the disputes to verify the accuracy of the 
information furnished.\5\ A timely and responsive reply to a consumer 
dispute may reduce the impact inaccurate negative information in a 
consumer report may have on the consumer. The FCRA and Regulation V set 
forth requirements for furnishers concerning both accuracy and dispute 
handling. To ensure compliance with these requirements, Supervision 
regularly conducts reviews at furnishers subject to its supervisory 
authority.
---------------------------------------------------------------------------

    \5\ 15 U.S.C. 1681s-2(a)(8), 15 U.S.C. 1681s-2(b); 12 CFR 
1022.43.
---------------------------------------------------------------------------

    In recent supervisory reviews, examiners found CMS weaknesses and 
violations of the FCRA and Regulation V. In such cases, the 
furnisher(s) have taken or are taking corrective action.

2.1 Reasonable, Written Policies and Procedures

    Regulation V requires furnishers to establish and implement 
reasonable written policies and procedures regarding the accuracy and 
integrity of the information relating to consumers that they provide to 
CRCs.\6\ Such policies and procedures must be appropriate to the 
nature, size, complexity, and scope of each furnisher's activities.\7\ 
Furnishers must consider and incorporate, as appropriate, the 
guidelines of appendix E to Regulation V when developing their policies 
and procedures.\8\ In a previous issue of Supervisory Highlights, we 
described supervisory findings of furnishers that violated these 
requirements.\9\ In recent supervisory reviews, we have identified 
further violations of the Regulation V requirement for reasonable 
written policies and procedures. In the section below, we have 
highlighted key findings according to the products for which 
information is being furnished, in keeping with the Regulation V 
requirement that the procedures be ``appropriate to the nature, size, 
complexity, and scope of the furnisher's activities.''
---------------------------------------------------------------------------

    \6\ 12 CFR 1022.42(a).
    \7\ Id.
    \8\ 12 CFR 1022.42(b).
    \9\ CFPB, Supervisory Highlights, Winter 2017, at 13-17 (March 
2017).
---------------------------------------------------------------------------

2.1.1 Mortgage Furnishers
    In one or more reviews of furnishers of mortgage loans, examiners 
found that the furnishers' policies and procedures

[[Page 67726]]

were not appropriate to the nature, size, complexity, and scope of the 
furnisher's activities. For example, one or more furnishers maintained 
general FCRA-related policies and procedures that did not provide 
sufficient guidance for responding to disputes in a timely manner or 
reporting credit reporting changes in furnished accounts when the 
status of such accounts had changed. As a result of these findings, one 
or more furnishers are developing and implementing reasonable 
furnishing procedures governing the accurate reporting of accounts 
designed to ensure the timely update of information to reflect the 
current status of consumer accounts.
2.1.2 Auto Loan Furnishers
    In one or more reviews of furnishers of auto loans, examiners found 
that the furnishers' policies and procedures did not provide sufficient 
guidance for conducting reasonable investigations of indirect disputes 
that contain allegations of identity theft. For example, the 
furnishers' policies and procedures did not specify that agents 
investigating disputes alleging identity theft should review internal 
records of fraud investigations before completing dispute 
investigations and responding to CRCs. As a result of these findings, 
one or more furnishers are developing and implementing policies and 
procedures with respect to identity theft disputes to ensure the 
furnisher conducts its investigation, including review of internal 
records, prior to responding to the CRC.
2.1.3 Debt Collection Furnishers
    In one or more reviews of debt collection furnishers, examiners 
found that the furnishers' policies and procedures did not 
differentiate between FCRA disputes, FDCPA disputes, or validation 
requests. In this regard, the furnishers categorized and handled direct 
FCRA disputes, FDCPA disputes, and validation requests the same way and 
without consideration for the applicable regulatory requirements. 
Furthermore, the policies and procedures did not address the regulatory 
timeframes for conducting reasonable investigations of disputes, or for 
reporting the results of the investigations to the consumers or to 
CRCs, as appropriate. Instead, the policies and procedures provided 
general instructions on how to indicate that accounts are disputed and 
how to label dispute-related correspondence from consumers. The 
policies and procedures did not contain any substantive instructions on 
how to conduct investigations of disputed accounts. Following these 
findings, one or more furnishers are developing and implementing 
reasonable policies and procedures covering the steps necessary to 
conduct reasonable and timely investigations of disputes, as that term 
is defined in Regulation V.
2.1.4 Deposit Account Furnishers
    Examiners found that one or more furnishers of deposit account 
information to specialty CRCs had no written policies or procedures for 
furnishing such information to specialty CRCs. In response to this 
finding, one or more deposit account furnishers are developing and 
implementing reasonable written policies and procedures regarding 
furnishing to specialty deposit CRCs.
    Examiners also found that one or more deposit account furnishers 
did not have reasonable written policies and procedures regarding 
deposit account information. For example, policies and procedures did 
not require that the furnishers validate the data furnished to 
specialty deposit CRCs, causing the furnisher to inaccurately furnish 
consumers' account status information to one or more specialty CRCs. 
One or more deposit account furnishers are evaluating the effectiveness 
of existing policies and procedures regarding the accuracy and 
integrity of information furnished to nationwide specialty CRCs and 
develop new written policies where appropriate.
2.1.5 Improvements in Furnishing Policies and Procedures
    In follow-up reviews at furnishers previously examined, examiners 
found that one or more furnishers had made significant improvements in 
furnishing policies and procedures. For example, one or more furnishers 
updated their policies and procedures to incorporate specific 
requirements to ensure dispute investigation agents conduct reasonable 
dispute investigations and document their work. Revised dispute 
investigation procedures include an extensive list of internal systems 
and sources that dispute agents must research when investigating a 
dispute. Updated procedures also dictate that the furnisher retains 
dispute investigation documentation and records, including imaged 
screenshots, for a minimum of seven years.
    In another example of improved furnishing policies and procedures, 
examiners found that one or more deposit furnishers documented improved 
quality monitoring procedures to impose enhanced sampling and oversight 
procedures regarding furnished deposits information. Additionally, one 
or more furnishers improved procedures governing when to delete, 
update, and correct information in its records to avoid furnishing 
inaccurate information to specialty CRAs. One such new procedure 
required the furnisher to conduct a root-cause analysis of dispute 
results to ensure that when dispute investigations identify systemic 
errors, the furnisher corrects furnished data about other accounts that 
were also affected by similar errors.

2.2 Prohibition of Reporting Information With Actual Knowledge of 
Errors

    The FCRA prohibits furnishers from furnishing any information 
relating to a consumer to any CRC if the furnisher ``knows or has 
reasonable cause to believe that the information is inaccurate.'' \10\ 
However, a furnisher is not subject to this prohibition if it ``clearly 
and conspicuously specifies to the consumer an address'' at which 
consumers can send notices that specific information reported by the 
furnisher is inaccurate.\11\ CFPB examiners found that one or more 
furnishers furnished information they knew or had reasonable cause to 
believe was inaccurate. One or more furnishers reported thousands of 
accounts to one or more CRCs with inaccurate derogatory status codes. 
The accounts were furnished inaccurately because of coding errors. The 
furnishers had reasonable cause to believe the information was 
inaccurate because consumers filed disputes with one or more CRCs 
identifying the errors, and those disputes were forwarded to the 
furnishers for investigation. The furnishers, in investigating the 
disputes, failed to conduct root-cause analysis that would have 
identified the issue as a systemic source of inaccuracy. Further, the 
furnishers did not clearly and conspicuously specify to consumers an 
address at which consumers could send notices that furnished 
information was inaccurate. The furnishers provided an address to 
consumers for direct disputes, but that address was provided on the 
last page of lengthy consumer disclosures under a heading of 
``Additional Information and Use Disclosures'' that followed topics 
such as ``General Terms,'' ``Arbitration,'' and ``Privacy Notice.'' 
Examiners concluded that these notices did not qualify as ``clear and 
conspicuous.'' After discovery of these inaccuracies, one or more 
furnishers implemented a program fix for the inaccurate coding issue 
and

[[Page 67727]]

conducted a review of all furnished accounts to identify and correct 
the furnishing of all affected consumers.
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 1681s-2(a)(1)(A).
    \11\ 15 U.S.C. 1681s-2(a)(1)(C).
---------------------------------------------------------------------------

2.3 Duty To Correct and Update Information

    If a furnisher who ``regularly and in the ordinary course of 
business furnishes information to one or more [CRCs] about the person's 
transactions or experiences with any consumer'' has furnished to a CRC 
information that the furnisher determines is not complete or accurate, 
it shall promptly notify the CRC of that determination and provide to 
the CRC any corrections to that information, or any additional 
information, that is necessary to make the information provided to the 
CRC complete and accurate, and shall not thereafter furnish to the CRC 
any of the information that remains not complete or accurate.\12\
---------------------------------------------------------------------------

    \12\ 15 U.S.C. 1681s-2(a)(2)(B).
---------------------------------------------------------------------------

    The CFPB has identified violations of this provision in one or more 
recent furnisher reviews. For example, in one or more reviews of auto 
loan furnishers, examiners found that the furnishers failed to provide 
prompt notifications to CRCs of their determinations that information 
they had previously furnished was inaccurate because the furnishers had 
found that the loans had been opened as a result of identity theft. In 
such cases, the furnishers recorded the results of their investigations 
internally, but failed to make the corrections necessary to make the 
furnished information accurate. In response to these findings, one or 
more auto furnishers are developing and implementing policies and 
procedures to ensure that they promptly notify CRCs and/or correct 
information furnished, as appropriate, if they find that information 
they had previously furnished is inaccurate.
    As another example, in one or more reviews of deposit account 
furnishers, examiners found that the furnishers failed to promptly 
correct and update deposit account information reported to nationwide 
specialty CRCs that the furnishers determined was not complete or 
accurate. Examiners identified several situations where the furnishers 
failed to promptly update or correct information. These situations 
included when consumers' charged-off balances had been discharged in 
bankruptcy, and when consumers paid their charged-off balances in full. 
In both situations, the furnishers updated their systems of record to 
indicate that the status of the accounts had changed but failed to 
update and correct the information furnished to CRCs about these 
accounts. In response to these findings, one or more furnishers are 
updating account information with the relevant CRCs for all impacted 
accounts and enhancing furnishing procedures.
    In one or more follow up deposit account furnisher reviews to 
address the furnishers' prior failure to update and correct information 
when consumers paid-in-full or settled-in-full, examiners found one or 
more deposit account furnishers had improved furnishing activities to 
address the failure to correct and update information required by the 
FCRA. To address this violation and the matters requiring attention 
from the prior exam, one or more furnishers of deposit account 
information took several actions, including:
    [ssquf] System changes that included the creation of coding 
processes to automated systems to identify consumers who paid in-full, 
and where appropriate, notification to CRCs of the corrected status of 
affected consumers;
    [ssquf] Notification to CRCs of the correct status of paid-in-full 
and settled-in-full consumer accounts;
    [ssquf] Improved tracking of paid-in-full and settled-in-full 
consumers and the establishment of a trigger to update the CRCs once 
final payment is made without requiring consumer to notify the 
furnisher;
    [ssquf] Enhanced policies and procedures and new policies and 
procedures to adhere to the requirements of the FCRA and Regulation V, 
including modification of standards for reporting fraud or account 
abuse and use of appropriate closure codes; and
    [ssquf] Improved dispute monitoring and tracking, as well as 
analysis of disputes to improve the accuracy and integrity of 
information furnished to CRCs.
    One or more deposit account furnishers adequately addressed the 
matters requiring attention from the prior exam(s) and properly 
notified CRCs of the correct status of all paid in full and settled in 
full accounts.

2.4 Duty To Provide Notice of Delinquency of Accounts

    The date of first delinquency is important for CRCs, creditors, and 
consumers because it determines when information on a consumer report 
becomes obsolete and may no longer be reported.\13\ The FCRA requires 
furnishers of information regarding delinquent accounts to report the 
date of delinquency to the CRC within 90 days.\14\ The FCRA specifies 
that the date of first delinquency reported by the furnisher ``shall be 
the month and year of the commencement of the delinquency on the 
account that immediately preceded the action.'' \15\
---------------------------------------------------------------------------

    \13\ 15 U.S.C. 1681c(a)-(b). Information may be reported if 
certain exceptions specified in the statute apply.
    \14\ 15 U.S.C. 1681s-2(a)(5)(A). This provision applies to 
accounts being placed for collection, charged to profit or loss, or 
subjected to similar action.
    \15\ Id.
---------------------------------------------------------------------------

    In one or more reviews, furnishers reported the incorrect date of 
first delinquency. For example, one or more furnishers of auto loans 
furnished the date of repossession of the collateral vehicle, rather 
than the date of first delinquency. The date of repossession at this 
furnisher was several months after the date of first missed payment.

2.5 Obligations Upon Notice of Dispute

    Pursuant to the FCRA and Regulation V, consumers can file disputes 
concerning the accuracy of information contained in a consumer report 
with the CRCs as well as directly with the furnisher of that 
information.\16\ Whether filed directly with the furnisher or 
indirectly through a CRC, the furnisher must conduct a reasonable 
investigation of the dispute.\17\ Further, for direct disputes, the 
furnisher must complete its investigation of the dispute and respond to 
the consumer before the expiration of the time period under section 
611(a)(1) of the FCRA.\18\ Finally, if the furnisher determines that a 
direct dispute is frivolous or irrelevant, it must provide notice of 
that determination to the consumer.\19\
---------------------------------------------------------------------------

    \16\ Disputes filed with CRCs are governed by 15 U.S.C. 1681i 
and 1681s-2(b). Disputes filed directly with the furnisher are 
governed by 15 U.S.C. 1681s-2(a)(8) as implemented by Regulation V, 
12 CFR 1022.43.
    \17\ 15 U.S.C. 1681s-2(b)(1)(A) (indirect disputes); 12 CFR 
1022.43(e)(1) (direct disputes).
    \18\ 15 U.S.C. 1681s-2(a)(8)(E)(iii). See also 15 U.S.C. 
1681i(a)(1).
    \19\ 15 U.S.C. 1681s-2(a)(F)(ii); 12 CFR 1022.43(f)(2).
---------------------------------------------------------------------------

2.5.1 Duty To Conduct Reasonable Investigation of Dispute
    For disputes filed directly with furnishers, Regulation V requires 
furnishers to conduct a reasonable investigation with respect to the 
disputed information and review all relevant information provided by 
the consumer with the dispute notice.\20\ Examiners found one or more 
furnishers violated these provisions when the furnishers failed to 
investigate disputes submitted by consumers. At one or more furnishers, 
backlogs of thousands of direct disputes accumulated in document 
processing queues and were not investigated or responded to at all. 
When the furnishers discovered the

[[Page 67728]]

backlogs, the furnishers responded to the disputes pursuant to 
methodologies that broadly categorized the backlogged account 
correspondence, which resulted in the furnishers failing to undertake 
individual investigation of the disputes in the backlogs.
---------------------------------------------------------------------------

    \20\ 12 CFR 1022.43(e)(1-2).
---------------------------------------------------------------------------

    For indirect disputes filed with CRCs, the FCRA requires that, upon 
receiving notice of the dispute from the CRC, the furnisher must 
conduct an investigation with respect to the disputed information and 
review all relevant information provided by the CRC.\21\ The standard 
for investigation of indirect disputes is, like direct disputes, that 
the furnisher's investigation must be reasonable.\22\ Examiners found 
one or more furnishers violated these provisions when the furnishers 
responded to CRC notices of disputes without verifying the accuracy of 
the disputed information but instead with instructions to the CRC that 
the consumer should contact the furnisher directly and that the 
disputed information should not be deleted. In response to these 
findings, one or more furnishers are developing dispute handling 
policies and procedures to ensure the investigation of disputes is in 
accordance with the requirements of the FCRA.
---------------------------------------------------------------------------

    \21\ 15 U.S.C. 1681s-2(b)(1)(A)-(B).
    \22\ See, e.g., Johnson v. MBNA Am. Bank, 357 F.3d 426, 430-31 
(4th Cir. 2004) (holding that the furnisher, after receiving notice 
of a consumer dispute, must conduct a reasonable investigation to 
determine whether the disputed information can be verified).
---------------------------------------------------------------------------

    In another example, one or more furnishers failed to conduct 
reasonable investigations of indirect disputes where the disputes 
alleged identity theft. The furnishers responded to such disputes and 
verified the disputed information as accurate without reviewing their 
own system records as part of the investigation. Had the furnishers 
reviewed their own records, examiners found, they would have seen that 
some of the disputed accounts were, in fact, the result of identity 
theft. In response to these findings, one or more furnishers are 
developing and implementing policies and procedures with respect to 
indirect identity theft disputes to ensure that the furnishers conduct 
their investigation of the dispute, including a review of internal 
records, prior to responding to the CRC.
2.5.2 Duty To Complete Dispute Investigations Timely
    After receiving a dispute notice from a consumer, a furnisher is 
required under Regulation V to complete a reasonable investigation and 
report the results of the investigation to the consumer within the 
timeframe required, which is generally 30 days but can be extended up 
to 45 days in limited circumstances.\23\
---------------------------------------------------------------------------

    \23\ 15 U.S.C. 1681s-2(a)(8)(E)(iii); 12 CFR 1022.42(e)(3). See 
also 15 U.S.C. 1681i(a)(1).
---------------------------------------------------------------------------

    One or more furnishers failed to complete dispute investigations 
within this timeframe, resulting in delayed notice to consumers of 
dispute results as well as delayed deletion of delinquencies from 
consumers' credit reports. In one or more examinations, examiners found 
system design flaws--including coding errors and poor work stream 
management that resulted in a backlog of complaints that were not 
investigated or responded to in a timely manner. At one or more 
furnishers, examiners also identified inadequate control policies, poor 
resource allocation, and weak oversight that led to the results of 
dispute investigations not being sent to consumers. In response to 
these findings, one or more furnishers are updating policies and 
procedures, improving staff training, and implementing software 
enhancements.
2.5.3 Duty To Notify Consumer of Determination That Dispute Is 
Frivolous or Irrelevant
    When consumers file disputes directly with a furnisher, Regulation 
V allows the furnisher to decline to investigate the dispute if the 
furnisher has ``reasonably determined that the dispute is frivolous or 
irrelevant.'' \24\ A dispute qualifies as ``frivolous or irrelevant'' 
if (i) the consumer did not provide sufficient information to 
investigate the disputed information, (ii) the consumer's dispute is 
substantially the same as a dispute previously submitted by the 
consumer, and the furnisher has already investigated the dispute and 
responded as required, or (iii) an exception applies to the dispute 
investigation requirement.\25\ If a furnisher determines that the 
dispute is frivolous or irrelevant, the furnisher must provide notice 
to consumers of its determination (``frivolousness notices'').\26\ 
Furnishers must notify the consumers of such determinations no later 
than five business days after the furnishers made the determination by 
mail or, if authorized by the consumer for that purpose, by any other 
means available to the furnisher.\27\
---------------------------------------------------------------------------

    \24\ 15 U.S.C. 1681s-2(a)(8)(F); 12 CFR 1022.43(f)(1).
    \25\ 15 U.S.C. 1681s-2(a)(8)(F)(i); 12 CFR 1022.43(f)(1)(i)-
(iii).
    \26\ 15 U.S.C. 1681s-2(a)(8)(F)(ii); 12 CFR 1022.43(f)(2).
    \27\ Id.
---------------------------------------------------------------------------

    Examiners found that one or more furnishers failed to provide 
frivolousness notices to consumers when the furnisher determined that 
the consumers' disputes were frivolous or irrelevant when the furnisher 
believed the disputes were from credit repair organizations. When 
agents for one or more furnishers determined that disputes were sent by 
a credit repair agency, the disputes would be discarded as frivolous. 
Although these disputes were considered frivolous, no frivolousness 
notices were sent to consumers.
    Examiners also found one or more furnishers failed to send 
frivolousness notices for consumer disputes when they believed the 
disputes were the same as another previously submitted dispute by or on 
behalf of consumers that had already been investigated and addressed. 
Although one or more furnishers had a policy stating that consumers 
must be notified within five days of determining that the dispute is 
frivolous, one or more furnishers failed to provide such notifications 
to consumers.
    In addition to requiring that the furnisher send frivolousness 
notices, Regulation V also requires furnishers to include the reasons 
for determinations that disputes are frivolous and identify any 
information required to investigate the disputed information.\28\ 
Examiners found that one or more furnishers failed to consistently send 
frivolousness notices and failed to communicate the reasons for such 
determinations to the consumers. Instead, one or more furnishers simply 
provided consumers with letters stating that there would be no further 
correspondence unless the consumers provided new information. The 
letters did not include the reason for the frivolousness determination 
and did not identify information required to investigate the disputed 
information as required by Regulation V. In response to these findings, 
one or more furnishers updated, documented and implemented policies and 
procedures to ensure they respond to all disputes, including those 
determined to be frivolous, to ensure compliance with legal 
requirements.
---------------------------------------------------------------------------

    \28\ 15 U.S.C. 1681s-2(a)(8)(F)(iii); 12 CFR 1022.43(f)(3).
---------------------------------------------------------------------------

3. Supervisory Observations at Consumer Reporting Companies

    Participants in the larger participant market for consumer 
reporting include nationwide consumer reporting companies as well as 
some consumer report resellers and specialty consumer reporting 
companies.\29\ Recent

[[Page 67729]]

supervisory reviews of CRCs have evaluated compliance with FCRA 
provisions regarding the CRC's procedures to ensure maximum possible 
accuracy of information, as well as provisions regarding permissible 
purpose, restriction of information resulting from identity theft, and 
dispute investigation obligations.\30\ Examiners identified violations 
and weaknesses in procedures associated with these FCRA provisions.
---------------------------------------------------------------------------

    \29\ The term ``consumer reporting company'' means the same as 
``consumer reporting agency,'' as defined in the Fair Credit 
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer 
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide 
specialty consumer reporting agencies as defined in 15 U.S.C. 
1681a(x). The term ``reseller'' is defined in 15 U.S.C. 1681a(u).
    \30\ FCRA obligations regarding accuracy procedures are detailed 
at 15 U.S.C. 1681e(b); the permissible purpose provisions are 
detailed at 15 U.S.C. 1681b and 15 U.S.C. 1681e(a); the ID theft 
block provisions are detailed at 15 U.S.C. 1681c-2; and the dispute 
process requirements applicable to CRCs are detailed at 15 U.S.C. 
1681i.
---------------------------------------------------------------------------

    As a result of these reviews, CRCs have continued to make 
improvements to procedures regarding the accuracy of information 
contained in consumer reports. CRCs have also improved procedures to 
monitor users to help ensure that consumer reports are not furnished to 
users when the CRC has reasonable grounds for believing the user lacks 
a permissible purpose. CRCs have also implemented improvements in 
procedures to block information that a consumer has identified as 
resulting from an alleged identity theft and reasonably to investigate 
and respond to disputes from consumers regarding the accuracy or 
completeness of information in consumer files. The following sections 
discuss the observations in these areas at CRCs and the improvements 
made by these entities following these reviews.

3.1 Reasonable Procedures To Assure Maximum Possible Accuracy

    The FCRA states that ``Inaccurate credit reports directly impair 
the efficiency of the banking system. . .'' and that CRCs ``have 
assumed a vital role in assembling and evaluating consumer credit and 
other information on consumers.'' \31\ In recognition of this core 
concern with accuracy in consumer reports, the FCRA requires that, 
``[w]henever a consumer reporting agency prepares a consumer report it 
shall follow reasonable procedures to assure maximum possible accuracy 
of the information concerning the individual about whom the report 
relates.'' \32\
---------------------------------------------------------------------------

    \31\ 15 U.S.C. 1681(a)(1)-(3).
    \32\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------

    Examiners found that one or more nationwide specialty CRCs failed 
to follow reasonable procedures to assure maximum possible accuracy by 
exempting certain furnishers from a data validation testing procedure 
without a valid basis. The CRCs had implemented an accuracy procedure 
under which the CRCs validated the data reported by direct furnishers 
on an annual basis. However, the CRCs' procedure exempted from this 
validation procedure smaller direct furnishers that contributed low 
volume of data. Further, the CRCs procedure also exempted all indirect 
furnishers, who contributed data to the CRCs through a reseller. 
Examiners concluded that the exemption of these low-volume direct 
furnishers and indirect furnishers posed an unreasonable risk of 
producing errors in consumer reports. In response to these findings, 
one or more CRCs are conducting data validation testing on all direct 
and indirect furnishers, without exceptions, and will be reporting the 
results of such testing to the CFPB.
    Examiners also found that one or more nationwide specialty CRCs 
failed to follow reasonable procedures to assure maximum possible 
accuracy by failing to properly process files furnished to the CRCs by 
certain furnishers. The CRCs failed to fully process incoming data 
files from multiple data furnishers on several occasions. The files 
that were not properly processed resulted in the inclusion of 
inaccurate, derogatory information in consumer reports. Further, for a 
period of more than 12 months, the CRCs failed to receive any data from 
one or more furnishers because the furnishers had applied an incorrect 
technology parameter, preventing the furnishers' data files from 
reaching the CRCs. This failure to receive updated data resulted in 
inaccurate, derogatory information being included in consumer reports. 
Subsequent to the discovery of these errors, one or more CRCs have 
implemented data monitoring procedures that are designed to notify 
furnishers of such data processing errors.

3.2 Duty To Limit the Furnishing of Consumer Reports to Permissible 
Purposes

    The FCRA states that ``there is a need to insure that consumer 
reporting agencies exercise their grave responsibilities with fairness, 
impartiality, and a respect for the consumer's right to privacy.'' \33\ 
The FCRA protects consumers' privacy, in part, by stating that CRCs may 
furnish consumer reports only to persons who have a permissible purpose 
to use or obtain the information in the report.\34\ Further, the FCRA 
requires CRCs to maintain reasonable procedures designed to limit the 
furnishing of consumer reports to users with a permissible purpose.\35\
---------------------------------------------------------------------------

    \33\ 15 U.S.C. 1681(a)(4).
    \34\ 15 U.S.C. 1681b(a).
    \35\ 15 U.S.C. 1681e(a).
---------------------------------------------------------------------------

    Supervision conducted one or more reviews of CRCs to evaluate the 
entities' permissible purpose procedures. In these reviews, examiners 
found that one or more CRCs have procedures to verify the identity and 
permissible purposes of new prospective users, which one or more CRCs 
refer to as ``credentialing.'' Further, examiners found that one or 
more CRCs have procedures to monitor that users have a permissible 
purpose when users obtain consumer reports.
    However, examiners also found CMS weaknesses in one or more CRCs' 
permissible purpose procedures. For example, one or more CRCs lacked 
procedures to conduct proactive re-credentialing reviews of its users. 
Under such a re-credentialing review, the CRCs review existing users to 
confirm that the user continues to have a permissible purpose to use 
and obtain consumer reports. Examiners found that the CRCs had 
procedures to conduct re-credentialing reviews of users only when users 
notified the CRCs of a change in ownership, name, status, or nature of 
business or if the CRCs' monitoring identified a specific potential 
permissible purpose violation by a user. The CRCs did not, however, 
have a procedure to review the credentialing of users based on the 
length of time since the user was previously reviewed. As a result of 
these findings, one or more CRCs are implementing proactive re-
credentialing policies and procedures that consider factors such as the 
time since a user was last credentialed for permissible purpose.
    Examiners also found CMS weaknesses in the monitoring procedures at 
one or more CRCs regarding permissible purpose. For example, one or 
more CRCs failed to monitor users or resellers that requested the CRCs 
delete large numbers of hard inquiry records from consumer reports. 
When users obtain consumer reports from CRCs, the CRCs document that 
event by entering an inquiry record in the relevant consumer's file. 
Depending on the user's permissible purpose, the inquiry may be visible 
for up to a year to other users/creditors that obtain the consumer's 
report as well as being visible to the consumer; or instead it may be 
visible only to the consumer.\36\

[[Page 67730]]

When a record of an inquiry is visible to other creditors, it is known 
as a ``hard inquiry'' and when it is visible only to the consumer, it 
is known as a ``soft inquiry.'' One or more CRCs have procedures that 
allow users to request that the CRCs delete hard inquiries from 
consumer reports, usually by converting them into soft inquiries. Users 
may request such deletions to protect consumers who may be victims of 
identity theft. For example, if a consumer notifies a creditor that an 
account was opened in his or her name due to fraud or identity theft, 
the creditor may, in addition to closing the account, contact the CRCs 
and request that the CRCs delete the hard inquiry from the consumers' 
credit report. But users may also ask that inquiries be deleted because 
the user did not have a permissible purpose to obtain the report. 
Examiners found that one or more CRCs had no procedure for monitoring 
the users who requested such deletions at higher rates than usual, 
which may be a risk indicator that a user is obtaining consumer reports 
without any permissible purpose. As a result of these findings, one or 
more CRCs are enhancing permissible purpose monitoring systems to 
include user inquiry change or deletion request volume as a potential 
risk area for investigation of user permissible purpose.
---------------------------------------------------------------------------

    \36\ The CRC must disclose to the consumer the identity of all 
users who obtained that consumer's report, pursuant to 15 U.S.C. 
1681g(a)(3). For more information about the differences between hard 
inquiries and soft inquiries, see CFPB, Key Dimensions and Processes 
in the U.S. Credit Reporting System, at 9 (Dec. 2012).
---------------------------------------------------------------------------

3.3 Blocking Information Resulting From Identity Theft

    The FCRA requires that, unless an exception applies, a CRC must 
``block the reporting of any information in the file of a consumer that 
the consumer identifies as information that resulted from an alleged 
identity theft'' provided that the consumer provides required 
information.\37\ The CRC is then required to promptly notify the 
furnisher of the information identified by the consumer.\38\ The CRC 
may decline to block the information, or may rescind a block, if the 
CRC ``reasonably determines'' that the consumer requested the block in 
error, based on a material misrepresentation of the facts, or the 
consumer obtained goods, services, or money as a result of the 
transaction.\39\ Finally, if the CRC determines to decline to block the 
information requested by the consumer, the CRC must notify the consumer 
promptly of the determination in writing or, if authorized by the 
consumer for that purpose, by any other means available to the CRC.\40\
---------------------------------------------------------------------------

    \37\ 15 U.S.C. 1681c-2(a).
    \38\ 15 U.S.C. 1681c-2(b).
    \39\ 15 U.S.C. 1681c-2(c).
    \40\ 15 U.S.C. 1681c-2(c)(2).
---------------------------------------------------------------------------

    Examiners found that one or more nationwide specialty CRCs violated 
the requirements of this provision of the FCRA. When consumers 
submitted an identity theft block request with all required underlying 
documentation, the CRCs forwarded the information to furnishers and 
relied on the furnishers' response without making an independent 
determination, even in cases where the furnisher stated no block should 
be applied. Therefore, examiners concluded that the CRCs did not 
reasonably determine to decline the block and on what basis, as 
required by the statute. Following this finding, one or more nationwide 
specialty CRCs are changing procedures to the identity-theft block 
provisions of the FCRA. These changes include adopting new policies and 
procedures that require that the CRCs block the identified information 
within four business days of receiving a valid identity theft report. 
Revised procedures also included that for any identity theft block 
request that the CRCs declines or rescinded, the CRCs includes 
documentation of the rationale for denying or rescinding the block to 
ensure that decisions can be monitored and audited for compliance with 
the FCRA.

3.4 Dispute Investigation

    Supervision has continued its focus on reviewing CRCs' compliance 
with the provisions of the FCRA governing consumer disputes. In 
previous issues of Supervisory Highlights, we discussed findings at one 
or more CRCs regarding violations of several provisions in this 
area.\41\ The FCRA right to dispute inaccurate information and have 
that dispute be reasonably investigated by the CRC and relevant 
furnisher is a key consumer protection in the statute. These 
protections recognize that consumers may identify inaccuracies in their 
own reports and sets out procedures that CRCs must follow before 
allowing such information to continue to be reported.
---------------------------------------------------------------------------

    \41\ See, e.g., CFPB, Supervisory Highlights, Winter 2017, at 9-
11 (March 2017).
---------------------------------------------------------------------------

    In recent reviews, examiners have identified new violations of 
several sub-sections of this area of the FCRA. These new violations 
include failures by CRCs to conduct reasonable dispute investigations, 
breakdowns in the required notification procedures to furnishers about 
disputes, failures of CRCs to provide notices of results to consumers, 
and failure of resellers to convey notice of disputes to CRCs that 
provided the disputed information.
3.4.1 Duty To Conduct a Reasonable Reinvestigation
    The FCRA requires that when a consumer disputes the completeness or 
accuracy of an item of information in their file, the CRC must 
``conduct a reasonable reinvestigation to determine whether the 
disputed information is inaccurate and record the current status of the 
disputed information, or delete the item from the file. . . .'' \42\
---------------------------------------------------------------------------

    \42\ 15 U.S.C. 1681i(a)(1)(A).
---------------------------------------------------------------------------

    Examiners found that one or more CRCs systematically violated this 
requirement by failing to initiate investigations after notice of the 
dispute. When the CRCs received disputes related to identity theft or 
fraud via telephone, they instructed consumers to submit the dispute in 
writing and did not initiate investigations until the consumer 
resubmitted in written form. Examiners concluded that the FCRA does not 
permit a CRC to decline to investigate disputes in this manner. 
According to the FCRA, the CRC must conduct a dispute investigation 
when it receives notice of the dispute information. As a result of 
these findings, one or more CRCs enhanced their dispute resolution 
process by updating policies, procedures, and training materials, and 
requiring agents to initiate investigations of all disputes received 
via telephone.
    The FCRA also requires that, in conducting its dispute 
investigation, the CRC must ``review and consider all relevant 
information submitted by the consumer . . . with respect to such 
disputed information.'' \43\ Examiners found that one or more CRCs 
failed to review and consider all such relevant information. The CRCs 
relied on the furnisher's response in validating information from a 
dispute, without independently considering the relevant information or 
documentation provided by the consumer when that information called 
into question the accuracy or validity of the information provided by 
the furnishers. In response to these findings, one or more CRCs updated 
procedures to more clearly describe that agents must review all 
relevant information the consumer provided. However, in a follow-up 
review at one or more CRCs, examiners found that these revised 
procedures were not fully implemented, causing the CRCs to continue to 
fail to review and consider all relevant information provided by

[[Page 67731]]

consumers in support of disputes. The Bureau will continue to monitor 
compliance in this area.
---------------------------------------------------------------------------

    \43\ 15 U.S.C. 1681i(a)(4).
---------------------------------------------------------------------------

    The FCRA generally requires that the CRCs' dispute investigations 
must be completed ``before the end of the 30-day period beginning on 
the date on which the agency receives the notice of dispute from the 
consumer or reseller.'' \44\ Examiners found that one or more CRCs 
failed to complete the investigation within this 30-day timeframe. The 
CRCs incorrectly recorded the date of disputes filed on weekends, 
holidays, and after-hours. These disputes were incorrectly recorded in 
systems as being filed the next business day. As a result of these 
findings, one or more CRCs took action to correct the system logic and 
reassess those disputes.
---------------------------------------------------------------------------

    \44\ 15 U.S.C. 1681i(a)(1)(A). Note that the 30-day period may 
be extended for an additional 15 days if the CRC receives 
information from the consumer during the 30-day period that is 
relevant to the reinvestigation. 15 U.S.C. 1681i(a)(1)(B).
---------------------------------------------------------------------------

3.4.2 Duty To Provide Prompt Notice of Dispute to Furnisher
    The FCRA requires that when a CRC receives a notice of a dispute 
from a consumer, the CRC must ``provide notification of the dispute to 
any person who provided any item of information in dispute. . . .'' 
\45\ This notice must be provided ``[b]efore the expiration of the 5-
business-day period beginning on the date on which a [CRC] receives 
notice of the dispute. . . .'' \46\
---------------------------------------------------------------------------

    \45\ 15 U.S.C. 1681i(a)(2)(A).
    \46\ Id.
---------------------------------------------------------------------------

    Examiners found that one or more CRCs violated this provision of 
the FCRA when they failed to notify furnishers of a consumer's dispute 
within five business days of receiving a dispute. This violation 
occurred in thousands of disputes over several months. This violation 
was caused by lack of adequate staffing at the CRCs and was not 
detected by the CRCs' compliance monitoring. As a result of the 
examination findings, the CRCs developed and implemented dispute 
investigation procedures to ensure agents provide required notices to 
furnishers and forward all relevant information regarding the dispute 
within the mandatory time periods.
3.4.3 Duty To Notify Furnisher That Inaccurate, Incomplete, or 
Unverified Information Has Been Modified or Deleted
    When a CRC has completed its dispute investigation, if the CRC 
finds that any disputed information is inaccurate or incomplete or 
unable to be verified, the FCRA requires the CRC to ``promptly notify 
the furnisher of that information that the information has been 
modified or deleted from the file of the consumer.'' \47\
---------------------------------------------------------------------------

    \47\ 15 U.S.C. 1681i(a)(5)(A)(ii).
---------------------------------------------------------------------------

    In one or more reviews of nationwide specialty CRCs, examiners 
identified instances where one or more specialty CRCs failed to notify 
furnishers that information from the consumer's file had been modified 
or deleted after an investigation. In these instances, one or more CRCs 
were informed by the furnisher that a modification or deletion was 
necessary. One or more specialty CRCs investigation agents then 
modified or deleted the incorrect information but failed to inform the 
furnisher of the action taken, as required by the FCRA. In other 
instances, the information was internally resolved in the consumer's 
favor by one or more specialty CRCs but either the CRCs did not provide 
the notice to the furnishers of the modification or deletion, or they 
did not provide ``prompt'' notice to the furnisher required by the 
FCRA. As a result of these findings, one or more specialty CRCs 
developed and implemented dispute investigation procedures to ensure 
agent provide the required notice consistent with the requirements in 
the FCRA.
    Additionally, examiners found that one or more CRCs failed to 
promptly send furnishers notices when investigations found that 
information was not accurate and information was changed in the 
consumer's file. One or more CRCs admitted that they failed to transmit 
approximately 2.7 million notices over a period of approximately two 
months. The cause for the failure was a programming error. This failure 
primarily affected consumers who submitted direct disputes to 
furnishers but some consumers who submitted indirect disputes to CRCs 
were also affected. As a result of this finding, one or more CRCs are 
fixing the programming error and enhancing their internal monitoring to 
avoid future issues of this type.
3.4.4 Duty To Provide Consumer With Written Notice of Results of 
Reinvestigation
    The FCRA requires that, upon completion of the reasonable 
reinvestigation, the CRC must provide written notice of the results to 
the consumer not later than five business days after completion of the 
reinvestigation.\48\ Examiners found that one or more CRCs failed to 
send consumers results notices as required when the consumer sent the 
CRCs a dispute that was not accompanied by a consumer identification 
and certification form. In such cases, the CRCs resolved the dispute 
and, where necessary updated its records, but did not send the consumer 
the required notice of results. In response to these findings, one or 
more CRCs are developing and implementing policies and procedures to 
send consumers notifications of the results of disputes even when the 
consumer did not provide a consumer identification and certification 
form with the dispute.
---------------------------------------------------------------------------

    \48\ 15 U.S.C. 1681i(a)(6)(A).
---------------------------------------------------------------------------

3.4.5 Duty of Reseller To Convey Notice of Dispute to the CRC That 
Provided the Reseller With the Information That Is Subject of the 
Dispute
    The FCRA dispute provisions provide direction to resellers upon 
receipt of a dispute from a consumer. These requirements include, where 
applicable, providing notice of the dispute to the CRC that provided 
the reseller with the disputed information. ``If a reseller receives a 
notice from a consumer of a dispute concerning the completeness or 
accuracy of any item of information contained in a consumer report on 
such consumer produced by the reseller, the reseller shall'' determine 
whether the item of information is incomplete or inaccurate as a result 
of an act or omission of the reseller within five business days.\49\ If 
the reseller determines that the disputed information is not incomplete 
or inaccurate as a result of an act or omission of the reseller, the 
reseller must convey the notice of the dispute, together with all 
relevant information provided by the consumer, to each CRC that 
provided the reseller with the information that is the subject of the 
dispute.\50\
---------------------------------------------------------------------------

    \49\ 15 U.S.C. 1681i(f)(2)(A).
    \50\ 15 U.S.C. 1681i(f)(2)(B)(ii).
---------------------------------------------------------------------------

    Examiners found that one or more resellers, after determining that 
disputed information was not incomplete or inaccurate as a result of an 
act or omission of the resellers, failed to convey to the CRCs that 
provided the information the notice of the dispute together with all 
relevant information provided by the consumer. In response to these 
findings, one or more resellers developed and implemented dispute 
investigation procedures designed to ensure agents provide required 
notice of disputes to CRCs that provided the information to the 
reseller.
    In follow-up reviews, examiners found that one or more resellers 
developed and implemented enhanced procedures designed to ensure that 
the reseller(s) promptly conveyed notice of

[[Page 67732]]

disputes the reseller received to the CRC that provided the reseller 
with the disputed information.

4. Conclusion

    The Bureau will continue to publish Supervisory Highlights to aid 
Bureau-supervised entities in their efforts to comply with Federal 
consumer financial law. The report shares information regarding general 
supervisory and examination findings regarding the FCRA and Regulation 
V (without identifying specific institutions). This information is 
shared, in part, to communicate the Bureau's supervisory expectations 
to CRCs and furnishers that those institutions comply with the 
applicable provisions of the FCRA and Regulation V.
    Supervision's work in the consumer reporting market is ongoing and 
remains a high priority. As detailed in this report, CFPB examiners 
have continued to identify violations and CMS weaknesses regarding 
critical FCRA and Regulation V protections. However, examiners have 
also observed significant improvements in these areas, including 
continued investment in FCRA-related CMS. Supervision will continue to 
conduct reviews at CRCs, including resellers, as well as at furnishers 
and users of consumer reports within our supervisory jurisdiction.

    Dated: November 30, 2019.
Kathleen L. Kraninger,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2019-26669 Filed 12-10-19; 8:45 am]
BILLING CODE 4810-AM-P