Supervisory Highlights Consumer Reporting Special Edition, Issue 20 (Fall 2019), 67725-67732 [2019-26669]

Agencies

• BUREAU OF CONSUMER FINANCIAL PROTECTION

[Federal Register Volume 84, Number 238 (Wednesday, December 11, 2019)]
[Notices]
[Pages 67725-67732]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-26669]



[[Page 67725]]

=======================================================================
-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION


Supervisory Highlights Consumer Reporting Special Edition, Issue 
20 (Fall 2019)

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Supervisory highlights.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is 
issuing its twentieth edition of its Supervisory Highlights. In this 
special issue of Supervisory Highlights, we report examination findings 
in the areas of consumer reporting and furnishing of information to 
consumer reporting companies, pursuant to the Fair Credit Reporting Act 
and Regulation V. The report does not impose any new or different legal 
requirements, and all violations described in the report are based only 
on those specific facts and circumstances noted during those 
examinations.

DATES: The Bureau released this edition of the Supervisory Highlights 
on its website on December 9, 2019.

FOR FURTHER INFORMATION CONTACT: David Wake, Senior Counsel, Office of 
Supervision Policy, at (202) 435-9613. If you require this document in 
an alternative electronic format, please contact 
[email protected].

SUPPLEMENTARY INFORMATION: 

1. Introduction

    The Consumer Financial Protection Bureau (CFPB or Bureau) is 
committed to a consumer financial marketplace that is free, innovative, 
competitive, and transparent, where the rights of all parties are 
protected by the rule of law, and where consumers are free to choose 
the products and services that best fit their individual needs. To 
effectively accomplish this, the Bureau remains committed to sharing 
with the public key findings from its supervisory work to help industry 
limit risks to consumers and comply with Federal consumer financial 
law.
    The findings included in this report cover examinations in the 
areas of consumer reporting and furnishing of information to consumer 
reporting companies (CRCs),\1\ pursuant to the Fair Credit Reporting 
Act (FCRA) and Regulation V.\2\ In March 2017, the CFPB published its 
first special edition of Supervisory Highlights dedicated to consumer 
reporting issues.\3\ This special edition of Supervisory Highlights 
reports on more recent supervisory findings in this area.
---------------------------------------------------------------------------

    \1\ The term ``consumer reporting company'' means the same as 
``consumer reporting agency,'' as defined in the Fair Credit 
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer 
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide 
specialty consumer reporting agencies as defined in 15 U.S.C. 
1681a(x).
    \2\ 15 U.S.C. 1681 et seq. and 12 CFR part 1022.
    \3\ CFPB, Supervisory Highlights (Winter 2017), available at 
https://files.consumerfinance.gov/f/documents/201703_cfpb_Supervisory-Highlights-Consumer-Reporting-Special-Edition.pdf.
---------------------------------------------------------------------------

    Recent supervisory reviews of compliance with the FCRA and 
Regulation V have identified new violations and compliance management 
system (CMS) weaknesses at institutions within the CFPB's supervisory 
authority. These institutions include CRCs that are larger participants 
in the consumer reporting market \4\ as well as furnishers subject to 
the Bureau's supervisory authority. These furnishers include banks, 
mortgage servicers, auto loan servicers, student loan servicers, and 
debt collectors.
---------------------------------------------------------------------------

    \4\ Larger participants in the consumer reporting market are 
defined in 12 CFR 1090.104.
---------------------------------------------------------------------------

    The information contained in Supervisory Highlights is disseminated 
to communicate the Bureau's supervisory expectations to CRCs and 
furnishers that those institutions comply with the applicable 
provisions of the FCRA and Regulation V. This document does not impose 
any new or different legal requirements. In addition, the legal 
violations described in this and previous issues of Supervisory 
Highlights are based on the particular facts and circumstances reviewed 
by the Bureau as part of its examinations. A conclusion that a legal 
violation exists on the facts and circumstances described here may not 
lead to such a finding under different facts and circumstances.
    We invite readers with questions or comments about the findings and 
legal analysis reported in Supervisory Highlights to contact us at 
[email protected].

2. Supervisory Observations at Furnishers

    Furnishers of information play a crucial role in the accuracy and 
integrity of consumer reports when they provide information to CRCs. 
Inaccurate information from furnishers can lead to inaccurate reports 
and consumer and market harm. For example, inaccurate information on a 
consumer report can impact a consumer's ability to obtain credit or 
open a new deposit or savings account at a bank. Moreover, furnishers 
have an important role in the dispute process when consumers dispute 
the accuracy of information in their consumer reports. Consumers may 
dispute information that appears on their consumer report directly to 
furnishers (``direct disputes'') or indirectly through CRCs (``indirect 
disputes''). When furnishers receive direct or indirect disputes, they 
are required to investigate the disputes to verify the accuracy of the 
information furnished.\5\ A timely and responsive reply to a consumer 
dispute may reduce the impact inaccurate negative information in a 
consumer report may have on the consumer. The FCRA and Regulation V set 
forth requirements for furnishers concerning both accuracy and dispute 
handling. To ensure compliance with these requirements, Supervision 
regularly conducts reviews at furnishers subject to its supervisory 
authority.
---------------------------------------------------------------------------

    \5\ 15 U.S.C. 1681s-2(a)(8), 15 U.S.C. 1681s-2(b); 12 CFR 
1022.43.
---------------------------------------------------------------------------

    In recent supervisory reviews, examiners found CMS weaknesses and 
violations of the FCRA and Regulation V. In such cases, the 
furnisher(s) have taken or are taking corrective action.

2.1 Reasonable, Written Policies and Procedures

    Regulation V requires furnishers to establish and implement 
reasonable written policies and procedures regarding the accuracy and 
integrity of the information relating to consumers that they provide to 
CRCs.\6\ Such policies and procedures must be appropriate to the 
nature, size, complexity, and scope of each furnisher's activities.\7\ 
Furnishers must consider and incorporate, as appropriate, the 
guidelines of appendix E to Regulation V when developing their policies 
and procedures.\8\ In a previous issue of Supervisory Highlights, we 
described supervisory findings of furnishers that violated these 
requirements.\9\ In recent supervisory reviews, we have identified 
further violations of the Regulation V requirement for reasonable 
written policies and procedures. In the section below, we have 
highlighted key findings according to the products for which 
information is being furnished, in keeping with the Regulation V 
requirement that the procedures be ``appropriate to the nature, size, 
complexity, and scope of the furnisher's activities.''
---------------------------------------------------------------------------

    \6\ 12 CFR 1022.42(a).
    \7\ Id.
    \8\ 12 CFR 1022.42(b).
    \9\ CFPB, Supervisory Highlights, Winter 2017, at 13-17 (March 
2017).
---------------------------------------------------------------------------

2.1.1 Mortgage Furnishers
    In one or more reviews of furnishers of mortgage loans, examiners 
found that the furnishers' policies and procedures

[[Page 67726]]

were not appropriate to the nature, size, complexity, and scope of the 
furnisher's activities. For example, one or more furnishers maintained 
general FCRA-related policies and procedures that did not provide 
sufficient guidance for responding to disputes in a timely manner or 
reporting credit reporting changes in furnished accounts when the 
status of such accounts had changed. As a result of these findings, one 
or more furnishers are developing and implementing reasonable 
furnishing procedures governing the accurate reporting of accounts 
designed to ensure the timely update of information to reflect the 
current status of consumer accounts.
2.1.2 Auto Loan Furnishers
    In one or more reviews of furnishers of auto loans, examiners found 
that the furnishers' policies and procedures did not provide sufficient 
guidance for conducting reasonable investigations of indirect disputes 
that contain allegations of identity theft. For example, the 
furnishers' policies and procedures did not specify that agents 
investigating disputes alleging identity theft should review internal 
records of fraud investigations before completing dispute 
investigations and responding to CRCs. As a result of these findings, 
one or more furnishers are developing and implementing policies and 
procedures with respect to identity theft disputes to ensure the 
furnisher conducts its investigation, including review of internal 
records, prior to responding to the CRC.
2.1.3 Debt Collection Furnishers
    In one or more reviews of debt collection furnishers, examiners 
found that the furnishers' policies and procedures did not 
differentiate between FCRA disputes, FDCPA disputes, or validation 
requests. In this regard, the furnishers categorized and handled direct 
FCRA disputes, FDCPA disputes, and validation requests the same way and 
without consideration for the applicable regulatory requirements. 
Furthermore, the policies and procedures did not address the regulatory 
timeframes for conducting reasonable investigations of disputes, or for 
reporting the results of the investigations to the consumers or to 
CRCs, as appropriate. Instead, the policies and procedures provided 
general instructions on how to indicate that accounts are disputed and 
how to label dispute-related correspondence from consumers. The 
policies and procedures did not contain any substantive instructions on 
how to conduct investigations of disputed accounts. Following these 
findings, one or more furnishers are developing and implementing 
reasonable policies and procedures covering the steps necessary to 
conduct reasonable and timely investigations of disputes, as that term 
is defined in Regulation V.
2.1.4 Deposit Account Furnishers
    Examiners found that one or more furnishers of deposit account 
information to specialty CRCs had no written policies or procedures for 
furnishing such information to specialty CRCs. In response to this 
finding, one or more deposit account furnishers are developing and 
implementing reasonable written policies and procedures regarding 
furnishing to specialty deposit CRCs.
    Examiners also found that one or more deposit account furnishers 
did not have reasonable written policies and procedures regarding 
deposit account information. For example, policies and procedures did 
not require that the furnishers validate the data furnished to 
specialty deposit CRCs, causing the furnisher to inaccurately furnish 
consumers' account status information to one or more specialty CRCs. 
One or more deposit account furnishers are evaluating the effectiveness 
of existing policies and procedures regarding the accuracy and 
integrity of information furnished to nationwide specialty CRCs and 
develop new written policies where appropriate.
2.1.5 Improvements in Furnishing Policies and Procedures
    In follow-up reviews at furnishers previously examined, examiners 
found that one or more furnishers had made significant improvements in 
furnishing policies and procedures. For example, one or more furnishers 
updated their policies and procedures to incorporate specific 
requirements to ensure dispute investigation agents conduct reasonable 
dispute investigations and document their work. Revised dispute 
investigation procedures include an extensive list of internal systems 
and sources that dispute agents must research when investigating a 
dispute. Updated procedures also dictate that the furnisher retains 
dispute investigation documentation and records, including imaged 
screenshots, for a minimum of seven years.
    In another example of improved furnishing policies and procedures, 
examiners found that one or more deposit furnishers documented improved 
quality monitoring procedures to impose enhanced sampling and oversight 
procedures regarding furnished deposits information. Additionally, one 
or more furnishers improved procedures governing when to delete, 
update, and correct information in its records to avoid furnishing 
inaccurate information to specialty CRAs. One such new procedure 
required the furnisher to conduct a root-cause analysis of dispute 
results to ensure that when dispute investigations identify systemic 
errors, the furnisher corrects furnished data about other accounts that 
were also affected by similar errors.

2.2 Prohibition of Reporting Information With Actual Knowledge of 
Errors

    The FCRA prohibits furnishers from furnishing any information 
relating to a consumer to any CRC if the furnisher ``knows or has 
reasonable cause to believe that the information is inaccurate.'' \10\ 
However, a furnisher is not subject to this prohibition if it ``clearly 
and conspicuously specifies to the consumer an address'' at which 
consumers can send notices that specific information reported by the 
furnisher is inaccurate.\11\ CFPB examiners found that one or more 
furnishers furnished information they knew or had reasonable cause to 
believe was inaccurate. One or more furnishers reported thousands of 
accounts to one or more CRCs with inaccurate derogatory status codes. 
The accounts were furnished inaccurately because of coding errors. The 
furnishers had reasonable cause to believe the information was 
inaccurate because consumers filed disputes with one or more CRCs 
identifying the errors, and those disputes were forwarded to the 
furnishers for investigation. The furnishers, in investigating the 
disputes, failed to conduct root-cause analysis that would have 
identified the issue as a systemic source of inaccuracy. Further, the 
furnishers did not clearly and conspicuously specify to consumers an 
address at which consumers could send notices that furnished 
information was inaccurate. The furnishers provided an address to 
consumers for direct disputes, but that address was provided on the 
last page of lengthy consumer disclosures under a heading of 
``Additional Information and Use Disclosures'' that followed topics 
such as ``General Terms,'' ``Arbitration,'' and ``Privacy Notice.'' 
Examiners concluded that these notices did not qualify as ``clear and 
conspicuous.'' After discovery of these inaccuracies, one or more 
furnishers implemented a program fix for the inaccurate coding issue 
and

[[Page 67727]]

conducted a review of all furnished accounts to identify and correct 
the furnishing of all affected consumers.
---------------------------------------------------------------------------

    \10\ 15 U.S.C. 1681s-2(a)(1)(A).
    \11\ 15 U.S.C. 1681s-2(a)(1)(C).
---------------------------------------------------------------------------

2.3 Duty To Correct and Update Information

    If a furnisher who ``regularly and in the ordinary course of 
business furnishes information to one or more [CRCs] about the person's 
transactions or experiences with any consumer'' has furnished to a CRC 
information that the furnisher determines is not complete or accurate, 
it shall promptly notify the CRC of that determination and provide to 
the CRC any corrections to that information, or any additional 
information, that is necessary to make the information provided to the 
CRC complete and accurate, and shall not thereafter furnish to the CRC 
any of the information that remains not complete or accurate.\12\
---------------------------------------------------------------------------

    \12\ 15 U.S.C. 1681s-2(a)(2)(B).
---------------------------------------------------------------------------

    The CFPB has identified violations of this provision in one or more 
recent furnisher reviews. For example, in one or more reviews of auto 
loan furnishers, examiners found that the furnishers failed to provide 
prompt notifications to CRCs of their determinations that information 
they had previously furnished was inaccurate because the furnishers had 
found that the loans had been opened as a result of identity theft. In 
such cases, the furnishers recorded the results of their investigations 
internally, but failed to make the corrections necessary to make the 
furnished information accurate. In response to these findings, one or 
more auto furnishers are developing and implementing policies and 
procedures to ensure that they promptly notify CRCs and/or correct 
information furnished, as appropriate, if they find that information 
they had previously furnished is inaccurate.
    As another example, in one or more reviews of deposit account 
furnishers, examiners found that the furnishers failed to promptly 
correct and update deposit account information reported to nationwide 
specialty CRCs that the furnishers determined was not complete or 
accurate. Examiners identified several situations where the furnishers 
failed to promptly update or correct information. These situations 
included when consumers' charged-off balances had been discharged in 
bankruptcy, and when consumers paid their charged-off balances in full. 
In both situations, the furnishers updated their systems of record to 
indicate that the status of the accounts had changed but failed to 
update and correct the information furnished to CRCs about these 
accounts. In response to these findings, one or more furnishers are 
updating account information with the relevant CRCs for all impacted 
accounts and enhancing furnishing procedures.
    In one or more follow up deposit account furnisher reviews to 
address the furnishers' prior failure to update and correct information 
when consumers paid-in-full or settled-in-full, examiners found one or 
more deposit account furnishers had improved furnishing activities to 
address the failure to correct and update information required by the 
FCRA. To address this violation and the matters requiring attention 
from the prior exam, one or more furnishers of deposit account 
information took several actions, including:
    [ssquf] System changes that included the creation of coding 
processes to automated systems to identify consumers who paid in-full, 
and where appropriate, notification to CRCs of the corrected status of 
affected consumers;
    [ssquf] Notification to CRCs of the correct status of paid-in-full 
and settled-in-full consumer accounts;
    [ssquf] Improved tracking of paid-in-full and settled-in-full 
consumers and the establishment of a trigger to update the CRCs once 
final payment is made without requiring consumer to notify the 
furnisher;
    [ssquf] Enhanced policies and procedures and new policies and 
procedures to adhere to the requirements of the FCRA and Regulation V, 
including modification of standards for reporting fraud or account 
abuse and use of appropriate closure codes; and
    [ssquf] Improved dispute monitoring and tracking, as well as 
analysis of disputes to improve the accuracy and integrity of 
information furnished to CRCs.
    One or more deposit account furnishers adequately addressed the 
matters requiring attention from the prior exam(s) and properly 
notified CRCs of the correct status of all paid in full and settled in 
full accounts.

2.4 Duty To Provide Notice of Delinquency of Accounts

    The date of first delinquency is important for CRCs, creditors, and 
consumers because it determines when information on a consumer report 
becomes obsolete and may no longer be reported.\13\ The FCRA requires 
furnishers of information regarding delinquent accounts to report the 
date of delinquency to the CRC within 90 days.\14\ The FCRA specifies 
that the date of first delinquency reported by the furnisher ``shall be 
the month and year of the commencement of the delinquency on the 
account that immediately preceded the action.'' \15\
---------------------------------------------------------------------------

    \13\ 15 U.S.C. 1681c(a)-(b). Information may be reported if 
certain exceptions specified in the statute apply.
    \14\ 15 U.S.C. 1681s-2(a)(5)(A). This provision applies to 
accounts being placed for collection, charged to profit or loss, or 
subjected to similar action.
    \15\ Id.
---------------------------------------------------------------------------

    In one or more reviews, furnishers reported the incorrect date of 
first delinquency. For example, one or more furnishers of auto loans 
furnished the date of repossession of the collateral vehicle, rather 
than the date of first delinquency. The date of repossession at this 
furnisher was several months after the date of first missed payment.

2.5 Obligations Upon Notice of Dispute

    Pursuant to the FCRA and Regulation V, consumers can file disputes 
concerning the accuracy of information contained in a consumer report 
with the CRCs as well as directly with the furnisher of that 
information.\16\ Whether filed directly with the furnisher or 
indirectly through a CRC, the furnisher must conduct a reasonable 
investigation of the dispute.\17\ Further, for direct disputes, the 
furnisher must complete its investigation of the dispute and respond to 
the consumer before the expiration of the time period under section 
611(a)(1) of the FCRA.\18\ Finally, if the furnisher determines that a 
direct dispute is frivolous or irrelevant, it must provide notice of 
that determination to the consumer.\19\
---------------------------------------------------------------------------

    \16\ Disputes filed with CRCs are governed by 15 U.S.C. 1681i 
and 1681s-2(b). Disputes filed directly with the furnisher are 
governed by 15 U.S.C. 1681s-2(a)(8) as implemented by Regulation V, 
12 CFR 1022.43.
    \17\ 15 U.S.C. 1681s-2(b)(1)(A) (indirect disputes); 12 CFR 
1022.43(e)(1) (direct disputes).
    \18\ 15 U.S.C. 1681s-2(a)(8)(E)(iii). See also 15 U.S.C. 
1681i(a)(1).
    \19\ 15 U.S.C. 1681s-2(a)(F)(ii); 12 CFR 1022.43(f)(2).
---------------------------------------------------------------------------

2.5.1 Duty To Conduct Reasonable Investigation of Dispute
    For disputes filed directly with furnishers, Regulation V requires 
furnishers to conduct a reasonable investigation with respect to the 
disputed information and review all relevant information provided by 
the consumer with the dispute notice.\20\ Examiners found one or more 
furnishers violated these provisions when the furnishers failed to 
investigate disputes submitted by consumers. At one or more furnishers, 
backlogs of thousands of direct disputes accumulated in document 
processing queues and were not investigated or responded to at all. 
When the furnishers discovered the

[[Page 67728]]

backlogs, the furnishers responded to the disputes pursuant to 
methodologies that broadly categorized the backlogged account 
correspondence, which resulted in the furnishers failing to undertake 
individual investigation of the disputes in the backlogs.
---------------------------------------------------------------------------

    \20\ 12 CFR 1022.43(e)(1-2).
---------------------------------------------------------------------------

    For indirect disputes filed with CRCs, the FCRA requires that, upon 
receiving notice of the dispute from the CRC, the furnisher must 
conduct an investigation with respect to the disputed information and 
review all relevant information provided by the CRC.\21\ The standard 
for investigation of indirect disputes is, like direct disputes, that 
the furnisher's investigation must be reasonable.\22\ Examiners found 
one or more furnishers violated these provisions when the furnishers 
responded to CRC notices of disputes without verifying the accuracy of 
the disputed information but instead with instructions to the CRC that 
the consumer should contact the furnisher directly and that the 
disputed information should not be deleted. In response to these 
findings, one or more furnishers are developing dispute handling 
policies and procedures to ensure the investigation of disputes is in 
accordance with the requirements of the FCRA.
---------------------------------------------------------------------------

    \21\ 15 U.S.C. 1681s-2(b)(1)(A)-(B).
    \22\ See, e.g., Johnson v. MBNA Am. Bank, 357 F.3d 426, 430-31 
(4th Cir. 2004) (holding that the furnisher, after receiving notice 
of a consumer dispute, must conduct a reasonable investigation to 
determine whether the disputed information can be verified).
---------------------------------------------------------------------------

    In another example, one or more furnishers failed to conduct 
reasonable investigations of indirect disputes where the disputes 
alleged identity theft. The furnishers responded to such disputes and 
verified the disputed information as accurate without reviewing their 
own system records as part of the investigation. Had the furnishers 
reviewed their own records, examiners found, they would have seen that 
some of the disputed accounts were, in fact, the result of identity 
theft. In response to these findings, one or more furnishers are 
developing and implementing policies and procedures with respect to 
indirect identity theft disputes to ensure that the furnishers conduct 
their investigation of the dispute, including a review of internal 
records, prior to responding to the CRC.
2.5.2 Duty To Complete Dispute Investigations Timely
    After receiving a dispute notice from a consumer, a furnisher is 
required under Regulation V to complete a reasonable investigation and 
report the results of the investigation to the consumer within the 
timeframe required, which is generally 30 days but can be extended up 
to 45 days in limited circumstances.\23\
---------------------------------------------------------------------------

    \23\ 15 U.S.C. 1681s-2(a)(8)(E)(iii); 12 CFR 1022.42(e)(3). See 
also 15 U.S.C. 1681i(a)(1).
---------------------------------------------------------------------------

    One or more furnishers failed to complete dispute investigations 
within this timeframe, resulting in delayed notice to consumers of 
dispute results as well as delayed deletion of delinquencies from 
consumers' credit reports. In one or more examinations, examiners found 
system design flaws--including coding errors and poor work stream 
management that resulted in a backlog of complaints that were not 
investigated or responded to in a timely manner. At one or more 
furnishers, examiners also identified inadequate control policies, poor 
resource allocation, and weak oversight that led to the results of 
dispute investigations not being sent to consumers. In response to 
these findings, one or more furnishers are updating policies and 
procedures, improving staff training, and implementing software 
enhancements.
2.5.3 Duty To Notify Consumer of Determination That Dispute Is 
Frivolous or Irrelevant
    When consumers file disputes directly with a furnisher, Regulation 
V allows the furnisher to decline to investigate the dispute if the 
furnisher has ``reasonably determined that the dispute is frivolous or 
irrelevant.'' \24\ A dispute qualifies as ``frivolous or irrelevant'' 
if (i) the consumer did not provide sufficient information to 
investigate the disputed information, (ii) the consumer's dispute is 
substantially the same as a dispute previously submitted by the 
consumer, and the furnisher has already investigated the dispute and 
responded as required, or (iii) an exception applies to the dispute 
investigation requirement.\25\ If a furnisher determines that the 
dispute is frivolous or irrelevant, the furnisher must provide notice 
to consumers of its determination (``frivolousness notices'').\26\ 
Furnishers must notify the consumers of such determinations no later 
than five business days after the furnishers made the determination by 
mail or, if authorized by the consumer for that purpose, by any other 
means available to the furnisher.\27\
---------------------------------------------------------------------------

    \24\ 15 U.S.C. 1681s-2(a)(8)(F); 12 CFR 1022.43(f)(1).
    \25\ 15 U.S.C. 1681s-2(a)(8)(F)(i); 12 CFR 1022.43(f)(1)(i)-
(iii).
    \26\ 15 U.S.C. 1681s-2(a)(8)(F)(ii); 12 CFR 1022.43(f)(2).
    \27\ Id.
---------------------------------------------------------------------------

    Examiners found that one or more furnishers failed to provide 
frivolousness notices to consumers when the furnisher determined that 
the consumers' disputes were frivolous or irrelevant when the furnisher 
believed the disputes were from credit repair organizations. When 
agents for one or more furnishers determined that disputes were sent by 
a credit repair agency, the disputes would be discarded as frivolous. 
Although these disputes were considered frivolous, no frivolousness 
notices were sent to consumers.
    Examiners also found one or more furnishers failed to send 
frivolousness notices for consumer disputes when they believed the 
disputes were the same as another previously submitted dispute by or on 
behalf of consumers that had already been investigated and addressed. 
Although one or more furnishers had a policy stating that consumers 
must be notified within five days of determining that the dispute is 
frivolous, one or more furnishers failed to provide such notifications 
to consumers.
    In addition to requiring that the furnisher send frivolousness 
notices, Regulation V also requires furnishers to include the reasons 
for determinations that disputes are frivolous and identify any 
information required to investigate the disputed information.\28\ 
Examiners found that one or more furnishers failed to consistently send 
frivolousness notices and failed to communicate the reasons for such 
determinations to the consumers. Instead, one or more furnishers simply 
provided consumers with letters stating that there would be no further 
correspondence unless the consumers provided new information. The 
letters did not include the reason for the frivolousness determination 
and did not identify information required to investigate the disputed 
information as required by Regulation V. In response to these findings, 
one or more furnishers updated, documented and implemented policies and 
procedures to ensure they respond to all disputes, including those 
determined to be frivolous, to ensure compliance with legal 
requirements.
---------------------------------------------------------------------------

    \28\ 15 U.S.C. 1681s-2(a)(8)(F)(iii); 12 CFR 1022.43(f)(3).
---------------------------------------------------------------------------

3. Supervisory Observations at Consumer Reporting Companies

    Participants in the larger participant market for consumer 
reporting include nationwide consumer reporting companies as well as 
some consumer report resellers and specialty consumer reporting 
companies.\29\ Recent

[[Page 67729]]

supervisory reviews of CRCs have evaluated compliance with FCRA 
provisions regarding the CRC's procedures to ensure maximum possible 
accuracy of information, as well as provisions regarding permissible 
purpose, restriction of information resulting from identity theft, and 
dispute investigation obligations.\30\ Examiners identified violations 
and weaknesses in procedures associated with these FCRA provisions.
---------------------------------------------------------------------------

    \29\ The term ``consumer reporting company'' means the same as 
``consumer reporting agency,'' as defined in the Fair Credit 
Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer 
reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide 
specialty consumer reporting agencies as defined in 15 U.S.C. 
1681a(x). The term ``reseller'' is defined in 15 U.S.C. 1681a(u).
    \30\ FCRA obligations regarding accuracy procedures are detailed 
at 15 U.S.C. 1681e(b); the permissible purpose provisions are 
detailed at 15 U.S.C. 1681b and 15 U.S.C. 1681e(a); the ID theft 
block provisions are detailed at 15 U.S.C. 1681c-2; and the dispute 
process requirements applicable to CRCs are detailed at 15 U.S.C. 
1681i.
---------------------------------------------------------------------------

    As a result of these reviews, CRCs have continued to make 
improvements to procedures regarding the accuracy of information 
contained in consumer reports. CRCs have also improved procedures to 
monitor users to help ensure that consumer reports are not furnished to 
users when the CRC has reasonable grounds for believing the user lacks 
a permissible purpose. CRCs have also implemented improvements in 
procedures to block information that a consumer has identified as 
resulting from an alleged identity theft and reasonably to investigate 
and respond to disputes from consumers regarding the accuracy or 
completeness of information in consumer files. The following sections 
discuss the observations in these areas at CRCs and the improvements 
made by these entities following these reviews.

3.1 Reasonable Procedures To Assure Maximum Possible Accuracy

    The FCRA states that ``Inaccurate credit reports directly impair 
the efficiency of the banking system. . .'' and that CRCs ``have 
assumed a vital role in assembling and evaluating consumer credit and 
other information on consumers.'' \31\ In recognition of this core 
concern with accuracy in consumer reports, the FCRA requires that, 
``[w]henever a consumer reporting agency prepares a consumer report it 
shall follow reasonable procedures to assure maximum possible accuracy 
of the information concerning the individual about whom the report 
relates.'' \32\
---------------------------------------------------------------------------

    \31\ 15 U.S.C. 1681(a)(1)-(3).
    \32\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------

    Examiners found that one or more nationwide specialty CRCs failed 
to follow reasonable procedures to assure maximum possible accuracy by 
exempting certain furnishers from a data validation testing procedure 
without a valid basis. The CRCs had implemented an accuracy procedure 
under which the CRCs validated the data reported by direct furnishers 
on an annual basis. However, the CRCs' procedure exempted from this 
validation procedure smaller direct furnishers that contributed low 
volume of data. Further, the CRCs procedure also exempted all indirect 
furnishers, who contributed data to the CRCs through a reseller. 
Examiners concluded that the exemption of these low-volume direct 
furnishers and indirect furnishers posed an unreasonable risk of 
producing errors in consumer reports. In response to these findings, 
one or more CRCs are conducting data validation testing on all direct 
and indirect furnishers, without exceptions, and will be reporting the 
results of such testing to the CFPB.
    Examiners also found that one or more nationwide specialty CRCs 
failed to follow reasonable procedures to assure maximum possible 
accuracy by failing to properly process files furnished to the CRCs by 
certain furnishers. The CRCs failed to fully process incoming data 
files from multiple data furnishers on several occasions. The files 
that were not properly processed resulted in the inclusion of 
inaccurate, derogatory information in consumer reports. Further, for a 
period of more than 12 months, the CRCs failed to receive any data from 
one or more furnishers because the furnishers had applied an incorrect 
technology parameter, preventing the furnishers' data files from 
reaching the CRCs. This failure to receive updated data resulted in 
inaccurate, derogatory information being included in consumer reports. 
Subsequent to the discovery of these errors, one or more CRCs have 
implemented data monitoring procedures that are designed to notify 
furnishers of such data processing errors.

3.2 Duty To Limit the Furnishing of Consumer Reports to Permissible 
Purposes

    The FCRA states that ``there is a need to insure that consumer 
reporting agencies exercise their grave responsibilities with fairness, 
impartiality, and a respect for the consumer's right to privacy.'' \33\ 
The FCRA protects consumers' privacy, in part, by stating that CRCs may 
furnish consumer reports only to persons who have a permissible purpose 
to use or obtain the information in the report.\34\ Further, the FCRA 
requires CRCs to maintain reasonable procedures designed to limit the 
furnishing of consumer reports to users with a permissible purpose.\35\
---------------------------------------------------------------------------

    \33\ 15 U.S.C. 1681(a)(4).
    \34\ 15 U.S.C. 1681b(a).
    \35\ 15 U.S.C. 1681e(a).
---------------------------------------------------------------------------

    Supervision conducted one or more reviews of CRCs to evaluate the 
entities' permissible purpose procedures. In these reviews, examiners 
found that one or more CRCs have procedures to verify the identity and 
permissible purposes of new prospective users, which one or more CRCs 
refer to as ``credentialing.'' Further, examiners found that one or 
more CRCs have procedures to monitor that users have a permissible 
purpose when users obtain consumer reports.
    However, examiners also found CMS weaknesses in one or more CRCs' 
permissible purpose procedures. For example, one or more CRCs lacked 
procedures to conduct proactive re-credentialing reviews of its users. 
Under such a re-credentialing review, the CRCs review existing users to 
confirm that the user continues to have a permissible purpose to use 
and obtain consumer reports. Examiners found that the CRCs had 
procedures to conduct re-credentialing reviews of users only when users 
notified the CRCs of a change in ownership, name, status, or nature of 
business or if the CRCs' monitoring identified a specific potential 
permissible purpose violation by a user. The CRCs did not, however, 
have a procedure to review the credentialing of users based on the 
length of time since the user was previously reviewed. As a result of 
these findings, one or more CRCs are implementing proactive re-
credentialing policies and procedures that consider factors such as the 
time since a user was last credentialed for permissible purpose.
    Examiners also found CMS weaknesses in the monitoring procedures at 
one or more CRCs regarding permissible purpose. For example, one or 
more CRCs failed to monitor users or resellers that requested the CRCs 
delete large numbers of hard inquiry records from consumer reports. 
When users obtain consumer reports from CRCs, the CRCs document that 
event by entering an inquiry record in the relevant consumer's file. 
Depending on the user's permissible purpose, the inquiry may be visible 
for up to a year to other users/creditors that obtain the consumer's 
report as well as being visible to the consumer; or instead it may be 
visible only to the consumer.\36\

[[Page 67730]]

When a record of an inquiry is visible to other creditors, it is known 
as a ``hard inquiry'' and when it is visible only to the consumer, it 
is known as a ``soft inquiry.'' One or more CRCs have procedures that 
allow users to request that the CRCs delete hard inquiries from 
consumer reports, usually by converting them into soft inquiries. Users 
may request such deletions to protect consumers who may be victims of 
identity theft. For example, if a consumer notifies a creditor that an 
account was opened in his or her name due to fraud or identity theft, 
the creditor may, in addition to closing the account, contact the CRCs 
and request that the CRCs delete the hard inquiry from the consumers' 
credit report. But users may also ask that inquiries be deleted because 
the user did not have a permissible purpose to obtain the report. 
Examiners found that one or more CRCs had no procedure for monitoring 
the users who requested such deletions at higher rates than usual, 
which may be a risk indicator that a user is obtaining consumer reports 
without any permissible purpose. As a result of these findings, one or 
more CRCs are enhancing permissible purpose monitoring systems to 
include user inquiry change or deletion request volume as a potential 
risk area for investigation of user permissible purpose.
---------------------------------------------------------------------------

    \36\ The CRC must disclose to the consumer the identity of all 
users who obtained that consumer's report, pursuant to 15 U.S.C. 
1681g(a)(3). For more information about the differences between hard 
inquiries and soft inquiries, see CFPB, Key Dimensions and Processes 
in the U.S. Credit Reporting System, at 9 (Dec. 2012).
---------------------------------------------------------------------------

3.3 Blocking Information Resulting From Identity Theft

    The FCRA requires that, unless an exception applies, a CRC must 
``block the reporting of any information in the file of a consumer that 
the consumer identifies as information that resulted from an alleged 
identity theft'' provided that the consumer provides required 
information.\37\ The CRC is then required to promptly notify the 
furnisher of the information identified by the consumer.\38\ The CRC 
may decline to block the information, or may rescind a block, if the 
CRC ``reasonably determines'' that the consumer requested the block in 
error, based on a material misrepresentation of the facts, or the 
consumer obtained goods, services, or money as a result of the 
transaction.\39\ Finally, if the CRC determines to decline to block the 
information requested by the consumer, the CRC must notify the consumer 
promptly of the determination in writing or, if authorized by the 
consumer for that purpose, by any other means available to the CRC.\40\
---------------------------------------------------------------------------

    \37\ 15 U.S.C. 1681c-2(a).
    \38\ 15 U.S.C. 1681c-2(b).
    \39\ 15 U.S.C. 1681c-2(c).
    \40\ 15 U.S.C. 1681c-2(c)(2).
---------------------------------------------------------------------------

    Examiners found that one or more nationwide specialty CRCs violated 
the requirements of this provision of the FCRA. When consumers 
submitted an identity theft block request with all required underlying 
documentation, the CRCs forwarded the information to furnishers and 
relied on the furnishers' response without making an independent 
determination, even in cases where the furnisher stated no block should 
be applied. Therefore, examiners concluded that the CRCs did not 
reasonably determine to decline the block and on what basis, as 
required by the statute. Following this finding, one or more nationwide 
specialty CRCs are changing procedures to the identity-theft block 
provisions of the FCRA. These changes include adopting new policies and 
procedures that require that the CRCs block the identified information 
within four business days of receiving a valid identity theft report. 
Revised procedures also included that for any identity theft block 
request that the CRCs declines or rescinded, the CRCs includes 
documentation of the rationale for denying or rescinding the block to 
ensure that decisions can be monitored and audited for compliance with 
the FCRA.

3.4 Dispute Investigation

    Supervision has continued its focus on reviewing CRCs' compliance 
with the provisions of the FCRA governing consumer disputes. In 
previous issues of Supervisory Highlights, we discussed findings at one 
or more CRCs regarding violations of several provisions in this 
area.\41\ The FCRA right to dispute inaccurate information and have 
that dispute be reasonably investigated by the CRC and relevant 
furnisher is a key consumer protection in the statute. These 
protections recognize that consumers may identify inaccuracies in their 
own reports and sets out procedures that CRCs must follow before 
allowing such information to continue to be reported.
---------------------------------------------------------------------------

    \41\ See, e.g., CFPB, Supervisory Highlights, Winter 2017, at 9-
11 (March 2017).
---------------------------------------------------------------------------

    In recent reviews, examiners have identified new violations of 
several sub-sections of this area of the FCRA. These new violations 
include failures by CRCs to conduct reasonable dispute investigations, 
breakdowns in the required notification procedures to furnishers about 
disputes, failures of CRCs to provide notices of results to consumers, 
and failure of resellers to convey notice of disputes to CRCs that 
provided the disputed information.
3.4.1 Duty To Conduct a Reasonable Reinvestigation
    The FCRA requires that when a consumer disputes the completeness or 
accuracy of an item of information in their file, the CRC must 
``conduct a reasonable reinvestigation to determine whether the 
disputed information is inaccurate and record the current status of the 
disputed information, or delete the item from the file. . . .'' \42\
---------------------------------------------------------------------------

    \42\ 15 U.S.C. 1681i(a)(1)(A).
---------------------------------------------------------------------------

    Examiners found that one or more CRCs systematically violated this 
requirement by failing to initiate investigations after notice of the 
dispute. When the CRCs received disputes related to identity theft or 
fraud via telephone, they instructed consumers to submit the dispute in 
writing and did not initiate investigations until the consumer 
resubmitted in written form. Examiners concluded that the FCRA does not 
permit a CRC to decline to investigate disputes in this manner. 
According to the FCRA, the CRC must conduct a dispute investigation 
when it receives notice of the dispute information. As a result of 
these findings, one or more CRCs enhanced their dispute resolution 
process by updating policies, procedures, and training materials, and 
requiring agents to initiate investigations of all disputes received 
via telephone.
    The FCRA also requires that, in conducting its dispute 
investigation, the CRC must ``review and consider all relevant 
information submitted by the consumer . . . with respect to such 
disputed information.'' \43\ Examiners found that one or more CRCs 
failed to review and consider all such relevant information. The CRCs 
relied on the furnisher's response in validating information from a 
dispute, without independently considering the relevant information or 
documentation provided by the consumer when that information called 
into question the accuracy or validity of the information provided by 
the furnishers. In response to these findings, one or more CRCs updated 
procedures to more clearly describe that agents must review all 
relevant information the consumer provided. However, in a follow-up 
review at one or more CRCs, examiners found that these revised 
procedures were not fully implemented, causing the CRCs to continue to 
fail to review and consider all relevant information provided by

[[Page 67731]]

consumers in support of disputes. The Bureau will continue to monitor 
compliance in this area.
---------------------------------------------------------------------------

    \43\ 15 U.S.C. 1681i(a)(4).
---------------------------------------------------------------------------

    The FCRA generally requires that the CRCs' dispute investigations 
must be completed ``before the end of the 30-day period beginning on 
the date on which the agency receives the notice of dispute from the 
consumer or reseller.'' \44\ Examiners found that one or more CRCs 
failed to complete the investigation within this 30-day timeframe. The 
CRCs incorrectly recorded the date of disputes filed on weekends, 
holidays, and after-hours. These disputes were incorrectly recorded in 
systems as being filed the next business day. As a result of these 
findings, one or more CRCs took action to correct the system logic and 
reassess those disputes.
---------------------------------------------------------------------------

    \44\ 15 U.S.C. 1681i(a)(1)(A). Note that the 30-day period may 
be extended for an additional 15 days if the CRC receives 
information from the consumer during the 30-day period that is 
relevant to the reinvestigation. 15 U.S.C. 1681i(a)(1)(B).
---------------------------------------------------------------------------

3.4.2 Duty To Provide Prompt Notice of Dispute to Furnisher
    The FCRA requires that when a CRC receives a notice of a dispute 
from a consumer, the CRC must ``provide notification of the dispute to 
any person who provided any item of information in dispute. . . .'' 
\45\ This notice must be provided ``[b]efore the expiration of the 5-
business-day period beginning on the date on which a [CRC] receives 
notice of the dispute. . . .'' \46\
---------------------------------------------------------------------------

    \45\ 15 U.S.C. 1681i(a)(2)(A).
    \46\ Id.
---------------------------------------------------------------------------

    Examiners found that one or more CRCs violated this provision of 
the FCRA when they failed to notify furnishers of a consumer's dispute 
within five business days of receiving a dispute. This violation 
occurred in thousands of disputes over several months. This violation 
was caused by lack of adequate staffing at the CRCs and was not 
detected by the CRCs' compliance monitoring. As a result of the 
examination findings, the CRCs developed and implemented dispute 
investigation procedures to ensure agents provide required notices to 
furnishers and forward all relevant information regarding the dispute 
within the mandatory time periods.
3.4.3 Duty To Notify Furnisher That Inaccurate, Incomplete, or 
Unverified Information Has Been Modified or Deleted
    When a CRC has completed its dispute investigation, if the CRC 
finds that any disputed information is inaccurate or incomplete or 
unable to be verified, the FCRA requires the CRC to ``promptly notify 
the furnisher of that information that the information has been 
modified or deleted from the file of the consumer.'' \47\
---------------------------------------------------------------------------

    \47\ 15 U.S.C. 1681i(a)(5)(A)(ii).
---------------------------------------------------------------------------

    In one or more reviews of nationwide specialty CRCs, examiners 
identified instances where one or more specialty CRCs failed to notify 
furnishers that information from the consumer's file had been modified 
or deleted after an investigation. In these instances, one or more CRCs 
were informed by the furnisher that a modification or deletion was 
necessary. One or more specialty CRCs investigation agents then 
modified or deleted the incorrect information but failed to inform the 
furnisher of the action taken, as required by the FCRA. In other 
instances, the information was internally resolved in the consumer's 
favor by one or more specialty CRCs but either the CRCs did not provide 
the notice to the furnishers of the modification or deletion, or they 
did not provide ``prompt'' notice to the furnisher required by the 
FCRA. As a result of these findings, one or more specialty CRCs 
developed and implemented dispute investigation procedures to ensure 
agent provide the required notice consistent with the requirements in 
the FCRA.
    Additionally, examiners found that one or more CRCs failed to 
promptly send furnishers notices when investigations found that 
information was not accurate and information was changed in the 
consumer's file. One or more CRCs admitted that they failed to transmit 
approximately 2.7 million notices over a period of approximately two 
months. The cause for the failure was a programming error. This failure 
primarily affected consumers who submitted direct disputes to 
furnishers but some consumers who submitted indirect disputes to CRCs 
were also affected. As a result of this finding, one or more CRCs are 
fixing the programming error and enhancing their internal monitoring to 
avoid future issues of this type.
3.4.4 Duty To Provide Consumer With Written Notice of Results of 
Reinvestigation
    The FCRA requires that, upon completion of the reasonable 
reinvestigation, the CRC must provide written notice of the results to 
the consumer not later than five business days after completion of the 
reinvestigation.\48\ Examiners found that one or more CRCs failed to 
send consumers results notices as required when the consumer sent the 
CRCs a dispute that was not accompanied by a consumer identification 
and certification form. In such cases, the CRCs resolved the dispute 
and, where necessary updated its records, but did not send the consumer 
the required notice of results. In response to these findings, one or 
more CRCs are developing and implementing policies and procedures to 
send consumers notifications of the results of disputes even when the 
consumer did not provide a consumer identification and certification 
form with the dispute.
---------------------------------------------------------------------------

    \48\ 15 U.S.C. 1681i(a)(6)(A).
---------------------------------------------------------------------------

3.4.5 Duty of Reseller To Convey Notice of Dispute to the CRC That 
Provided the Reseller With the Information That Is Subject of the 
Dispute
    The FCRA dispute provisions provide direction to resellers upon 
receipt of a dispute from a consumer. These requirements include, where 
applicable, providing notice of the dispute to the CRC that provided 
the reseller with the disputed information. ``If a reseller receives a 
notice from a consumer of a dispute concerning the completeness or 
accuracy of any item of information contained in a consumer report on 
such consumer produced by the reseller, the reseller shall'' determine 
whether the item of information is incomplete or inaccurate as a result 
of an act or omission of the reseller within five business days.\49\ If 
the reseller determines that the disputed information is not incomplete 
or inaccurate as a result of an act or omission of the reseller, the 
reseller must convey the notice of the dispute, together with all 
relevant information provided by the consumer, to each CRC that 
provided the reseller with the information that is the subject of the 
dispute.\50\
---------------------------------------------------------------------------

    \49\ 15 U.S.C. 1681i(f)(2)(A).
    \50\ 15 U.S.C. 1681i(f)(2)(B)(ii).
---------------------------------------------------------------------------

    Examiners found that one or more resellers, after determining that 
disputed information was not incomplete or inaccurate as a result of an 
act or omission of the resellers, failed to convey to the CRCs that 
provided the information the notice of the dispute together with all 
relevant information provided by the consumer. In response to these 
findings, one or more resellers developed and implemented dispute 
investigation procedures designed to ensure agents provide required 
notice of disputes to CRCs that provided the information to the 
reseller.
    In follow-up reviews, examiners found that one or more resellers 
developed and implemented enhanced procedures designed to ensure that 
the reseller(s) promptly conveyed notice of

[[Page 67732]]

disputes the reseller received to the CRC that provided the reseller 
with the disputed information.

4. Conclusion

    The Bureau will continue to publish Supervisory Highlights to aid 
Bureau-supervised entities in their efforts to comply with Federal 
consumer financial law. The report shares information regarding general 
supervisory and examination findings regarding the FCRA and Regulation 
V (without identifying specific institutions). This information is 
shared, in part, to communicate the Bureau's supervisory expectations 
to CRCs and furnishers that those institutions comply with the 
applicable provisions of the FCRA and Regulation V.
    Supervision's work in the consumer reporting market is ongoing and 
remains a high priority. As detailed in this report, CFPB examiners 
have continued to identify violations and CMS weaknesses regarding 
critical FCRA and Regulation V protections. However, examiners have 
also observed significant improvements in these areas, including 
continued investment in FCRA-related CMS. Supervision will continue to 
conduct reviews at CRCs, including resellers, as well as at furnishers 
and users of consumer reports within our supervisory jurisdiction.

    Dated: November 30, 2019.
Kathleen L. Kraninger,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2019-26669 Filed 12-10-19; 8:45 am]
BILLING CODE 4810-AM-P