Supervisory Highlights, Issue 32, Spring 2024, 36775-36779 [2024-09712]

Download as PDF Federal Register / Vol. 89, No. 87 / Friday, May 3, 2024 / Notices With respect to this collection of information via the proposed form, the Commission welcomes comments on the following: • The necessity to collect this information to support the Commission’s mission and oversight responsibilities. • Methodology to improve the accuracy of the estimated time burden, i.e., specific year-over-year employee turnover rates for NPAs or number of additional employee hires above turnovers, expressed as a percentage of the NPAs’ total number of Participating Employees; • Suggestions or methods to minimize the burdens associated with collecting the information described in this ICR. The proposed form is viewable at www.abilityone.gov. Michael R. Jurkowski, Director, Business Operations. [FR Doc. 2024–09705 Filed 5–2–24; 8:45 am] BILLING CODE 6353–01–P CONSUMER FINANCIAL PROTECTION BUREAU Supervisory Highlights, Issue 32, Spring 2024 Consumer Financial Protection Bureau. ACTION: Supervisory Highlights. AGENCY: The Consumer Financial Protection Bureau (CFPB or Bureau) is issuing its thirty-second edition of Supervisory Highlights. DATES: The findings in this report cover select examinations in connection with credit reporting and furnishing that were completed from April 1, 2023, through December 31, 2023. FOR FURTHER INFORMATION CONTACT: Jaclyn Sellers, Senior Counsel, at (202) 435–7449. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@ cfpb.gov. SUPPLEMENTARY INFORMATION: lotter on DSK11XQN23PROD with NOTICES1 SUMMARY: 1. Introduction Credit reporting is critical to consumers’ ability to access credit and other products and services and often is used as a factor in rental and employment determinations. Accuracy in consumer reports is of vital importance to the credit reporting system and to consumers. Inaccurate information on a consumer report can have significant consequences for consumers and may, among other things, lead them to receive products or VerDate Sep<11>2014 18:11 May 02, 2024 Jkt 262001 services on less favorable terms or impede their ability to access credit or open a bank account. Inaccuracy in the credit reporting system is a long-standing issue that remains a problem today. Accordingly, the CFPB continues to prioritize examinations of consumer reporting companies (CRCs) and furnishers. CRCs are companies that regularly engage in whole or in part in the practice of assembling or evaluating information about consumers for the purpose of providing consumer reports to third parties.1 Furnishers are entities, such as banks, loan servicers, and others, that furnish information to the CRCs for inclusion in consumer reports. CRCs and furnishers play a crucial role in ensuring the accuracy and integrity of information contained in consumer reports. They also have an important role in the investigation of consumer disputes relating to the accuracy of information in consumer reports. The Fair Credit Reporting Act (FCRA) 2 and its implementing regulation, Regulation V,3 subject CRCs and furnishers to requirements relating to their roles in the credit reporting system, including the requirement to reasonably investigate disputes and certain accuracy-related requirements. The FCRA and Regulation V also impose obligations in connection with, among other things, consumer-alleged identity theft and—most recently— adverse information resulting from human trafficking including on consumer reports of human-trafficking victims. In recent reviews of CRCs, examiners have continued to find deficiencies in CRCs’ compliance with the accuracy and identity theft requirements of the FCRA and Regulation V.4 For example, examiners found some CRCs were engaged in the practice of automatically declining to implement identity theft blocks upon receipt of the requisite documentation based on overbroad disqualifying criteria and without an individualized determination that there is a statutory basis to decline the block, in violation of the FCRA. Examiners 1 The term ‘‘consumer reporting company’’ as used in this publication means the same as ‘‘consumer reporting agency,’’ as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), including nationwide consumer reporting agencies as defined in 15 U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies as defined in 15 U.S.C. 1681a(x). 2 15 U.S.C. 1681 et seq. 3 12 CFR part 1022. 4 If a supervisory matter is referred to the Office of Enforcement, Enforcement may cite additional violations based on these facts or uncover additional information that could impact the conclusion as to what violations may exist. PO 00000 Frm 00027 Fmt 4703 Sfmt 4703 36775 also found some CRCs violated Regulation V’s human trafficking requirements, effective as of July 25, 2022, by failing to timely block, or in some cases failing to block all, adverse items of information identified by the consumer as resulting from human trafficking. In recent reviews of furnishers, examiners have continued to find deficiencies in furnishers’ compliance with the accuracy and dispute investigation requirements of the FCRA and Regulation V. Examiners found several furnishers violated the FCRA duty to promptly update or correct information determined to be incomplete or inaccurate, including, for example, by continuing to report fraudulent accounts to CRCs as valid (i.e., non-fraudulent) accounts for several years after determining the accounts were fraudulent. Examiners also found that some furnishers violated the FCRA, after receiving an identity theft report from a consumer at the appropriate address, by continuing to furnish information identified in the report as resulting from identity theft without the furnishers knowing or being informed by the consumer that the information was, in fact, correct. The findings in this report cover select examinations in connection with credit reporting and furnishing that were completed from April 1, 2023, through December 31, 2023. To maintain the anonymity of the supervised institutions discussed in Supervisory Highlights, references to institutions generally are in the plural and related findings may pertain to one or more institutions. 2. Supervisory Observations 2.1 Consumer Reporting Companies In recent reviews of CRCs, examiners found deficiencies in CRCs’ compliance with FCRA and Regulation V identity theft block, human trafficking submission and accuracy requirements. 2.1.1 CRC Duty To Block the Reporting of Information Resulting From an Alleged Identity Theft The FCRA requires CRCs to block the reporting of any information in a consumer’s file that the consumer identifies as information that resulted from an alleged identity theft not later than four business days after the CRC receives certain documentation relating to the alleged identity theft. Such documentation includes appropriate proof of the consumer’s identity, a copy of an identity theft report, identification of the information that resulted from the alleged identity theft, and a statement by the consumer that such information E:\FR\FM\03MYN1.SGM 03MYN1 36776 Federal Register / Vol. 89, No. 87 / Friday, May 3, 2024 / Notices does not relate to any transaction by the consumer.5 A CRC may decline to block, or rescind any block of, information if the CRC reasonably determines that: the information was blocked in error or a block was requested by the consumer in error; the information was blocked, or the block was requested, on the basis of a material misrepresentation of fact by the consumer relevant to the request to block; or the consumer obtained possession of goods, services or money as a result of the blocked transaction(s).6 In recent reviews of CRCs, examiners found that CRCs failed to timely implement blocks of information after receiving the requisite documentation relating to an alleged identity theft, without otherwise making a reasonable determination with respect to one of the statutory bases for declining to block such information. Examiners found that the CRCs instead maintained policies pursuant to which the CRCs automatically declined to block information if the associated account(s) of the consumer met any one of a set of overbroad disqualifying criteria that were not sufficiently tailored to support a reasonable determination regarding any of the statutory declination bases. In response to these findings, CRCs were directed to cease the practice of automatically declining to implement blocks based on overbroad disqualifying criteria without an individualized determination that there is a statutory basis to decline. CRCs also were directed to implement revisions to the CRCs’ policies to ensure compliance with FCRA identity theft block obligations, including any circumstances in which the CRCs may reasonably request additional information or documentation to determine the validity of an alleged identity theft and any circumstances in which there is a valid basis to decline to block. lotter on DSK11XQN23PROD with NOTICES1 2.1.2 CRC Duty To Promptly Notify Consumers After Declining To Implement, or Rescind, an Identity Block The FCRA requires CRCs to promptly notify the affected consumer if the CRC declines to block, or rescinds a block of, information that the consumer identifies as information resulting from an alleged identity theft.7 CRCs must notify the consumer in the same manner as CRCs are required to notify consumers of a reinsertion of information into a 5 15 U.S.C. 1681c–2(a); see 15 U.S.C. 1681a(q)(4) and 12 CFR 1022.3(i)(1) (defining ‘‘identity theft report’’). 6 15 U.S.C. 1681c–2(c). 7 15 U.S.C. 1681c–2(c)(2). VerDate Sep<11>2014 18:11 May 02, 2024 Jkt 262001 consumer’s file—i.e., in writing within five business days and by providing certain information, including the name and address of the furnisher of the identified information if reasonably available and a notice that the consumer has the right to add a statement to the consumer’s file disputing the accuracy or completeness of such information.8 In recent reviews of CRCs, examiners found that CRCs failed to provide the requisite notice within five business days of declining to block information— in some instances due to system issues and in others due to human error. Examiners also found that CRCs systematically failed to timely provide consumers with the relevant furnisher’s contact information and/or notice regarding the consumer’s right to add a statement to the consumer’s file disputing the accuracy or completeness of the furnished information. In response to these findings, CRCs were directed to revise their policies to ensure compliance with FCRA identity theft block notice obligations and update notice templates to include the requisite information for consumers. 2.1.3 CRC Duty To Provide Victims of Identity Theft With Summaries of Rights The FCRA requires CRCs, upon a consumer contacting the CRC and expressing a belief that they are a victim of fraud or identity theft, to provide the consumer with a summary of rights containing all of the information required by the CFPB in its model summary of rights,9 along with information about how to request more detailed information from the CFPB.10 In recent reviews of CRCs, examiners found that CRCs failed to comply with this provision, either by failing to include required information in summaries of rights or by failing to provide the summary of rights to eligible consumers entirely. In response to these findings, CRCs are updating their systems to ensure that they provide the required summary of rights. 2.1.4 CRC Duty To Block Adverse Information Resulting From Human Trafficking Regulation V requires CRCs to block adverse items of information identified by a consumer or their representative as resulting from a severe form of trafficking in persons or sex trafficking, 8 Id. (referencing the notice requirements of 15 U.S.C. 1681i(a)(5)(B)). 9 Consumer Fin. Prot. Bureau, Appendix I to part 1022—Summary of Consumer Identity Theft Rights, https://www.consumerfinance.gov/rules-policy/ regulations/1022/i. 10 15 U.S.C. 1681g(d)(2). PO 00000 Frm 00028 Fmt 4703 Sfmt 4703 as defined in the regulation.11 CRCs must block such items within four business days of receiving a consumer’s submission, except in limited circumstances where additional information is necessary to complete the submission.12 In recent reviews of CRCs, examiners found that CRCs failed to timely block identified adverse items of information within the applicable four business days. CRCs blocked some but not all items identified in a qualifying consumer submission and in other instances failed to implement a block entirely. In response to these findings, CRCs were directed to revise their compliance processes to ensure that they process all human trafficking block requests in accordance with the requirements of Regulation V. 2.1.5 CRC Duty To Follow Reasonable Procedures To Assure Maximum Possible Accuracy The FCRA requires that, wherever a CRC ‘‘prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.’’ 13 In recent reviews of CRCs, examiners found that CRCs’ accuracy procedures failed to comply with this obligation because the CRCs (1) failed to adequately monitor dispute metrics that would suggest a furnisher may no longer be a source of reliable, verifiable information about consumers, and (2) continued to include information in consumer reports that was provided by unreliable furnishers without implementing procedures to assure the accuracy of information provided by unreliable furnishers. Specifically, the CRCs did not monitor metrics and thresholds tied to objective measures of inaccuracy or unreliability. Moreover, the CRCs maintained data from furnishers that responded to disputes in ways that suggested that the furnishers were no longer sources of reliable, verifiable information about consumers. For example, CRCs received furnisher dispute response data indicating that, for several months, furnishers failed to respond to all or nearly all disputes, or responded to all disputes in the same manner. Despite observing this dispute response behavior by these furnishers, CRCs continued to include information from these furnishers in consumer reports. In response to these findings, CRCs were directed to revise their accuracy 11 12 CFR 1022.142(c). CFR 1022.142(e)(1). 13 15 U.S.C. 1681e(b). 12 12 E:\FR\FM\03MYN1.SGM 03MYN1 Federal Register / Vol. 89, No. 87 / Friday, May 3, 2024 / Notices procedures to identify and monitor furnishers and take corrective action regarding data from furnishers whose dispute response behavior indicates the furnisher is not a source of reliable, verifiable information about consumers. lotter on DSK11XQN23PROD with NOTICES1 2.2 Furnishers In recent reviews of furnishers, examiners found deficiencies in furnishers’ compliance with FCRA and Regulation V accuracy, dispute investigation and identity theft requirements. 2.2.1 Furnisher Duty to Promptly Correct and Update Information Determined To Be Incomplete or Inaccurate Examiners are continuing to find that furnishers are violating the FCRA duty to promptly correct and update furnished information after determining that such information is incomplete or inaccurate.14 Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers continued to furnish incomplete or inaccurate information for several months, and in some cases years, after the furnishers determined, through either dispute handling or identification of systemic issues, the information was furnished incompletely or inaccurately. For example, examiners found that furnishers continued to report dates of first delinquency inaccurately for several months after determining that they were reporting inaccurately due to various system coding issues. Examiners also found that after determining accounts were in a bankruptcy status and therefore should have been reported as current with dates of first delinquency that reflect the bankruptcy filing dates, furnishers failed to update the dates of first delinquency for the accounts to the bankruptcy filing dates. By failing to update the dates of first delinquency for the accounts in bankruptcy when they determined the accounts were in bankruptcy, the furnishers failed to promptly update or correct information they had determined to be incomplete or inaccurate. In response to these findings, furnishers are updating their internal controls related to promptly correcting or updating furnished information after determining it is incomplete or inaccurate and engaging in lookbacks to remediate the furnishing of the previously impacted accounts. Examiners also found that auto loan furnishers did not promptly send corrections or updates to CRCs after determining that accounts with lease returns were paid-in-full. When leased cars were returned to dealerships, furnishers updated their systems of record to reflect that the accounts had been paid-in-full. However, examiners found that the furnishers failed to update the information furnished to CRCs to reflect that the accounts were paid-in-full. In response to these findings, furnishers are conducting lookbacks to ensure that corrections or updates are furnished for impacted accounts and are implementing internal controls to ensure they promptly correct or update furnished information after determining it is incomplete or inaccurate. In addition, in reviews of deposit furnishers, examiners found that furnishers continued to report fraudulent accounts to CRCs for several years after determining the accounts were fraudulent. While, in some instances, furnishers closed the accounts determined to be fraudulent, they continued to furnish the accounts as valid (i.e., non-fraudulent) accounts and failed to notify CRCs that the accounts should be deleted because they were fraudulent. By not instructing CRCs to delete the accounts promptly after determining they were fraudulent, the furnishers failed to promptly correct or update furnished information determined to be inaccurate or incomplete. In response to these findings, furnishers conducted lookbacks to ensure they deleted all accounts they determined to be opened fraudulently and updated their policies and procedures related to notifying CRCs when accounts are determined to be fraudulent to ensure the accounts are deleted. 2.2.2 Furnisher Duty To Notify CRCs of Direct Disputes Examiners are continuing to find that furnishers are violating the FCRA duty to notify CRCs that the accuracy or completeness of items being furnished by them are subject to dispute.15 Specifically, in recent reviews of deposit furnishers, examiners found that furnishers who received direct disputes from consumers were continuing to furnish the disputed information to CRCs without notifying the CRCs that the information was subject to dispute. In response to these findings, furnishers are updating their policies to make clear that they will provide notices of direct disputes to CRCs. 2.2.3 Furnisher Duty To Conduct Reasonable Investigations of Direct Disputes Examiners are continuing to find that furnishers are violating the Regulation V duty to conduct a reasonable investigation of direct disputes.16 Specifically, in recent reviews of auto loan furnishers, examiners found evidence that furnishers failed to investigate direct disputes that did not satisfy those furnishers’ extraneous identity verification requirements. Regulation V specifically defines what a consumer must include in a dispute notice to trigger a furnisher’s duty to investigate. Although these disputes met the Regulation V requirements for a direct dispute, examiners found evidence that the furnishers did not investigate the disputes because the consumer had not satisfied additional identity verification requirements of the furnisher. However, Regulation V does not permit a furnisher to establish additional requirements beyond what the regulation requires in order to initiate a direct dispute investigation by the furnisher. Also, in recent reviews of debt collection furnishers, examiners found that when the furnishers received a direct dispute, they simply deleted the tradeline, rather than conducting an investigation. As the Bureau has previously explained, simply deleting tradelines in response to a direct dispute does not satisfy furnishers’ responsibility to conduct a reasonable investigation with respect to the disputed information.17 After identification of these issues, furnishers were directed to update their policies and procedures to ensure they conduct reasonable investigations of direct disputes. 2.2.4 Furnisher Duty To Provide Notice of Delinquency of Accounts Examiners are continuing to find that furnishers are violating the FCRA duty to notify CRCs of the dates of first delinquency on applicable accounts.18 Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers inaccurately reported dates of first delinquency to CRCs due to various coding issues. For example, examiners found that coding errors resulted in furnishers inaccurately reporting dates of first delinquency as the first day of the statement cycle following the consumer’s missed payment, rather than 30 days after the missed payment due date. Examiners also found that auto 16 12 CFR 1022.43(e)(1). Bulletin 2014–01 (Feb. 27, 2014). 18 15 U.S.C. 1681s–2(a)(5). 17 CFPB 14 15 U.S.C. 1681s–2(a)(2). VerDate Sep<11>2014 18:11 May 02, 2024 15 15 Jkt 262001 PO 00000 U.S.C. 1681s–2(a)(3). Frm 00029 Fmt 4703 Sfmt 4703 36777 E:\FR\FM\03MYN1.SGM 03MYN1 36778 Federal Register / Vol. 89, No. 87 / Friday, May 3, 2024 / Notices loan furnishers reported inaccurate dates of first delinquency for accounts by reporting the dates of first delinquency as more recent than they should have been, including by changing the dates of first delinquency for accounts that remained delinquent month after month (i.e., accounts for which the dates of first delinquency should not have been changed). In response to these findings, furnishers are conducting lookbacks to identify and remediate impacted accounts and updating their policies and procedures to ensure that they report dates of first delinquency accurately. 2.2.5 Furnisher Duty Not To Furnish Information That Purports To Relate to a Consumer Upon Receipt of an Identity Theft Report Examiners are continuing to find that furnishers are violating the FCRA’s requirement that if a consumer submits an identity theft report at the address specified by the furnisher for receiving such reports stating that information maintained by that furnisher that purports to relate to the consumer resulted from identity theft, the furnisher may not furnish such information to any CRC, unless the furnisher subsequently knows or is informed by the consumer that the information is correct.19 Specifically, in recent reviews of auto loan furnishers, examiners found that furnishers who received identity theft reports at a qualifying address continued to furnish information identified in the report before knowing or being informed by the consumer that the information was correct. In response to these findings, furnishers are updating their policies and procedures to ensure that information subject to this requirement is not furnished prior to the completion of an investigation and determination of validity. 3. Supervisory Program Developments lotter on DSK11XQN23PROD with NOTICES1 3.1 Recent CFPB Supervisory Program Developments Set forth below are select supervision program developments including advisory opinions, that have been issued regarding credit reporting since our last regular edition of Supervisory Highlights. 3.1.1 CFPB Issued Advisory Opinion on Fair Credit Reporting: Background Screening On January 11, 2024, the CFPB issued an advisory opinion to affirm that, when 19 15 U.S.C. 1681s–2(a)(6)(B). VerDate Sep<11>2014 18:11 May 02, 2024 Jkt 262001 preparing consumer reports, a CRC that reports public record information is not using reasonable procedures to assure maximum possible accuracy under the FCRA if it does not have procedures in place that: (1) prevent reporting information that is duplicative or that has been expunged, sealed, or otherwise legally restricted from public access; and (2) include any existing disposition information if it reports arrests, criminal charges, eviction proceedings, or other court filings.20 The advisory opinion also highlights that, when CRCs include adverse information in consumer reports: (1) the occurrence of the adverse event starts the running of the reporting period for adverse items under FCRA section 605(a)(5); (2) that period is not restarted or reopened by the occurrence of subsequent events; and (3) a non-conviction disposition of a criminal charge cannot be reported beyond the seven-year period that begins to run at the time of the charge. CRCs thus must ensure that they do not report adverse information beyond the reporting period in FCRA section 605(a)(5) and must at all times have reasonable procedures in place to prevent reporting of information that is duplicative or legally restricted from public access and to ensure that any existing disposition information is included if court filings are reported. 3.1.2 CFPB Issues Advisory Opinion on File Disclosures On January 11, 2024, the CFPB issued an advisory opinion to address certain obligations that CRCs have under section 609(a) of the FCRA.21 The advisory opinion underscores that, to trigger a CRC’s file disclosure requirement under FCRA section 609(a), a consumer does not need to use specific language, such as ‘‘complete file’’ or ‘‘file.’’ The advisory opinion also highlights the requirements regarding the information that must be disclosed to a consumer under FCRA section 609(a). In addition, the advisory opinion affirms that CRCs must disclose to a consumer both the original source and any intermediary or vendor source (or sources) that provide the item of information to the CRC under FCRA section 609(a). 20 The advisory opinion is available at: cfpb_faircredi-reporting-background-screening_2024–01.pdf (consumerfinance.gov). 21 The advisory opinion is available at: cfpb_faircredit-reporting-file-disclosure_2024–01.pdf (consumerfinance.gov). PO 00000 Frm 00030 Fmt 4703 Sfmt 4703 4. Remedial Actions 4.1 Public Enforcement Actions The CFPB’s supervisory actions resulted in and supported the below enforcement actions related to credit reporting or furnishing. 4.1.1 Toyota Motor Credit Corporation On November 20, 2023, the CFPB issued an order against Toyota Motor Credit Corporation (Toyota Motor Credit), which is the United Statesbased auto-financing arm of Toyota Motor Corporation and one of the largest indirect auto lenders in the country. Toyota Motor Credit provides financing for vehicles and optional ‘‘add-on’’ products and services sold with the vehicles. These add-ons include Guaranteed Asset Protection, which can waive some of a consumer’s remaining loan balance if their car is totaled, stolen or damaged when they still owe money on the loan even with car insurance, and Credit Life and Accidental Health, which is designed to pay a remaining balance if the consumer dies or becomes disabled. The CFPB found that Toyota Motor Credit violated the Consumer Financial Protection Act of 2010 by: (1) unfairly and abusively making it unreasonably difficult for consumers to cancel unwanted add-ons, including when consumers complained that dealers had forced add-ons on consumers without their consent; (2) unfairly failing to ensure consumers received refunds of unearned Guaranteed Asset Protection and Credit Life and Accidental Health premiums when they paid off their loans early or ended lease agreements early, making the products no longer of any value to consumers; and (3) unfairly failing to provide accurate refunds to consumers who canceled their vehicle service agreements as a result of flawed system logic. The CFPB also found that Toyota Motor Credit violated the FCRA and its implementing Regulation V by (1) failing to promptly correct negative information it had sent to CRCs, where the negative information was falsely reporting customer accounts as delinquent even though customers had already returned their vehicles; and (2) failing to maintain reasonable policies and procedures to ensure related payment information it sent to CRCs was accurate. The order requires Toyota Motor Credit to pay $48 million in consumer redress and a $12 million civil money penalty.22 The order also requires Toyota Motor Credit to stop its 22 The Order is available at: cfpb_toyota-motorcredit-corporation-consent-order_2023–11.pdf (consumerfinance.gov). E:\FR\FM\03MYN1.SGM 03MYN1 Federal Register / Vol. 89, No. 87 / Friday, May 3, 2024 / Notices unlawful practices and come into compliance with the law and prohibits incentive-based employee compensation or performance measurements in relation to add-on products. lotter on DSK11XQN23PROD with NOTICES1 4.1.2 TransUnion, Trans Union LLC, and TransUnion Interactive, Inc. 23 A copy of the Consent Order is available at:https://www.consumerfinance.gov/enforcement/ actions/transunion-trans-union-llc-and-transunioninteractive-inc/. 18:11 May 02, 2024 Jkt 262001 Rohit Chopra, Director, Consumer Financial Protection Bureau. [FR Doc. 2024–09712 Filed 5–2–24; 8:45 am] On October 12, 2023, the CFPB issued an order against TransUnion, parent company of one of the three nationwide CRCs, and two of its subsidiaries, Trans Union LLC, and TransUnion Interactive, Inc. (collectively, TransUnion), which are headquartered in Chicago, Illinois. Security freezes and locks block certain third parties, such as lenders, from accessing consumers’ credit reports to prevent a potential identity thief from obtaining new credit in those consumers’ names. Starting in September 2018, Federal law has required nationwide CRCs to provide security freezes as a free service, whereas locks are a feature of certain paid products. The CFPB found that TransUnion, from as early as 2003, failed to timely place or remove security freezes and locks on the credit reports of tens of thousands of consumers who requested them, including certain vulnerable consumers; in some cases, those requests were left unmet for months or years. The CFPB found TransUnion’s failure to place or remove security freezes in a timely manner occurred as a result of problems, including systems issues, that TransUnion knew about but failed to address for years. The CFPB found that TransUnion’s failure to place or remove security freezes in a timely manner violated the FCRA, and TransUnion’s failure to place or remove both security freezes and locks in a timely manner was unfair in violation of the Consumer Financial Protection Act of 2010. Further, the CFPB found that TransUnion engaged in deceptive acts and practices by falsely telling certain consumers that their requests had been successful when they had not. In addition, the CFPB found that from about 2016 to 2020, TransUnion failed to exclude certain consumers, including active-duty military and other potential victims of identity theft, from prescreened solicitation lists in violation of FCRA. The CFPB’s order requires TransUnion to pay $3 million to consumers in redress and $5 million in civil penalties.23 TransUnion must also take steps to address and prevent unlawful conduct, including convening VerDate Sep<11>2014 a committee to identify and address technology problems that can affect consumers. BILLING CODE 4810–AM–P CONSUMER FINANCIAL PROTECTION BUREAU Supervisory Highlights, Issue 33, Spring 2024 Consumer Financial Protection Bureau. ACTION: Supervisory Highlights. AGENCY: The Consumer Financial Protection Bureau (CFPB or Bureau) is issuing its thirty-third edition of Supervisory Highlights. DATES: The findings in this report cover select examinations regarding mortgage servicing, that were completed from April 1, 2023, through December 31, 2023. FOR FURTHER INFORMATION CONTACT: Jaclyn Sellers, Senior Counsel, at (202) 435–7449. If you require this document in an alternative electronic format, please contact CFPB_Accessibility@ cfpb.gov. SUPPLEMENTARY INFORMATION: SUMMARY: 1. Introduction The residential mortgage servicing market exceeds $13 trillion in current outstanding balances. When servicers do not comply with the law, they impose significant costs on consumers. The CFPB is actively monitoring the market for emerging risks during a period of increasing default servicing activity since the end of the COVID–19 pandemic emergency. The mortgage industry has grappled with many challenges during this period, including increased requests for loss mitigation, changes to housing policies and programs, and staffing issues. Violations described in prior editions of Supervisory Highlights raised concerns about servicers’ ability to appropriately respond to consumer requests for assistance, especially consumers at risk of foreclosure. While mortgage delinquencies and foreclosure rates remain near all-time lows, this may change in the future as consumers grapple with higher levels of debt and affordability challenges due to high rates and low housing supply. Foreclosure starts have risen in recent months, increasing the risks that vulnerable consumers face. PO 00000 Frm 00031 Fmt 4703 Sfmt 4703 36779 The CFPB also continues to prioritize scrutiny of exploitative illegal fees charged by banks and financial companies, commonly referred to as ‘‘junk fees.’’ Examiners continue to find supervised mortgage servicers assessing junk fees, including unnecessary property inspection fees and improper late fees. Additionally, examiners found that mortgage servicers engaged in other unfair, deceptive, and abusive acts or practices (UDAAP) such as sending deceptive loss mitigation eligibility notices to consumers.1 Mortgage servicers also violated several of Regulation X’s loss mitigation provisions.2 The CFPB is currently reviewing Regulation X’s existing framework to identify ways to simplify and streamline the mortgage servicing rules. The CFPB is considering a proposal to streamline the mortgage servicing rules, only if it would promote greater agility on the part of mortgage servicers in responding to future economic shocks while also continuing to ensure they meet their obligations for assisting borrowers promptly and fairly. The findings in this report cover select examinations regarding mortgage servicing, that were completed from April 1, 2023, through December 31, 2023. To maintain the anonymity of the supervised institutions discussed in Supervisory Highlights, references to institutions generally are in the plural and related findings may pertain to one or more institutions. 2. Supervisory Observations 2.1 Mortgage Servicing Examiners found that mortgage servicers engaged in UDAAPs and regulatory violations while processing payments by overcharging certain fees, failing to adequately describe fees in periodic statements, and not making timely escrow account disbursements. Additionally, as in prior editions of Supervisory Highlights, examiners identified persistent UDAAP and regulatory violations at mortgage servicers related to loss mitigation practices. 2.1.1 Unfair Charges for Property Inspections Prohibited by Investor Guidelines Mortgage investors generally require servicers to perform property inspection visits for accounts that reach a specified 1 12 U.S.C. 5531, 5536. a supervisory matter is referred to the Office of Enforcement, Enforcement may cite additional violations based on these facts or uncover additional information that could impact the conclusion as to what violations may exist. 2 If E:\FR\FM\03MYN1.SGM 03MYN1

Agencies

CONSUMER FINANCIAL PROTECTION BUREAU

[Federal Register Volume 89, Number 87 (Friday, May 3, 2024)]
[Notices]
[Pages 36775-36779]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-09712]


=======================================================================
-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU


Supervisory Highlights, Issue 32, Spring 2024

AGENCY: Consumer Financial Protection Bureau.

ACTION: Supervisory Highlights.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB or Bureau) is 
issuing its thirty-second edition of Supervisory Highlights.

DATES: The findings in this report cover select examinations in 
connection with credit reporting and furnishing that were completed 
from April 1, 2023, through December 31, 2023.

FOR FURTHER INFORMATION CONTACT: Jaclyn Sellers, Senior Counsel, at 
(202) 435-7449. If you require this document in an alternative 
electronic format, please contact [email protected].

SUPPLEMENTARY INFORMATION:

1. Introduction

    Credit reporting is critical to consumers' ability to access credit 
and other products and services and often is used as a factor in rental 
and employment determinations. Accuracy in consumer reports is of vital 
importance to the credit reporting system and to consumers. Inaccurate 
information on a consumer report can have significant consequences for 
consumers and may, among other things, lead them to receive products or 
services on less favorable terms or impede their ability to access 
credit or open a bank account.
    Inaccuracy in the credit reporting system is a long-standing issue 
that remains a problem today. Accordingly, the CFPB continues to 
prioritize examinations of consumer reporting companies (CRCs) and 
furnishers. CRCs are companies that regularly engage in whole or in 
part in the practice of assembling or evaluating information about 
consumers for the purpose of providing consumer reports to third 
parties.\1\ Furnishers are entities, such as banks, loan servicers, and 
others, that furnish information to the CRCs for inclusion in consumer 
reports.
---------------------------------------------------------------------------

    \1\ The term ``consumer reporting company'' as used in this 
publication means the same as ``consumer reporting agency,'' as 
defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), 
including nationwide consumer reporting agencies as defined in 15 
U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies 
as defined in 15 U.S.C. 1681a(x).
---------------------------------------------------------------------------

    CRCs and furnishers play a crucial role in ensuring the accuracy 
and integrity of information contained in consumer reports. They also 
have an important role in the investigation of consumer disputes 
relating to the accuracy of information in consumer reports. The Fair 
Credit Reporting Act (FCRA) \2\ and its implementing regulation, 
Regulation V,\3\ subject CRCs and furnishers to requirements relating 
to their roles in the credit reporting system, including the 
requirement to reasonably investigate disputes and certain accuracy-
related requirements. The FCRA and Regulation V also impose obligations 
in connection with, among other things, consumer-alleged identity theft 
and--most recently--adverse information resulting from human 
trafficking including on consumer reports of human-trafficking victims.
---------------------------------------------------------------------------

    \2\ 15 U.S.C. 1681 et seq.
    \3\ 12 CFR part 1022.
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners have continued to find 
deficiencies in CRCs' compliance with the accuracy and identity theft 
requirements of the FCRA and Regulation V.\4\ For example, examiners 
found some CRCs were engaged in the practice of automatically declining 
to implement identity theft blocks upon receipt of the requisite 
documentation based on overbroad disqualifying criteria and without an 
individualized determination that there is a statutory basis to decline 
the block, in violation of the FCRA. Examiners also found some CRCs 
violated Regulation V's human trafficking requirements, effective as of 
July 25, 2022, by failing to timely block, or in some cases failing to 
block all, adverse items of information identified by the consumer as 
resulting from human trafficking.
---------------------------------------------------------------------------

    \4\ If a supervisory matter is referred to the Office of 
Enforcement, Enforcement may cite additional violations based on 
these facts or uncover additional information that could impact the 
conclusion as to what violations may exist.
---------------------------------------------------------------------------

    In recent reviews of furnishers, examiners have continued to find 
deficiencies in furnishers' compliance with the accuracy and dispute 
investigation requirements of the FCRA and Regulation V. Examiners 
found several furnishers violated the FCRA duty to promptly update or 
correct information determined to be incomplete or inaccurate, 
including, for example, by continuing to report fraudulent accounts to 
CRCs as valid (i.e., non-fraudulent) accounts for several years after 
determining the accounts were fraudulent. Examiners also found that 
some furnishers violated the FCRA, after receiving an identity theft 
report from a consumer at the appropriate address, by continuing to 
furnish information identified in the report as resulting from identity 
theft without the furnishers knowing or being informed by the consumer 
that the information was, in fact, correct. The findings in this report 
cover select examinations in connection with credit reporting and 
furnishing that were completed from April 1, 2023, through December 31, 
2023. To maintain the anonymity of the supervised institutions 
discussed in Supervisory Highlights, references to institutions 
generally are in the plural and related findings may pertain to one or 
more institutions.

2. Supervisory Observations

2.1 Consumer Reporting Companies

    In recent reviews of CRCs, examiners found deficiencies in CRCs' 
compliance with FCRA and Regulation V identity theft block, human 
trafficking submission and accuracy requirements.

2.1.1 CRC Duty To Block the Reporting of Information Resulting From an 
Alleged Identity Theft

    The FCRA requires CRCs to block the reporting of any information in 
a consumer's file that the consumer identifies as information that 
resulted from an alleged identity theft not later than four business 
days after the CRC receives certain documentation relating to the 
alleged identity theft. Such documentation includes appropriate proof 
of the consumer's identity, a copy of an identity theft report, 
identification of the information that resulted from the alleged 
identity theft, and a statement by the consumer that such information

[[Page 36776]]

does not relate to any transaction by the consumer.\5\ A CRC may 
decline to block, or rescind any block of, information if the CRC 
reasonably determines that: the information was blocked in error or a 
block was requested by the consumer in error; the information was 
blocked, or the block was requested, on the basis of a material 
misrepresentation of fact by the consumer relevant to the request to 
block; or the consumer obtained possession of goods, services or money 
as a result of the blocked transaction(s).\6\
---------------------------------------------------------------------------

    \5\ 15 U.S.C. 1681c-2(a); see 15 U.S.C. 1681a(q)(4) and 12 CFR 
1022.3(i)(1) (defining ``identity theft report'').
    \6\ 15 U.S.C. 1681c-2(c).
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners found that CRCs failed to 
timely implement blocks of information after receiving the requisite 
documentation relating to an alleged identity theft, without otherwise 
making a reasonable determination with respect to one of the statutory 
bases for declining to block such information. Examiners found that the 
CRCs instead maintained policies pursuant to which the CRCs 
automatically declined to block information if the associated 
account(s) of the consumer met any one of a set of overbroad 
disqualifying criteria that were not sufficiently tailored to support a 
reasonable determination regarding any of the statutory declination 
bases.
    In response to these findings, CRCs were directed to cease the 
practice of automatically declining to implement blocks based on 
overbroad disqualifying criteria without an individualized 
determination that there is a statutory basis to decline. CRCs also 
were directed to implement revisions to the CRCs' policies to ensure 
compliance with FCRA identity theft block obligations, including any 
circumstances in which the CRCs may reasonably request additional 
information or documentation to determine the validity of an alleged 
identity theft and any circumstances in which there is a valid basis to 
decline to block.

2.1.2 CRC Duty To Promptly Notify Consumers After Declining To 
Implement, or Rescind, an Identity Block

    The FCRA requires CRCs to promptly notify the affected consumer if 
the CRC declines to block, or rescinds a block of, information that the 
consumer identifies as information resulting from an alleged identity 
theft.\7\ CRCs must notify the consumer in the same manner as CRCs are 
required to notify consumers of a reinsertion of information into a 
consumer's file--i.e., in writing within five business days and by 
providing certain information, including the name and address of the 
furnisher of the identified information if reasonably available and a 
notice that the consumer has the right to add a statement to the 
consumer's file disputing the accuracy or completeness of such 
information.\8\
---------------------------------------------------------------------------

    \7\ 15 U.S.C. 1681c-2(c)(2).
    \8\ Id. (referencing the notice requirements of 15 U.S.C. 
1681i(a)(5)(B)).
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners found that CRCs failed to 
provide the requisite notice within five business days of declining to 
block information--in some instances due to system issues and in others 
due to human error. Examiners also found that CRCs systematically 
failed to timely provide consumers with the relevant furnisher's 
contact information and/or notice regarding the consumer's right to add 
a statement to the consumer's file disputing the accuracy or 
completeness of the furnished information.
    In response to these findings, CRCs were directed to revise their 
policies to ensure compliance with FCRA identity theft block notice 
obligations and update notice templates to include the requisite 
information for consumers.

2.1.3 CRC Duty To Provide Victims of Identity Theft With Summaries of 
Rights

    The FCRA requires CRCs, upon a consumer contacting the CRC and 
expressing a belief that they are a victim of fraud or identity theft, 
to provide the consumer with a summary of rights containing all of the 
information required by the CFPB in its model summary of rights,\9\ 
along with information about how to request more detailed information 
from the CFPB.\10\ In recent reviews of CRCs, examiners found that CRCs 
failed to comply with this provision, either by failing to include 
required information in summaries of rights or by failing to provide 
the summary of rights to eligible consumers entirely.
---------------------------------------------------------------------------

    \9\ Consumer Fin. Prot. Bureau, Appendix I to part 1022--Summary 
of Consumer Identity Theft Rights, https://www.consumerfinance.gov/rules-policy/regulations/1022/i.
    \10\ 15 U.S.C. 1681g(d)(2).
---------------------------------------------------------------------------

    In response to these findings, CRCs are updating their systems to 
ensure that they provide the required summary of rights.

2.1.4 CRC Duty To Block Adverse Information Resulting From Human 
Trafficking

    Regulation V requires CRCs to block adverse items of information 
identified by a consumer or their representative as resulting from a 
severe form of trafficking in persons or sex trafficking, as defined in 
the regulation.\11\ CRCs must block such items within four business 
days of receiving a consumer's submission, except in limited 
circumstances where additional information is necessary to complete the 
submission.\12\ In recent reviews of CRCs, examiners found that CRCs 
failed to timely block identified adverse items of information within 
the applicable four business days. CRCs blocked some but not all items 
identified in a qualifying consumer submission and in other instances 
failed to implement a block entirely.
---------------------------------------------------------------------------

    \11\ 12 CFR 1022.142(c).
    \12\ 12 CFR 1022.142(e)(1).
---------------------------------------------------------------------------

    In response to these findings, CRCs were directed to revise their 
compliance processes to ensure that they process all human trafficking 
block requests in accordance with the requirements of Regulation V.

2.1.5 CRC Duty To Follow Reasonable Procedures To Assure Maximum 
Possible Accuracy

    The FCRA requires that, wherever a CRC ``prepares a consumer report 
it shall follow reasonable procedures to assure maximum possible 
accuracy of the information concerning the individual about whom the 
report relates.'' \13\ In recent reviews of CRCs, examiners found that 
CRCs' accuracy procedures failed to comply with this obligation because 
the CRCs (1) failed to adequately monitor dispute metrics that would 
suggest a furnisher may no longer be a source of reliable, verifiable 
information about consumers, and (2) continued to include information 
in consumer reports that was provided by unreliable furnishers without 
implementing procedures to assure the accuracy of information provided 
by unreliable furnishers. Specifically, the CRCs did not monitor 
metrics and thresholds tied to objective measures of inaccuracy or 
unreliability. Moreover, the CRCs maintained data from furnishers that 
responded to disputes in ways that suggested that the furnishers were 
no longer sources of reliable, verifiable information about consumers. 
For example, CRCs received furnisher dispute response data indicating 
that, for several months, furnishers failed to respond to all or nearly 
all disputes, or responded to all disputes in the same manner. Despite 
observing this dispute response behavior by these furnishers, CRCs 
continued to include information from these furnishers in consumer 
reports.
---------------------------------------------------------------------------

    \13\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------

    In response to these findings, CRCs were directed to revise their 
accuracy

[[Page 36777]]

procedures to identify and monitor furnishers and take corrective 
action regarding data from furnishers whose dispute response behavior 
indicates the furnisher is not a source of reliable, verifiable 
information about consumers.

2.2 Furnishers

    In recent reviews of furnishers, examiners found deficiencies in 
furnishers' compliance with FCRA and Regulation V accuracy, dispute 
investigation and identity theft requirements.

2.2.1 Furnisher Duty to Promptly Correct and Update Information 
Determined To Be Incomplete or Inaccurate

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to promptly correct and update furnished information after 
determining that such information is incomplete or inaccurate.\14\ 
Specifically, in recent reviews of auto loan furnishers, examiners 
found that furnishers continued to furnish incomplete or inaccurate 
information for several months, and in some cases years, after the 
furnishers determined, through either dispute handling or 
identification of systemic issues, the information was furnished 
incompletely or inaccurately. For example, examiners found that 
furnishers continued to report dates of first delinquency inaccurately 
for several months after determining that they were reporting 
inaccurately due to various system coding issues. Examiners also found 
that after determining accounts were in a bankruptcy status and 
therefore should have been reported as current with dates of first 
delinquency that reflect the bankruptcy filing dates, furnishers failed 
to update the dates of first delinquency for the accounts to the 
bankruptcy filing dates. By failing to update the dates of first 
delinquency for the accounts in bankruptcy when they determined the 
accounts were in bankruptcy, the furnishers failed to promptly update 
or correct information they had determined to be incomplete or 
inaccurate. In response to these findings, furnishers are updating 
their internal controls related to promptly correcting or updating 
furnished information after determining it is incomplete or inaccurate 
and engaging in lookbacks to remediate the furnishing of the previously 
impacted accounts.
---------------------------------------------------------------------------

    \14\ 15 U.S.C. 1681s-2(a)(2).
---------------------------------------------------------------------------

    Examiners also found that auto loan furnishers did not promptly 
send corrections or updates to CRCs after determining that accounts 
with lease returns were paid-in-full. When leased cars were returned to 
dealerships, furnishers updated their systems of record to reflect that 
the accounts had been paid-in-full. However, examiners found that the 
furnishers failed to update the information furnished to CRCs to 
reflect that the accounts were paid-in-full. In response to these 
findings, furnishers are conducting lookbacks to ensure that 
corrections or updates are furnished for impacted accounts and are 
implementing internal controls to ensure they promptly correct or 
update furnished information after determining it is incomplete or 
inaccurate.
    In addition, in reviews of deposit furnishers, examiners found that 
furnishers continued to report fraudulent accounts to CRCs for several 
years after determining the accounts were fraudulent. While, in some 
instances, furnishers closed the accounts determined to be fraudulent, 
they continued to furnish the accounts as valid (i.e., non-fraudulent) 
accounts and failed to notify CRCs that the accounts should be deleted 
because they were fraudulent. By not instructing CRCs to delete the 
accounts promptly after determining they were fraudulent, the 
furnishers failed to promptly correct or update furnished information 
determined to be inaccurate or incomplete.
    In response to these findings, furnishers conducted lookbacks to 
ensure they deleted all accounts they determined to be opened 
fraudulently and updated their policies and procedures related to 
notifying CRCs when accounts are determined to be fraudulent to ensure 
the accounts are deleted.

2.2.2 Furnisher Duty To Notify CRCs of Direct Disputes

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to notify CRCs that the accuracy or completeness of items 
being furnished by them are subject to dispute.\15\ Specifically, in 
recent reviews of deposit furnishers, examiners found that furnishers 
who received direct disputes from consumers were continuing to furnish 
the disputed information to CRCs without notifying the CRCs that the 
information was subject to dispute.
---------------------------------------------------------------------------

    \15\ 15 U.S.C. 1681s-2(a)(3).
---------------------------------------------------------------------------

    In response to these findings, furnishers are updating their 
policies to make clear that they will provide notices of direct 
disputes to CRCs.

2.2.3 Furnisher Duty To Conduct Reasonable Investigations of Direct 
Disputes

    Examiners are continuing to find that furnishers are violating the 
Regulation V duty to conduct a reasonable investigation of direct 
disputes.\16\ Specifically, in recent reviews of auto loan furnishers, 
examiners found evidence that furnishers failed to investigate direct 
disputes that did not satisfy those furnishers' extraneous identity 
verification requirements. Regulation V specifically defines what a 
consumer must include in a dispute notice to trigger a furnisher's duty 
to investigate. Although these disputes met the Regulation V 
requirements for a direct dispute, examiners found evidence that the 
furnishers did not investigate the disputes because the consumer had 
not satisfied additional identity verification requirements of the 
furnisher. However, Regulation V does not permit a furnisher to 
establish additional requirements beyond what the regulation requires 
in order to initiate a direct dispute investigation by the furnisher.
---------------------------------------------------------------------------

    \16\ 12 CFR 1022.43(e)(1).
---------------------------------------------------------------------------

    Also, in recent reviews of debt collection furnishers, examiners 
found that when the furnishers received a direct dispute, they simply 
deleted the tradeline, rather than conducting an investigation. As the 
Bureau has previously explained, simply deleting tradelines in response 
to a direct dispute does not satisfy furnishers' responsibility to 
conduct a reasonable investigation with respect to the disputed 
information.\17\ After identification of these issues, furnishers were 
directed to update their policies and procedures to ensure they conduct 
reasonable investigations of direct disputes.
---------------------------------------------------------------------------

    \17\ CFPB Bulletin 2014-01 (Feb. 27, 2014).
---------------------------------------------------------------------------

2.2.4 Furnisher Duty To Provide Notice of Delinquency of Accounts

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to notify CRCs of the dates of first delinquency on 
applicable accounts.\18\ Specifically, in recent reviews of auto loan 
furnishers, examiners found that furnishers inaccurately reported dates 
of first delinquency to CRCs due to various coding issues. For example, 
examiners found that coding errors resulted in furnishers inaccurately 
reporting dates of first delinquency as the first day of the statement 
cycle following the consumer's missed payment, rather than 30 days 
after the missed payment due date. Examiners also found that auto

[[Page 36778]]

loan furnishers reported inaccurate dates of first delinquency for 
accounts by reporting the dates of first delinquency as more recent 
than they should have been, including by changing the dates of first 
delinquency for accounts that remained delinquent month after month 
(i.e., accounts for which the dates of first delinquency should not 
have been changed).
---------------------------------------------------------------------------

    \18\ 15 U.S.C. 1681s-2(a)(5).
---------------------------------------------------------------------------

    In response to these findings, furnishers are conducting lookbacks 
to identify and remediate impacted accounts and updating their policies 
and procedures to ensure that they report dates of first delinquency 
accurately.

2.2.5 Furnisher Duty Not To Furnish Information That Purports To Relate 
to a Consumer Upon Receipt of an Identity Theft Report

    Examiners are continuing to find that furnishers are violating the 
FCRA's requirement that if a consumer submits an identity theft report 
at the address specified by the furnisher for receiving such reports 
stating that information maintained by that furnisher that purports to 
relate to the consumer resulted from identity theft, the furnisher may 
not furnish such information to any CRC, unless the furnisher 
subsequently knows or is informed by the consumer that the information 
is correct.\19\ Specifically, in recent reviews of auto loan 
furnishers, examiners found that furnishers who received identity theft 
reports at a qualifying address continued to furnish information 
identified in the report before knowing or being informed by the 
consumer that the information was correct.
---------------------------------------------------------------------------

    \19\ 15 U.S.C. 1681s-2(a)(6)(B).
---------------------------------------------------------------------------

    In response to these findings, furnishers are updating their 
policies and procedures to ensure that information subject to this 
requirement is not furnished prior to the completion of an 
investigation and determination of validity.

3. Supervisory Program Developments

3.1 Recent CFPB Supervisory Program Developments

    Set forth below are select supervision program developments 
including advisory opinions, that have been issued regarding credit 
reporting since our last regular edition of Supervisory Highlights.

3.1.1 CFPB Issued Advisory Opinion on Fair Credit Reporting: Background 
Screening

    On January 11, 2024, the CFPB issued an advisory opinion to affirm 
that, when preparing consumer reports, a CRC that reports public record 
information is not using reasonable procedures to assure maximum 
possible accuracy under the FCRA if it does not have procedures in 
place that: (1) prevent reporting information that is duplicative or 
that has been expunged, sealed, or otherwise legally restricted from 
public access; and (2) include any existing disposition information if 
it reports arrests, criminal charges, eviction proceedings, or other 
court filings.\20\ The advisory opinion also highlights that, when CRCs 
include adverse information in consumer reports: (1) the occurrence of 
the adverse event starts the running of the reporting period for 
adverse items under FCRA section 605(a)(5); (2) that period is not 
restarted or reopened by the occurrence of subsequent events; and (3) a 
non-conviction disposition of a criminal charge cannot be reported 
beyond the seven-year period that begins to run at the time of the 
charge. CRCs thus must ensure that they do not report adverse 
information beyond the reporting period in FCRA section 605(a)(5) and 
must at all times have reasonable procedures in place to prevent 
reporting of information that is duplicative or legally restricted from 
public access and to ensure that any existing disposition information 
is included if court filings are reported.
---------------------------------------------------------------------------

    \20\ The advisory opinion is available at: cfpb_fair-credi-
reporting-background-screening_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

3.1.2 CFPB Issues Advisory Opinion on File Disclosures

    On January 11, 2024, the CFPB issued an advisory opinion to address 
certain obligations that CRCs have under section 609(a) of the 
FCRA.\21\ The advisory opinion underscores that, to trigger a CRC's 
file disclosure requirement under FCRA section 609(a), a consumer does 
not need to use specific language, such as ``complete file'' or 
``file.'' The advisory opinion also highlights the requirements 
regarding the information that must be disclosed to a consumer under 
FCRA section 609(a). In addition, the advisory opinion affirms that 
CRCs must disclose to a consumer both the original source and any 
intermediary or vendor source (or sources) that provide the item of 
information to the CRC under FCRA section 609(a).
---------------------------------------------------------------------------

    \21\ The advisory opinion is available at: cfpb_fair-credit-
reporting-file-disclosure_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

4. Remedial Actions

4.1 Public Enforcement Actions

    The CFPB's supervisory actions resulted in and supported the below 
enforcement actions related to credit reporting or furnishing.

4.1.1 Toyota Motor Credit Corporation

    On November 20, 2023, the CFPB issued an order against Toyota Motor 
Credit Corporation (Toyota Motor Credit), which is the United States-
based auto-financing arm of Toyota Motor Corporation and one of the 
largest indirect auto lenders in the country. Toyota Motor Credit 
provides financing for vehicles and optional ``add-on'' products and 
services sold with the vehicles. These add-ons include Guaranteed Asset 
Protection, which can waive some of a consumer's remaining loan balance 
if their car is totaled, stolen or damaged when they still owe money on 
the loan even with car insurance, and Credit Life and Accidental 
Health, which is designed to pay a remaining balance if the consumer 
dies or becomes disabled. The CFPB found that Toyota Motor Credit 
violated the Consumer Financial Protection Act of 2010 by: (1) unfairly 
and abusively making it unreasonably difficult for consumers to cancel 
unwanted add-ons, including when consumers complained that dealers had 
forced add-ons on consumers without their consent; (2) unfairly failing 
to ensure consumers received refunds of unearned Guaranteed Asset 
Protection and Credit Life and Accidental Health premiums when they 
paid off their loans early or ended lease agreements early, making the 
products no longer of any value to consumers; and (3) unfairly failing 
to provide accurate refunds to consumers who canceled their vehicle 
service agreements as a result of flawed system logic. The CFPB also 
found that Toyota Motor Credit violated the FCRA and its implementing 
Regulation V by (1) failing to promptly correct negative information it 
had sent to CRCs, where the negative information was falsely reporting 
customer accounts as delinquent even though customers had already 
returned their vehicles; and (2) failing to maintain reasonable 
policies and procedures to ensure related payment information it sent 
to CRCs was accurate. The order requires Toyota Motor Credit to pay $48 
million in consumer redress and a $12 million civil money penalty.\22\ 
The order also requires Toyota Motor Credit to stop its

[[Page 36779]]

unlawful practices and come into compliance with the law and prohibits 
incentive-based employee compensation or performance measurements in 
relation to add-on products.
---------------------------------------------------------------------------

    \22\ The Order is available at: cfpb_toyota-motor-credit-
corporation-consent-order_2023-11.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

4.1.2 TransUnion, Trans Union LLC, and TransUnion Interactive, Inc.

    On October 12, 2023, the CFPB issued an order against TransUnion, 
parent company of one of the three nationwide CRCs, and two of its 
subsidiaries, Trans Union LLC, and TransUnion Interactive, Inc. 
(collectively, TransUnion), which are headquartered in Chicago, 
Illinois. Security freezes and locks block certain third parties, such 
as lenders, from accessing consumers' credit reports to prevent a 
potential identity thief from obtaining new credit in those consumers' 
names. Starting in September 2018, Federal law has required nationwide 
CRCs to provide security freezes as a free service, whereas locks are a 
feature of certain paid products. The CFPB found that TransUnion, from 
as early as 2003, failed to timely place or remove security freezes and 
locks on the credit reports of tens of thousands of consumers who 
requested them, including certain vulnerable consumers; in some cases, 
those requests were left unmet for months or years. The CFPB found 
TransUnion's failure to place or remove security freezes in a timely 
manner occurred as a result of problems, including systems issues, that 
TransUnion knew about but failed to address for years. The CFPB found 
that TransUnion's failure to place or remove security freezes in a 
timely manner violated the FCRA, and TransUnion's failure to place or 
remove both security freezes and locks in a timely manner was unfair in 
violation of the Consumer Financial Protection Act of 2010. Further, 
the CFPB found that TransUnion engaged in deceptive acts and practices 
by falsely telling certain consumers that their requests had been 
successful when they had not. In addition, the CFPB found that from 
about 2016 to 2020, TransUnion failed to exclude certain consumers, 
including active-duty military and other potential victims of identity 
theft, from pre-screened solicitation lists in violation of FCRA. The 
CFPB's order requires TransUnion to pay $3 million to consumers in 
redress and $5 million in civil penalties.\23\ TransUnion must also 
take steps to address and prevent unlawful conduct, including convening 
a committee to identify and address technology problems that can affect 
consumers.
---------------------------------------------------------------------------

    \23\ A copy of the Consent Order is available at:https://www.consumerfinance.gov/enforcement/actions/transunion-trans-union-llc-and-transunion-interactive-inc/.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-09712 Filed 5-2-24; 8:45 am]
BILLING CODE 4810-AM-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.