Fair Credit Reporting Act

Introduction  The Fair and Accurate Credit Transactions Act (“FACTA”) greatly amended the Fair Credit Reporting Act (FCRA).

 Partially implemented by regulation found at 12 CFR 1022

Purpose and Scope  The FCRA was enacted by Congress to serve the following principal purposes:

o To regulate the consumer-reporting industry, and to ensure the issuers of consumer reports provide information that is fair and equitable to consumers, and fair and accurate to report users.

o To prohibit consumer-reporting agencies (CRAs) from taking actions that are unfair or that adversely affect a consumer’s credit and ability to obtain credit.

o To restrict the availability and use of consumer reports.

 The FCRA’s rules apply to all reports issued with respect to members, regardless of whether a report is issued in connection with a consumer loan, a business loan, or for any other purpose (such as an application for any account, debit card or other services).

Definitions Consumer  A consumer is an individual.

 Information a CRA communicates that bears on the creditworthiness of a consumer is subject to the rules of the FCRA, including information related to business credit.

Consumer Report A consumer report consists of the following:  Any oral, written, or other communication of information by a CRA.

 The information communicated must bear on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.

 The information must be used (or be expected to be used or collected, in whole or in part) to serve as a factor in establishing a consumer’s eligibility for any of the purposes permitted under the FCRA.

1 Fair Credit Reporting Act The following are not considered consumer reports under the FCRA:  Reports containing information as to transactions or experiences between the credit union and the member that are communicated among persons related by common ownership or affiliated by corporate control.

 Any communication of other information among persons related by common ownership or affiliated by corporate control, if it is clearly and conspicuously disclosed to the member that the information may be so distributed and the member is given the opportunity to direct that such information not be so communicated before the information is actually communicated.

Consumer-Reporting Agency A consumer reporting agency is any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other consumer information for the purpose of furnishing consumer reports to third parties, and uses any means of interstate commerce for the purpose of preparing or furnishing consumer reports.

Permissible Purposes for Requesting Consumer Reports Permissible uses of consumer reports permitted by FCRA include:  Determining an applicant’s eligibility for credit or insurance, or to open a deposit account, or in connection with a review or collection of a member’s account.

 In response to a court order.

 Prescreening a list of members to solicit for credit services.

 Use in accordance with written instructions of the member to whom the report relates.

Adverse Action Disclosure  Disclosure is required when the credit union denies or increases the cost of a member’s credit or deposit account based on third-party information.

 The FCRA notice may be combined with the ECOA notice

Credit Bureau Information If information related to an adverse credit decision came from a credit bureau, the creditor must disclose the following to an applicant:  That information from a credit bureau was used in the credit decision.

 The name, address and telephone number (toll-free if a nationwide bureau) of the credit bureau used.

2 Fair Credit Reporting Act  A statement that the credit bureau did not make the decision to take the adverse action.

 Notice of the member’s right to get a free copy of his credit report from the bureau upon written request, within 60 days.

 Notice of the member’s right to dispute with the bureau the accuracy or completeness of any information contained in his report.

 The credit union does not have to include the nature of the information contained in the report.

Credit Score Information  In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act amended the FCRA to require creditors to disclose credit scores and related information to consumers in risk-based pricing and adverse action notices under the FCRA if a credit score was used in setting the credit terms or taking adverse action.

 The credit score disclosure must include:

o A statement that a credit score takes into account information in a consumer report and a credit score can change over time

o The specific numerical credit score used in making the credit decision

o The range of possible scores

o Key factors that adversely affected the credit score such as late payments and high credit utilization

o The date on which the credit score was created

o The name of the entity that provided the credit score.

Combined FCRA/ECOA Adverse Action Notice  Both the FCRA and ECOA contain adverse action notice requirements

 Regulation B provides model notices that allow creditors to comply with both statutes’ requirements.

Information From Other Outside Sources  If information related to an adverse credit decision was obtained from an outside source other than a credit bureau, the credit union must either disclose the nature of the information or the member’s right to obtain the nature of the information, if a written request is filed within 60 days of the adverse action notice.

 The credit union may, but need not, disclose the source of the information. 3 Fair Credit Reporting Act Information From a Credit Union’s Own Internal Records  If the credit union uses information from its own experience with the member, there are no disclosure obligations.

 This disclosure exception does not apply to use of information from other affiliates of a credit union’s holding company.

Reporting Third Party Information to Others  Under the FCRA, you may report your own transactions and experiences with a member to both consumer-reporting agencies and other creditors.

 If you report to others about information you gather from sources other than through your own experience, you can become a consumer-reporting agency.

Negative Information Reporting Notice Creditors are required to provide this notice if:  They extend credit regularly and in the ordinary course of business furnish information to a nationwide consumer reporting agency, and

 They furnish negative information to such an agency regarding credit extended to that consumer

Format The institution must provide a “clear and conspicuous” notice about furnishing negative information, in writing, to the consumer. Model Notice  The CFPB’s Regulation V contains a model notice that may be used by all financial institutions.

 Credit unions are not required to use the model notices.

 Institutions that use the Fed’s model notices shall be deemed to be in compliance with FCRA’s notice requirement relating to furnishing negative information to credit bureaus.

 Credit unions that provide the notice to members prior to furnishing the negative information to credit bureaus may use Model Notice B-1: “We may report information about your account to credit bureaus. Late payments, missed payments, or other defaults on your account may be reflected in your credit report.”

 Credit unions that provide the notice to members after furnishing the negative information to credit bureaus may use Model Notice B-2: “We have told a credit

4 Fair Credit Reporting Act bureau about a late payment, missed payment or other default on your account. This information may be reflected in your credit report.”

Timing  The notice must be provided prior to, or no later than, 30 days after furnishing the negative information to the CRA.

 Negative information means a consumer’s delinquencies, late payments, insolvency or any form of default.

 The credit union need not provide the notice each time the member is late with a payment on the same loan account.

 The credit union generally may provide the notice about furnishing negative information on or with any notice of default, any billing statement, or any other materials provided to the member, as long as the notice is “clear and conspicuous.”

 The credit union may not include the notice in the initial Truth In Lending disclosures provided under the Truth in Lending Act

Notice to Home Loan Applicants  If a credit union uses credit scores in connection with mortgage loan applications, they must provide the following disclosures to applicants:

o The “Notice to Home Loan Applicants”

o The credit score(s) used in connection with the application

o Key factors that make up the credit score(s)

 Mortgage loan applications include purchase money mortgages, refinanced loans, home equity loans, second mortgages, and home equity lines of credit secured by 1 to 4 units of residential real property.

Timing  The notice and score disclosure must be provided as soon as “reasonably practical.”

 The notice is required whether or not the loan is approved.

 For privacy purposes, each applicant should receive a separate notice.

Model Notice The following model language for this notice is provided in the statute:

Notice to home loan applicants

5 Fair Credit Reporting Act

In connection with your application for a home loan, the lender must disclose to you the score that a consumer-reporting agency distributed to users and the lender used in connection with your home loan, and the key factors affecting your credit scores.

The credit score is a computer-generated summary calculated at the time of the request and based on information that a consumer reporting agency or lender has on file. The scores are based on data about your credit history and payment patterns. Credit scores are important because they are used to assist the lender in determining whether you will obtain a loan. They may also be used to determine what interest rate you may be offered on the mortgage. Credit scores can change over time, depending on your conduct, how your credit history and payment patterns change, and how credit-scoring technologies change.

Because the score is based on information in your credit history, it is very important that you review the credit-related information that is being furnished to make sure it is accurate. Credit records may vary from one company to another.

If you have questions about your credit score or the credit information that is furnished to you, contact the consumer reporting agency at the address and telephone number provided with this notice, or contact the lender, if the lender developed or generated the credit score.

The consumer-reporting agency plays no part in the decision to take any action on the loan application and is unable to provide you with specific reasons for the decision on a loan application.

If you have questions concerning the terms of the loan, contact the lender.

Risk-based Pricing Notice Credit unions are required to provide a risk-based pricing notice when:  The credit union uses a consumer report in connection with a consumer’s credit application or extension; and

 Based at least in part on that report, the credit union grants or extends credit to the consumer on “material terms” (e.g., annual percentage rate or APR) that are “materially less favorable” (higher cost for credit) than the most favorable terms available to a substantial portion of the credit union’s members.

Coverage  The regulation applies to consumer credit (primarily for personal, family, or household purposes), and only the original creditor is responsible for providing the notice (i.e., the creditor to whom the obligation is initially payable).

 The rule does not apply to lease transactions.

6 Fair Credit Reporting Act Model Forms  The regulation includes model forms that credit unions may use to comply with these notice requirements.

 Credit unions may make changes to these forms as long as the substance, clarity, and sequence of the notice are not changed.

Methods For Determining Who Receives a Notice  There are several methods for determining which consumers must receive risk- based pricing notices.

 The credit union must use the same method to evaluate all consumers receiving a specific type of credit (e.g., auto loans, mortgages, etc.), but may vary the methods among different products.

 Risk- based pricing notices may only be given to members who receive materially less favorable terms, and not to all consumers who apply for credit.

Method 1 — Consumer-to-Consumer Comparison  A direct consumer-to-consumer comparison involves comparing each consumer to an adequate sample of consumers who are offered a specific type of credit.

 The group of consumers given less favorable terms based on credit report information receive the notice.

Method 2 — Credit Score Proxy Method Credit unions that use credit scores to set material terms may comply with the risk-based notice requirements by:  Determining the credit score that represents the point at which approximately 40 percent of its members have higher scores and approximately 60 percent of its members have lower scores

 Providing a risk-based pricing notice to members with a score below this cutoff.

Method 3 — Tiered Pricing Method  A credit union may place a member within one of a discrete number of pricing tiers based on a consumer report.

 The only factor a credit union using this method must consider is tiers with different APRs or, for credit with no annual percentage rate, other financial terms that the credit union varies based on consumer report information.

 A notice must be sent to those consumers who do not qualify for the top tier (lowest-priced) for a four or fewer tier system; or the top two tiers for a five or more tier system, as well as additional tiers that comprise between 30-40% of the total number of tiers.

7 Fair Credit Reporting Act Alternative Approach for Credit Cards  Credit card issuers may use one of the methods described above or a special method for credit cards that allows the card issuer to determine which consumers must receive a notice on an offer-by-offer basis.

 A credit union must send a risk-based pricing notice if:

o The member applies for a credit card in connection with an application in which more than one possible purchase APR may apply; and

o Based on the consumer report, the card issuer provides the member with a credit card with a purchase APR that is not the lowest purchase APR available under that application or solicitation.

 There are two exceptions to the notice requirement for credit cards:

o If the consumer applies for a credit card in which a creditor provides a single purchase APR.

o If the consumer is offered the lowest purchase APR available under the credit card offer for which he or she applied, even if the issuer offers lower rates under a different credit card offer to other consumers.

 If a credit card does not have a purchase APR, the issuer may instead use the APR that varies based on information in a consumer report and that has the most significant impact on the consumer.

Content, Form, and Timing of Notice  The credit union must generally provide the notice before the consummation of the transaction, or the first transaction for credit cards or other open-end credit, but no earlier than the time that approval of the credit is communicated to the consumer.

 The risk-based pricing notice must include the following:

o A statement that a consumer report includes information about a consumer’s credit history and the type of information included in that history.

o A statement that the terms offered are based on information from that consumer report.

o A statement that the terms offered “may” be less favorable than those offered other consumers with better credit histories

o A statement that the consumer has the right to dispute any inaccurate information in the report

o Each consumer reporting agency that furnished a report used in the credit decision

o An explanation that the consumer may obtain a free consumer report from that agency within 60 days after receipt of the notice, which would be in addition to the free credit report that consumers are already entitled to receive under the FACTA amendments to the FCRA;

o Description of how to obtain the free report from the consumer reporting agency, along with the toll-free number, if applicable, for each agency; and

o A statement directing consumers to the Federal Trade Commission or CFPB websites to obtain more information about consumer reports.

o Additional content must be disclosed to consumers in risk-based pricing notices if a credit score is used in setting the material terms of credit:

. A statement that a credit score is a number that takes into account information in a consumer report, that the consumer‘s credit score was used to set the terms of credit offered, and that a credit score can change over time to reflect changes in the consumer‘s credit history;

. The credit score used by the person in making the credit decision;

. The range of possible credit scores under the model used to generate the credit score;

9 Fair Credit Reporting Act . All of the key factors that adversely affected the credit score, which shall not exceed four key factors, except that if one of the key factors is the number of enquiries made with respect to the consumer report, the number of key factors shall not exceed five;

. The date on which the credit score was created

. The name of the consumer reporting agency or other person that provided the credit score.

Account Review  A notice must be provided if the credit union reviews a consumer’s credit account, and based on credit report information, increases the APR on that account.

 A notice must be provided if a credit card issuer periodically obtains consumer reports in order to review the terms of the credit it has extended to a consumer and based on that review increases the APR.

 Notices issued in response to account review must include the same basic information as notices provided for credit applicants.

 The notice must be provided at the time the decision to increase the APR is communicated to the consumer.

Exceptions

Application for Specific Terms Exception A risk-based pricing notice is not required if the consumer applies for and is granted specific terms for credit, unless those terms were specified after the credit was applied for and after the credit union obtained a consumer report.

Adverse Action Exception A credit union does not have to provide a risk-based pricing notice if it provides an adverse action notice under Section 615(a) of the FCRA.

Prescreened Solicitations Exception A credit union does not have to provide a risk-based pricing notice if it obtains a consumer report that is a prescreened list and uses that report to make a firm offer of credit to a consumer, regardless of whether the material terms of such an offer differ from the terms that the credit union includes in firm offers of credit to other consumers.

Credit Score Disclosure Exception for Non-mortgage Credit  A credit union may provide a credit score disclosure instead of the risk-based pricing notice.

 The disclosure must contain the consumer’s credit score along with explanatory information regarding the score, and information regarding the use of consumer reports and scores in the underwriting process.

 Under this exception, a credit union must provide this disclosure to any consumer who requested an extension of credit.

 Use of this notice does not give consumer a right to a free copy of their credit report.

Credit Score Disclosure Exception for Mortgage Loans: For mortgage loans, creditors are allowed to add supplementary information to the already required credit score disclosure for mortgage loans.

Credit Score Disclosure Exception When no Credit Score is Available A credit union provides this disclosure when the credit score for a particular consumer is unavailable from the consumer reporting agency the creditor regularly uses.

Obligations of Furnishers of Credit Data Reporting Inaccurate Information  Credit Unions are prohibited from providing incorrect information to a CRA that they know (or consciously avoid knowing) is inaccurate.

 A credit union is not subject to this prohibition if it clearly and conspicuously specifies an address to which members may write in order to notify the credit union that certain information is inaccurate.

Duty to Correct and Update Information  A credit union must provide updated information to a CRA anytime it discovers it is reporting incomplete or inaccurate information.

 Credit unions must notify all CRAs that received the information of any corrections.

Furnisher Accuracy Rules  A credit union must establish and implement reasonable written policies and procedures to ensure the accuracy and integrity of information that it furnishes to credit bureaus.

 “Accuracy” means that the information the furnisher provides to a consumer reporting agency about an account or other relationship with the consumer correctly: 11 Fair Credit Reporting Act o Reflects the terms of and liability for the account or other relationship;

o Reflects the consumer’s performance and other conduct with respect to the account or other relationship; and

o Identifies the appropriate consumer

 “Integrity” means the information that a furnisher provides to the credit bureau about an account or other relationship with the consumer:

o Is substantiated by the furnisher’s records at the time it is furnished

o Is furnished in a form and manner that is designed to minimize the likelihood that the information may be incorrectly reflected in a consumer report

o Includes the information in the furnisher’s possession about the account or other relationship that, if omitted from the credit report, would present a misleading picture of the consumer’s creditworthiness.

 In developing its policies and procedures, the credit union should address:

o Establishing and implementing a system for furnishing information that is appropriate to the nature, size, complexity, and scope of the credit union’s operations.

o Using standard data reporting formats and standard procedures for compiling and furnishing data to CRAs.

o Maintaining records for a reasonable period of time in order to substantiate the accuracy of any information it furnishes that is subject to a direct dispute.

o Establishing and implementing appropriate internal controls regarding the accuracy and integrity of consumer information, such as by implementing standard procedures and verifying random samples of information provided to CRAs.

o Training staff that participates in activities related to the furnishing of information to CRAs to implement the policies and procedures.

o Providing for appropriate and effective oversight of relevant service providers whose activities may affect the accuracy or integrity of information furnished to CRAs.

o Furnishing information to CRAs following mergers, portfolio acquisitions or sales, or other acquisitions or transfers of accounts or other obligations in a manner that prevents re-aging of information, duplicative reporting, or other

12 Fair Credit Reporting Act problems that may similarly affect the accuracy or integrity of the information furnished.

o Deleting, updating, and correcting information in the credit union’s records, as appropriate, to avoid furnishing inaccurate information.

o Conducting reasonable investigations of disputes.

o Designing technological and other means of communication with CRAs to prevent duplicative reporting of accounts, erroneous association of information with the wrong consumer(s), and other occurrences that may compromise the accuracy or integrity of information provided to CRAs.

o Providing CRAs with sufficient identifying information to enable the consumer reporting agency properly to identify the consumer.

Investigating Direct Disputes  Credit unions must investigate a direct dispute if it relates to an account at the credit union and involves specific information regarding that account.

 The credit union does not have to investigate anything having to do with:

o The consumer’s identifying information (DOB, SSN, address, etc.)

o The identity of past employers

o Inquiries or requests for consumer reports

o Information derived from public records (e.g., judgments, bankruptcies),

o Fraud or active duty alerts

o Information provided by another furnisher

o Direct disputes submitted by credit repair organizations.

Address for Disputes A credit union will only be required to investigate a direct dispute if a consumer submits a dispute notice to the credit union at:  An address provided by the credit union and set forth on the consumer report relating to that consumer

 An address clearly and conspicuously specified by the credit union for submitting direct disputes that is provide to the consumer in writing

 Any credit union address if the credit union has not otherwise specified an address for submitting direct disputes.

13 Fair Credit Reporting Act Dispute Notice Contents A consumer’s dispute notice must include:  Sufficient information to identify the account or other relationship that is in dispute, such as an account number and the name, address and telephone number of the consumer

 The specific information that the consumer is disputing and an explanation of the basis for the dispute

 Any supporting documentation or other information reasonably required by the credit union to substantiate the basis of the dispute (e.g., a copy of consumer report allegedly containing the inaccurate information, a police report, ID theft affidavit, court order, account statements, etc.)

Investigation Procedures  Credit unions must complete their investigation of direct disputes within 30 days of receiving the dispute notice.

 If the investigation finds that the information in the report was inaccurate, the credit union must correct the error and provide accurate information to the credit bureau.

 Results of the investigation must be reported to the consumer upon completion.

Frivolous Disputes  A credit union is not be required to investigate disputes that are determined to be frivolous or irrelevant, such as:

o Those containing insufficient information to conduct an investigation

o Substantially similar disputes that were previously submitted to the credit union or a consumer reporting agency by or on behalf of the consumer.

 Upon making a determination that a dispute is frivolous or irrelevant, the credit union must notify the consumer not later than 5 business days after making the determination, by mail (or other means if authorized for that purpose by the consumer).

 The notice to the consumer must explain the reasons for the credit union’s determination that the dispute was frivolous.

Investigating Disputes from CRAs When a CRA notifies the credit union that a member disputes the completeness or accuracy of information provided, the credit union must:  Conduct an investigation and review all relevant information provided by the CRA, including information given to the CRA by the member.

 Report the results to the CRA, and, if the investigation establishes that the information was, in fact, incomplete or inaccurate, report the results to all CRAs that compile and maintain files on nationwide basis to which the credit union provided the information.

 Complete the investigation and make necessary corrections within 30 days from the date the CRA receives the dispute (or 45 days, if the member later provides relevant additional information to the CRA).

Reporting Voluntary Account Closures Credit unions must promptly report voluntary account closures to CRAs. Reporting Delinquency Dates Within 90 days of reporting to a CRA that an account is a delinquent, has been placed for collection, charged to profit or loss, or subject to any similar action, the credit union must provide the CRA with the month and the year of the commencement of the delinquency that immediately preceded the action. Identity Theft Notifications  Credit unions are required to have reasonable procedures in place to respond to any notification from a credit bureau that information they have furnished was the result of identity theft, and to prevent refurnishing that information in the future.

 Information a member has identified as resulting from ID theft must not be furnished unless the credit union later learns or is informed by the consumer that the information actually is correct.

 If the credit union learns that it has furnished information that is incorrect due to ID theft, each consumer-reporting agency that received the incorrect information must be notified and the credit union must from then on report only complete and accurate information.

 If the credit union is notified that a debt has resulted from identity theft, that debt may not be sold, transferred, or placed for collection.

Fraud Alerts and Active Duty Alerts  CRAs maintain an alert system to notify all prospective users of consumer reports that a consumer may be a victim of fraud, including ID theft, or that a consumer is an “active duty military consumer,” as applicable.

 Consumers may request that fraud alerts be placed on their credit reports for an initial period of 90 days, or for an extended period lasting seven years.

 Active duty military consumers may request that an “active duty alert” be placed on their credit report files during the period of their active duty.

Responding to Fraud and Active Duty Alerts  A credit union must maintain procedures to form a “reasonable belief” that they know the true identity of a member with a fraud alter on his or her credit report before establishing a new credit plan, issuing additional cards on an existing credit account, or increasing any credit limit in the subject member’s name.

 For initial active duty alerts, if the consumer has specified a telephone number in the alert, the credit union cannot extend any credit until it contacts the consumer using that number, or takes other reasonable steps to verify the person’s identity and confirm that the application for credit is not the result of ID theft.

 For extended alerts, the credit union must contact the consumer in person, at the telephone number indicated in the alert, or other reasonable contact method specified by the consumer before credit is granted or additional cards are sent.

Identity Theft Red Flags Credit unions must develop and implement a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account. Covered Accounts Covered accounts are:  Accounts offered or maintained primarily for personal, family, or household purposes that involve or are designed to permit multiple payments or transactions or

 Any other accounts the credit union offers or maintains for which there is a reasonably foreseeable risk to members or to the safety and soundness of the credit union from ID theft, including financial, operational, compliance, reputation, or litigation risks.

Red Flags  Red flags are patterns, practices, or activities that indicate a possible risk of ID theft.

 Examples of red flags include:

o A fraud or active duty alert on the credit report

o A notice of address discrepancy provided by a credit bureau

o The credit report or a use of the account that indicates a pattern of activity inconsistent with the history or pattern of activity usually associated with the consumer

o The credit union is notified of unauthorized charges or transactions in connection with the account

o Personal information provided is inconsistent when compared to external information sources (e.g., credit bureau report)

o Personal information associated with fraudulent activity, such as an invalid address and phone number

o There is a request for additional authorized users for the account or a request for new, additional, or replacement cards shortly after a request for a change of address

o When the account is being used after being inactive for a long time

o Mail is returned repeatedly as undeliverable even though transactions on the account continue to be conducted

ID Theft Program Requirements  The program must be risk-based and appropriate to the size and complexity of the institution, as well as the nature and scope of its activities.

 The credit union’s board of directors or a board committee must approve the initial program.

 The board, any appropriate committees, or a designated a senior management employee must be involved in the oversight, development, implementation and continued administration of the program;

 Staff must be trained as necessary to effectively implement the program

 The credit union must exercise appropriate oversight of any service provider arrangements to ensure that vendors have policies and procedures in place to detect, prevent and mitigate the risk of ID theft.

 Every program must contain “reasonable policies and procedures” to:

o Identify relevant red flags and incorporate them into the program

o Detect red flags that have been incorporated into the program

o Respond appropriately to any red flags that are detected to prevent and mitigate identity theft.

o Ensure the program is updated periodically

Change of Address Requests for Card Issuers  Credit unions must assess the validity of change of address requests.

 Validation is required when a card issuer receives a change-of-address notice and then, within a short period of time (at least 30 days) afterwards receives a request for an additional or replacement card.

 The card issuer is prohibited from issuing a new card unless it takes steps to assess whether the change of address is valid, such as:

o Notifying the cardholder at the old address

o Notifying the cardholder through some other means of communication that the cardholder has previously agreed to

o Using another method of assessing the validity of the change of address that the issuer has included in its red flag program

18 Fair Credit Reporting Act Address Discrepancies Responding to Address Discrepancy Reports  Credit unions must have reasonable policies and procedures to respond to notices of address discrepancy received from a CRA.

 The policies and procedures must be designed to enable the credit union to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report.

 The credit union can only use a consumer report if it has verified that the information actually belongs to the individual for whom the report was obtained.

Furnishing Addresses Credit unions are required maintain reasonable policies and procedures for furnishing a consumer’s address to a consumer reporting agency that the credit union has reasonably confirmed is accurate.

Prescreening Rules Credit Unions that request prescreened lists from CRAs to in order to market to consumer must follow certain rules. Notice Accompanying Prescreened Offer  A credit union that uses credit reports to make prescreened solicitations must provide notices to consumers that contain an initial prominent statement that provides basic opt-out information followed by a separate, longer explanation that provides additional details.

 The initial short notice must:

o Be a simple and easy to understand statement that the consumer has a right to opt-out of receiving prescreened solicitations

o Include a toll-free telephone number of the credit bureau(s) that the consumer may call to opt-out.

 The long notice must

o Be simple and easy to understand.

o State that information contained in the consumer’s credit report was used in connection with the offer.

o State that the consumer received the credit or insurance offer because he or she met certain criteria for creditworthiness or insurability.

19 Fair Credit Reporting Act o State that the offer may not be extended after the consumer responds to the offer if he or she does not meet the applicable criteria, including providing acceptable property as collateral.

o State that the consumer has the right to prohibit credit report information from being used with credit or insurance transactions not initiated by the consumer.

o Provide opt-out procedures.

Pre-screened Offers  A credit union must make an offer of credit to all members who pass the prescreening process.

 The offer can contain the following conditions:

o The member must first be determined to meet any specific criteria that the credit union established prior to selection.

o The member must provide proof that he or she continues to meet the criteria the credit union established prior to the prescreening process.

o The member must provide acceptable collateral if the collateral requirement was established before the prescreening was performed and the offer of credit made to the member disclosed the collateral requirement.

Record Retention  Credit unions that obtain prescreened lists, and make offers of credit based on such lists, must maintain a record of the criteria used to select the members who are to receive the offer of credit and any requirements for furnishing collateral as a condition for the extension of credit.

 This information must be maintained for a three-year period beginning on the date the offer of credit is made.

Medical Information  Certain restrictions apply to medical information contained in consumer reports.

 Medical information includes information that was created or derived from:

o A health provider or consumer that relates to the past, present, or future physical, mental, or behavioral condition of an individual

o The providing of health care to an individual

o The payment or provision of health care to an individual

 Medical information includes consumer report information related to medical debts.

 The definition of medical information does not include the age or gender of the consumer, demographic information about the consumer, or any other information that does not relate to the physical, mental or behavioral health or condition of the consumer, including the existence or value of any insurance policy.

Prohibitions  Credit unions may obtain and use medical information in determining credit eligibility if the following three requirements are met:

o The information relates to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of the proceeds.

o The credit union uses the information in a manner and to an extent no less favorable than it would use comparable information that is not medical information in a credit transaction. (Medical expenses or income may be treated more favorably.)

o The credit union does not take the consumer’s physical, mental, or behavioral, condition or history, type of treatment, or prognosis into account as part of any credit eligibility determination.

 A creditor may obtain such information in connection with determining credit eligibility if it is received unsolicited.

 Any unsolicited medical information the creditor receives cannot be used for later credit eligibility determinations.

 Additional exceptions under the rule include:

o Determining whether the use of a power of attorney or legal representative is necessary and appropriate. 21 Fair Credit Reporting Act o Complying with applicable requirements of local, state, or federal laws.

o When such information is included in a consumer report from a credit bureau, as permitted under the FCRA, and is used for the purpose for which the consumer provided written consent.

o For fraud prevention and detection.

o Verifying the medical purpose of a loan and use of proceeds with regard to financing of medical products or services.

o If the consumer or the consumer’s legal representative requests in writing, on a separate form signed by the consumer or legal representative, that the creditor use specific medical information in determining credit eligibility to accommodate the consumer’s particular circumstances.

Disposal of Records  Credit unions must maintain appropriate measures to properly dispose of consumer information derived from consumer reports.

 These measures may be implemented in conjunction with Information Security measures required by the NCUA’s Guidelines for Safeguarding Member Information.