Understanding “Permissible Purpose” Under the FCRA

We are often asked when credit unions may—or may not—obtain a consumer report on a member or potential member. The federal Fair Credit Reporting Act (FCRA) restricts the use of consumer reports to safeguard consumers’ sensitive financial information. Consumer reports include traditional credit reports issued by credit bureaus, as well as reports from specialty consumer reporting agencies that provide information such as residential or tenant history, check-writing history, or employment history. Under the FCRA, any person that obtains and uses a consumer report must have a legally recognized “permissible purpose” to do so.

What is a permissible purpose? 

Section 604(a) of the FCRA (15 U.S.C. § 1681b) permits a consumer reporting agency to furnish a consumer report to a credit union when authorized in writing by the consumer to whom the report relates; or the consumer reporting agency has reason to believe that the credit union intends to use the information:

• In connection with a credit transaction (e.g., loan application) involving a consumer;
• For the review or collection of a consumer’s current account; 
• For employment purposes (including hiring and promotion decisions); 
• In connection with insurance underwriting involving a consumer; or 
• When the credit union otherwise has a legitimate business need for the information: (1) in connection with a business transaction (primarily for personal, family, or household purposes) that is initiated by the consumer; or  (2) to review an account to determine whether the consumer continues to meet the terms of the account.

Consumer reporting agencies may also release consumer reports:

• As ordered by a court or a federal grand jury subpoena;
• To determine a consumer's eligibility for a government-issued license or other benefit required by law to consider an applicant's financial responsibility or status;
• For use by a potential investor or servicer, or current insurer, in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation; and
• For use by state and local officials in connection with the determination and enforcement of child support payments or modifications.

Typical Scenarios 

Generally, when a permissible purpose exists, a consumer reporting agency may furnish a consumer report without the consumer’s specific permission or written authorization. Here are a few examples:

• When a member submits a loan application, the credit union has a permissible purpose to obtain a credit report on the member-applicant “in connection with a credit transaction involving a consumer.”  
• Likewise, a credit union has a permissible purpose to obtain a consumer report on an existing delinquent account to formulate a collection strategy. 
• And on the deposit-side, a credit union has a permissible purpose to obtain a consumer report in connection with a membership application initiated by a consumer.

Note that employers must provide written notice to the employee or prospective employee and obtain the individual’s written consent before obtaining consumer reports for employment purposes. 

What about obtaining a credit report for marketing purposes? In general, marketing is not a permissible purpose under the FCRA. However, credit unions may obtain certain consumer report information for the purpose of making “prescreened” unsolicited “firm offers of credit” under Section 604(c) of the Act (15 U.S.C. § 1681b(c)). FCRA Section 603(l) defines the term “firm offer of credit” as any offer of credit or insurance that will be honored if the consumer is determined, based on information in a consumer report, to meet the specific criteria used to select the consumer for the offer. 

The FCRA sets forth the procedures that must be followed when making unsolicited prescreened credit or insurance offers to consumers. Section 1022.54 of Regulation V (FCRA pre-screening rule) requires specific “opt-out” disclosures for prescreened solicitations. Credit unions are required to provide “layered” notices to consumers consisting of an initial, prominent statement that provides the basic opt-out information, followed by a separate, longer explanation that provides additional details. 

What if none of the above categories apply? Then the credit union may obtain a consumer’s written authorization to obtain a consumer report. A consumer’s written consent qualifies as an “instruction” that provides a permissible purpose if it clearly authorizes the issuance of a consumer report on that consumer.

For example: a consumer’s clear and specific written statement that “I authorize you to procure a consumer report on me” provides a clear authorization. However, the consumer’s signature on a form that includes the statement “I understand that where appropriate, credit bureau reports may be obtained” is more like a notification than a specific instruction from the consumer. The Federal Trade Commission’s 40 Years of Experience with the Fair Credit Reporting Act. Please work with your legal counsel on the appropriate language for your credit union's agreement(s).

Certification Requirement

The FCRA prohibits any person from obtaining a consumer report unless the person certifies to the consumer reporting agency the permissible purpose(s) for obtaining the report and certifies that the report will not be used for any other purpose. A consumer reporting agency may accept an individual certification (e.g., per credit pull) or a blanket certification (for on-going access by the credit union). This should be spelled out in your service agreement with the consumer reporting agency.

Click here to access the Compliance 101 Series for additional information on the FCRA, under “Accounts” in the Compliance Resource Library. 

Questions? Contact the Compliance Team at [email protected].