The Consumer Financial Protection Bureau (CFPB) recently released its Supervisory Highlights covering consumer reporting companies and furnishers. The CFPB emphasized that inaccuracies in the credit reporting system have been a long-standing issue and as such will be prioritized in examinations of consumer reporting companies (CRCs) and furnishers, such as credit unions. This compliance blog will provide an overview of these two topics.
Consumer Reporting Companies
The Fair Credit Reporting Act (FCRA) implemented by Regulation V obligates CRCs to block the reporting of any information in a consumer’s file that the consumer identifies as information that resulted from an alleged identity theft not later than four business days after the CRC receives certain documentation relating to the alleged identity theft. Examiners found that CRCs failed to timely implement blocks of information after receiving the requisite documentation relating to an alleged identity theft. Examiners also found that the CRCs instead maintained policies in which the CRCs automatically declined to block information for reasons that were not supported by the statutory bases for declining to block such information.
Additionally, CRCs are required to notify the affected consumer in the event that the CRC declines to block, or rescind a block of, information that the consumer identifies as information resulting from an alleged identity theft. CRCs failed to provide the required notice within five business days of declining to block information as well as provide the consumers with the furnisher’s contact information and/or notice regarding the consumer’s right to add a statement to the consumer’s file disputing the accuracy or completeness of the furnished information. Consequently, examiners instructed CRCs to revise their policies to ensure compliance with FCRA identity theft block obligations, complete an individualized review to determine the validity of an alleged identify theft to ensure there is a statutory basis to decline to block, and update notice templates to include the required information for consumers.
Another issue pertaining to the CRCs was their failure to follow reasonable procedures to assure the maximum possible accuracy of the consumers’ information. Specifically, the report states that CRCs “(1) failed to adequately monitor dispute metrics that would suggest a furnisher may no longer be a source of reliable, verifiable information about consumers, and (2) continued to include information in consumer reports that was provided by unreliable furnishers without implementing procedures to assure the accuracy of information provided by unreliable furnishers.” The report provided examples of how CRCs received furnisher dispute response data which indicated that furnishers failed to respond to all or nearly all disputes or responded to all disputes in the same manner. Finally, examinations found that CRCs were not providing victims of identity theft with a summary of rights containing all the information required by the CFPB in its model form as well as information about how to request more information.
Furnishers
Examiners found several issues in furnishers’ compliance with FCRA accuracy, dispute investigation and notification requirements. Examiners found that furnishers were not updating furnished information after determining that the information was incomplete or inaccurate. For example, the report stated that furnishers continued to report dates of first delinquency inaccurately for several months after determining that they were reporting inaccurately. Another example found that furnishers had failed to update the dates of first delinquency to reflect the bankruptcy filing dates after determining accounts were in a bankruptcy status.
Furthermore, examiners found that deposit furnishers continued to report fraudulent accounts to CRCs for several years after determining the accounts were fraudulent and failed to notify CRCs that the accounts should be deleted because they were fraudulent. Consequently, examiners instructed furnishers to conduct lookbacks to ensure that corrections or updates are furnished correctly, accounts are deleted if they are found to have been opened fraudulently, and policies and procedures as well as internal controls are updated to ensure that they furnish information correctly after determining that an account is it is incomplete or inaccurate.
Examiners also found that furnishers were not conducting reasonable investigations of direct disputes. According to the report, examiners found that although consumers were providing the requisite dispute notice, furnishers were not investigating a dispute because the consumer had not satisfied additional identity verification requirements required by the furnisher. However, Regulation V does not permit a furnisher to establish additional requirements beyond what the regulation requires in order to initiate a direct dispute investigation by the furnisher.
Lastly, examiners found that furnishers who received direct disputes from consumers were continuing to furnish the disputed information to CRCs without notifying the CRCs that the information was subject to dispute.
The highlights also addressed supervisory program developments which included advisory opinions regarding credit reporting and a review of public enforcement actions which included a CRC which failed to “timely place or remove security freezes and locks on the credit reports” of consumers who requested them.