By Lisa Hudson Kim, Credit Union

Does Your Credit Union Measure Up to the Requirements under the Fair Credit Reporting Act (the “FCRA”)?

As lawsuits under the FCRA continue to emerge, it is worth spending some time and effort to determine whether your credit union needs to address your processes related to FCRA’s requirements and to perform some proactive housekeeping measures.

Background. The FCRA was enacted to promote accuracy, fairness, and privacy related to consumers’ credit information. See 15 U.S.C. §1681, et seq. While consumer reporting agencies (“CRAs”), such as Experian, Equifax and TransUnion have duties to ensure that they comply with FCRA’s requirements, companies, including credit unions, also have their own specific duties when reporting (also called “furnishing”) their members’ credit history to these reporting agencies, as well as duties to investigate disputed information, among other requirements under 15 U.S.C. §1681i. Failing to do so not only exposes the credit union to risks of monetary violations, it also harms members by having a negative impact on their credit scores and making it difficult to obtain credit among other challenges and impacts. 

Common Violations. Let’s take a look at some of the most common violations a credit union should focus upon while reviewing its processes to ensure compliance with FCRA’s requirements

Furnishing and reporting old information. It is a violation for credit unions to report old or outdated information to the CRAs. What is old and outdated? Examples of this would be if the information is older than seven (7) to ten (10) years old, failing to report a debt as being discharged in bankruptcy, reporting old debts as new or current debts, and reporting closed accounts as still active.

Furnishing and reporting inaccurate information. What’s the difference between reporting “old” information verses “inaccurate” information? Inaccurate information reporting includes overstating or misstating total loan balances due to the credit union, reporting a debt that has been paid off as a charge-off, reporting timely payments as late, or listing a member on an account as a debtor when they are not a debtor, such as when the member is only an authorized user of the account.

Mixed credit files. This inaccurate type of reporting happens when members may share the same first or last name or where a suffix, such as “Jr.,” “Sr.,” “III” or other such suffixes are included in the member’s name and the account is not reported under the correct member. Often, this is a misnomer or mistake of identity. Another example is when one member’s information is reported under a different member with a similar Social Security number. When this type of inaccurate reporting occurs, the incorrect member’s credit history is reported under another member’s credit history.

Failing to report an account as a disputed debt and failing to follow debt dispute procedures. Credit unions must have specific procedures in place to investigate and respond to member disputes and to report the account as disputed when applicable. Once a dispute is received, credit unions have a duty under 12 CFR §1022.43(e) to: (1) conduct a reasonable investigation with respect to the disputed information; (2) review all relevant information submitted by the consumer with  the dispute notice; (3) complete its investigation of the dispute and report the results of the investigation to the consumer before the expiration of the period under Section 611(a)(1) of the FCRA (15 U.S.C. §1681i(a)(1)) (generally, within 30 days) within which a consumer reporting agency would be required to complete its action if the consumer had elected to dispute the information under that section; and (4) if the investigation finds that the information reported was inaccurate, promptly notify each consumer reporting agency to which the furnisher provided inaccurate information of that determination and  provide to the consumer reporting agency any correction to that information that is necessary to make the information provided by the furnisher accurate.

If the credit union has a member who continues to re-send the same dispute, it may be considered a “frivolous” or “irrelevant” dispute as defined in 12 CFR §1022.43(f), giving the credit union a little relief in terms of its investigation duties. The law requires an initial response but does not require an endless loop of responses for repeated communications from complaining members when they have already been sufficiently previously addressed. 

Damages for FCRA Violations. Damages for violations of the FCRA can be costly. See 15 U.S.C. §§ 1681n; 1681o. Statutory damages can range between $100 and $1,000 even if the member doesn’t prove that the violation caused them any harm. There is no limit to punitive damages, but such damages must be decided upon by the court. There are also reasonable attorneys’ fees and court costs to prevailing plaintiffs when litigating a matter if there is no jury trial, and class action waiver and no mandatory mediation.

Where to Begin a Process Review. Conducting a review to determine compliance with FCRA’s requirements can be a daunting task. If the credit union conducts its own investigation to determine compliance, it may be difficult to know where to begin. Credit unions may want to consider developing a checklist to summarize the statutory requirements. This also helps with determining which areas within the credit union that are impacted by the FCRA’s requirements.

• The lending or servicing areas may bear the burden of ensuring the credit union accurately furnishes its member information.
• Another area may be information technology which maintains all the information programmed into the core system, including loan payment history.

While this article focuses on the most common violations, there are more requirements under the FCRA to which credit unions need to adhere:

• Does the credit union comply with the rule’s notification requirements, such as risk-based pricing and adverse action notices?
• How about disclosing the negative information notice to members?
• Even the marketing department is impacted when it makes written firm offers of credit based upon credit report information by having to comply with the prescreen opt-out notice requirements under 12 CFR §1022.54(c).
• Don’t forget about human resources, as this department has to comply with FCRA-mandated disclosure requirements.

To conduct a thorough review, it’s important to have a working knowledge of the rule’s requirements in terms of which area or department is responsible for complying with each provision of the law. Otherwise, if FCRA violations are detected, it makes it difficult to know where the violation originates in order to correct it.

Take-Aways. Some key take-aways to consider in your compliance housekeeping measures: (1) credit unions should review processes and procedures to ensure compliance with the most common types of violations addressed in this article; (2) if violations are detected, correct them – immediately; (3) don’t overlook the overall FCRA requirements that apply to the credit union, as doing so may expose the institution to a higher risk of paying monetary damages, court, attorneys’ fees, and damaging the credit union’s reputation.

Action Required. It is prudent to develop a plan sooner rather than later to ensure compliance with FCRA. Kaufman & Canoles, P.C. stands ready to assist credit unions with this compliance review exercise. To that end, we have created a FCRA checklist to assist credit unions with conducting reviews. We look forward to navigating these compliance challenges alongside of you.

The contents of this publication are intended for general information only and should not be construed as legal advice or a legal opinion on specific facts and circumstances. Copyright 2024.