Data Furnisher Obligations Under the FCRA: Disputes and Liability

Data furnisher obligations under the Fair Credit Reporting Act require banks, credit unions, mortgage servicers, auto lenders, and similar creditors to report accurate account information to credit bureaus, keep written policies that support that accuracy, investigate consumer disputes on a set timeline, notify consumers when they report negative information, and honor specific protections for identity theft victims. The catch most consumers miss: you can generally sue a furnisher for mishandling a dispute investigation, but not for the underlying inaccurate reporting itself. That split runs through everything below.

Reporting Accurate Information

A furnisher may not send information to a credit bureau if it knows or has reasonable cause to believe the data is inaccurate.¹ The standard is narrower than it sounds. It kicks in when the furnisher actually knows or should know the data is wrong, not simply when a consumer disagrees with it.

Once a furnisher discovers that something it previously reported is incomplete or wrong, it must promptly notify the bureau and provide the correction, and it cannot keep sending the same flawed data in later cycles.¹ This self-correction duty runs independently of the dispute process.

Accuracy Versus Integrity

Federal regulations use two related standards. Information is “accurate” when it correctly reflects the account terms and payment behavior and identifies the right consumer. Information has “integrity” only when it is backed up by the furnisher’s own records at the time of reporting, sent in a format that minimizes errors at the bureau level, and includes any detail whose omission would be materially misleading in evaluating creditworthiness.² A technically correct balance can still fail the integrity standard if it strips out context that would change how a lender reads the account.

Delinquency Date Reporting

When an account goes to collections or is charged off, the furnisher must report the date of original delinquency to the bureau within 90 days. That date starts the seven-year clock for how long the negative item can remain on the report.³ A wrong or missing delinquency date can keep negative information on a consumer’s file longer than the law allows.

Written Policies and Recordkeeping

Every furnisher must maintain reasonable written policies and procedures to keep its reported data accurate and complete. The policies must be scaled to the company’s size and complexity, so a community credit union and a national bank face the same obligation but satisfy it differently. The regulations also require periodic review and updates so the policies keep pace with the business.⁴

A furnisher must also keep records long enough to back up the accuracy of anything a consumer later challenges through a direct dispute.⁵ Regulators looking at a furnisher’s conduct usually start here: was there a written program, and did the company actually follow it?

Investigating Consumer Disputes

Disputes reach a furnisher two ways, and both trigger investigation duties.

Disputes Filed Through a Credit Bureau

When a consumer disputes information through a bureau, the bureau forwards the dispute to the furnisher. The furnisher must review all relevant information the bureau supplies, conduct its own investigation, and report the results back.¹ A superficial file review does not count.

The investigation must be completed within 30 days. That can stretch to 45 days if the consumer submits additional information during the original window, but the extension disappears if the furnisher determines the data is inaccurate or unverifiable before the 30 days run out.⁶ If the data turns out to be wrong or incomplete, the furnisher must notify every other nationwide bureau it reported to, not only the one that raised the dispute.¹

Direct Disputes to the Furnisher

A consumer can also send a dispute straight to the company that reported the data. The furnisher must investigate direct disputes on the same timeline, unless it determines the dispute is frivolous or irrelevant.⁷ A dispute may be treated as frivolous if the consumer does not provide enough specific information to investigate, or if the submission is essentially a form letter from a credit repair company with no real facts behind it.

When a furnisher rejects a dispute as frivolous, it must notify the consumer within five business days, explain why, and identify what information would let the investigation proceed. That notice goes by mail unless the consumer has authorized another method. After completing a direct dispute investigation, the furnisher must report the results to the consumer, not only to the bureau.⁷

Notifying Consumers of Negative Information

Financial institutions that regularly extend credit and report to nationwide bureaus must notify a consumer when they furnish negative information about that consumer’s account. Negative information includes late payments, defaults, and anything else likely to hurt a credit score.¹ The notice must be written and clear enough to actually register with the consumer.

The institution may send the notice before reporting the negative information or within 30 days afterward.¹ Many lenders satisfy the rule by building the notice into their loan agreements or monthly statements. It is a one-time obligation per account, so a fresh notice is not required for each subsequent late payment on the same account.

Federal regulations provide two safe-harbor forms: Model Notice B-1 for notices sent before reporting and Model Notice B-2 for notices sent after. An institution that uses the model language is automatically deemed compliant with this obligation.⁸

Identity Theft Duties

When a consumer submits an identity theft report to a furnisher, the furnisher must stop reporting the fraudulent account to any credit bureau. It cannot resume reporting unless it later learns, or the consumer confirms, that the information is actually correct.¹ The furnisher must also keep reasonable procedures in place to prevent blocked information from being re-reported after a bureau flags an identity theft block.

Identity theft victims have the right to obtain business records related to the fraudulent transactions, including application forms and account statements. The furnisher must provide these records free of charge within 30 days of a proper request, and must also make them available to any law enforcement agency the victim designates.⁹

Once a furnisher has been notified through the identity theft block process that a debt resulted from fraud, it cannot sell, transfer for value, or place that debt for collection, and the restriction follows the debt to anyone downstream. Narrow exceptions allow a repurchase by the original seller when the buyer requires it because of the identity theft, and corporate mergers or securitization transactions are unaffected.¹⁰

Medical Debt Reporting

The CFPB tried to ban furnishers from reporting medical debt to credit bureaus, but a federal court vacated that rule in July 2025.¹¹ As of 2026, the pre-existing FCRA rules govern: medical debt can be furnished and considered in credit decisions, but the information must be coded so it does not identify the specific provider or reveal the nature of the services.¹²

Veteran medical debt gets extra protection. Nationwide bureaus cannot include medical debt from veteran hospital care or medical services if the debt is less than one year old, and they must exclude veteran medical debt that has been fully paid or settled regardless of age.¹² Accurately reported veteran medical debt may still be excluded at the bureau level under these rules.

Enforcement and Liability

Furnisher duties fall into two buckets, and the enforcement paths for each are completely different. This is where consumers most often misjudge their rights.

Who Can Sue for What

The general duty to report accurate information, laid out in subsection (a) of the statute, can only be enforced by federal agencies like the FTC and CFPB, or by state officials. Consumers cannot bring private lawsuits over inaccurate reporting itself, however egregious.¹³ A company could report a wildly wrong balance for months, and the consumer’s only recourse under subsection (a) is a regulator complaint.

The dispute investigation duties under subsection (b) work differently. If a furnisher mishandles a dispute that came through a credit bureau, the consumer can sue directly.¹³ That is why consumer attorneys almost always frame their cases around the investigation failure rather than the original reporting error. The path to court runs through subsection (b), which is also why filing a bureau dispute is a practical prerequisite before a lawsuit will go anywhere.

Damages for Willful Violations

When a furnisher willfully violates the FCRA, the consumer can recover actual damages or statutory damages between $100 and $1,000 (whichever is higher), plus punitive damages at the court’s discretion, plus attorney fees and court costs.¹⁴ The statutory floor matters. Many consumers cannot prove a precise dollar loss from a credit reporting error even when the error is obvious, and without a floor those cases would be impractical to bring.

Damages for Negligent Violations

A furnisher that negligently fails to meet FCRA requirements is liable for actual damages the consumer can prove, plus attorney fees and court costs.¹⁵ No statutory minimum, no punitive damages. The consumer must show a concrete financial loss, such as a denied mortgage, a higher interest rate, or a lost job offer, to recover anything beyond legal costs. Most successful private FCRA cases against furnishers are pleaded as willful violations for that reason.

Regulatory Penalties

When the FTC brings an enforcement action, the maximum civil penalty is $4,983 per violation, adjusted periodically for inflation.¹⁶ Per-violation penalties add up quickly in large-scale reporting failures. The CFPB has independent enforcement authority and has used it against major furnishers in recent years.

Time Limit for Filing Suit

A consumer must file an FCRA lawsuit within the earlier of two deadlines: two years after discovering the violation, or five years after the violation occurred.¹⁷ The discovery clock drives most cases because consumers often do not learn of a reporting error until they apply for credit and get denied. Even a late discovery cannot push a claim past the five-year hard cutoff from when the violation happened.

1
Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
2
eCFR. 12 CFR Part 1022 Subpart E – Duties of Furnishers of Information
3
Federal Trade Commission. Consumer Reports: What Information Furnishers Need to Know
4
Consumer Financial Protection Bureau. Reasonable Policies and Procedures Concerning the Accuracy and Integrity of Furnished Information
5
eCFR. 12 CFR Part 1022 – Fair Credit Reporting (Regulation V)
6
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
7
eCFR. 12 CFR 1022.43 – Direct Disputes
8
Legal Information Institute. 12 CFR Appendix B to Part 222 – Model Notices of Furnishing Negative Information
9
Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
10
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
11
Consumer Financial Protection Bureau. Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)
12
Federal Trade Commission. Fair Credit Reporting Act
13
Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
14
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
15
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
16
Federal Trade Commission. Consumer Reports: What Information Furnishers Need to Know
17
Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts