Fair Credit Reporting Act compliance means meeting the specific duties the FCRA assigns to your business based on its role in the consumer reporting system. There are three roles, and the rules differ for each: consumer reporting agencies that compile reports, furnishers that send data to those agencies, and users that pull reports to make decisions. Get the role wrong and you’ll miss obligations. Get the obligations wrong and you face statutory damages of $100 to $1,000 per willful violation, uncapped punitive damages, and attorney fees.
Figure Out Which Role You’re In
The same business can wear more than one hat, so start here.
A consumer reporting agency (CRA) is any entity that regularly collects or evaluates consumer information and sells reports to third parties.1Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction Equifax, Experian, and TransUnion are the obvious ones, but specialty agencies that track bank account behavior, rental history, evictions, or medical payments are CRAs too, and they operate under the same framework.2Consumer Financial Protection Bureau. What Are Specialty Consumer Reporting Agencies and What Types of Information Do They Collect
Furnishers are the companies that feed data to CRAs: banks, credit card issuers, auto lenders, collection agencies, landlords, and the like. A furnisher cannot report information it knows or has reasonable cause to believe is inaccurate, and once it learns that something it already reported is wrong, it has to notify the CRA and correct the record.3Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
Users are businesses that pull reports to make decisions. Lenders, employers, insurers, and landlords are the usual users. Pulling a report at all requires a permissible purpose, and the user must certify that purpose to the CRA.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Only Pull a Report for a Permissible Purpose
The FCRA does not allow open access to consumer files. You can only request a report for a reason the statute recognizes. The common permissible purposes are evaluating a credit application the consumer submitted, underwriting insurance, screening a rental applicant, reviewing an existing account, and employment screening with the extra consent requirements described below.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Court orders and limited government requests also qualify.
Pulling a report without a permissible purpose is itself a violation, and when someone misrepresents the purpose to get access, it crosses into criminal territory. Train anyone who orders reports to document the specific purpose for every pull.
Keep the Data Accurate and Handle Disputes
CRAs must follow reasonable procedures to ensure the maximum possible accuracy of the information they report.5Office of the Law Revision Counsel. 15 USC 1681e – Compliance Procedures The standard is reasonable procedures, not perfection, but ignoring known accuracy problems creates liability. CRAs also have to notify users and furnishers of their respective FCRA responsibilities.
When a consumer disputes something on a report, the CRA must conduct a free investigation and resolve it within 30 days of receiving notice. If the information turns out to be inaccurate or cannot be verified, the CRA has to delete or correct it.6Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy Consumers can also dispute directly with the furnisher, which triggers a parallel investigation duty on the furnisher’s side.3Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies Most day-to-day FCRA friction lives here: a lender reports a late payment, the consumer disputes it, and the lender has to actually investigate rather than rubber-stamp the original data.
Follow the Full Process for Employment Background Checks
Employment-related checks carry the strictest requirements under the FCRA, and this is where employers most often trip up. The process has two notice stages.
Before You Pull the Report
The employer must give the applicant or employee a clear written disclosure, on a standalone document, that a consumer report may be obtained for employment purposes. The person must then authorize the report in writing before it’s pulled.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The standalone requirement is strict. Burying the disclosure inside a job application or employee handbook violates the statute, and class actions have been certified over exactly that mistake.
Before You Act on What’s in It
If the report contains anything that could lead to a negative decision, such as rejecting a candidate, denying a promotion, or terminating an employee, you have to send a pre-adverse action notice first. That notice must include a copy of the report and a summary of the consumer’s FCRA rights.7Federal Trade Commission. Using Consumer Reports: What Employers Need to Know The point is to give the person a chance to review and dispute errors before you decide. Only after providing that notice and allowing a reasonable period to respond can you send the final adverse action notice.
Send Adverse Action Notices Correctly
Any user that makes a decision negatively affecting a consumer based on report information has to send an adverse action notice. This covers denying credit, raising interest rates, declining a rental applicant, and refusing insurance coverage, not just employment.8Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
Every adverse action notice has to include:
- A clear statement of the decision that was made.
- The name, address, and phone number of the CRA that supplied the report, along with a statement that the CRA did not make the decision and cannot explain it.
- If a credit score was used, the score itself, the range of possible scores under the model used, and the key factors that lowered it.
- A statement that the consumer can get a free copy of the report from that CRA within 60 days and can dispute inaccurate information.
Skipping or botching this notice is one of the most common FCRA violations. Many businesses do not realize the duty reaches beyond credit decisions into employment, insurance, and housing.
Dispose of Report Data Securely
Any business holding consumer report information, whether it’s a CRA, furnisher, or user, must take reasonable steps to protect that data when disposing of it. The FTC’s Disposal Rule describes what reasonable looks like: shredding, burning, or pulverizing paper records so they can’t be reconstructed, and destroying or erasing electronic media so the data is unrecoverable.9eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records The rule doesn’t mandate a single method, but whatever method you choose has to actually prevent unauthorized access.
What Noncompliance Costs
Penalties depend on whether the violation was willful, negligent, or criminal.
Willful Violations
When a business intentionally violates the FCRA, a consumer can recover statutory damages of $100 to $1,000 per violation without proving any actual financial harm. Courts can add punitive damages with no statutory cap, plus attorney fees and costs.10Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance For anyone who pulls a report under false pretenses or knowingly without a permissible purpose, the minimum liability is $1,000 or actual damages, whichever is greater. In class actions involving large companies, these per-violation amounts add up quickly.
Negligent Violations
If the violation was not intentional but resulted from negligence, such as sloppy procedures, untrained staff, or a missing required notice, the consumer can recover actual damages plus attorney fees and costs.11Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance There’s no statutory minimum and no punitive damages here, so the consumer has to show actual harm: a denied loan, a lost job opportunity, or emotional distress tied to the negligence.
Criminal Penalties
Knowingly and willfully obtaining a consumer report under false pretenses is a federal crime, punishable by a fine under Title 18 and up to two years in prison.12Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses This provision targets people who lie about their identity or fabricate a permissible purpose to access someone’s file.
How Long Consumers Have to Sue
FCRA suits can be brought in any U.S. district court regardless of the amount at stake. The statute of limitations is the earlier of two years from the date the consumer discovers the violation or five years from the date it occurred.13Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery rule matters: if inaccurate information has been sitting on a report for three years and the consumer only learns about it today, the two-year clock starts today. The five-year outer limit eventually time-bars even undiscovered violations, but relying on that cutoff is a bad plan when records of your compliance decisions, or lack of them, outlive the limitations window.