To become a data furnisher, you build a Metro 2 reporting system, put a written FCRA and Gramm-Leach-Bliley compliance program in place, and apply separately to each credit bureau you want to report to. Each bureau credentials you on its own terms, including a site inspection and a period of test file submissions, before your data goes live. Most organizations spend several months on this work before the first real file moves.
Decide Whether Direct Reporting Is Worth It
Any business that regularly extends credit or collects payments can report to Experian, Equifax, and TransUnion. Banks, credit unions, auto lenders, mortgage servicers, card issuers, collection agencies, utilities, and landlords all do it. There’s no federal license required to be a furnisher, but participation is voluntary on both sides: the bureaus decide whether to accept your data, and you decide whether the compliance load is worth the control.
Direct reporting lets you shape how your accounts appear in consumer files and helps your borrowers build credit history. In exchange, you take on every furnisher obligation the FCRA imposes: accuracy standards, dispute investigations, notification duties, and real civil liability for mistakes. If your compliance staff is thin, read the ongoing obligations section below before you commit.
Build Metro 2 Reporting Capability
All three bureaus accept data in one format: Metro 2, developed and maintained by the Consumer Data Industry Association.1Consumer Data Industry Association (CDIA). Metro 2 Format for Credit Reporting Nothing else works. If your internal systems track accounts in any other structure, you need software that converts your records into Metro 2 files.
Before shopping for software, get the Credit Reporting Resource Guide from the CDIA. The CRRG is the reference manual for Metro 2 field definitions, status codes, and reporting rules. It’s free once you create a CDIA account and agree to the Metro 2 Access Policy. Read it before you talk to vendors so you can tell whether a product actually covers what you need.
Metro 2 codes and field requirements change. Bureaus reject files that don’t match current specifications, so plan for ongoing software maintenance or a vendor subscription, not a one-time build.
Check the Bureau Volume Minimums
Each bureau sets its own minimum number of accounts before it will onboard a new furnisher. Equifax generally requires at least 500 open accounts with a balance, with exceptions for banks and credit unions (100 accounts) and some auto dealer associations (as few as 50).2Equifax. Consumer Data Furnishing TransUnion requires a minimum of 100 accounts in the first reporting month. Experian doesn’t impose a minimum volume, which makes it the most accessible bureau for smaller furnishers.
If you fall short of those thresholds at one or more bureaus, a third-party service bureau is usually the way in. More on that near the end.
Put the Required Compliance Program in Writing
Bureaus expect your compliance documentation to exist before they credential you, and regulators expect it to exist while you’re reporting. There are three pieces.
A GLBA Information Security Program
Under 15 U.S.C. ยง 6801, financial institutions must protect the confidentiality of customer records through administrative, technical, and physical safeguards.3Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information The FTC’s Safeguards Rule at 16 CFR Part 314 spells out what that looks like in practice: a written information security program appropriate to your size and the sensitivity of the data you handle.4eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information It has to address three objectives: confidentiality of customer records, protection against anticipated threats to data integrity, and prevention of unauthorized access that could cause substantial harm. In operational terms, that means encrypted storage, access controls limiting which staff can see consumer data, and documented procedures for how the data moves.
The Safeguards Rule also now requires notifying the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers.5Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Data is treated as unencrypted if an unauthorized person accessed the encryption key. Those notifications are posted publicly on the FTC’s site.
A Red Flags Identity Theft Program
If you offer or maintain covered accounts, you also need a written identity theft prevention program under the Red Flags Rule at 16 CFR Part 681. The program has to detect warning signs of identity theft, respond when they appear, and update itself as fraud techniques change.6eCFR. 16 CFR Part 681 – Identity Theft Rules If you extend credit, this almost certainly applies. It’s not a template exercise; the program should fit your specific fraud exposure.
FCRA Accuracy Policies
The FCRA requires every furnisher to maintain reasonable written policies and procedures for the accuracy and integrity of what it reports. The Furnisher Rule at 16 CFR Part 660 implements the requirement and lays out what those policies need to accomplish.7eCFR. 16 CFR Part 660 – Duties of Furnishers of Information to Consumer Reporting Agencies Your policies should cover how you verify that reported information identifies the right consumer, reflects the actual account terms, and captures payment history accurately. Furnished data must be substantiated by your own records at the time you report it, submitted in a standardized form, and updated to reflect current status.8Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies Review and revise the policies on a set cycle, and document every revision. A set of procedures written at onboarding and never touched again won’t survive regulator questions two years later.
Apply to Each Bureau Separately
Reporting to one bureau doesn’t carry over to the others. Three bureaus, three applications.9TransUnion. Data Reporting FAQs Each credentialing package typically asks for business license documentation, third-party verification of your business (bank and trade references), and proof of relevant sponsorships or affiliations.10TransUnion. Getting Started – Data Reporting Specifics differ, so contact each bureau’s data furnisher enrollment team early. Credentialing runs in weeks, not days.
Site Inspection
Credentialing typically includes an on-site inspection. A bureau representative comes to your physical location to confirm it’s a legitimate, secure operation. They look for locked file storage, secure server environments, and an office consistent with what you described in the application. A failed inspection means denial and remediation before you can reapply.
Test Files
Once you clear credentialing, you enter a testing phase. You submit sample Metro 2 files, and the bureau’s technical team checks them for formatting, code accuracy, and data integrity.10TransUnion. Getting Started – Data Reporting Corrections go back and forth until your files consistently meet the standard. Only then does the bureau move you to live production. Take the testing seriously. Errors in test files are cheap; errors in live files hit real consumer credit files.
What You’re Signing Up For After You Go Live
The work starts, not ends, at go-live. Active furnishers report on a regular cycle, usually monthly, to keep balances, limits, and payment statuses current. Stop reporting for an extended period and a bureau may deactivate your connection. When an account closes, the closure needs to show up in your next file.
Notice to Consumers Before Reporting Negative Information
Financial institutions that extend credit and furnish to a nationwide bureau have a specific duty many new furnishers miss: before or within 30 days of first reporting negative information about a customer, you must give that customer a written notice.8Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies It can ride along with a billing statement or default notice as long as it’s clear and conspicuous. Once you’ve sent the initial notice for an account, you can continue reporting additional negative information on that same account without repeating it.
Dispute Investigations
Disputes are the most time-consuming ongoing duty and the most common source of compliance failures. When a bureau forwards a dispute, you have to investigate, review what the consumer provided, and report your findings back within the same 30-day window the bureau has to resolve it. If the consumer sends more information during that window, the timeline extends by 15 days.11Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report If your investigation shows the reported information was inaccurate or incomplete, you must correct it at every bureau that received it, not just the one that flagged the dispute.
Most bureau-routed disputes flow through e-OSCAR, a web-based system for exchanging dispute information between furnishers and the bureaus. Registration costs a one-time, non-refundable fee of $90.12e-OSCAR. Billing and Finance Staff the queue with people who can actually respond in time. Miss the deadline and the bureau must delete the disputed information from the consumer’s file.
Consumers can also send disputes directly to you. Your investigation duty covers account liability, account terms like balance or credit limit, and payment performance. You aren’t required to investigate direct disputes about identifying information, public records, inquiries, or disputes submitted by credit repair organizations. You have 30 days to investigate and report back. If you conclude a dispute is frivolous, you have five business days to tell the consumer.
Understand the Liability Before You Start
The FCRA creates two tiers of civil liability. For willful violations, a consumer can recover statutory damages between $100 and $1,000, plus punitive damages at the court’s discretion, plus attorney’s fees.13Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance For negligent violations, the consumer recovers actual damages and attorney’s fees.14Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
The per-consumer numbers are small, but the exposure isn’t. A systemic coding error touching hundreds of accounts creates hundreds of potential claims, and courts have allowed FCRA class actions. Punitive damages in willful cases have no statutory cap. The CFPB and FTC can also bring enforcement actions against furnishers who don’t maintain reasonable accuracy policies or respond to disputes. The compliance program you build before you start reporting is the main protection against all of it.
When a Third-Party Service Bureau Makes Sense
Not every business needs a direct relationship with each credit bureau. Third-party service bureaus act as intermediaries: they handle Metro 2 formatting, manage the technical connection to the bureaus, and sometimes help with dispute processing. This is often the practical path for smaller lenders, community organizations, or any business that falls below a bureau’s minimum volume threshold.
The trade-offs are ongoing fees and less direct control over transmission. And one point worth stating plainly: using a service bureau does not remove your legal obligations under the FCRA. You are still the furnisher of record, responsible for accuracy, dispute investigation, and every other duty above. The service bureau is a conduit, not a shield.