How to Run a Credit Check on a Potential Customer

To run a credit check on a potential customer, first determine whether the customer is an individual or a business entity, because that single fact decides which law applies and what paperwork you need. For an individual, the Fair Credit Reporting Act controls the process: you need a permissible purpose, identifying information, and in practice a signed authorization, after which you order the report from Equifax, Experian, or TransUnion. For a business, you order a commercial report from a provider like Dun & Bradstreet with far fewer restrictions. Everything else below is the detail that keeps you compliant and gives you a usable answer about whether to extend credit.

Is the Customer an Individual or a Business?

The FCRA defines a “consumer” as an individual, and its protections apply only to reports about individuals.¹ A report on an LLC, corporation, or partnership falls outside the FCRA. Commercial bureaus will sell you a business credit report without the consent procedures and permissible-purpose rules that govern consumer reports.

In practice, many businesses extending trade credit do both: they pull the company’s commercial report and ask an owner to personally guarantee the account. The moment you check the owner’s personal credit, you’re inside the FCRA again, even though the underlying deal is B2B.

What the FCRA Requires Before You Pull a Consumer Report

A credit reporting agency can only release a consumer report to someone with a “permissible purpose.”² For businesses extending credit, that purpose is using the report in connection with a credit transaction involving the consumer, or a legitimate business need tied to a transaction the consumer initiated.

A nuance that trips people up: the FCRA does not require written consumer authorization for every credit check. Written authorization is specifically mandated for employment-purpose reports. For credit transactions, access is based on the permissible purpose itself.² That said, every major bureau requires a signed authorization form under its own policies before processing an inquiry. Treat the authorization as a non-negotiable step.

Pulling a report without a permissible purpose exposes you to civil liability under 15 U.S.C. §§ 1681n and 1681o, and to Federal Trade Commission enforcement for data mishandling.³

Information to Collect From the Applicant

For an individual, you need their full legal name, current residential address, date of birth, and Social Security number. The SSN is the identifier the bureaus use to locate the file, and a single wrong digit can pull the wrong person’s record. For a business, you need the legal entity name, address, and Employer Identification Number.⁴ A sole proprietor may use their SSN as the tax identifier.

The Authorization Form

Your form should include a clear statement that you intend to obtain a credit report, space for the applicant’s identifying information, and a dated signature line. Keep the credit disclosure focused. If a personal guarantee is involved, the guarantee language should be visually separated from the authorization so the applicant understands they are agreeing to two distinct things. Credit bureau platforms often provide compliant forms when you set up an account.

Trade and Bank References

Credit reports show how someone handled formal credit, but trade references fill gaps the bureaus don’t capture. Ask the applicant for two or three vendors they currently do business with, with account numbers and contact information, then call to verify payment patterns, average days to pay, and the credit limit extended. A bank reference will usually confirm how long an account has been open and give a general characterization of the balance. Trade references matter most for newer businesses that haven’t yet built a thick commercial file.

Getting Set Up With a Credit Bureau

For consumer reports, the three nationwide bureaus are Equifax, Experian, and TransUnion.⁵ For commercial reports, Dun & Bradstreet is the dominant provider and assigns a PAYDEX score from 1 to 100 based on trade payment data, with 80 or higher signaling low risk of late payment.⁶ Equifax and Experian also maintain commercial databases. Third-party platforms sometimes aggregate data from multiple bureaus into one report at a higher price.

A basic single-bureau consumer check might run $15 to $50. Comprehensive commercial reports with payment trend analysis typically cost more. Volume pricing and monthly subscription plans bring the per-report cost down if you run checks regularly.

Site Inspections and Credentialing

Before any bureau lets you pull consumer credit reports, you have to prove your business is legitimate and can protect sensitive data. The bureaus typically require an on-site inspection to verify basic security measures: a locking file cabinet for paper records, password-protected Wi-Fi, a paper shredder, and a dedicated workspace that isn’t shared with unrelated businesses. Inspectors also confirm your business license and that you operate from the address you provided.

Banks, credit unions, and franchised auto dealerships are generally exempt because they already operate under heavy federal regulatory oversight. Everyone else, including independent lenders, contractors offering financing, medical offices with payment plans, and general businesses extending trade credit, should plan for an inspection. Credentialing can take several weeks, so start before you have an application sitting on your desk.

Running the Check and Reading the Report

Once your account is active, the mechanics are straightforward. Log in, enter the applicant’s identifying information, upload or confirm the signed authorization, and pay the per-report fee. Consumer reports from the major bureaus typically generate within seconds. Commercial reports are usually instant for established businesses, though more detailed investigative reports can take a day or two.

The report arrives through the provider’s secure portal. Don’t email reports as unencrypted attachments, don’t forward them to colleagues without a business need, and don’t store them in shared folders without access restrictions. From the moment the report hits your system, you’re responsible for protecting what it contains.

What a Consumer Report Shows

You’ll see a three-digit credit score, a detailed history of each credit account, records of on-time and late payments, total outstanding balances, revolving credit utilization, and the age of the oldest account. Recent hard inquiries appear as well; a cluster of new ones can signal that the person is taking on debt quickly. On public records, bankruptcies are the only item that still appears on consumer reports from the nationwide bureaus, and a bankruptcy can stay on the report for up to ten years from the date the order for relief was entered.⁷ Tax liens and civil judgments were removed from consumer credit reports in 2018 and no longer appear.⁸

What a Business Report Shows

A Dun & Bradstreet report centers on the PAYDEX score, trade line payment trends, and a financial stress score estimating the likelihood of severe financial difficulty over the next twelve months.⁶ Equifax and Experian commercial reports use their own models and may include bankruptcies, liens, and judgments at the business level, since those records aren’t subject to the consumer-side removal rules.

When reviewing either report, focus on patterns more than a single number. A customer with a strong score but a recent sharp drop in payment speed is a different risk from one with a mediocre score that has been steadily improving. Use the data to set appropriate credit limits rather than treating it as a binary approve-or-reject decision. A smaller initial line, revisited after a few months of on-time payments, is often the right call.

Personal Guarantees From Business Owners

When your customer is an LLC or corporation, the business credit report alone may not give you enough confidence. A personal guarantee from an owner lets you pursue that individual’s personal assets if the business defaults. Collect the guarantor’s full name, home address, and Social Security number separately from the business application. Set the guarantee language apart from the rest of the credit application with its own signature line so there’s no ambiguity about what the person agreed to.⁹

One rule catches creditors off guard: under the Equal Credit Opportunity Act’s Regulation B, you cannot require a guarantor’s spouse to co-sign the guarantee just because they are married. If the guarantor individually meets your creditworthiness standards, asking for a spousal signature violates federal law. If the guarantor doesn’t qualify alone and you need an additional guarantor, you can require one, but you must allow anyone financially qualified to serve, not just the spouse.⁹ A narrow exception applies when the guarantee is secured by jointly owned property and state law requires both owners’ signatures to reach that property in a default.

If You Deny the Application

If you decline a credit application based in whole or in part on information from a consumer credit report, federal law requires you to send an adverse action notice. Skipping it is one of the more common compliance failures among businesses new to extending credit.

The FCRA requires the notice to include the name, address, and telephone number of the credit reporting agency that supplied the report, a statement that the agency did not make the denial decision, and a notice of the applicant’s right to request a free copy of the report within 60 days and to dispute inaccurate information.¹⁰ Regulation B separately requires specific reasons for the denial and a notice within 30 days of a completed application.¹¹ The notice must be in writing. If you give reasons orally, you must also tell the applicant they can receive those reasons in writing on request within 30 days.

You can satisfy both requirements with a single combined notice, which is standard practice. Model forms published by the CFPB with Regulation B are a solid starting point.

Keeping and Destroying Records Afterward

Regulation B requires you to retain credit application records, including the authorization form, the report, and any adverse action notice, for 25 months after you notify the applicant of your decision. For business credit applications, the retention period drops to 12 months in most cases.¹² A carve-out applies when a business applicant had gross revenues exceeding $1 million, or the credit involved trade credit or factoring: you only need to keep records for 60 days unless the applicant requests in writing that you retain them longer, extending the period to 12 months. If you learn of a regulatory investigation or lawsuit, hold everything until it’s resolved.

When retention periods expire, don’t toss reports in the recycling bin. The FACTA Disposal Rule at 16 CFR Part 682 requires reasonable measures to protect consumer information when discarding it.¹³ For paper, that means burning, pulverizing, or shredding. For electronic files, it means destroying or erasing the media so the data cannot practicably be reconstructed.¹⁴

Not every business that invoices customers qualifies. Simply deferring payment by billing at month end doesn’t make you a creditor; the trigger is regularly advancing funds or using consumer reports in credit decisions.¹⁵ If you do fall within the definition, the program needn’t be elaborate for a small operation, but it has to exist in writing and be updated periodically. Common red flags include application documents that appear altered, identification that doesn’t match the applicant’s stated information, and application addresses that don’t match the credit report.

1
Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction
2
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
3
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
4
Internal Revenue Service. US Taxpayer Identification Number Requirement
5
USA.gov. Learn About Your Credit Report and How to Get a Copy
6
Dun & Bradstreet. Business Credit Scores and Ratings
7
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
8
Consumer Financial Protection Bureau. A New Retrospective on the Removal of Public Records
9
FDIC. Guidance on the Spousal Signature Provisions of Regulation B
10
Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
11
Consumer Financial Protection Bureau. Regulation B 1002.9 – Notifications
12
Consumer Financial Protection Bureau. Regulation B 1002.12 – Record Retention
13
eCFR. Disposal of Consumer Report Information and Records
14
Federal Register. Fighting Identity Theft With the Red Flags Rule – A How-To Guide for Business