No single agency regulates the credit bureaus. Oversight of Equifax, Experian, and TransUnion is split among several federal and state authorities, and the Fair Credit Reporting Act, which answers the question of who regulates the credit bureaus in the United States, gives each one a defined role. The Consumer Financial Protection Bureau has been the lead federal regulator since 2011, though its operations have been sharply curtailed in 2025. The Federal Trade Commission, federal banking regulators, and state attorneys general all share enforcement authority, and consumers can sue credit bureaus directly in federal court.
The Law Behind Every Regulator: The FCRA
Every layer of credit bureau regulation traces back to the Fair Credit Reporting Act, the federal statute that governs how consumer reporting agencies collect, maintain, and share your financial information.1Federal Trade Commission. Fair Credit Reporting Act The FCRA requires bureaus to follow reasonable procedures aimed at producing the most accurate reports possible, limits who can pull your report, caps how long negative items can appear, and gives you specific rights you can enforce when the law is broken.
A credit bureau can only release your report for a recognized reason: evaluating a credit application, underwriting insurance, screening for employment with your written consent, assessing eligibility for a government license, or fulfilling a legitimate business need tied to a transaction you initiated.2Office of the Law Revision Counsel. 15 U.S.C. 1681b – Permissible Purposes of Consumer Reports Court orders and child support enforcement agencies also qualify. Outside those categories, pulling your report is illegal.
Bankruptcies drop off after ten years. Most other adverse items, including late payments, collections, civil judgments, and paid tax liens, must be removed after seven.3Office of the Law Revision Counsel. 15 U.S.C. 1681c – Requirements Relating to Information Contained in Consumer Reports Criminal convictions have no time limit.
The Consumer Financial Protection Bureau
The CFPB became the lead federal regulator for credit reporting in July 2011, when the Dodd-Frank Act transferred rulemaking authority for the FCRA from seven federal agencies into a single bureau.4Consumer Financial Protection Bureau. Fair Credit Reporting (Regulation V) That consolidation gave the CFPB two powerful tools: supervisory authority to conduct on-site examinations of the largest credit bureaus, and enforcement authority to bring legal actions and impose civil penalties when it finds violations.
Both tools were visible in January 2025. The CFPB issued a consent order against Equifax carrying a $15 million civil penalty, finding that Equifax had routinely failed to initiate reinvestigations, had not forwarded relevant consumer information to furnishers, had improperly reinserted previously deleted items without notice, and had sent results letters that inaccurately described what the investigation found.5Consumer Financial Protection Bureau. Equifax Inc. Consent Order The same month, the CFPB sued Experian, alleging the company had failed to forward more than two million disputes to furnishers within the required five business days and had deleted over 100,000 disputed tradelines instead of investigating them.6Consumer Financial Protection Bureau. Experian Information Solutions Complaint
What’s Different About the CFPB in 2025
The bureau’s ability to continue this work is now in question. Beginning in February 2025, the CFPB’s acting leadership issued stop-work orders, closed ongoing supervisory examinations, and terminated employees, contracts, and enforcement cases. A Government Accountability Office report described these moves as an effort to fulfill the agency’s statutory duties “as a smaller, more efficient operation” in response to executive orders.7Government Accountability Office. Consumer Financial Protection Bureau: Status of Reorganization Some of those actions, including employee terminations, remain in litigation. Congress has not repealed the CFPB’s statutory authority, but the bureau’s capacity to exercise it is significantly reduced as of this writing. In practical terms, the other regulators and private lawsuits carry more weight right now than at any point since the CFPB was created.
The Federal Trade Commission
The FTC held primary enforcement authority over credit reporting before the CFPB existed, and the Dodd-Frank Act preserved all of that power even as it shifted rulemaking to the new bureau.1Federal Trade Commission. Fair Credit Reporting Act The FTC has sued credit bureaus, charged companies with furnishing inaccurate data, and gone after report users who failed to notify consumers of adverse decisions.8Federal Trade Commission. Credit Reporting With the CFPB’s supervisory capacity diminished, the FTC’s role as a backstop enforcer is more significant than it has been in over a decade.
Data Security Rules for Credit Bureaus
The FTC also sets the data security standards that credit bureaus must follow. Under the Safeguards Rule, financial institutions that handle consumer information, including consumer reporting agencies, must develop and maintain a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the data they hold.9Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Amendments effective in May 2024 added a breach notification requirement: when a security breach affects 500 or more consumers, the institution must report it to the FTC within 30 days of discovery.10Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
Banking Regulators and the Furnishers
Credit reports are only as accurate as the information fed into them, and that information comes from furnishers: banks, credit card companies, mortgage servicers, collection agencies, and other businesses that report your account activity. The FCRA bars a furnisher from reporting information it knows or has reasonable cause to believe is inaccurate, and when a credit bureau forwards your dispute, the furnisher must investigate, review all relevant information provided, and report results back. If the furnisher finds the data was wrong, it must correct the record with every nationwide bureau it reported to.11Office of the Law Revision Counsel. 15 U.S.C. 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
Federal banking regulators including the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation oversee furnisher compliance at the banks and financial institutions they supervise.12Federal Trade Commission. Consumer Reports: What Information Furnishers Need to Know This matters because a bureau-only dispute sometimes isn’t enough. If the furnisher keeps sending the same bad data, the error reappears. The furnisher has its own independent legal obligation to investigate, which gives you a second route to challenge inaccurate information.
State Attorneys General and State Laws
Federal law is the floor, not the ceiling. State attorneys general have explicit statutory authority to enforce the FCRA in federal court on behalf of their residents, and they can sue to stop violations and recover damages of up to $1,000 per willful or negligent violation, plus attorney fees.13Office of the Law Revision Counsel. 15 U.S.C. 1681s – Administrative Enforcement State AGs and state regulators can also enforce the Consumer Financial Protection Act’s prohibition against unfair, deceptive, or abusive practices by financial companies, including credit bureaus.14Consumer Financial Protection Bureau. CFPB Bolsters Enforcement Efforts by States
States also pass their own consumer reporting statutes that add protections the FCRA doesn’t provide. A CFPB interpretive rule has clarified that the FCRA’s preemption of state law is narrow: states retain broad flexibility to prohibit credit bureaus from including medical debt, eviction records, or arrest records in consumer reports, or to require that bureaus provide information in languages other than English.15Consumer Financial Protection Bureau. The Fair Credit Reporting Act’s Limited Preemption of State Laws The specifics vary by state, but consumers in states with aggressive attorneys general and strong supplementary laws have an enforcement layer that operates independently of what’s happening at the federal level.
Your Right to Sue a Credit Bureau
Filing a regulatory complaint isn’t your only option. The FCRA gives you a private right of action, meaning you can sue a credit bureau, furnisher, or report user directly in federal court without waiting for a government agency to act.
For willful violations, you can recover either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. The court can also award punitive damages in whatever amount it deems appropriate, plus your attorney fees and court costs.16Office of the Law Revision Counsel. 15 U.S.C. 1681n – Civil Liability for Willful Noncompliance For negligent violations, recovery is limited to actual damages you can prove, plus attorney fees and costs.17Office of the Law Revision Counsel. 15 U.S.C. 1681o – Civil Liability for Negligent Noncompliance The distinction matters. Willful cases can produce meaningful recoveries even when your provable financial loss is small; negligent cases require you to document specific harm like a denied loan or a higher interest rate.
You must file suit within two years of discovering the violation, or five years from the date it occurred, whichever comes first.18Office of the Law Revision Counsel. 15 U.S.C. 1681p – Jurisdiction of Courts; Limitation of Actions Because a successful plaintiff recovers reasonable attorney fees by statute, consumer rights attorneys often take FCRA cases on contingency. The bar for proving willfulness is higher than it sounds, though. A credit bureau with some dispute-handling process in place, even a flawed one, may not meet the threshold. If you’re thinking about suing, the strength of your documentation from the dispute process will be the foundation of the case.
How to File a Complaint or Check Your Reports
The most direct way to trigger regulatory attention is the CFPB’s online complaint portal, which accepts complaints about credit reports and other consumer financial products. You describe the problem, the CFPB forwards it to the company, and the company generally responds within 15 days.19Consumer Financial Protection Bureau. Learn How the Complaint Process Works In complex cases, the company may notify you that a response is in progress and provide a final answer within 60 days. The CFPB also shares complaint data with other state and federal agencies to support their supervision and enforcement.20Consumer Financial Protection Bureau. Submit a Complaint Even with the CFPB’s reduced operations, the portal has stayed functional, and a filed complaint creates a documented record that can support a later lawsuit or state AG investigation.
You can also check your credit reports regularly at no cost. The three nationwide bureaus have permanently extended a program that lets you pull your report from each bureau once a week for free through AnnualCreditReport.com. Equifax is additionally offering six free reports per year through 2026 on the same site.21Federal Trade Commission. Free Credit Reports Federal law also guarantees free credit freezes and unfreezes at all three bureaus, a right established by the Economic Growth, Regulatory Relief, and Consumer Protection Act in 2018.22Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts A freeze blocks new creditors from accessing your report, and lifting it when you need to apply for credit takes minutes online.