Hot Spots In Fair Credit Reporting

As September 30, 1997, the mandatory final compliance date for changes to the Fair Credit Reporting Act, looms near, there are several areas that should be resolved or revisited to ensure compliance.

Adverse Action Notices on Deposits
The 1996 amendments to FCRA included a change to the notice requirement when taking adverse action. The old notice requirement applied primarily to credit applications, but did not affect "applications" for deposit accounts. Because there were no notice requirements related to deposit accounts, banks did not need to be concerned about whether certain types of information - reports relating to activity and management of deposit accounts - were consumer reports as defined by the FCRA. Now, however, it matters very much.

The companies that report information relating to deposit accounts are consumer reporting agencies under the FCRA. It is important to note that the defined term is "consumer reporting agency", and the "c" stands for "consumer", not "credit." Thus, the legal status of information about the deposit accounts of a consumer is identical to that of information about the consumer's credit accounts. The reports relate to the consumer and the reporter is a consumer reporting agency for purposes of the FCRA. This means that when taking adverse action on a deposit account, you must give the customer a notice explaining the action taken and providing information about the consumer reporting agency.

The FCRA adverse action notice does not require you to give the consumer your reasons for adverse action. The notice requirement simply explains where you obtained the information and refers the consumer to that source. The consumer reporting agency should take it from there. This should make it easier to deal with situations where fraud is suspected. The notice you send the customer doesn't give your reason. It states that you used information from a reporting company and tells the customer how to get a copy of the report from that company.

When sending these notices, it may be useful to include information about the Fair Credit Reporting Act and consumer reports in general. The Federal Trade Commission has published a consumer information booklet on the Fair Credit Reporting Act. This booklet is available on the Internet from FTC or through the federal government's Consumer Information Center in Pueblo, Colorado - also located on the Internet. You can download it and print it on your bank's stock or you can obtain printed copies from the Center. Also, a compliance tip. Because this is both new and old - by old, we mean that examiners are familiar with the process - it would be a good idea to establish a compliance procedure for deposit notices. Examiners often match the list of credit reports requested to the list of loan applications to ensure that credit reports are being requested only for permissible purposes. It also serves as a check on adverse action notices. It is very likely that the same procedure will be used to assess compliance with the deposit notices. Therefore, it may be a good idea to maintain a log of reports pulled, and the account or adverse action file to which the report pertains. This kind of procedure will also help you measure compliance with this new procedure.

Employment
A bank may only obtain a copy of a consumer report for a permissible purpose. In addition to credit, the permissible purposes include insurance underwriting and employment. For these purposes, the bank must have the consumer's permission to obtain a copy of the report. Many employers obtain a standing permission from the employee for this purpose. The Federal Trade Commission does not prohibit the use of such a standing permission. However, Commission staff advises that in order for the standing permission to withstand scrutiny, the permission should have been clear when the employee signed it.

The ability to access an employee's consumer report can be central to an investigation of any insider crime. To ensure that your bank can have access to employee's consumer reports and withstand a challenge from that employee, it may be a good idea to renew your bank's permissions.

The process of renewing these permissions may cause some employees concern. It may be a good idea to simply present the process as a routine update of all employee files. After all, that's what it is. Place the blame on the compliance department. Compliance is used to taking the blame for thankless tasks. Using a universal process that coincides with the new effective date should help to defuse any employee concerns.

This is also an opportunity to educate your employees. Send them the same FTC information brochure that you sent to your customers. Recommend that they read it and alert them to the fact that customers may be asking questions as they receive new notices.

ACTION STEPS

Review these requirements with deposit staff, including new accounts reps and operations staff. Identify situations that call for sending adverse action notices. Design notices for these purposes.
Develop procedures and training for deposit account adverse action notices. Distribute the procedures and the notices. Conduct training.
Establish a credit report log for deposit accounts and use this log to demonstrate and monitor compliance.
Contact any companies that you use for deposit account verifications or fraud checks. Discuss the FCRA and their compliance procedures. Explain your new procedures to them and give them copies of your notices. Designate a staff contact at each company.
Review your permissions to obtain a copy of the employee's consumer report. Evaluate whether the permission was presented in a way that the employee clearly understood that they were giving permission. If the permission fails the test, obtain new permissions from all employees.