Are lenders required under FCRA to document the method in which an applicant authorized the lender to pull their credit in connection with an application for credit?

If it's in connection with an application for credit, then you don't need the applicant to authorize the pull under FCRA. You have a permissible purpose.

We had an auditor cite this as an issue because we didn't "collect the method in which the applicant gave their authorization".

I don't think that would be required under ECOA, right? I just can't imagine a scenario in which it would be required.

the method in which the applicant gave their authorization

That would be the consumer's oral or written request for credit.

I just can't imagine a scenario in which it would be required.

It could possibly be a state law requirement.

Ask the auditor for the cite so you can look it up. That'll shut them up or otherwise resolve the issue. There should be an app, an existing loan with a problem or some valid reason that is obvious, otherwise I'd ask "why?"

I used to get the credit bureau bill and contact different departments where the terminals were and ask to see the app, AAN, employment reason, etc. to justify getting the report. But there is no requirement that it be documents or signed off. That is why we audit and impose these controls.

@ Compliance Nut this didn't happen to be an Equifax Permissible Purpose audit did it?```````````