15 U.S. Code § 1681m - Requirements on users of consumer reports
(a) Duties of users taking adverse actions on basis of information contained in consumer reports
If any person takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the person shall—
(2) provide to the consumer written or electronic disclosure—
(A) of a numerical credit score as defined in section 1681g (f)(2)(A) of this title used by such person in taking any adverse action based in whole or in part on any information in a consumer report; and
(3) provide to the consumer orally, in writing, or electronically—
(A) the name, address, and telephone number of the consumer reporting agency (including a toll-free telephone number established by the agency if the agency compiles and maintains files on consumers on a nationwide basis) that furnished the report to the person; and
(4) provide to the consumer an oral, written, or electronic notice of the consumer’s right—
(A) to obtain, under section 1681j of this title, a free copy of a consumer report on the consumer from the consumer reporting agency referred to in paragraph (3), which notice shall include an indication of the 60-day period under that section for obtaining such a copy; and
(B) to dispute, under section 1681i of this title, with a consumer reporting agency the accuracy or completeness of any information in a consumer report furnished by the agency.
(b) Adverse action based on information obtained from third parties other than consumer reporting agencies
(1) In general
Whenever credit for personal, family, or household purposes involving a consumer is denied or the charge for such credit is increased either wholly or partly because of information obtained from a person other than a consumer reporting agency bearing upon the consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, the user of such information shall, within a reasonable period of time, upon the consumer’s written request for the reasons for such adverse action received within sixty days after learning of such adverse action, disclose the nature of the information to the consumer. The user of such information shall clearly and accurately disclose to the consumer his right to make such written request at the time such adverse action is communicated to the consumer.
(2) Duties of person taking certain actions based on information provided by affiliate
(A) Duties, generally
If a person takes an action described in subparagraph (B) with respect to a consumer, based in whole or in part on information described in subparagraph (C), the person shall—
(i) notify the consumer of the action, including a statement that the consumer may obtain the information in accordance with clause (ii); and
(B) Action described
(C) Information described
Information referred to in subparagraph (A)—
(i) except as provided in clause (ii), is information that—
(I) is furnished to the person taking the action by a person related by common ownership or affiliated by common corporate control to the person taking the action; and
(c) Reasonable procedures to assure compliance
No person shall be held liable for any violation of this section if he shows by a preponderance of the evidence that at the time of the alleged violation he maintained reasonable procedures to assure compliance with the provisions of this section.
(d) Duties of users making written credit or insurance solicitations on basis of information contained in consumer files
(1) In general
Any person who uses a consumer report on any consumer in connection with any credit or insurance transaction that is not initiated by the consumer, that is provided to that person under section 1681b (c)(1)(B) of this title, shall provide with each written solicitation made to the consumer regarding the transaction a clear and conspicuous statement that—
(A) information contained in the consumer’s consumer report was used in connection with the transaction;
(B) the consumer received the offer of credit or insurance because the consumer satisfied the criteria for credit worthiness or insurability under which the consumer was selected for the offer;
(C) if applicable, the credit or insurance may not be extended if, after the consumer responds to the offer, the consumer does not meet the criteria used to select the consumer for the offer or any applicable criteria bearing on credit worthiness or insurability or does not furnish any required collateral;
(D) the consumer has a right to prohibit information contained in the consumer’s file with any consumer reporting agency from being used in connection with any credit or insurance transaction that is not initiated by the consumer; and
(2) Disclosure of address and telephone number; format
A statement under paragraph (1) shall—
(A) include the address and toll-free telephone number of the appropriate notification system established under section 1681b (e) of this title; and
(3) Maintaining criteria on file
A person who makes an offer of credit or insurance to a consumer under a credit or insurance transaction described in paragraph (1) shall maintain on file the criteria used to select the consumer to receive the offer, all criteria bearing on credit worthiness or insurability, as applicable, that are the basis for determining whether or not to extend credit or insurance pursuant to the offer, and any requirement for the furnishing of collateral as a condition of the extension of credit or insurance, until the expiration of the 3-year period beginning on the date on which the offer is made to the consumer.
(4) Authority of Federal agencies regarding unfair or deceptive acts or practices not affected
This section is not intended to affect the authority of any Federal or State agency to enforce a prohibition against unfair or deceptive acts or practices, including the making of false or misleading statements in connection with a credit or insurance transaction that is not initiated by the consumer.
(e) Red flag guidelines and regulations required
The Federal banking agencies, the National Credit Union Administration, the Federal Trade Commission, the Commodity Futures Trading Commission, and the Securities and Exchange Commission shall jointly, with respect to the entities that are subject to their respective enforcement authority under section 1681s of this title—
(A) establish and maintain guidelines for use by each financial institution and each creditor regarding identity theft with respect to account holders at, or customers of, such entities, and update such guidelines as often as necessary;
(B) prescribe regulations requiring each financial institution and each creditor to establish reasonable policies and procedures for implementing the guidelines established pursuant to subparagraph (A), to identify possible risks to account holders or customers or to the safety and soundness of the institution or customers; and
(C) prescribe regulations applicable to card issuers to ensure that, if a card issuer receives notification of a change of address for an existing account, and within a short period of time (during at least the first 30 days after such notification is received) receives a request for an additional or replacement card for the same account, the card issuer may not issue the additional or replacement card, unless the card issuer, in accordance with reasonable policies and procedures—
(i) notifies the cardholder of the request at the former address of the cardholder and provides to the cardholder a means of promptly reporting incorrect address changes;
(ii) notifies the cardholder of the request by such other means of communication as the cardholder and the card issuer previously agreed to; or
(A) In general
In developing the guidelines required by paragraph (1)(A), the agencies described in paragraph (1) shall identify patterns, practices, and specific forms of activity that indicate the possible existence of identity theft.
(B) Inactive accounts
In developing the guidelines required by paragraph (1)(A), the agencies described in paragraph (1) shall consider including reasonable guidelines providing that when a transaction occurs with respect to a credit or deposit account that has been inactive for more than 2 years, the creditor or financial institution shall follow reasonable policies and procedures that provide for notice to be given to a consumer in a manner reasonably designed to reduce the likelihood of identity theft with respect to such account.
(3) Consistency with verification requirements
As used in this subsection, the term “creditor”—
(A) means a creditor, as defined in section 1691a of this title, that regularly and in the ordinary course of business—
(i) obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction;
(ii) furnishes information to consumer reporting agencies, as described in section 1681s–2 of this title, in connection with a credit transaction; or
(B) does not include a creditor described in subparagraph (A)(iii) that advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person; and
(C) includes any other type of creditor, as defined in that section 1691a of this title, as the agency described in paragraph (1) having authority over that creditor may determine appropriate by rule promulgated by that agency, based on a determination that such creditor offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.
(f) Prohibition on sale or transfer of debt caused by identity theft
(1) In general
No person shall sell, transfer for consideration, or place for collection a debt that such person has been notified under section 1681c–2 of this title has resulted from identity theft.
The prohibitions of this subsection shall apply to all persons collecting a debt described in paragraph (1) after the date of a notification under paragraph (1).
(3) Rule of construction
Nothing in this subsection shall be construed to prohibit—
(A) the repurchase of a debt in any case in which the assignee of the debt requires such repurchase because the debt has resulted from identity theft;
(B) the securitization of a debt or the pledging of a portfolio of debt as collateral in connection with a borrowing; or
(g) Debt collector communications concerning identity theft
If a person acting as a debt collector (as that term is defined in subchapter V of this chapter) on behalf of a third party that is a creditor or other user of a consumer report is notified that any information relating to a debt that the person is attempting to collect may be fraudulent or may be the result of identity theft, that person shall—
(1) notify the third party that the information may be fraudulent or may be the result of identity theft; and
(h) Duties of users in certain credit transactions
(1) In general
Subject to rules prescribed as provided in paragraph (6), if any person uses a consumer report in connection with an application for, or a grant, extension, or other provision of, credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person, based in whole or in part on a consumer report, the person shall provide an oral, written, or electronic notice to the consumer in the form and manner required by regulations prescribed in accordance with this subsection.
The notice required under paragraph (1) may be provided at the time of an application for, or a grant, extension, or other provision of, credit or the time of communication of an approval of an application for, or grant, extension, or other provision of, credit, except as provided in the regulations prescribed under paragraph (6).
No notice shall be required from a person under this subsection if—
(A) the consumer applied for specific material terms and was granted those terms, unless those terms were initially specified by the person after the transaction was initiated by the consumer and after the person obtained a consumer report; or
(4) Other notice not sufficient
A person that is required to provide a notice under subsection (a) of this section cannot meet that requirement by providing a notice under this subsection.
(5) Content and delivery of notice
A notice under this subsection shall, at a minimum—
(A) include a statement informing the consumer that the terms offered to the consumer are set based on information from a consumer report;
(C) include a statement informing the consumer that the consumer may obtain a copy of a consumer report from that consumer reporting agency without charge;
(D) include the contact information specified by that consumer reporting agency for obtaining such consumer reports (including a toll-free telephone number established by the agency in the case of a consumer reporting agency described in section 1681a (p) of this title); and
(E) include a statement informing the consumer of—
(i) a numerical credit score as defined in section 1681g (f)(2)(A) of this title, used by such person in making the credit decision described in paragraph (1) based in whole or in part on any information in a consumer report; and
Rules required by subparagraph (A) shall address, but are not limited to—
(ii) clarification of the meaning of terms used in this subsection, including what credit terms are material, and when credit terms are materially less favorable;
(iii) exceptions to the notice requirement under this subsection for classes of persons or transactions regarding which the agencies determine that notice would not significantly benefit consumers;
A person shall not be liable for failure to perform the duties required by this section if, at the time of the failure, the person maintained reasonable policies and procedures to comply with this section.
(A) No civil actions
(B) Administrative enforcement
This section shall be enforced exclusively under section 1681s of this title by the Federal agencies and officials identified in that section.
Source(Pub. L. 90–321, title VI, § 615, as added Pub. L. 91–508, title VI, § 601,Oct. 26, 1970, 84 Stat. 1133; amended Pub. L. 104–208, div. A, title II, § 2411,Sept. 30, 1996, 110 Stat. 3009–443; Pub. L. 108–159, title I, §§ 114, 154 (b), 155, title II, § 213(a), title III, § 311(a), title VIII, § 811(h),Dec. 4, 2003, 117 Stat. 1960, 1967, 1978, 1988, 2012; Pub. L. 111–203, title X, §§ 1088(a)(2)(C), (7)–(9), 1100F, July 21, 2010, 124 Stat. 2087, 2088, 2112; Pub. L. 111–319, § 2(a),Dec. 18, 2010, 124 Stat. 3457.)
2010—Subsec. (a)(2) to (4). Pub. L. 111–203, § 1100F(1), added par. (2), redesignated former pars. (2) and (3) as (3) and (4), respectively, and substituted “paragraph (3)” for “paragraph (2)” in par. (4).
Subsec. (d)(2)(B). Pub. L. 111–203, § 1088(a)(7), substituted “the Federal Trade Commission, the Federal banking agencies,” for “the Federal banking agencies”.
Pub. L. 111–203, § 1088(a)(2)(C), substituted “the Bureau” for “the Commission”.
Subsec. (e)(1). Pub. L. 111–203, § 1088(a)(8), substituted “the Federal Trade Commission, the Commodity Futures Trading Commission, and the Securities and Exchange Commission” for “and the Commission” in introductory provisions.
Subsec. (e)(4). Pub. L. 111–319added par. (4).
Subsec. (h)(5)(E). Pub. L. 111–203, § 1100F(2), added subpar. (E).
Subsec. (h)(6)(A). Pub. L. 111–203, § 1088(a)(9), added subpar. (A) and struck out former subpar. (A). Prior to amendment, text read as follows: “The Commission and the Board shall jointly prescribe rules.”
2003—Subsec. (d)(2). Pub. L. 108–159, § 213(a), amended heading and text of par. (2) generally. Prior to amendment, text read as follows: “A statement under paragraph (1) shall include the address and toll-free telephone number of the appropriate notification system established under section 1681b (e) of this title.”
Subsec. (e). Pub. L. 108–159, § 811(h), repealed Pub. L. 104–208, § 2411(c). See 1996 Amendment note below.
Pub. L. 108–159, § 114, added subsec. (e) and struck out former subsec. (e) designation that had been added with no heading or text by Pub. L. 104–208, § 2411(c). See note above and 1996 Amendment note below.
Subsec. (f). Pub. L. 108–159, § 154(b), added subsec. (f).
Subsec. (g). Pub. L. 108–159, § 155, added subsec. (g).
Subsec. (h). Pub. L. 108–159, § 311(a), added subsec. (h).
1996—Subsec. (a). Pub. L. 104–208, § 2411(a), inserted heading and amended text of subsec. (a) generally. Prior to amendment, text read as follows: “Whenever credit or insurance for personal, family, or household purposes, or employment involving a consumer is denied or the charge for such credit or insurance is increased either wholly or partly because of information contained in a consumer report from a consumer reporting agency, the user of the consumer report shall so advise the consumer against whom such adverse action has been taken and supply the name and address of the consumer reporting agency making the report.”
Subsec. (b). Pub. L. 104–208, § 2411(e), inserted subsec. heading, designated existing provisions as par. (1) and inserted heading, and added par. (2).
Subsec. (c). Pub. L. 104–208, § 2411(d), substituted “this section” for “subsections (a) and (b) of this section”.
Subsec. (d). Pub. L. 104–208, § 2411(b), added subsec. (d).
Subsec. (e). Pub. L. 104–208, § 2411(c), which added subsec. (e) containing subsec. designation, but no heading or text, was repealed by Pub. L. 108–159, § 811(h).
Effective Date of 2010 Amendment
Pub. L. 111–319, § 2(b),Dec. 18, 2010, 124 Stat. 3458, provided that: “The amendment made by this section [amending this section] shall become effective on the date of enactment of this Act [Dec. 18, 2010].”
Amendment by Pub. L. 111–203effective on the designated transfer date, see section 1100H ofPub. L. 111–203, set out as a note under section 552a of Title 5, Government Organization and Employees.
Effective Date of 2003 Amendment
Amendment by Pub. L. 108–159subject to joint regulations establishing effective dates as prescribed by Federal Reserve Board and Federal Trade Commission, except as otherwise provided, see section 3 ofPub. L. 108–159, set out as a note under section 1681 of this title.
Effective Date of 1996 Amendment
Amendment by Pub. L. 104–208effective 365 days after Sept. 30, 1996, with special rule for early compliance, see section 2420 ofPub. L. 104–208, set out as a note under section 1681a of this title.
Pub. L. 108–159, title II, § 213(b),Dec. 4, 2003, 117 Stat. 1979, provided that: “Regulations required by section 615(d)(2) of the Fair Credit Reporting Act [15 U.S.C. 1681m (d)(2)], as amended by this section, shall be issued in final form not later than 1 year after the date of enactment of this Act [Dec. 4, 2003].”