A Consumer Reporting Agency (CRA) can give a consumer report only if it meets one of these requirements:

1. There is a court order or Federal Grand Jury subpoena
2. There are written instructions from the consumer in question
3. The consumer report is for a financial institution that the CRA has reason to believe will use the report for purposes allowed by the FCRA

Financial institutions are permitted use consumer reports for any of the following purposes:

1. to extend, review, or collect credit,
2. for employment purposes,
3. for the underwriting of insurance involving the consumer,
4. to determine the consumer's eligibility for a license or other benefit granted by the government that is required by law to consider the consumer's financial responsibility,
5. for the evaluation or assessment of credit or prepayment risks associated with an existing credit obligation (by a potential investor, servicer, or current insurer),
6. if there is a legitimate business need for information.

An institution is considered to have a legitimate need for information if:

1. it has to do with a business transaction initiated by the consumer,
2. it's to review an account and determine whether the consumer is meeting the terms, or
3. it's for use by state or local officials to determine child support payments or modifications and enforcement thereof.

In order to procure an investigative consumer report, you need to meet all of the following requirements:

1. You need to "clearly and accurately" disclose that you might obtain an investigative consumer report to the consumer.
2. The disclosure has to contain a statement of the consumer's right to request other information about the report and a summary of their rights under the FCRA.
3. You need to mail the written disclosure or deliver it by other means to the consumer within 3 business days of the request for the report.
4. You have to certify to the CRA that you have complied with the disclosure requirements and will comply if the consumer requests additional disclosures about the report.

The lists can only contain:

1. The name and address of the consumer
2. An identifier that isn't unique to the consumer and is used solely to verify the identity of the consumer.
3. Information pertaining to a consumer that doesn't identify what relationship or experience the consumer has with a particular creditor (or any other entity).

Thankfully, there are some exceptions to the definition of a consumer report that allow financial institutions to share this type of information without becoming a CRA. Communicated information will not qualify as a consumer report as long as it meets one of the following requirements:

1. The report only contains information about transactions or experiences between the consumer and the person making the report. If the information is strictly related to your own transactions or experiences with a consumer, you may share it with any third party without regard to affiliation. (However, this kind of information may still be restricted by the GLBA if it qualifies as "nonpublic personal information.")
2. You're communicating about transaction or experience information among financial institutions that are related by common ownership or affiliated by corporate control.
3. You're communicating other information that would usually be considered a consumer report among persons related by common ownership or affiliated by corporate control. However, you have to clearly disclose to the consumer that the information will be communicated among these entities, and the consumer must be given the opportunity to opt-out before you share the information.
4. You're communicating about a specific extension of credit (directly or indirectly)if you're the issuer of a credit card or similar. This allows a consumer to complete a transaction using a credit card by enabling a lender to communicate an authorization through the credit card network to a retailer.
5. Any report in which you convey a decision about a request by a third party to make a specific extension of credit to a consumer. (The third party in question has to tell the consumer your name and address, and they have to make any adverse action disclosures as required by the FCRA.)
6. If you're using a consumer report, you may share information if you and another user are jointly involved in a decision to approve a consumer's request for a product or service as long as you both have permissible purpose in obtaining the consumer report.

The financial information exception allows a creditor to obtain and use medical information in connection with a consumer's eligibility for credit if they meet all of the following requirements:

1. It is the type of information usually used in determining eligibility for credit. (This includes information about debts, expenses, income, benefits, assets, collateral, the purpose of the loan, and use of the loan proceeds.)
2. The outcome is just as favorable as it would be if using comparable, non-medical information.
3. The creditor doesn't take physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account as part of any determination.

A creditor cannot disclose medical information to an affiliate (exclusions to the definition of a "consumer report" do not apply). If medical information is shared, the creditor will no longer meet the qualifications to be exempt from being defined as a CRA, and they will become subject to the numerous FCRA requirements that are specific to CRAs.

The only exceptions for sharing medical information with affiliates are as follows:

1. In connection with insurance or annuities.
2. For any permitted reason that doesn't require authorization under HIPPA.
3. For any purpose referred to in Section 1179 of HIPPA.
4. For any purpose described in Section 502(e) of the Gramm-Leach-Bliley Act.
5. When dealing with a consumer's eligibility for credit if it is consistent with the financial information exceptions or other specific exceptions.
6. As otherwise permitted by order of the CFPB.

1. To determine if a consumer has experienced a medical condition and whether another individual has Power of Attorney or can act as a legal representative for them.
2. If it complies with applicable requirements of local, state, or Federal laws.
3. To determine, at a consumer's request, whether they qualify for a legally permissible special credit program or credit-related assistance program.
4. To prevent or detect fraud.
5. To determine and verify the medical purpose of a loan and the use of the proceeds if the credit is for financing medical products or services.
6. If a consumer (or their legal representative) requests that a creditor use medical information to evaluate the consumer's eligibility for credit in order to accommodate the consumer's particular circumstances. (This exception does not require a creditor to make such an accommodation or grant a loan that is not consistent with safe and sound banking practices.)
7. To determine if a forbearance practice or program that is triggered by a medical condition or event applies to a customer. (This does not require the creditor to grant forbearance but provides an exception so creditors can consider medical information in these instances.)
8. To determine whether a consumer is eligible for the triggering or reactivation of a debt cancellation contract or debt suspension agreement if a medical condition or event is a trigger.
9. To determine a consumer's eligibility for the triggering or reactivation of a credit insurance product if a medical condition or event is the trigger.

You are not allowed to use eligibility information you've received from an affiliate about a consumer for marketing purposes unless all of the following apply:

1. You give the consumer a clear and conspicuous written disclosure in a concise notice that such information may be used to make solicitations. (You can only give this notice electronically if you have the consumer's permission.)
2. You give the consumer the opportunity and a reasonable and simple method to opt out.
3. The consumer does not opt out.

Additionally, an affiliate who has a pre-existing business relationship with the consumer has to be the one to provide this notice.

You are making a solicitation for marketing purposes if any of the following apply:

1. You receive eligibility information from an affiliate in any way
2. You use that information to identify a consumer or type of consumer to receive a solicitation, establish criteria to select a consumer to receive a solicitation, or decide which of your products or services to market to a consumer or tailor a solicitation to that consumer.
3. A consumer receives a solicitation as a result of your use of their eligibility information.

• If you give a consumer a menu of alternatives to prohibit solicitations, at least one of the options must allow the consumer to prohibit all solicitations from all affiliates covered by the notice.
• If you have a continuing relationship with a consumer, an opt-out notice might apply to eligibility information obtained from one or more continuing relationships, or even future relationships, if the notice adequately describes the relationships that would be covered.
• Let's say that a consumer establishes a new relationship with you after a previous relationship was terminated. If they chose to opt-out in their previous relationship, but opt-in for the current relationship, the opt-out still holds for any eligibility information from the previous relationship.
• If you receive a consumer's eligibility information in connection with a transaction, and there is no continuing relationship, an opt-out notice you provide to the consumer only applies to eligibility information in connection with that transaction.

You are exempt from the rule if you use eligibility information received from an affiliate for any of the following purposes:

1. To make a solicitation to a consumer the person already has an existing relationship with.
2. For communications to a consumer who you provide employee benefit or other services for by contract with their employer.
3. To perform services on behalf of an affiliate (as long as the consumer hasn't opted out).
4. After you receive a consumer's communication about your products or services. (The communication must be initiated by the consumer.)
5. In response to a consumer's authorization or request to receive solicitations.
6. If compliance with the regulation would prevent you from complying with State insurance laws pertaining to unfair discrimination.

• A consumer can opt-out at any time.
• The opt-out must be effective for at least five years after the opt-out election is implemented unless the consumer revokes the opt-out in writing or electronically. This includes each opt-out renewal.
• After the opt-out period expires, you must give the consumer a renewal notice and the opportunity to opt-out again.
• The renewal notice has to be provided by the same affiliate that provided the previous opt-out notice. If the previous notice was provided jointly by affiliates, the renewal notice can be provided by a part of the group of affiliates.
• You can give the renewal notice to a consumer either a reasonable period of time before the expiration of the opt-out period or any time after the expiration of the opt-out period. However, you need to provide the renewal notice before you make any solicitations to the consumer that would have been prohibited by the expired opt-out.

There are four methods you can use to deliver the opt-out notice:

1. Hand delivering a printed copy
2. Mailing a printed copy to the consumer's last known address
3. Providing an email notice (only if the consumer has agreed to receive electronic disclosures)
4. Posting the notice on you website and requiring the consumer to acknowledge receipt of the notice before they can obtain a product or service electronically.

There are two alternative methods provided by the rule you can use to determine if you need to give a consumer a Risk-Based Pricing Notice.

1. The credit score proxy method – You can determine a cutoff score that represents the point where approximately 40% of your consumers have higher credit scores and 60% have lower credit scores. You then need to give the risk-based pricing notice to every consumer with a lower credit score than the cutoff. There is also an alternative that allows you to set a different cut off if, based on their historical experience, more than 40% of consumers receive the most favorable terms.
2. The tiered pricing method – You can assign consumers to a number of pricing tiers based on their consumer report. If you're using four or fewer pricing tiers, you would need to provide a risk-based pricing notice to all consumers who aren't qualified for the top tier. If you're using five or more tiers, you would need to provide the notice to all consumers that don't qualify for the best-priced tiers.

If you make a decision to increase the consumer's APR based on their consumer report after a review of their account, you need to send them an account review risk-based pricing notice.

If you have provided credit jointly to two or more consumers, you need to provide a risk-based pricing notice to each consumer. If the consumers have the same address and there is no credit score included, you only need to provide a single notice. If credit scores are included, you need to give each consumer a separate notice containing their own credit score. The same goes for the credit score disclosure exception notice.

You do not need to send the Risk-Based Pricing Notice if any of these apply:

1. The consumer specifically applied for the material terms of credit and received them, i.e. you didn't specify the terms after obtaining a consumer report.
2. You have provided an adverse action notice.
3. You made a firm offer of credit in a prescreened solicitation, even if you've made more favorable offers of credit to other consumers.
4. You provide a credit score disclosure to each consumer that requests a loan.
5. If you otherwise provide a credit score disclosure to each consumer, but the consumer's credit score was not available.

If anyone other than a CRA provides information that leads to a creditor taking adverse action, the creditor must 1) clearly and accurately disclose that the consumer has a right to make a written request for the reasons behind the adverse reaction within 60 days after learning of the adverse action and 2) disclose the nature of the information within a reasonable time period after receipt of a written request from the consumer.

The same rules apply if 1) the third party is related by common ownership or affiliated by common corporate control to the creditor and 2) the information given is not related to transactions or experiences between the consumer and the third party. However, the creditor needs to disclose the nature of the information within 30 days of a written request from the consumer instead of 60.

• A notice containing information about the adverse action
• A disclosure containing 
  • the credit score in the consumer report used to make the decision
  • the range of possible credit scores
  • all of the key factors that adversely affected the credit score of the consumer in the model used (no more than 4 key factors listed)
  • the date on which the credit score was created; and
  • the name of the person or entity that provided the credit score or credit file upon which the credit score was created.
• The name, address, and phone number of the CRA the report was obtained from
• A statement that the CRA didn't make the decision and is unable to provide the reasoning behind the decision
• A notice of the consumer's right 
  • to obtain a free copy of their consumer report from the CRA (including the 60-day period for which this applies)
  • to dispute the accuracy or completeness of any information in the consumer report with the CRA

The disclosure also needs to contain all of the following information:

1. the credit score
2. the range of possible scores
3. the date the score was created
4. the "key factors" used in the calculation.

If you use an automated underwriting system to generate a credit score, you can satisfy the disclosure requirement by using a score and key factors supplied by CRA.

Key factors are relevant factors that adversely affect the credit score of a consumer, such as amounts owed or credit history length. They are listed in order of how much they impacted the credit score, and no more than four can be disclosed. However, if one of the factors is the number of inquiries into a consumer's credit then the number is increased to five.

Before taking any adverse action based on the consumer report, you must give the consumer a copy of the report and a description of their rights under the FCRA section (609(c)). If the consumer had applied by any means other than in person, and there was never an in person interaction, the description of their rights will be under FCRA section 615(a). You must also provide a notice that an adverse action has been taken based on their consumer report within 3 business days, which must include all of the following information:

1. the name, address, and phone number of the CRA that provided the consumer report
2. that the CRA was not responsible for the decision and can't provide reasons why the action was taken to the consumer
3. that the consumer can request a free copy of their report and dispute the accuracy or completeness of the information in the report with the CRA if they provide the proper identification.
   (If the consumer does request a copy of the report, the report must be sent within 3 business days of the request along with a copy of the consumer's rights under section 609(c)(3).)

• A NCRA (Nationwide Consumer Reporting Agency) must give you notice of address discrepancy if the address you provide in your request for a report is substantially different from the address the NCRA has in the consumer's file.
• If you're a furnisher, you need to confirm that an address is correct before giving it to an NCRA.
• Your policies and procedures for giving a consumer’s address to an NCRA have to require you to give the confirmed address as part of the information you regularly furnish to the NCRA during the reporting period when you establish a continuing relationship with a consumer.
• If you receive a notice of address discrepancy, you have to develop and implement policies and procedures that allow you to make sure a consumer report is actually related to the consumer whose report was requested.
• You have a duty to ensure that the information you supply to CRAs is reasonably accurate, and you must establish written policies and procedures to that end.
• If you furnish information regarding an account holder to a CRA regularly and in the usual course of business, you must notify the CRA of any voluntary account closure as part of the regularly furnished information.
• You must notify the CRA of the month and year of the commencement of a delinquency no later than 90 days after originally supplying the information about a delinquent account.
• Upon receiving notice of possible identity theft, you are required to establish and follow procedures to ensure you don't re-report the information and "re-pollute" the victim's consumer report.
• You are required to provide consumers with a negative information notice either before or within 30 days of reporting negative information to a NCRA.

If you receive a notice of dispute from a CRA, you need to perform all of the following duties:

1. conduct an investigation about the information that was disputed,
2. review the information the CRA provided with the notice, and
3. report the results to the CRA.

If you find that the information was incomplete or inaccurate over the course of the investigation, those results need to be reported to all NCRAs you have given information to in the past. If the information is incomplete, inaccurate, or isn't verifiable, you need to modify, delete, or permanently block the reporting of the piece of information.

All aspects of the investigation, including reports, are due within 30 days. If the CRA receives additional information from the consumer, this may be extended by a further 15 days.

A direct dispute is any dispute by a consumer relating to:

1. the consumer's liability for credit or other debt with you, such as identity theft or fraud,
2. the terms of credit or other debt with you,
3. the consumer's conduct concerning an account or relationship with you, or
4. any other information regarding an account or relationship with you that would be in a consumer report.

Direct dispute requirements do not apply if the dispute is submitted by a credit repair organization, prepared for the consumer by a credit repair organization, or submitted on a form supplied by a credit repair organization.

1. Conduct an investigation on the disputed information.
2. Review the information provided in the dispute notice.
3. Complete the investigation and report the results to the consumer within 30 days.

If the information is found to be inaccurate, notify the CRAs that the information has been given to and provide correction.

The consumer's direct dispute notice must include all of the following:

1. information to identify the account or relationship in dispute,
2. what specific information is being disputed and the basis for the dispute,
3. all supporting documentation you might require to substantiate the basis of the dispute.

A dispute does not apply to you if it relates to:

1. name, DOB, SSN, phone number, or address,
2. identity of employers,
3. public record information,
4. fraud or active duty alerts, or
5. information given to a CRA by a different furnisher.

You are only required to investigate if a dispute notice is submitted by the consumer at your specified address. If you don't have a specified address, the dispute notice may be submitted to any of your business addresses.

Additionally, if you reasonably determine that a dispute is frivolous or irrelevant, you are not required to investigate. You can reasonably determine that a dispute is frivolous or irrelevant if:

1. insufficient information was provided by the consumer in the notice,
2. the dispute is substantially the same as a previously submitted dispute which you have already followed the requirements for, or
3. you are not required to investigate because the dispute does not apply to you for one of the other reasons listed above.

If there is a fraud or active duty alert on a consumer report, you are required to verify a consumer's identity before establishing a new credit plan or extension credit, issuing an additional card on an existing account, or increasing the credit limit.

Additionally, you are required to provide records of fraudulent transactions to victims of identity theft, any law enforcement agency or officer specified by the victim in the request, or any law enforcement agency investigating the identity theft that was authorized to receive the records by the victim. If a consumer who is the victim of identity theft makes a written request for records of fraudulent transactions, you are required to provide the records at no charge within 30 days of receipt of the request. Before disclosing the information, you must verify the consumer's identity by government-issued ID card, personally identifying information of the same type that was provided to you by the unauthorized person, or personally identifying information that you typically request for new transactions. You can also elect to require the victim to provide proof of an identity theft complaint.

You are not required to provide any information if any of the following is applicable:

1. Section 609(e) doesn't require it
2. You don't have confidence in knowing the true identity of the requestor based on the ID/proof provided.
3. The requester misrepresents the facts
4. The requested information is internet navigational data or similar about a your institution's visit to a website or online service