alerts & publications
The CFPB’s Examination Procedures for the Credit Reporting IndustryOctober 16, 2012
The CFPB’s credit reporting industry examination procedures, while focused primarily on Fair Credit Reporting Act compliance, also allow the examiner to assess compliance with other consumer finance law provisions.
The Issue: In advance of the September 30, 2012 effective date of the Consumer Financial Protection Bureau’s (CFPB) final regulation subjecting entities in the industry to its examination powers, the CFPB released the procedures by which its agents will conduct examinations of credit reporting businesses. Firms can be subject to such examinations if they (a) collect, analyze, maintain or provide information used to decide whether to offer or provide any consumer financial product or service, and (b) have more than $7 million in annual receipts from such activities. Such firms can include credit bureaus that collect information and firms that store, analyze and/or resell the collected information. The examination procedures are intended to “allow examiners to develop a thorough understanding of the regulated entity’s practices and operations” and meet the following objectives:
- To evaluate the quality of the regulated entity’s compliance management systems, including its internal controls and policies and procedures, related to its consumer reporting business.
- To identify acts or practices that materially increase the risk of violations of federal consumer financial law in connection with consumer reporting.
- To gather facts that help to determine whether a regulated entity engages in acts or practices that violate the requirements of federal consumer financial law.
- To determine, in accordance with CFPB internal consultation requirements, whether a violation of federal consumer financial law has occurred and whether further supervisory or enforcement actions are appropriate.
To complete an examination, the examiner may review materials such as the firm’s consumer complaints, process flowcharts, management reports, policies and procedures, telephone recordings, compliance checklists, monitoring reports, compensation policies, third party contracts and advertisements; interview the firm’s employees and/or customers; and test of a statistically appropriate sample of transactions. Certain examination focuses are discussed below.
Fair Credit Reporting Act jurisdiction: The Fair Credit Reporting Act (FCRA) defines most of the legal obligations of consumer reporting firms. Accordingly, as a first step the CFPB asks whether the entity is subject to FCRA. In the rare case that the entity is subject to the above examination powers, but it is not subject to FCRA, examiners are directed to consult with the CFPB’s headquarters to tailor a customized examination. The examiners are asked to pay special attention to methods used to evade FCRA’s jurisdiction and to scrutinize the entity’s service providers and affiliates.
Accuracy of the consumer information: Because FCRA requires the use of reasonable procedures to assure maximum possible accuracy of the information maintained on consumers, the examiner’s review will include, inter alia, (a) assessing how the firm screens parties that provide it with information, (b) reviewing procedures used to audit the accuracy of information, (c) reviewing how the firm investigates notifications by consumers disputing the information, and (d) determining how quickly the firm deletes incorrect information.
Whether accurate but prohibited information is provided: FCRA requires the inclusion of certain information in consumer reports while prohibiting the inclusion of certain other information. The manual provides a detailed checklist of these rules.
Whether information is provided to an improper party: Because FCRA provides that consumer information can be shared only with certain parties, for certain permissible purposes, examiners are directed to scrutinize compliance with this rule by inquiring into how the firm verifies (a) the identity of persons receiving the information, and (b) the use of that information. Consumers have a right to request copies of their information, and the examinations focus particularly on how the consumer’s identity is validated and whether the consumer is provided a summary of rights along with the information. Compliance with the Gramm-Leach-Bliley provisions creating obligations with respect to the disclosure of personal information are also assessed.
Identity theft: The manual provides a checklist to assess compliance with FCRA’s provisions designed to identify and mitigate the harm of identity theft.
Additional procedures relating to certain types of reports: Particular examination procedures are used if (a) the firm provides information on a “pre-screened” basis (e.g. providing buyers with a list of consumers meeting specifications identified by the buyer), (b) the firm provides reports for employment purposes, or (c) the firm provides “investigative” consumer reports (e.g. providing reports that include information obtain through interviews with the consumer’s neighbors or coworkers).
Other: On September 25, 2012, the CFPB published a report highlighting the discrepancy between credit scores reported to consumers and those reported to lenders. The CFPB stated that “even small variations can have large impacts for certain consumers,” suggesting that it will also note the issue during examination.
Implications: The precise nature of the CFPB’s examination manual leaves little room for discretion on the part of individual examiners. A positive corollary is that firms in the consumer reporting industry have helpful notice of how they can ensure a smooth examination.
The examination procedures explicitly expand the scope of the exam beyond FCRA compliance, noting that examiners are to assess compliance with other consumer finance laws as well — such as the prohibitions against unfair, deceptive or abusive acts or practices typically found in state codes. Entities subject to a CFPB examination as a result of their credit reporting activities will find the manual to be a useful guide to the potential scope of CFPB review.
This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Brian D. Boyle, an O'Melveny partner licensed to practice law in the District of Columbia and California, Trevor Lain, an O'Melveny counsel licensed to practice law in New York and California, and Vivi Lee, an O'Melveny counsel licensed to practice law in California, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.
Portions of this communication may contain attorney advertising. Prior results do not guarantee a similar outcome. Please direct all inquiries regarding New York's Rules of Professional Conduct to O’Melveny & Myers LLP, Times Square Tower, 7 Times Square, New York, NY, 10036, Phone:+1-212-326-2000. © 2012 O'Melveny & Myers LLP. All Rights Reserved.
 77 FR 42874 (July 20, 2012), available here.
 Press Release, Consumer Financial Protection Bureau, Consumer Financial Protection Bureau releases exam procedures for consumer reporting market (Sep. 5, 2012), available here.
 12 CFR § 1090.104(b).
 CFPB Examination Procedures for Consumer Reporting Larger Participants (“Examination Manual”), at 4, available here.
 Id. at 1.
 Id. at 4-5.
 For the definitions used to determine whether an activity is subject to FCRA, see 15 USC §1681a.
 Examination Manual at 6-9.
 Id. at 10, 29-35.
 Id. at 11-15.
 15 USC § 1681b.
 Examination Manual at 16-19.
 Id. at 20-28.
 15 USC §§ 6802 et seq., as implemented by Regulation P (12 CFR §1016).
 Examination Manual at 51.
 Id. at 36-41; 15 USC §§ 1681c-1, 1681c-2.
 Id. at 42-48.
 CFPB, Analysis of Differences between Consumer and Creditor Purchased Credit Scores, Sep. 25, 2012, available here.
 Examination Manual at 1, 4; 12 USC § 5531.
Thank you for your interest. Before you communicate with one of our attorneys, please note: Any comments our attorneys share with you are general information and not legal advice. No attorney-client relationship will exist between you or your business and O’Melveny or any of its attorneys unless conflicts have been cleared, our management has given its approval, and an engagement letter has been signed. Meanwhile, you agree: we have no duty to advise you or provide you with legal assistance; you will not divulge any confidences or send any confidential or sensitive information to our attorneys (we are not in a position to keep it confidential and might be required to convey it to our clients); and, you may not use this contact to attempt to disqualify O’Melveny from representing other clients adverse to you or your business. By clicking "accept" you acknowledge receipt and agree to all of the terms of this paragraph and our Disclaimer.