Extending Credit to a
Beware of FCRA Requirements
for Obtaining Credit Reports
by Lisa Sumner, Credit Today, June 2005
Businesses often fail to comply with the Fair Credit
Reporting Act (“FCRA”) and thereby expose themselves to civil penalties and
potential criminal liability. FCRA is a Federal statute that regulates the
activities of credit reporting agencies, those who furnish information to
credit reporting agencies, and businesses that are users of credit reports.
Frequently, a business that is considering extending credit
to a closely held corporation will want to run a credit check on related
individuals such as the business owner or guarantor. The mere fact that a
business is the source that initially requested credit is no exception to
compliance with FCRA’s requirements when the credit report of an individual is
Consider these examples of situations that can expose your
firm to claims of a FCRA violation:
Pulling the credit report on an officer of a
corporation when the corporation has applied for credit or on an individual
partner of a partnership when the partnership has applied for credit. Written
authorization from the individual or another “permissible purpose” (see below
for examples of permissible purpose) under FCRA is required.
Pulling the credit report on the spouse of an applicant
for credit or employment. Generally, FCRA does not authorize pulling a spouse’s
report unless the spouse will be liable on a credit account.
Taking a copy of an individual’s credit report that was
pulled for a permissible purpose and using it later for an impermissible
purpose (such as to identify new marketing opportunities or offer unrelated
products or services), or sharing it with someone who does not have a
Pulling the credit report of an individual to get
information useful to potential or ongoing litigation. FCRA does not list litigation
as a permissible purpose for obtaining or using a credit report. Therefore,
unless the litigation is of such a nature that one of the enumerated purposes
under FCRA applies; it is generally impermissible to pull a credit report for
use in litigation.
Examples of Permissible Purpose
Because credit reports contain confidential information
about an individual’s credit history, FCRA only allows an individual’s credit
report to be released for certain purposes. Whether obtaining a credit report
from one of the “Big Three” nationwide agencies (Experian, Equifax and Trans Union)
or a different agency or bureau, FCRA requires that you certify the purpose for
which the report is being obtained and that the report will not be used for any
Some of the permissible purposes for obtaining a consumer
credit report under FCRA include:
As instructed by the individual in writing (e.g. a
dated, written authorization designating who is to send and receive the credit
report). Such a written instruction is always sufficient to create a
permissible purpose and is sometimes the only method of pulling a credit report
in compliance with FCRA when no other permissible purpose exists. However, if a
different FCRA-enumerated permissible purpose applies, it is not always
necessary to obtain written instructions from the individual.
For the extension of credit as a result of an
application from an individual or for review or collection of the individual’s
account (e.g. “skip tracing”).
When there is a legitimate business need to review an
individual’s exiting account to determine whether her/she continues to meet the
terms of the account or to evaluate the current credit risk. This purpose may
apply to deposit or other non-credit accounts.
For employment purposes, including hiring and promotion
decisions, where the individual candidate has given prior written permission to
obtain the report.
Having a permissible purpose is not necessary when pulling a
credit report on the business entity itself. However, when you want a report on
an individual business owner, proprietor, officer, partner, guarantor or
spouse, in addition to the business report, you are required to have a
permissible purpose or written authorization.
The prudent practice is to obtain an individual’s written
authorization prior to pulling a credit report whenever possible, even if
another permissible purpose exists under FCRA. Obviously, obtaining such
authorization is impractical for purposes such as collection of an existing
credit account in default. In other situations, though, having a record
evidencing the individual’s consent will be of tremendous benefit in defending
against claims that there was no permissible purpose for pulling the report.
When obtained, it is advisable to retain written authorization
for a period of five years. The statute of limitations period for claims based
on FCRA violations is two years from the date of discovery of the violation,
but in no event longer than five years from the date of the violation.
Finally, FCRA was amended by the Fair and Accurate Credit
Transactions Act of 2003. A key reason for the amendment was to protect
consumers from identity theft. The amendment did not materially change the law
regarding obtaining and using credit reports, but you should pay renewed
attention to your procedures for ensuring that the individual for whom you seek
to pull a credit report is, in fact, the same as the individual seeking credit.