Extending Credit to a Business?

Beware of FCRA Requirements for Obtaining Credit Reports

-         by Lisa Sumner, Credit Today, June 2005

 

 

Businesses often fail to comply with the Fair Credit Reporting Act (“FCRA”) and thereby expose themselves to civil penalties and potential criminal liability. FCRA is a Federal statute that regulates the activities of credit reporting agencies, those who furnish information to credit reporting agencies, and businesses that are users of credit reports.

 

Frequently, a business that is considering extending credit to a closely held corporation will want to run a credit check on related individuals such as the business owner or guarantor. The mere fact that a business is the source that initially requested credit is no exception to compliance with FCRA’s requirements when the credit report of an individual is pulled.

 

Consider these examples of situations that can expose your firm to claims of a FCRA violation:

q       Pulling the credit report on an officer of a corporation when the corporation has applied for credit or on an individual partner of a partnership when the partnership has applied for credit. Written authorization from the individual or another “permissible purpose” (see below for examples of permissible purpose) under FCRA is required.

q       Pulling the credit report on the spouse of an applicant for credit or employment. Generally, FCRA does not authorize pulling a spouse’s report unless the spouse will be liable on a credit account.

q       Taking a copy of an individual’s credit report that was pulled for a permissible purpose and using it later for an impermissible purpose (such as to identify new marketing opportunities or offer unrelated products or services), or sharing it with someone who does not have a permissible purpose.

q       Pulling the credit report of an individual to get information useful to potential or ongoing litigation. FCRA does not list litigation as a permissible purpose for obtaining or using a credit report. Therefore, unless the litigation is of such a nature that one of the enumerated purposes under FCRA applies; it is generally impermissible to pull a credit report for use in litigation.

 

Examples of Permissible Purpose

Because credit reports contain confidential information about an individual’s credit history, FCRA only allows an individual’s credit report to be released for certain purposes. Whether obtaining a credit report from one of the “Big Three” nationwide agencies (Experian, Equifax and Trans Union) or a different agency or bureau, FCRA requires that you certify the purpose for which the report is being obtained and that the report will not be used for any other purpose.

 

Some of the permissible purposes for obtaining a consumer credit report under FCRA include:

q       As instructed by the individual in writing (e.g. a dated, written authorization designating who is to send and receive the credit report). Such a written instruction is always sufficient to create a permissible purpose and is sometimes the only method of pulling a credit report in compliance with FCRA when no other permissible purpose exists. However, if a different FCRA-enumerated permissible purpose applies, it is not always necessary to obtain written instructions from the individual.

q       For the extension of credit as a result of an application from an individual or for review or collection of the individual’s account (e.g. “skip tracing”).

q       When there is a legitimate business need to review an individual’s exiting account to determine whether her/she continues to meet the terms of the account or to evaluate the current credit risk. This purpose may apply to deposit or other non-credit accounts.

q       For employment purposes, including hiring and promotion decisions, where the individual candidate has given prior written permission to obtain the report.

 

Having a permissible purpose is not necessary when pulling a credit report on the business entity itself. However, when you want a report on an individual business owner, proprietor, officer, partner, guarantor or spouse, in addition to the business report, you are required to have a permissible purpose or written authorization.

 

The prudent practice is to obtain an individual’s written authorization prior to pulling a credit report whenever possible, even if another permissible purpose exists under FCRA. Obviously, obtaining such authorization is impractical for purposes such as collection of an existing credit account in default. In other situations, though, having a record evidencing the individual’s consent will be of tremendous benefit in defending against claims that there was no permissible purpose for pulling the report.

 

Record Retention

When obtained, it is advisable to retain written authorization for a period of five years. The statute of limitations period for claims based on FCRA violations is two years from the date of discovery of the violation, but in no event longer than five years from the date of the violation.

 

Finally, FCRA was amended by the Fair and Accurate Credit Transactions Act of 2003. A key reason for the amendment was to protect consumers from identity theft. The amendment did not materially change the law regarding obtaining and using credit reports, but you should pay renewed attention to your procedures for ensuring that the individual for whom you seek to pull a credit report is, in fact, the same as the individual seeking credit.