Federal Mortgage Law — Fair Credit Reporting and Privacy
mlopractice study guide with diagrams.
Federal Mortgage Law — Fair Credit Reporting and Privacy
Learning Objectives
Upon completing this chapter, you will be able to:
Identify the purpose, scope, and key enforcement provisions of the Fair Credit Reporting Act (FCRA) and its implementing regulation, Regulation V (12 CFR Part 1022).
Explain the difference between a "consumer report" and an "investigative consumer report" and the distinct rules that apply to each.
Describe when a mortgage loan originator (MLO) may obtain a consumer report and the required permissible purpose under FCRA Section 604.
State the adverse action notice requirements under FCRA Section 615, including timing, content, and the requirement to provide the consumer with the name and address of the consumer reporting agency (CRA).
Apply the rules for furnishing information to CRAs, including the duty to investigate disputes under FCRA Section 623.
Understand the risk-based pricing rule and the "adverse action" versus "risk-based pricing notice" distinction.
Explain the Gramm-Leach-Bliley Act (GLBA) Privacy Rule and Safeguards Rule, including the requirement for a written information security program.
Recognize the intersection of FCRA and GLBA with the Fair and Accurate Credit Transactions Act (FACTA), including the Red Flags Rule and the disposal rule.
Identify common exam traps, including confusion between FCRA adverse action and ECOA adverse action, and the difference between a "consumer report" and a "credit score" disclosure.
1.1 The Fair Credit Reporting Act (FCRA) — Overview and Purpose
The Fair Credit Reporting Act, codified at 15 U.S.C. § 1681 et seq., is the primary federal statute governing the collection, dissemination, and use of consumer credit information. The FCRA is implemented by the Consumer Financial Protection Bureau (CFPB) through Regulation V, located at 12 CFR Part 1022. The statute was enacted in 1970 and significantly amended by the Fair and Accurate Credit Transactions Act of 2003 (FACTA).
The purpose of the FCRA is to ensure that consumer reporting agencies (CRAs) — such as Equifax, Experian, and TransUnion — adopt fair and equitable procedures for gathering, evaluating, and distributing consumer information. The FCRA also protects consumers from the unauthorized or improper use of their credit information by users of consumer reports, including mortgage lenders and brokers.
For the SAFE exam, you must know that the FCRA applies to any person or entity that uses a consumer report, furnishes information to a CRA, or acts as a CRA. A mortgage loan originator is typically a "user" of consumer reports, and in some cases, a "furnisher" when it reports loan payment history to a CRA.
Key definitions under FCRA:
Consumer report: Any communication of information by a CRA that bears on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used to establish the consumer's eligibility for credit, insurance, employment, or other permissible purpose.
Investigative consumer report: A consumer report that contains information about the consumer's character, general reputation, personal characteristics, or mode of living, obtained through personal interviews with neighbors, friends, or associates. These reports are subject to additional disclosure requirements.
Consumer reporting agency (CRA): Any person or entity that regularly assembles or evaluates consumer credit information for the purpose of furnishing consumer reports to third parties.
User: Any person or entity that requests and obtains a consumer report for a permissible purpose.
Furnisher: Any person or entity that provides information about a consumer to a CRA.
1.2 Permissible Purposes for Obtaining a Consumer Report
Under FCRA Section 604 (15 U.S.C. § 1681b), a consumer report may only be obtained for a "permissible purpose." The most relevant permissible purpose for a mortgage loan originator is when the consumer has applied for credit and the report is used in connection with the underwriting or evaluation of that application. A consumer report may also be obtained for:
A court order or written instruction from the consumer.
Employment purposes, with prior written authorization.
Underwriting of insurance.
A legitimate business need for a transaction initiated by the consumer.
Review of an existing account to determine collection activity.
Critical rule: A mortgage loan originator may NOT obtain a consumer report unless the consumer has applied for credit or otherwise initiated the transaction. Pulling a report for "pre-qualification" without a formal application is permissible only if the consumer initiated the request. However, pulling a report for marketing purposes or to "see if the consumer qualifies" without a pending application is a violation of the FCRA.
Written authorization: For mortgage loans, the consumer must provide written authorization before the MLO obtains a consumer report. This authorization is typically embedded in the loan application package. The authorization must be clear and conspicuous and must not be buried in fine print.
1.3 Adverse Action Notices Under FCRA Section 615
When a mortgage loan originator takes an "adverse action" based in whole or in part on information contained in a consumer report, the FCRA requires the user to provide an adverse action notice to the consumer. This is distinct from the adverse action notice required under the Equal Credit Opportunity Act (ECOA) and Regulation B, though the two are often combined into a single notice in practice.
What constitutes an adverse action under FCRA?
Denial of credit.
A change in the terms of credit that is less favorable than the terms originally offered.
A refusal to increase the amount of credit available.
Termination of an account.
For mortgage loans, a counteroffer that is not accepted by the consumer may also trigger the notice requirement if the original terms were denied.
Timing: The adverse action notice must be provided within 30 days of the adverse action. This is a strict deadline. For mortgage applications, if the lender denies the loan, the notice must be sent within 30 days of the denial decision.
Content of the FCRA adverse action notice:
The name, address, and telephone number of the CRA that furnished the report (note: the notice must identify the CRA, not the MLO).
A statement that the CRA did not make the adverse decision and cannot provide the specific reasons for the denial.
A statement that the consumer has the right to obtain a free copy of the consumer report from the CRA within 60 days.
A statement that the consumer has the right to dispute the accuracy or completeness of the information with the CRA.
Important distinction: The FCRA adverse action notice does NOT require the user to state the specific reasons for the denial. That requirement comes from ECOA. Under ECOA/Regulation B, the lender must provide a statement of specific reasons for the adverse action (e.g., "credit score below minimum," "debt-to-income ratio too high"). The FCRA notice focuses on the consumer's right to obtain and dispute the report. In practice, lenders combine both notices into a single document.
Exam trap: Do not confuse the 30-day FCRA adverse action deadline with the ECOA requirement. ECOA also requires notice within 30 days, but the content requirements differ. The FCRA notice must identify the CRA; the ECOA notice must state the specific reasons.
1.4 Investigative Consumer Reports
An investigative consumer report is a special category under FCRA. It involves personal interviews with third parties about the consumer's character, reputation, or lifestyle. These reports are rarely used in standard mortgage lending but may be used for fraud prevention or in certain high-net-worth lending situations.
Requirements for investigative consumer reports:
The consumer must be notified in writing within 3 days of requesting the report that an investigative consumer report may be made.
The notice must include a statement of the consumer's right to request additional disclosures about the nature and scope of the investigation.
If the consumer requests additional information, the user must make a complete disclosure of the nature and scope of the investigation within 5 days of the request.
Exam trap: Candidates often confuse the 3-day notice for investigative consumer reports with the 3-business-day rescission period under TILA or the 3-business-day TRID waiting period. They are unrelated.
1.5 Duties of Furnishers of Information
Mortgage loan originators and lenders that report loan payment information to CRAs are "furnishers" under FCRA. Furnishers have specific duties under FCRA Section 623 (15 U.S.C. § 1681s-2):
Duty to provide accurate information: A furnisher may not report information that it knows or has reasonable cause to believe is inaccurate.
Duty to correct and update: If a furnisher discovers that it has furnished inaccurate information, it must promptly correct the information and notify the CRA.
Duty to investigate disputes: If a consumer disputes information with a CRA, the CRA will notify the furnisher. The furnisher must conduct a reasonable investigation, review all relevant information provided by the CRA, and report the results to the CRA. This investigation must be completed within 30 days (or 45 days if the consumer provides additional relevant information during the 30-day period).
Duty to notify of closed accounts: If a consumer voluntarily closes an account, the furnisher must report the account as "closed by consumer" in subsequent updates.
Duty to notify of delinquent accounts: If a furnisher reports an account as delinquent, it must also report the month and year of the commencement of the delinquency.
Important: The consumer does not have a private right of action to sue a furnisher directly for violations of Section 623(b) (the duty to investigate). Enforcement is through the CRA, state attorneys general, or federal regulators. However, consumers may sue furnishers for willful violations of Section 623(a) (the duty to provide accurate information) in limited circumstances.
1.6 The Risk-Based Pricing Rule and Credit Score Disclosures
Under FACTA, the CFPB issued the Risk-Based Pricing Rule, which requires creditors to provide a risk-based pricing notice to consumers when they receive credit on terms that are materially less favorable than the terms offered to a substantial proportion of other consumers. For mortgage loans, this rule is largely superseded by the credit score disclosure requirement.
Credit score disclosure requirement: When a mortgage loan originator uses a consumer report to deny a loan or to set the interest rate, the lender must provide the consumer with:
The credit score used in the decision.
The range of possible credit scores.
The key factors that adversely affected the credit score (up to four factors).
The date the credit score was created.
The name of the CRA that provided the credit score.
This disclosure must be provided at the same time as the adverse action notice or, for approved loans, at the time the loan terms are disclosed (typically on the Loan Estimate).
Exam trap: The credit score disclosure is NOT the same as the FCRA adverse action notice. A lender may approve a loan but at a higher interest rate due to a low credit score. In that case, the lender must provide the credit score disclosure but may not need to provide a full FCRA adverse action notice (unless the terms are materially less favorable, triggering the risk-based pricing notice).
1.7 The Gramm-Leach-Bliley Act (GLBA) — Privacy and Safeguards
The Gramm-Leach-Bliley Act (GLBA), codified at 15 U.S.C. § 6801 et seq., governs the privacy of consumer financial information. The GLBA has two primary components relevant to mortgage loan originators: the Privacy Rule and the Safeguards Rule.
Privacy Rule (Regulation P, 12 CFR Part 1016):
Requires financial institutions (including mortgage lenders and brokers) to provide consumers with a privacy notice at the time the customer relationship is established and annually thereafter.
The notice must describe the institution's information collection and sharing practices, including whether the institution shares nonpublic personal information with affiliates or nonaffiliated third parties.
Consumers must be given a reasonable opportunity to opt out of certain information sharing with nonaffiliated third parties.
The privacy notice must be provided before any nonpublic personal information is shared with a nonaffiliated third party (with limited exceptions for servicing, processing, or marketing on behalf of the institution).
Nonpublic personal information (NPI): Any personally identifiable financial information that is not publicly available. This includes a consumer's name, address, Social Security number, income, credit score, and loan payment history.
Safeguards Rule (12 CFR Part 314):
Requires financial institutions to develop, implement, and maintain a comprehensive written information security program.
The program must be appropriate to the size and complexity of the institution, the nature and scope of its activities, and the sensitivity of the customer information it handles.
The program must include administrative, technical, and physical safeguards.
Institutions must designate an employee to coordinate the information security program.
Institutions must conduct a risk assessment and regularly test and monitor the effectiveness of the safeguards.
Institutions must oversee service providers by contractually requiring them to maintain appropriate safeguards.
Exam trap: The GLBA privacy notice is annual, but the initial notice must be provided before the institution shares any NPI. If a mortgage broker shares a consumer's application information with a lender, that is typically permitted under the "servicing or processing" exception and does not require an opt-out opportunity. However, if the broker shares NPI with a nonaffiliated third party for marketing purposes, the consumer must have received the privacy notice and been given an opt-out opportunity.
1.8 FACTA — Red Flags Rule and Disposal Rule
The Fair and Accurate Credit Transactions Act (FACTA) of 2003 amended FCRA and added several important requirements.
Red Flags Rule (12 CFR Part 1022.90):
Requires financial institutions and creditors that hold covered accounts to develop and implement a written Identity Theft Prevention Program.
The program must include policies and procedures for detecting, preventing, and mitigating identity theft.
The program must identify relevant "red flags" (patterns, practices, or specific activities that indicate possible identity theft) and describe how the institution will respond.
The program must be updated periodically to reflect changes in risks.
For mortgage lenders, a "covered account" includes any loan account or any account for which there is a reasonably foreseeable risk of identity theft.
Disposal Rule (12 CFR Part 1022.130):
Requires any person or entity that maintains or possesses consumer information to take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.
For mortgage loan originators, this means that when disposing of loan files, credit reports, or other consumer information, the originator must shred, burn, or otherwise destroy the information so that it cannot be read or reconstructed.
The rule applies to both paper and electronic records.
Exam trap: The Red Flags Rule applies to "covered accounts," which are accounts that involve multiple payments or transactions. A mortgage loan is a covered account. However, a one-time transaction, such as a single closing where no ongoing account is established, may not be a covered account. The exam may test whether a mortgage broker who does not service loans still has a covered account — the answer is yes, because the broker regularly obtains consumer reports and may hold consumer information.
1.9 FCRA and ECOA — Overlap and Distinction
The SAFE exam frequently tests the overlap between FCRA and ECOA adverse action requirements. Both statutes require adverse action notices, but they serve different purposes:
Feature
FCRA (Section 615)
ECOA (Regulation B)
Trigger
Adverse action based on consumer report
Adverse action based on any prohibited basis or any reason
Content
Must identify the CRA
Must state specific reasons for denial
Timing
Within 30 days
Within 30 days
Purpose
Inform consumer of right to obtain/dispute report
Inform consumer of specific reasons for denial
In practice, lenders combine both into one notice. However, the exam may present a scenario where a lender denies a loan based on the applicant's debt-to-income ratio, not on the credit report. In that case, an ECOA notice is required, but an FCRA notice may not be required (unless the credit report was also used and adversely affected the decision).
1.10 Common Exam Traps
120.Confusing the FCRA adverse action notice with the ECOA notice. The FCRA notice identifies the CRA; the ECOA notice states the specific reasons. If the question asks "what must the notice include regarding the credit reporting agency," the answer is the name, address, and phone number of the CRA.
121.Mixing the 30-day adverse action deadline with the 3-business-day TRID waiting period. The 30-day deadline applies to adverse action notices under both FCRA and ECOA. The 3-business-day period applies to the delivery of the Loan Estimate before closing and the rescission period for refinances.
122.Believing that a consumer report can be obtained without written authorization. For mortgage loans, written authorization is always required. A verbal request is insufficient.
123.Confusing the "investigative consumer report" 3-day notice with the TILA rescission period. The 3-day notice for investigative reports is about informing the consumer that an investigation is occurring. It has nothing to do with the right to rescind a loan.
124.Assuming that the GLBA privacy notice must be provided annually only. The initial notice must be provided before any NPI is shared. Annual notices are required thereafter, but the initial notice is the critical trigger.
125.Thinking that the Red Flags Rule applies only to large institutions. It applies to all financial institutions and creditors with covered accounts, regardless of size.
126.Confusing the credit score disclosure with the risk-based pricing notice. For mortgage loans, the credit score disclosure is provided with the Loan Estimate or adverse action notice. The risk-based pricing notice is generally not used for mortgage loans because the credit score disclosure satisfies the requirement.
127.Believing that a furnisher has no duty to investigate a dispute. Furnishers must investigate disputes forwarded by CRAs within 30 days. However, the consumer cannot sue the furnisher directly for failure to investigate — that claim must go through the CRA.
1.11 Summary of Key Deadlines and Requirements
Requirement
Deadline / Timing
FCRA adverse action notice
Within 30 days of adverse action
ECOA adverse action notice
Within 30 days of adverse action
Investigative consumer report notice
Within 3 days of requesting the report
Additional investigative report disclosure
Within 5 days of consumer request
Furnisher investigation of dispute
Within 30 days (45 days with additional info)
GLBA initial privacy notice
Before sharing NPI with nonaffiliated third party
GLBA annual privacy notice
Annually
Free credit report from CRA after adverse action
Within 60 days of notice
Credit score disclosure
With adverse action notice or Loan Estimate
1.12 Conclusion
The Fair Credit Reporting Act and the Gramm-Leach-Bliley Act form the backbone of consumer privacy and credit reporting law in mortgage lending. The SAFE exam will test your ability to distinguish between the various notices, deadlines, and permissible purposes. Remember that FCRA governs the use of consumer reports, GLBA governs the privacy of nonpublic personal information, and FACTA adds identity theft and disposal requirements. Master the distinctions between FCRA and ECOA adverse action notices, and you will be well prepared for this portion of the exam.
