Consumer Reporting Agencies: CFPB Should Define Its Supervisory Expectations

CRAs collect data from various sources, such as banks and credit card companies, to create consumer reports that they sell to third parties. The three largest CRAs hold information on more than 200 million Americans.

The Economic Growth, Regulatory Relief, and Consumer Protection Act, enacted in 2018, included a provision for GAO to examine issues related to the consumer reporting market. This report examines, among other objectives, the causes of consumer report inaccuracies and how CFPB has overseen CRAs.

To answer these questions, GAO reviewed relevant laws, regulations, and agency documents related to CRA oversight. GAO interviewed representatives of federal agencies and stakeholders, including a nongeneralizable selection of state agencies from four states that had laws or oversight activities involving CRAs and seven CRAs selected based on size and the type of consumer reports produced. GAO also interviewed groups representing state agencies, consumers, and CRAs selected to reflect a range of stakeholders or based on their work related to CRAs.

Businesses and other entities use consumer reports to make decisions about consumers, such as whether they are eligible for credit, employment, or insurance. Consumer report inaccuracies can negatively affect such decisions. The Consumer Financial Protection Bureau (CFPB) and other stakeholders identified various causes of consumer report inaccuracies, such as errors in the data collected by consumer reporting agencies (CRA) and CRAs not matching data to the correct consumer.

In 2010, CFPB was granted supervisory and enforcement authority over CRAs. In using its oversight authorities, CFPB has prioritized CRAs that pose the greatest potential risks to consumers—such as those with significant market shares and large volumes of consumer complaints—for examination. CFPB's oversight has generally focused on assessing compliance with Fair Credit Reporting Act (FCRA) requirements regarding accuracy and the investigations CRAs conduct in response to consumer disputes. For example, since 2013, CFPB has conducted examinations of several CRAs and directed specific changes in CRAs' policies and procedures for ensuring data accuracy and conducting dispute investigations.

CFPB has not defined its expectations for how CRAs can comply with key statutory requirements. FCRA requires CRAs (1) to follow reasonable procedures for ensuring maximum possible accuracy and (2) to conduct reasonable investigations of consumer disputes. CFPB has identified deficiencies related to these requirements in its CRA examinations, but it has not defined its expectations—such as by communicating information on appropriate practices—for how CRAs can comply with these requirements. Absent such information, staff from four CRAs GAO interviewed said that they look to other sources, such as court cases or industry presentations, to understand what CFPB will consider to be noncompliant during examinations. A 2018 policy statement issued by CFPB and other regulators highlighted the important role of supervisory expectations in helping to ensure consistency in supervision by providing transparent insight to industry and to supervisory staff. By providing information to CRAs about its expectations for complying with key FCRA requirements, CFPB could help achieve its goal of accurate consumer reporting and effective dispute resolution processes. Such information also could help to promote consistency and transparency in CFPB's supervisory approach.

CFPB should communicate to CRAs its expectations regarding (1) reasonable procedures for assuring maximum possible accuracy and (2) reasonable investigations of consumer disputes. CFPB described actions it has taken to provide information to CRAs. GAO maintains that communicating expectations in these two areas is beneficial, as discussed in the report.

Consumer reporting agencies (CRA) compile consumer reports that play  an important role in the lives of American consumers. These companies  collect vast amounts of sensitive consumer information, such as loan  status or payment and employment history, package it into consumer  reports, and sell the reports to third parties. The Consumer Data Industry  Association has reported that CRAs issue more than 3 billion consumer  reports and make more than 36 billion updates to files they keep on  consumers each year. Banks, employers, and others use these reports  to assess consumer risks and behaviors and make important decisions  about issues such as cost of credit, insurance premiums, employment,  and housing. Inaccuracies in consumer reports could affect these  decisions. For example, inaccurate negative information in consumer  reports may affect consumers’ access to credit or the cost at which they  can obtain credit. The exclusion of positive or updated information, such as timely payments, may also limit consumers’ access to credit or  increase its cost. Consumers may not know that there are errors in their  reports until they are notified of negative actions that have been taken,  such as rejection of credit, employment, or rental housing, based on  information in their consumer reports.

The Economic Growth, Regulatory Relief, and Consumer Protection Act,  enacted in 2018, included a provision for us to examine topics related to  the consumer reporting market, including the current legal and regulatory  structure, inaccuracies in consumer reports, and data security, among  other topics. This report (1) describes the current oversight framework  for CRAs, (2) examines how the Consumer Financial Protection Bureau  (CFPB) has overseen CRAs and entities that furnish consumer data, (3)  examines how other federal agencies, including the Federal Trade  Commission (FTC) and the prudential regulators, have overseen CRAs  and entities that furnish consumer data, and (4) identifies what is known  about the causes of inaccuracies in consumer reports and the processes  that are in place to help ensure accuracy. Some information has not been  included in this public report because CFPB determined it was  information prohibited by law from public disclosure. This report omits  such information, but we will be issuing a nonpublic version of this report  that includes all the information. Although the information provided in this  report is more limited, it addresses the same objectives as the sensitive  nonpublic report and uses the same methodology.

To describe the oversight framework for CRAs, we identified and  reviewed relevant federal laws and oversight authorities given to federal  agencies to oversee CRAs and institutions that furnish data to CRAs  (called furnishers) under those laws. We interviewed staff from CFPB,  FTC, and prudential regulators—the Board of Governors of the Federal  Reserve System (Federal Reserve), the Federal Deposit Insurance  Corporation (FDIC), the National Credit Union Administration (NCUA),  and the Office of the Comptroller of the Currency (OCC)—about their  oversight authority over CRAs and furnishers. Additionally, we  interviewed or received information from stakeholders, consisting of state agencies such as state regulators or Attorney General offices, CRAs, and  others. We interviewed, or received written responses to questions from,  staff of state agencies from four states—Maine, Maryland, New York, and  Ohio—about applicable state laws and state oversight over CRAs. We  selected these states because they had laws and regulations related to  consumer reporting or had oversight activities involving CRAs. We  interviewed representatives from three nationwide CRAs and four smaller  or specialty CRAs that produce or compile consumer reports covering the  credit and background-screening markets about federal and state  oversight. We selected these CRAs because of potential differences in  oversight based on their size and market. Additionally, we interviewed two  groups representing state agencies, two industry groups representing  CRAs, and four consumer groups about federal and state oversight of  CRAs. We selected these groups because, based on our analysis of  publicly available information and interviews with federal agencies, they  are the primary organizations representing stakeholders in our review,  such as CRAs, or have existing work, such as reports or congressional  testimonies, related to CRAs. The groups we included and the views they  represent reflect a range of stakeholders but do not necessarily reflect the  full scope of the industry.

To examine how CFPB has overseen CRAs and furnishers, including  CFPB’s supervision and enforcement strategies and activities, we  interviewed CFPB staff and reviewed relevant documents, including  supervisory plans, examination documents, and reports CFPB has  published. Additionally, we reviewed the types of enforcement actions  available to CFPB for violations of relevant laws, and we identified  enforcement actions CFPB brought against CRAs and furnishers for  violations related to the Fair Credit Reporting Act (FCRA) and its  implementing regulation (Regulation V) from 2012 through 2018.

To examine how FTC and the prudential regulators have overseen CRAs  and furnishers, we interviewed staff from FTC and the prudential  regulators to discuss their oversight and enforcement activities over  CRAs and furnishers. To learn about FTC’s enforcement strategies and  activities in the consumer reporting market, we reviewed the types of  enforcement actions available to FTC for violations of relevant laws, and  we identified enforcement actions FTC brought against CRAs and furnishers for violations related to FCRA and Regulation V from 2010  through 2018. To learn about prudential regulators’ activities, we  reviewed the prudential regulators’ policies and procedures for examining  furnishers and interviewed regulators’ staff. We also collected information  from the regulators about their FCRA-related findings for furnishers from  2013 through 2018.

To identify what is known about the causes of inaccuracies in consumer  reports and the processes that are currently in place to help ensure  accuracy, we interviewed the stakeholders identified above. Additionally,  we identified reports from CFPB and FTC that included information on the  causes of inaccuracies in consumer reports as well as information CFPB  has published on the processes CRAs have in place to help ensure  accuracy. For more information on our scope and methodology, see  appendix I.

We conducted this performance audit from July 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Information on consumers is exchanged through a consumer reporting  process that includes consumers, CRAs, furnishers of consumer  information, and users of consumer reports (see fig. 1).

Consumers are individuals whose information is collected by CRAs  and shared by CRAs with users of consumer reports to make  decisions about eligibility, such as for credit, insurance, or  employment. Information about consumers is generated through their  participation in markets for goods and services—such as the use of  banking or insurance products.

CRAs are companies that regularly assemble or evaluate consumer  information for the purpose of providing consumer reports to third  parties. CRAs obtain data from a wide variety of sources, including  data furnishers, such as banks and mortgage lenders, and public  records. They can generate revenue by selling consumer reports to  third parties. In 2012, CFPB estimated that the consumer reporting  market consisted of more than 400 CRAs. CFPB estimated in 2015  that the three nationwide CRAs—which also are the three largest  CRAs—held information on about 208 million Americans.

Data furnishers are companies that report consumer information to  CRAs. Examples of furnishers include banks, payday lenders,  mortgage lenders, collection agencies, automobile-finance lenders,  and credit card issuers. The information provided by furnishers may  include personally identifiable information such as names, addresses,  Social Security numbers, and employment data and account status  and credit histories. A furnisher may provide CRAs with consumer  information on multiple types of products. For example, a financial  institution may provide account information on student loans as well  as bank deposits. Furnishing of information to CRAs is generally  voluntary; therefore, a furnisher is not required to submit all of the  records about a consumer’s activity on an account to CRAs. Some  accounts may only be reported when the payment history turns  negative, such as when the debt is transferred to debt collection.

Users of consumer reports include banks, credit card companies,  landlords, employers, and other entities that use consumer reports to  determine individual consumers’ eligibility for housing, employment, or  products and services such as credit and insurance. Companies use  consumer information compiled in consumer reports to screen for  consumer risks and behaviors. For example, banks and credit unions  may rely on consumer reports to assess the risk of opening new  accounts. Some companies may act as both furnishers and consumer  report users.

During the consumer reporting process, a consumer does not necessarily  interact with the CRA; however, if consumers discover inaccurate or  incomplete information on their consumer reports as a result of, for  example, being denied credit, they can file a dispute with the CRA, the  furnisher, or both. Consumers may also request copies of their  consumer reports from CRAs directly, and CRAs may provide consumers  with certain disclosures about how their information is being shared.

Different types of CRAs compile different types of reports using the data  they obtain. The three nationwide CRAs produce credit reports and credit  scores that can be used to qualify consumers for credit. Credit reports  generally contain personally identifiable information, employment  information, account status and credit histories, and inquiries made about  consumers’ credit histories (see fig. 2). Other CRAs, called specialty  CRAs, provide a variety of specialized reports used for making decisions  on employment, rental housing, or other purposes. For example, reports  from a specialty background-screening CRA may include some of the  same information as a credit report but may also contain criminal history,  education verification, and employment history.

Laws and Regulations Governing Consumer Reporting

Several federal laws govern the consumer reporting industry, including  the accuracy, security, use, and sharing of consumer report information.

The Fair Credit Reporting Act (FCRA) is the primary federal law  governing the collection, assembly, and use of consumer reports. FCRA  was enacted to improve the accuracy and integrity of consumer reports,  and promote the consumer reporting agencies’ adoption of reasonable  procedures regarding the confidentiality, accuracy, relevancy, and proper  use of consumer information. FCRA has been amended several times  since it was enacted in 1970. When FCRA was originally enacted, FCRA  imposed certain requirements on CRAs and users of consumer reports.  Amendments to FCRA, pursuant to the Consumer Credit Reporting  Reform Act of 1996 and the Fair and Accurate Credit Transactions Act of  2003, expanded the duties of CRAs, including requirements for dispute  investigations, and imposed duties on data furnishers, such as  requirements related to data accuracy and dispute investigations.

FCRA Provisions Governing Consumer Report Accuracy

FCRA requires CRAs and furnishers to take steps regarding the accuracy  of the information contained in consumer reports. In addition, FCRA’s  implementing regulation—Regulation V—as well as FTC’s Furnisher Rule  more specifically outline furnishers’ responsibilities regarding accuracy.  FCRA requires CRAs to follow reasonable procedures to assure  “maximum possible accuracy” of the information concerning the individual  to whom the report relates when preparing consumer reports. FCRA  prohibits furnishers from reporting information that they know or have  reasonable cause to believe is inaccurate, unless the furnisher has clearly  and conspicuously specified to consumers an address whereby  consumers can notify the furnisher that specific information is  inaccurate. Regulation V and FTC’s Furnisher Rule require furnishers to  have reasonable written policies and procedures in place regarding the  accuracy and integrity of the information they provide to a CRA, where  accuracy means that the information is for the right person and reflects  the terms of the account and the consumer’s performance on the  account. They also require furnishers to consider and incorporate, as  appropriate, guidelines such as internal controls for accuracy and integrity  of furnished information.

FCRA requires CRAs and furnishers to address disputes consumers  submit to them about the completeness or accuracy of information in their  consumer reports. FCRA requires CRAs and Regulation V and FTC’s  Furnisher Rule require furnishers to conduct reasonable investigations of  a consumer’s dispute to determine the accuracy of the disputed  information. As part of the process, CRAs and furnishers are required to  consider all relevant information, including information provided by the  consumer.

Laws Governing Security of Consumer Data

The Gramm-Leach-Bliley Act (GLBA), provisions in the Federal Trade  Commission Act, and provisions of the Dodd-Frank Wall Street Reform  and Consumer Protection Act (Dodd-Frank Act), among other laws,  govern the security of consumer data.

Congress enacted GLBA in part to protect the privacy and security of  nonpublic personal information that individuals provide to financial  institutions. Many financial institutions furnish consumer data to CRAs. In  a prior report, FTC staff told us that CRAs themselves might be  considered financial institutions under GLBA if they collect, maintain, and  report on consumer information. GLBA includes a provision directing  FTC and certain federal regulators—including the Federal Reserve, FDIC,  and OCC—to establish standards relating to administrative, technical,  and physical safety for customer records. Specifically, GLBA directs  these federal agencies to establish appropriate standards for financial  institutions under their jurisdiction to ensure the security and  confidentiality of customer records and information; protect against any  anticipated threats or hazards to the security or integrity of such records;  and protect against unauthorized access to or use of such records or  information that could result in substantial harm or inconvenience to any  customer.

Provisions in the Federal Trade Commission Act prohibiting unfair or  deceptive acts or practices and provisions in the Dodd-Frank Act  prohibiting unfair, deceptive, or abusive acts or practices also may apply  to CRAs’ protection of consumer data. Specifically, section 5 of the  Federal Trade Commission Act prohibits “unfair or deceptive acts or  practices” in or affecting commerce. In the context of privacy and  security, these provisions require companies to represent practices to  consumers in a truthful manner. For example, we reported previously that  FTC has found companies that alleged they were following certain  security protections, but did not in fact have such security features, to  have engaged in unfair or deceptive practices. Similarly, the Dodd- Frank Act prohibits providers of consumer financial products or services  from engaging in “unfair, deceptive, or abusive acts or practices.” For  example, we reported previously that CFPB has alleged that claims to  consumers that transactions are safe and secure while simultaneously  lacking basic security practices can constitute “unfair, deceptive, or  abusive acts or practices.”

Laws Governing Use and Sharing of Consumer Information

FCRA, GLBA, and the Economic Growth, Regulatory Relief, and  Consumer Protection Act govern how consumer information may be used  and shared. However, as we have previously reported, consumers have  limited legal rights to control what personal information is collected and  how it is maintained, used, and shared. For example, consumers  generally cannot exercise choice in the consumer reporting market—such  as by choosing which CRAs maintain their information—and do not have  legal rights to delete their records with CRAs.

FCRA permits CRAs to provide users of consumer reports the report only  if the user has a “permissible purpose,” such as to process a credit  application, screen a job applicant, or underwrite an insurance policy,  subject to additional limitations where the credit or insurance transaction  is not initiated by the consumer. FCRA also prohibits a person from  using or obtaining a consumer report for any purpose other than that  specified to the CRA when the user obtained the report. Further, FCRA  requires that CRAs take steps to validate the legitimacy of users and their  requests for consumer report information. FCRA and Regulation V also  allow consumers to opt out of allowing CRAs to share their information  with third parties for prescreened offers and limits the ability of affiliated  companies to market products or services to consumers using shared  consumer data.

GLBA contains provisions regarding the use and sharing of consumer  information that apply to CRAs. GLBA restricts the sharing of nonpublic  personal information collected by or acquired from financial institutions. In  particular, generally a nonaffiliated third party that receives nonpublic  personal information from a financial institution faces restrictions on how it  may further share or use the information. For example, a third party that  receives nonpublic personal information from a financial institution to  process consumer account transactions may not use the information for  marketing purposes or sell it to another entity for marketing purposes.

Consumers can prevent certain users from accessing their consumer  reports by placing a security freeze on their consumer reports, which  generally prevents the opening of new lines of credit in the consumer’s  name (provided the creditor checks the consumer’s credit). Consumers  may place a credit freeze at the three nationwide CRAs free of charge.

Oversight of CRAs Is Shared among CFPB and Other Federal and State Agencies

Federal and state agencies share oversight of CRAs and furnishers. At  the federal level, CFPB has supervisory authority over certain CRAs and  shares enforcement and rulemaking authority with FTC for certain  statutes applicable to all CRAs. At the state level, state Attorney General  offices have enforcement authority to oversee CRAs, and some state  agencies have limited supervisory authority under state laws. Federal  agencies that have oversight authority for data furnishers are CFPB, FTC,  and prudential regulators—the Federal Reserve, FDIC, NCUA, and OCC.  Their oversight authority depends on the size as well as the type of the  furnisher, such as if the furnisher is a nonbank institution, depository  institution, or credit union.

CFPB Has Supervisory Authority over Certain CRAs and Shares Enforcement Authority with FTC for All CRAs

CFPB is the only federal agency with supervisory authority over CRAs,  but it generally shares enforcement authority over CRAs with FTC as well  as rulemaking authority for certain statutes applicable to all CRAs (see  table 1).

CFPB’s supervisory authority includes the authority to perform  examinations to assess compliance with FCRA and other Federal  consumer financial laws and to detect and assess risk to consumers and  markets. CFPB may issue matters requiring attention (MRA) based on  its examinations. MRAs identify corrective actions that result from  examination findings that require the attention of the supervised  institution’s board of directors or principals, including violations of Federal  consumer financial laws. According to CFPB, MRAs are not legally  enforceable, but CFPB can use them to determine future supervisory  work or the need for potential enforcement actions.

CFPB’s supervisory authority is generally limited to CRAs that qualify as  larger participants in the consumer reporting market. In 2012, CFPB  defined larger participants of the consumer reporting market to include  CRAs with more than $7 million in annual receipts resulting from  consumer reporting activities. CFPB’s authority does not extend to  CRAs that do not participate in activities involving the use of consumer  information to make decisions regarding financial products or services.  For example, a specialty CRA that only provides consumer reports  regarding a consumer’s employment history may not be considered a  larger participant for the purposes of CFPB supervision, even if the CRA’s  annual receipts from this activity are more than $7 million. In the  preamble to its 2012 rule defining larger participants, CFPB stated that  the threshold of more than $7 million is consistent with the objective of  supervising market participants that have a significant impact on  consumers and is appropriate in light of the highly concentrated nature of  the consumer reporting market. In particular, CFPB estimated that out of  about 410 CRAs, 30 CRAs met the threshold. Of those 30 CRAs, CFPB  estimated that the six largest CRAs generated approximately 85 percent  of industry receipts.

While CFPB generally has supervisory authority over only larger- participant CRAs, CFPB and FTC generally share enforcement authority  over CRAs. For example, they both enforce CRA compliance with most  provisions of FCRA and provisions in other laws related to unfair or  deceptive acts or practices. Both agencies have similar enforcement  tools, including investigation, civil penalties, monetary relief for  consumers, and requirements for a company to conduct or refrain from  conducting certain acts. CFPB and FTC entered into a memorandum of  understanding to coordinate their enforcement efforts, and staff from both  agencies told us they take additional actions to coordinate their  enforcement activities. For example, FTC staff said that CFPB and FTC  maintain a log of each agency’s investigations to avoid duplication.  Additionally, CFPB and FTC staff said they hold periodic coordination  meetings to discuss their enforcement activities. FTC staff told us that  because CFPB possesses supervisory authority over the three largest  CRAs, FTC has focused its FCRA enforcement efforts on other CRAs.  However, FTC staff said that to the extent that the largest CRAs offer  nonfinancial products or services, such as employment or tenant  background screening, FTC will also investigate these activities.

CFPB and FTC each have certain rulemaking authority in connection with  statutes that may apply to CRA activities, but generally CFPB has  broader authority than FTC. Generally, CFPB has broad authority to issue  regulations for Federal consumer financial laws, including most provisions  of FCRA, which are applied to all CRAs. FTC has specific rulemaking  authority that may apply to CRAs under FCRA, the Federal Trade  Commission Act, and GLBA. For example, FTC’s rule related to  safeguarding the security and confidentiality of customer records under  GLBA applies to CRAs.

State Agencies Have Enforcement Authority over CRAs, and Some State Laws Provide Limited Supervisory Authority

State agencies, such as state Attorney General offices, have enforcement  authority to oversee CRAs, and some state agencies have limited  supervisory authority under state laws. Federal laws establish  enforcement authority for state agencies over CRAs. Under FCRA and  the Dodd-Frank Act’s provisions prohibiting unfair, deceptive, or abusive  acts and practices, state Attorney General offices (or another official or  agency designated by the state) have certain enforcement authority over  some companies, including certain CRAs. However, states are required  to coordinate enforcement actions with CFPB and FTC.

In addition to enforcement authority under federal laws, state agencies  may have enforcement authority under their state laws that apply to  CRAs. Staff from state agencies in four selected states—Ohio, New York,  Maine, and Maryland—told us that their states’ Attorney General offices  have enforcement authority over CRAs under state laws prohibiting unfair  or deceptive acts or practices. In addition, according to the National  Consumer Law Center, every state has a consumer protection law that  prohibits deceptive acts or practices and many states prohibit unfair acts  or practices, and the enforcement of such state laws typically is the  responsibility of a state enforcement agency, such as the state Attorney  General offices.

Some state Attorney General offices have used their enforcement  authority under FCRA and state laws prohibiting unfair or deceptive acts  or practices to investigate and take enforcement actions against CRAs.  For example, the three nationwide CRAs entered into two separate  settlements with 30 state Attorney General offices in 2015 in which the  CRAs agreed to implement a number of specific reforms, including  reforms related to consumer report accuracy and dispute processes.  Under these settlements, the state Attorney General offices claimed the  CRAs violated FCRA and the states’ laws prohibiting unfair or deceptive  acts or practices. Additionally, representatives of several states’ Attorney  General offices told us in connection with a prior report that they launched a joint investigation into whether a nationwide CRA violated state laws in  a 2017 data breach, including state laws prohibiting unfair or deceptive  practices.

In addition to the enforcement authority state Attorney General offices  have under state laws prohibiting unfair or deceptive acts or practices,  some state laws provide state agencies, such as financial regulators and  consumer protection bureaus, with oversight authority over CRAs. Our  interviews with staff from four selected states’ agencies—Ohio, New York,  Maine, and Maryland—indicated that CRA oversight authority given to  state agencies under state laws varies.

Staff from Ohio’s Office of the Attorney General told us that Ohio does  not have specific laws that provide Ohio state regulators with  supervisory, rulemaking, or enforcement authority over CRAs, apart  from Ohio laws prohibiting unfair or deceptive acts or practices that  provide the Office of the Attorney General with enforcement authority.

New York’s financial regulator told us that state laws provide the  agency with supervisory, enforcement, and rulemaking authority over  institutions that provide financial products and services, including  certain CRAs. The agency issued a rule in 2018 requiring CRAs  reporting on consumers within the state to register with the agency  annually and provide information as required by the agency.

Staff from Maine’s consumer protection agency told us that under  Maine law, the agency has supervisory and enforcement authority  over CRAs operating within the state. Agency staff told us that the  agency examines certain CRAs every 2 years for compliance with  Maine’s consumer reporting laws, such as by reviewing records and  documents provided by CRAs.

Maryland’s financial regulator told us that Maryland’s laws provide the  agency with enforcement and rulemaking authority over CRAs but not  supervisory authority. The agency can adopt regulations in order to  administer provisions of Maryland statutes, such as procedures for  ensuring accuracy in consumer reports. Additionally, agency staff said  that the agency can investigate CRAs using its enforcement authority  but cannot conduct supervisory examinations of CRAs.

Representatives from several CRAs we interviewed told us that their  supervision by state regulators has been limited. Representatives from  two CRAs told us that a state agency has examined them.  Representatives from three other CRAs we interviewed said they had  limited encounters with state-level agencies. However, as previously  stated, CFPB, FTC, and state agencies generally have enforcement  authority over CRAs regarding consumer financial protection.

CFPB, FTC, and Prudential Regulators Share Oversight of Data Furnishers

CFPB, FTC, and the prudential regulators—the Federal Reserve, FDIC,  NCUA, and OCC—share federal oversight of data furnishers for  compliance with FCRA, among other Federal consumer financial laws.  These furnishers include insured depository institutions and credit unions  and nondepository institutions, such as student and mortgage loan  servicers. Federal agencies generally split oversight of furnishers based  on their charter type and asset size.

Oversight of furnishers that are depository institutions or credit  unions. CFPB and the prudential regulators have supervisory and  enforcement authority over insured depository institutions and credit  unions for compliance with FCRA and other federal consumer financial  laws (see table 2). The Dodd-Frank Act generally divided authority  between CFPB and the prudential regulators based on an institution’s  charter type and the value of an institution’s total assets.

Assets of more than $10 billion. In general, CFPB has enforcement  and supervisory authority for insured depository institutions and credit  unions (as well as their affiliates) that have more than $10 billion in  total assets for compliance with many Federal consumer financial  laws.However, a prudential regulator that is authorized to enforce a  Federal consumer financial law may recommend that CFPB initiate an  enforcement action, and if CFPB does not, the prudential regulator  may initiate an enforcement action.

Assets of $10 billion or less. In general, the four prudential  regulators have enforcement and supervisory authority over insured  depository institutions or credit unions with total assets of $10 billion  or less. If, however, CFPB believes that an institution in this category  has violated a Federal consumer financial law, it must notify the  appropriate prudential regulator in writing and recommend action.

Additionally, regardless of an institution’s asset size, CFPB generally has  rulemaking authority for many Federal consumer financial laws that apply  to insured depository institutions and insured credit unions. However,  prudential regulators have limited rulemaking authority as related to  furnishing activities for certain provisions specifically retained pursuant to  the Dodd-Frank Act and FCRA.

CFPB generally has supervisory and enforcement authority over insured depository institutions and  insured credit unions, as well as their affiliates, that have more than $10 billion in total assets, for  compliance with Federal consumer financial laws as defined under the Dodd-Frank Wall Street  Reform and Consumer Protection Act. CFPB has broad rulemaking authority under many Federal  consumer financial laws that apply to depository institutions and credit unions, with limited exceptions.  The Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation,  National Credit Union Administration, and Office of the Comptroller of Currency (collectively called the  prudential regulators) generally have supervisory and enforcement authority for Federal consumer  financial laws (as defined under the Dodd-Frank Wall Street Reform and Consumer Protection Act)  for insured depository institutions and credit unions that have $10 billion or less in total assets. The  prudential regulators also have limited rulemaking authority related to furnishing activities under  certain Federal consumer financial laws, including parts of FCRA.

Oversight of furnishers that are nondepository institutions. CFPB  and FTC share oversight of nondepository institutions. In general, CFPB  has supervisory authority over certain types of nondepository financial  institutions for compliance with FCRA and other Federal consumer  financial laws (see table 3). Such institutions include certain kinds of  mortgage market participants, private student lenders, and payday  lenders. CFPB also has supervisory authority over institutions in markets  for consumer financial products or services that it defines as larger  participants. For example, CFPB has issued rules defining larger  participants for automobile-financing and consumer debt-collection  markets.

CFPB and FTC share enforcement authority for many different types of  nondepository institutions, such as mortgage lenders, payday lenders,  debt collectors, and telecommunication companies. FTC additionally  has enforcement authority over other nondepository institutions for which  CFPB does not have enforcement authority, such as automobile dealers.  FTC staff told us that, similar to their coordination efforts for CRAs, FTC  and CFPB coordinate their enforcement activities with respect to  furnishers.

CFPB has rulemaking authority for most consumer financial laws,  including FCRA, that may apply to furnishers that are nondepository  institutions. In comparison to CFPB, FTC has specific rulemaking  authority under FCRA, the Federal Trade Commission Act, and GLBA to  promulgate rules that may apply to nondepository institution furnishers.

CFPB has supervisory authority over certain nondepository institutions. It shares enforcement  authority with FTC for certain nondepository institutions and has broad rulemaking authority for  Federal consumer financial laws which apply to many institutions, including those for which it has  supervisory jurisdiction.

CFPB’s Oversight Has Prioritized Supervision of CRAs Based on Perceived Risk, but CFPB Has Not Defined Supervisory Expectations

CFPB’s Supervision Has Prioritized Certain CRAs and Has Focused on Data Accuracy and Dispute Investigations

According to CFPB, in its oversight of the consumer reporting market,  CFPB has prioritized CRAs representing the greatest potential risks to  consumers. Additionally, CFPB has generally focused on certain  compliance areas, particularly data accuracy and investigations  conducted in response to consumer disputes. On an annual basis, CFPB  updates its plans for supervision of CRAs and furnishers for the next 1 to  2 years. According to CFPB, it assesses specific risks in the market and  determines entities and compliance areas to examine. In making these  determinations, CFPB stated that it considers factors such as market  presence, consumer complaints, its prior supervisory examinations and  findings, and its resources.

Supervisory Priorities for CRAs and Data Furnishers

According to CFPB, since the start of its supervisory program for the  consumer reporting market in 2012, CFPB has prioritized CRAs that pose  the greatest risks to consumers and the marketplace for examinations.  Specifically, CFPB staff told us that CFPB has prioritized CRAs that  represent a significant share of the market and the largest volume of  consumer complaints submitted to CFPB’s complaint database. CFPB  has also examined one or more specialty CRAs. CFPB stated that in  determining which specialty CRAs to examine, it considered factors such  as the CRAs’ market share in the particular consumer reporting products  they offer. According to CFPB, in setting supervisory priorities,  supervision staff also consulted with stakeholders and considered CFPB’s  resources and findings from prior examinations that may have indicated  weaknesses.

CFPB staff said that when CFPB began examining CRAs, its supervisory  approach was to examine their compliance management systems first  before focusing on other compliance areas. The staff said that the  compliance management system reviews helped CFPB to learn about  how CRAs operate. Based on the compliance management reviews,  CFPB determined that it could review data accuracy, dispute  investigations, and other compliance areas by examining the mechanisms  CRAs use to comply with FCRA. After examining compliance  management systems, CFPB prioritized examining other aspects of  compliance related to data accuracy (including processes for monitoring  furnishers) and dispute investigations, as well as performing follow-up  examinations in those areas. CFPB staff stated that they have chosen to  focus on data accuracy and dispute investigations because these were  the largest problem areas based on CFPB’s assessment of complaint  data. Additionally, CFPB identified compliance with the FCRA obligations  regarding data accuracy and effective and efficient dispute resolution as  agency priorities for the consumer reporting market.

CFPB has also examined other CRA compliance areas, including  procedures related to suppression and reinsertion of information that  CRAs found to be inaccurate, unverifiable, or obsolete; procedures for  ensuring a permissible purpose for obtaining consumer reports; and  compliance management systems related to data security. According to  CFPB, when determining compliance areas for examination, the agency  considered factors such as its data on complaints, the extent to which it  had previously examined the areas, and concerns identified in prior  examinations. In February 2019, we found that CFPB’s examination  process did not routinely include an assessment of CRAs’ data security  risks, and we recommended that CFPB’s prioritization specifically account  for data security risk.

In conducting its examinations, CFPB has focused on assessing CRA  procedures for complying with FCRA rather than on the extent of  inaccuracy in consumer reports. For example, according to a 2017 CFPB  report, CFPB directed one or more CRAs to establish quality control  programs to regularly assess the accuracy of information included in  consumer reports and to develop systems to measure the accuracy of  consumer reports and identify patterns and trends in errors. CFPB staff  said CFPB has not monitored the extent of inaccuracy in consumer  reports produced by the CRAs it examines. They stated that FCRA  requires CRAs and furnishers to follow reasonable procedures with  regard to accuracy but does not require or identify acceptable thresholds  for accuracy. CFPB staff explained that CFPB’s supervisory program has  therefore focused on evaluating CRAs’ compliance with FCRA  requirements for reasonable procedures with regard to accuracy and  identifying weaknesses in such procedures.

According to CFPB, in prioritizing examinations of data furnishers, the  agency has primarily considered the furnishers’ market shares, the  number of disputes CRAs received about the furnishers, and the number  of complaints CFPB received in its complaint database. CFPB has  prioritized large furnishers within their respective markets. For example,  CFPB identified one or more student loan servicers furnishing data to  CRAs that had large shares of the student loan servicing market. CFPB  has also prioritized furnishers with high dispute rates relative to other  furnishers within their markets. For example, CFPB identified one or more  credit card issuers with higher dispute rates compared to their peers,  based on CFPB’s review of dispute data provided by CRAs. According to  CFPB, it has also considered the results of prior CFPB examinations and  input from agency stakeholders. As with CRAs, CFPB’s examinations of  furnisher activities have focused on accuracy and dispute investigations.  In its Supervisory Highlights from March 2017, CFPB stated that the  accuracy of consumer report information is a CFPB priority and that  furnishers play an important role in ensuring the accuracy of consumer  report information through the dispute process. For example, CFPB  stated that furnishers’ timely response to consumer disputes may reduce  the effect that inaccurate negative information on a consumer report may  have on the consumer.

Examination Results for CRAs and Furnishers

From 2013 through 2018, CFPB examined several CRAs. Many of these  examinations evaluated CRA compliance with accuracy and dispute  investigation obligations under FCRA, such as by assessing data  governance systems, quality control programs, and furnisher oversight  and data monitoring. Additionally, some examinations evaluated other  FCRA compliance areas, including ensuring that users had permissible  purposes for requesting consumer reports and preventing reinsertion of  previously deleted information.

CFPB’s examinations related to data accuracy and dispute investigation  obligations resulted in supervisory findings that CFPB directed CRAs to  take actions to address. CFPB found that one or more CRAs had minimal  compliance mechanisms in place to meet requirements for data accuracy  and for dispute investigations (see table 4 for examples of CFPB’s  supervisory findings and directed actions in these areas). For example,  CFPB found that one or more CRAs lacked quality control policies and  procedures to test compiled consumer reports for accuracy and had  insufficient monitoring and oversight of furnishers that provided  information used in the reports. CFPB also found that one or more  CRAs did not review evidence that consumers provided to support their  disputes and relied entirely on the furnishers to investigate the disputes.  CFPB directed specific changes in some CRAs’ policies and procedures  for ensuring data accuracy and conducting dispute investigations,  including increasing oversight of incoming data from furnishers,  developing internal processes to monitor furnisher dispute responses to  detect those that may present higher risk of inaccurate data, and  enforcing the CRAs’ obligation to investigate consumer disputes,  including review of relevant information provided by consumers. In  addition, CFPB directed one or more CRAs to establish quality control  programs that regularly assess the accuracy and integrity of compiled  consumer reports.

In follow-up reviews of some of its supervisory findings, CFPB found that  one or more CRAs took actions that resulted in improvements in policies  and procedures. For example, CFPB has found that one or more CRAs  established quality control programs, including developing tests to identify  the extent to which consumer reports are produced using information for  the wrong consumer. For other findings, CFPB determined that one or  more CRAs had not taken actions to address the findings, or CFPB had  not yet conducted follow-up examinations to determine if they had been  addressed.

From 2013 through 2018, CFPB conducted examinations of several data  furnishers. These furnishers were involved in various consumer financial  markets, such as automobile loan servicing, debt collection, mortgage  servicing, and student loan servicing. CFPB staff told us that until 2017,  CFPB generally examined furnishers’ compliance with FCRA as part of its  assessment of compliance with other Federal consumer financial laws  and regulations. CFPB staff said that in 2017, CFPB began conducting  examinations specifically focused on furnishing activities under FCRA and  Regulation V. CFPB stated that this change was made because the  review of furnishers’ practices under FCRA and Regulation V was  resource-intensive and merited dedicated resources.

In a 2017 report, CFPB stated that it had found numerous furnisher  violations of FCRA and Regulation V related to data accuracy and dispute  investigations and that it directed furnishers to take corrective actions  (see table 5 for examples of CFPB’s supervisory findings and directed  actions). For example, CFPB found that certain furnishers failed to  establish, implement, and maintain reasonable written policies and  procedures consistent with Regulation V regarding the accuracy and  integrity of the information furnished; provided information to CRAs  despite having reasonable cause to believe the information was  inaccurate; and lacked policies for their employees on how to conduct  reasonable investigation of consumer disputes. In some cases, CFPB’s  furnisher examinations conducted from 2013 through 2018 resulted in  findings related to FCRA and Regulation V that CFPB directed the  furnishers to take actions to address. For example, CFPB directed  furnishers to develop reasonable written policies and procedures  regarding accuracy, to promptly update the information provided to CRAs  after determining that the information was not complete or accurate, and  to update and implement policies and procedures to ensure disputes are  handled in accordance with FCRA requirements.

CFPB staff told us that the agency decides whether to investigate based  on consideration of factors such as consumer complaints, extent of  effects on consumers, and severity of misconduct. CFPB staff told us  that, in many cases, CFPB has chosen to identify and correct FCRA  violations and weaknesses in compliance management systems at CRAs  through supervisory activity rather than enforcement investigations.  However, CFPB has also investigated and used enforcement remedies,  such as civil penalties and injunctive relief, against CRAs and furnishers  that violated FCRA or Regulation V. From 2012 through 2018, CFPB  settled 26 enforcement actions for violations related to FCRA and  Regulation V, including four settlements involving CRAs and 16  settlements involving furnishers. Although CFPB found other FCRA  violations in its investigations of these companies, such as those related  to permissible purpose for obtaining consumer reports and disclosure  issues, most of the violations related to data accuracy and dispute  investigations. For example, two of the four FCRA-related settlements  with CRAs involved dispute investigations or data accuracy procedures.  Of the 16 settlements with furnishers for alleged violations related to  FCRA and Regulation V, all contained violations related to the furnishers’  obligations regarding data accuracy or dispute investigations.

CFPB’s settlements contained findings similar to its supervisory  examination findings. For example, CFPB found that a CRA failed to  investigate consumer disputes, and another CRA failed to take steps to  ensure its consumer reports were accurate. For furnishers, CFPB found  violations including furnishers that failed to establish and implement  reasonable written policies and procedures regarding the accuracy and  integrity of information provided to CRAs, as well as furnishers that  provided inaccurate or incomplete information about consumers to CRAs  or failed to conduct reasonable investigations of consumer disputes.

CFPB Has Not Defined Expectations for CRA Accuracy and Dispute Investigation Procedures

CFPB has not defined its expectations—including views on appropriate  practices—for how CRAs can comply with key FCRA requirements.  Among other provisions, FCRA requires CRAs to (1) follow reasonable  procedures when preparing a consumer report to assure maximum  possible accuracy of consumer report information and (2) conduct  reasonable investigations of consumer disputes. However, FCRA does  not define what would constitute such reasonable policies and procedures  or investigations or stipulate the types of procedures or investigations that  would meet the requirements for CRAs.

While CFPB has not defined its expectations for these two key FCRA  requirements for CRAs, it has adopted Regulation V, which, as required  by statute, includes information on CFPB’s requirements and guidelines  in these areas for furnishers. Regulation V includes requirements and  guidelines for reasonable policies and procedures concerning the  accuracy and integrity of furnished consumer information and  requirements for reasonable investigations of consumer disputes filed  directly with the furnishers. In its supervision of furnishers, CFPB has  examined furnishers for compliance with the requirements of Regulation  V—for example, it has found in examinations that furnishers violated  Regulation V’s requirement to establish written policies and procedures  regarding the accuracy of consumer information furnished to a CRA.

Although CFPB has not similarly established guidelines or otherwise  provided information on its supervisory expectations for CRAs, CFPB has  found specific weaknesses in CRA practices. In particular, CFPB has  cited one or more CRAs for specific deficiencies related to determinations  of noncompliance with FCRA provisions regarding reasonable procedures  for accuracy and dispute investigations. For example, CFPB has directed  one or more CRAs to take specific actions to improve their accuracy  procedures. In addition, CFPB found one or more CRAs’ data governance  programs to be decentralized and informal, and it directed the CRAs to  develop and implement written policies and procedures to formalize the  programs. However, CFPB has not issued any information on its  supervisory expectations indicating that “reasonable procedures” include  having formal written policies and procedures. CFPB also has identified  FCRA violations related to reasonable dispute investigations. For  example, CFPB determined that one or more CRAs failed to review and  consider documentation attached by consumers to disputes and relied  entirely on furnishers to investigate a dispute—therefore violating FCRA  requirements for reasonable investigations and for reviewing and  considering all relevant information submitted by the consumer—and  directed the CRAs to independently investigate consumer disputes.  However, CFPB has not issued any information on its supervisory  expectations to help interpret FCRA’s requirement for CRAs to conduct a  reasonable investigation of disputes and to review and consider all  relevant information, including the expectation that CRAs investigate  consumer disputes independently. Based on the FCRA requirements  alone, it may be unclear to CRAs and others that these FCRA  requirements include performing independent investigations. For  example, representatives from one large CRA we interviewed stated that  the company is not required to conduct an independent investigation.

FCRA instructs CFPB to enact regulations that are necessary to carry out  the purposes of the act, which could include issuing implementing  regulations for CRAs regarding data accuracy and dispute  investigations. Additionally, a 2018 policy statement issued by CFPB  and the prudential regulators explains that information on supervisory  expectations serves to articulate an agency’s general views regarding  appropriate practices. The policy statement further states that it is  important for such information to provide insight to industry, as well as to  supervisory staff, in a transparent way that helps to ensure consistency in  the supervisory approach. According to CFPB’s Supervisory Highlights  from March 2017, CFPB’s vision for the consumer reporting system is a  system in which furnishers provide and CRAs maintain and distribute data  that are accurate, supplemented by an effective dispute management and  resolution process for consumers. According to the same CFPB  publication, this vision is rooted in the obligations and rights set forth in  FCRA and Regulation V.

One reason why accuracy guidelines exist for furnishers but not CRAs is  that the Fair and Accurate Credit Transactions Act of 2003 added a  provision to FCRA requiring the prudential regulators and FTC to  establish and maintain guidelines for furnishers regarding the accuracy of  consumer data furnished to CRAs and to prescribe regulations requiring  furnishers to establish reasonable policies and procedures for  implementing the guidelines. In 2011, CFPB adopted these regulations  as part of Regulation V after assuming rulemaking authority from the  other agencies. Neither the Fair and Accurate Credit Transactions Act of  2003 nor any other statutory provision within FCRA includes a similar provision for the agencies to establish and maintain guidelines or provide  information concerning supervisory expectations regarding the accuracy  of consumer data CRAs maintain, and CFPB has not established  guidelines or defined supervisory expectations for CRAs.

Since 2015, CFPB’s long-term rulemaking agenda has stated that it will  evaluate possible policy responses to consumer reporting issues,  including potential additional rules or amendments to existing rules  governing consumer reporting accuracy and dispute processes. However,  as of May 2019, CFPB had not conducted any rulemaking related to  these topics. CFPB staff said that a substantial body of case law exists to  guide CRAs regarding what practices may be considered compliant with  FCRA requirements, including with respect to provisions for reasonable  procedures for accuracy and performing reasonable dispute  investigations. The staff also said that CFPB staff look to relevant case  law when assessing CRA compliance with FCRA during examinations,  and that supervisory findings serve to communicate to a supervised CRA  how CFPB has applied FCRA during an examination.

Providing information to CRAs about its supervisory expectations for  these two key FCRA requirements—and ways in which CRAs could  comply—could help CFPB to facilitate CRA compliance with FCRA and  achieve agency objectives for the consumer reporting system. Without  information about its expectations, CFPB’s supervision lacks  transparency about what practices it considers appropriate or expects  CRAs to adopt to comply with key FCRA requirements. Absent such  information from CFPB, representatives from four CRAs we interviewed  told us that they look to other sources to understand what CFPB will  consider to be noncompliant during examinations and to determine if they  are meeting FCRA requirements for maintaining reasonable procedures.  These sources include publicly available information such as court cases,  presentations from industry associations, CFPB publications highlighting  supervisory actions, and public enforcement actions. While CFPB can  communicate with individual CRAs during examinations and by directing  corrective actions, the impact of such interactions is limited to specific  CRAs rather than helping to ensure consistency in its supervisory  approach by providing transparent insights to the industry.

While relevant case law could provide CRAs with some information  regarding practices that have been determined to be compliant with  FCRA requirements, there may be a lack of clarity about the extent to  which all case law fully reflects CFPB’s expectations. By communicating  information about its expectations and ways in which CRAs could comply,  CFPB could help ensure that CRAs receive complete and consistent  information about how to interpret key FCRA requirements. Further,  defining its expectations regarding how CRAs can meet key FCRA  requirements could help CFPB promote consistency in its supervisory  approach by providing examiners with information on the agency’s  interpretation of FCRA provisions.

FTC Enforcement Targets Smaller CRAs, and Prudential Regulators Examine Some Furnishers’ FCRA Compliance

FTC Enforcement Actions Have Focused on Smaller CRAs’ Data Accuracy, Dispute Investigation, and Data Security Practices

FTC’s enforcement actions since 2010 have targeted smaller CRAs. FTC  staff told us that because CFPB has supervisory authority over the larger  CRAs, FTC has focused its FCRA enforcement efforts on other CRAs.  Additionally, our review of FTC’s enforcement actions showed that FTC  generally took enforcement actions against specialty CRAs that are  smaller than the nationwide CRAs, such as CRAs conducting background  screening. However, FTC staff also told us that they do not use a specific  size threshold to initiate investigations against CRAs or furnishers and  that they conduct their enforcement on a case-by-case basis, focusing on  violations or potential violations of applicable laws.

Prior to taking an enforcement action against a company, FTC conducts  an investigation to determine if the company has violated a law. Using its  investigative authority, FTC can compel companies to produce  documents, testimony, and other materials to assist in its investigations.  To determine whether to initiate investigations, FTC staff said they  consider several sources, including leads from consumer advocacy  groups and other FTC investigations, tips from whistleblowers, and  monitoring of media reports. FTC staff also said that FTC regularly  monitors its consumer complaint database to identify the types of  complaints that consumers file and to determine if the activity described in  the complaint indicates potential noncompliance with laws and  regulations. FTC also can start investigations based on requests, such as  by a member of Congress. FTC staff said that the agency targets its  investigations based on the extent to which the potential noncompliance  may affect a large number of consumers. For example, staff said FTC  targets companies for investigation where inaccuracies may be occurring  on a large scale. In addition, as we reported in February 2019, FTC staff  said that when determining whether to initiate an investigation related to  privacy and data security matters, they consider factors such as the  companies’ size and the sensitivity of the data in the companies’  networks.

FTC staff said that the consumer reporting market is a high priority for  FTC, and that the accuracy of consumer reports and CRA activities has  been a large part of FTC’s enforcement priorities. FTC staff said that they  initiated about 160 FCRA investigations from 2008 through 2018. FTC  staff stated that of the approximately 160 investigations, about 70 related  to CRAs or companies, such as data brokers and companies selling  public records, that FTC investigated to determine if they were engaged  in conduct that would render them CRAs. Additionally, the staff said that  about 20 of the approximately 160 investigations related to furnishers,  about 55 related to users of consumer reports, and about 15 related to  companies that fall under provisions of FCRA that do not require that the  entity be a CRA, furnisher, or user. FTC staff stated that among these  investigations, FTC investigated specialty CRAs, such as background- screening and check-authorization companies, and furnishers, such as  debt collectors, lenders, and telecommunications companies.

After an investigation, FTC may initiate an enforcement action if it has  reason to believe that a law is being or has been violated. From 2010  through 2018, FTC took 30 enforcement actions related to FCRA,  including against 14 CRAs, six furnishers, and two companies that acted  as both a CRA and furnisher. Of the 30 enforcement actions, 14  contained issues related to data accuracy or disputes and two contained  issues related to data security. In total, 20 of the 30 enforcement actions  contained issues related to other consumer reporting topics, such as  provision of consumer reports without permissible purpose. FTC staff told  us that all of the enforcement actions related to FCRA involved injunctive  relief. Additionally, some enforcement actions involved civil penalties. For  example, in one action, a CRA was ordered to pay civil penalties for  failing to use reasonable procedures to ensure the maximum possible  accuracy of information it provided to its customers, and for failing to  reinvestigate consumer disputes, as required by FCRA. FTC alleged that  the CRA failed to take reasonable steps to ensure that the information in  the reports was current and reflected updates, such as the expungement  of criminal records. FTC staff said that there is no overarching definition  regarding the FCRA provision for reasonable procedures for assuring  maximum possible accuracy and that FTC determines on a case-by-case  basis whether a violation has occurred. FTC staff also said that FTC’s  enforcement actions provide industry with information on unacceptable  practices and that the enforcement actions are closely monitored by the  consumer reporting industry.

In addition to enforcement actions related to FCRA, FTC staff told us that  FTC took five actions against CRAs for unfair or deceptive acts or  practices related to data security in the past 10 years. FTC alleged that  all five CRAs failed to employ reasonable and appropriate security  measures to protect sensitive consumer information.

Prudential Regulators Said They Examine Some Furnishers’ FCRA Compliance in Conjunction with Other Laws and Regulations

As discussed previously, the prudential regulators have supervisory and  enforcement authority for FCRA over depository institutions and credit  unions with total assets of $10 billion or less, some of which act as  furnishers. The four prudential regulators told us they do not perform  standalone examinations of these financial institutions for FCRA  compliance. Rather, they examine for FCRA compliance in conjunction  with other consumer financial laws and regulations and as part of  examining an institution’s compliance with federal consumer protection  laws and regulations. For example, OCC staff told us that if an examiner  reviews an institution’s general compliance management system and  identifies compliance, procedural, or other weaknesses related to FCRA,  then the examiner would look at those issues more closely. Staff from the  four prudential regulators told us they take a risk-based approach to  determine the scope of examinations. They said that the approach  includes consideration of factors such as an institution’s asset size,  record of FCRA compliance, and trends in consumer complaints.

As part of their compliance examinations from 2013 through 2018, staff  from FDIC, the Federal Reserve, and NCUA said their agencies identified  multiple FCRA- and Regulation V-related findings, including findings not  related to financial institutions’ furnishing activities. FDIC staff said that  examiners identified more than 1,200 violations related to FCRA and  Regulation V at around 800 institutions, but found that the majority of the  violations posed a low level of concern to the institution and consumers.  Of these violations, FDIC staff stated that 106 related to furnisher  obligations under Regulation V regarding the accuracy and integrity of  information furnished to CRAs and that those types of violations were  among the five most frequently cited violation topics related to FCRA and  Regulation V. Federal Reserve staff said that in examinations that  reviewed compliance with FCRA and Regulation V, Federal Reserve  examiners cited FCRA and Regulation V about 210 times for an  aggregate of about 4,200 related violations. Of these, Federal Reserve  staff said the agency cited FCRA and Regulation V provisions related to  furnisher accuracy about 20 times and cited an aggregate of about 3,600  violations. NCUA staff stated that NCUA identified 160 FCRA violations at  around 150 credit unions. NCUA staff explained that 20 of the violations  related to furnisher accuracy and that these types of violations were not  among the five most frequently cited violation topics related to FCRA.  OCC staff told us that OCC identified no findings related to FCRA or  Regulation V from 2013 to 2018.

Three prudential regulators stated that they consider the risk that a FCRA  or Regulation V violation poses to the depository institution, including risk  to consumers. For example, FDIC staff stated that the violations they  cited may have had a small but negative effect on consumers, or may  have the potential to have a negative effect in the future if uncorrected.  FDIC staff added that such violations may also pose compliance and  legal risks to the institution. NCUA staff stated that they require corrective  action for any FCRA violation, and that they consider the pervasiveness  of violations—particularly a risk of systemic or repeated violations—in  determining the appropriate supervisory action.

Stakeholders Identified Various Causes for Inaccuracies in Consumer Reports, and Several Processes Exist to Help Promote Accuracy

Stakeholders Primarily Attributed Inaccuracies to CRAs Matching Data to the Wrong Consumer Files and Errors in Source Data

CFPB, FTC, and industry stakeholders attributed inaccuracies in  consumer reports to several causes, including (1) CRAs matching data to  the wrong consumer files due to missing, inaccurate, or inconsistent  personally identifiable information; (2) errors in furnished data; (3) timing  of data updates; and (4) identity fraud or theft. In particular, CFPB, FTC,  and industry stakeholders most frequently cited CRAs mismatching data  and errors in furnished data as the primary causes of consumer report  inaccuracies.

Matching Furnished Data to the Wrong Consumer Files

Several industry stakeholders identified CRAs’ mismatching of furnished  data or public records to consumer files as a major source of inaccuracies  in consumer reports. Two of the consumer groups we interviewed— Consumers Union and the National Consumer Law Center—also cited  mismatching of data to consumer files as a source of inaccuracies in  reports they published. In addition, FTC and CFPB reported in separate  studies in 2012 that mismatching is a key source of inaccuracies in  consumer reports. When CRAs do not correctly match data to the  appropriate consumer files, the consumer’s file may contain data  pertaining to another consumer. Alternatively, data can be excluded from  the “correct” consumer’s file. For example, if one consumer’s report  contains information about a different consumer’s debt payment history or  collections activity, this information would also be missing from the file of  the consumer who generated that activity.

CFPB reported in its 2012 study that inconsistent, inaccurate, or  incomplete personally identifiable information can cause errors in  matching furnished data to the correct consumer’s file. CFPB, FTC, and  industry stakeholders—three CRAs, a CRA industry group, and a  consumer group—identified multiple reasons why personally identifiable  information in data furnished to CRAs may be inconsistent, inaccurate, or  incomplete, including the following examples:

Consumers may use variations of their names when establishing an  account with financial institutions (such as Kathy and Katherine).

Consumers may change their names as a result of divorce or  marriage, but the name change may not be reflected in furnished  data.

Consumers with suffixes in their names (such as junior or senior) may  not consistently use suffixes in their applications.

Furnishers may omit personally identifiable information.

Furnishers may input consumers’ information incorrectly during data  entry.

In addition, CFPB stated in its 2012 report that matching public records to  consumers’ files can be particularly challenging for CRAs because public  records rarely contain Social Security numbers.

The processes CRAs have in place to match data to consumers’ files may  also contribute to inaccuracies in consumer reports. Generally, CRAs use  various combinations of personally identifiable information to match data  to consumers. For example, representatives from one CRA said the CRA  uses at least the name and address to conduct matches. These  representatives said that where only name and address are used, the  address is required to be an exact match while the name can be a logical  variation determined by the CRA’s algorithm. Representatives from  another CRA said that the CRA matches public record information using  at least the full name and date of birth but not the Social Security number  because it is difficult to obtain. According to a CFPB report, the three  nationwide CRAs—as part of their settlements with multiple state Attorney  General offices—now require name, address, and Social Security number  or date of birth to be present in public records furnished to them and use  that personally identifiable information to conduct matches.  Representatives from three consumer groups attributed consumer report  inaccuracies to how CRAs make such matches. For example,  representatives of two consumer groups said that CRAs could reduce  inaccuracies arising from mismatching by using stricter requirements,  such as requiring both Social Security number and date of birth, in  addition to names and addresses, or only matching data to consumers if  all nine digits of the Social Security number are present.

Altogether, the errors originating from consumers or furnishers, as well as  processes that CRAs have in place for matching, affect the accuracy of  consumer reports (see fig. 3).

CFPB and representatives from several industry stakeholders identified  errors in furnished data as a primary cause of consumer report  inaccuracies. Even when a CRA matches data to the correct consumer  file, the consumer report can still contain inaccuracies if the information a  furnisher provided to the CRA regarding the consumer contained errors  (see fig. 4). CFPB has reported and a few CRAs told us that CRAs  conduct quality checks to identify issues including blank fields or logical  inconsistencies in furnished data, such as reporting of new account  balance for closed consumer accounts. The CRA can reject furnished  data or ask furnishers to provide corrected data. However, a CFPB report  and a few industry stakeholders we interviewed identified weaknesses in  furnisher and CRA processes as contributing to errors in furnished data.  Two of the consumer groups we interviewed—Consumers Union and the  National Consumer Law Center—also cited weaknesses in furnisher and  CRA processes as contributing to errors in furnished data in reports they  published.

Processes for handling consumer transactions. CFPB reported  that problems with processes used by furnishers include failing to  update records, failing to post a payment, and misattributing  ownership of an account to an individual who is only an authorized  user.

Processes for handling data accuracy. CFPB also reported and a  few stakeholders told us that some furnishers lack processes for  ensuring the accuracy of data submitted to CRAs and some CRAs  lack processes for ensuring the accuracy of furnished data.

CFPB reported and representatives from a few industry stakeholders said  that timing of data updates in furnished data and court records could be a  source of potential inaccuracies. For example, representatives from one  CRA said that an address or name change can take up to two billing  cycles to be reflected in a consumer report. Additionally, representatives  from a CRA industry group told us that online court records, where CRAs  may obtain data, often lag behind paper court records. Representatives  from one consumer group pointed to the timing of when furnishers report  debt as a source of potential inaccuracies.

CFPB, the National Consumer Law Center, and Consumers Union have  reported that identity fraud and theft are causes of inaccuracies in  consumer reports. Additionally, representatives from one CRA also told  us that identity fraud and theft are primary causes of inaccuracies. For  example, identity thieves can create new credit accounts in a consumer’s  name and let the debt go unpaid. Such debts then may be reflected in the  consumer’s account and be reported to CRAs if not identified by the  furnisher as resulting from fraudulent activity.

Consumers Can Dispute Potential Inaccuracies in Their Consumer Reports with CRAs or Furnishers

Consumers can dispute the accuracy or completeness of their consumer  reports with the CRAs that produced the consumer reports, with the data  furnishers, or both. As stated previously, FCRA requires CRAs to conduct  reasonable investigations of consumer disputes; FCRA, Regulation V,  and FTC’s Furnisher Rule, as applicable, generally also require furnishers  to conduct reasonable investigations of consumer disputes. If consumers  are dissatisfied with the results of the investigations conducted by the  CRAs or furnishers, they have a few options, discussed in detail below.

FCRA requires CRAs and furnishers to take specific steps to respond to  consumer disputes. When a consumer files a dispute with the CRA, the  CRA must investigate the dispute internally, and once the CRA notifies  the furnisher of the dispute, the furnisher must also investigate the  disputed information (see fig. 5). If the CRA’s internal investigation or  the furnisher’s investigation finds that the disputed item is inaccurate,  incomplete, or cannot be verified, the CRA must delete the disputed item  from the consumer’s file or modify the information and notify the furnisher  of the action taken. The CRA must notify the consumer of the  investigation results. Representatives from six of the CRAs we  interviewed said that they consider disputes resolved when they or the  furnishers complete their investigations and notify consumers of the  results, even if the consumer does not agree with the results. If a  furnisher does not conduct an investigation and report to the CRA within  the time frame required by FCRA, then the CRA must remove the  disputed information from the consumer’s file.

Certain furnisher processes for investigating a dispute received from a  CRA and a dispute received directly from the consumer are similar under  FCRA. When a furnisher investigates a dispute received from a CRA, the  furnisher must report the results of the investigation to the CRA that  forwarded the dispute. If the furnisher receives the dispute directly from a  consumer, then it must investigate the dispute and report the results of  the investigation to the consumer, generally within 30 days (see fig. 6). In  both cases, the furnisher must provide corrected information to every  CRA to which it provided the information.

CRAs may have differing dispute investigation processes in place  because of regulatory requirements or because of how they obtained their  data. Under FCRA, the nationwide CRAs are required to maintain an  automated system through which furnishers can report incomplete or  inaccurate information in a consumer’s file. The nationwide CRAs share  the use of an automated system that sends disputes to furnishers and  receives furnishers’ responses to the disputes. Other CRAs are not  required by FCRA to use an automated system. Representatives from  one CRA told us that the CRA uses email and phone calls to send  disputes to and receive responses from furnishers. Representatives from  a CRA industry group, as well as representatives from a background- screening CRA, said that compared to CRAs that obtain information from  furnishers, background-screening CRAs generally obtain records from  courts and therefore conduct their dispute investigations by confirming  court records and contacting court officials.

Consumers have several options to address potential inaccuracies in their  consumer reports if they disagree with the results of a CRA or furnisher  investigation, but these options have potential limitations, according to the  stakeholders we interviewed.

Placing a consumer statement on the report. Under FCRA, if the  investigation does not resolve the dispute (where the dispute is filed  with a CRA), the consumer may place a statement regarding the  nature of the dispute on the consumer report, such as why the  consumer disagreed with the reported item. According to the three  nationwide CRAs, such statements alert creditors to the consumer’s  disagreement. However, the statement does not modify or remove the  information that the consumer perceived to be inaccurate from the  consumer report, and users of the consumer report may or may not  consider the consumer’s statement in their decision-making.

Resubmitting disputes to CRAs or furnishers. Consumers who  believe their disputes have not been satisfactorily resolved may  choose to resubmit disputes regarding the same items that they  disputed previously to CRAs or to the furnishers. If a consumer  submits a dispute and does not provide sufficient information to  investigate the disputed information or resubmits a dispute and does  not provide additional or new supporting information, a CRA or  furnisher may determine that the dispute is frivolous or irrelevant and  does not warrant an investigation. Representatives from one CRA  told us that if the CRA receives a dispute from a consumer about an  item that was previously disputed, it would review consumer records  to see if it has verified the consumer’s information previously. If so,  the CRA would ask the consumer to provide additional documentation  or to contact the furnisher to obtain support for the dispute. In some  cases, consumers may turn to third parties that submit disputes on  their behalf. Representatives from one CRA said that the CRA does  not investigate disputes that certain third parties submit on behalf of  consumers because these third parties dispute the same items  repeatedly. Representatives from another CRA said that the CRA  reviews third-party dispute requests to determine if the third party has  proper authorization from consumers to act on their behalf.

Submitting complaints to federal and state agencies. Consumers  can submit complaints about inaccuracies in their consumer reports to  federal and state agencies, such as CFPB and state Attorney General  offices. CFPB has stated that it forwards these complaints to CRAs  and works with them to obtain responses within 15 days. Staff from  several state agencies we interviewed generally told us that after  receiving complaints, they contact CRAs about the complaints to  obtain responses but do not compel CRAs to take specific actions.  CFPB has reported that CRAs handle complaints similarly to  consumer disputes. As a result, although complaints are separate  from the dispute process required under FCRA, the effectiveness of  this option also depends on the same CRA processes for addressing  inaccuracies. However, representatives from two consumer groups  said that submitting complaints to CFPB through its consumer  complaint database has helped consumers resolve inaccuracies in  their reports. Representatives from one consumer group said the  publication of complaints in CFPB’s database helps to hold CRAs  accountable and incentivizes CRAs to respond.

Taking private legal action. Under FCRA, consumers have private  rights of action—or ability to litigate—against CRAs and furnishers,  under certain provisions. Consumers have brought legal claims  against CRAs and furnishers for failure to follow reasonable  procedures to assure maximum possible accuracy or conduct a  reasonable investigation of a dispute. Under FCRA, consumers can  sue a furnisher for failure to conduct a proper investigation when  notified by a CRA that a consumer has disputed information provided  by the furnisher. However, before initiating suit, the consumer must  first dispute the information with the CRA. A consumer may initiate  a dispute through a CRA even if the consumer has previously initiated  a dispute with the furnisher. Representatives from two consumer  groups and one state agency told us that in general, consumer  barriers to litigation include that it is time-consuming and has  potentially high legal costs and that consumers might be unaware of  their legal rights.

Oversight Has Led CRAs to Make Changes to Promote Accuracy, but Challenges to Consumer Report Accuracy Remain

As a result of CFPB and FTC oversight and settlements with multiple  state Attorneys General, the nationwide CRAs and several other CRAs  have made changes in their policies and procedures to improve data  accuracy and processes for addressing inaccuracies in consumer reports.  However, CFPB and a few industry stakeholders said that challenges to  improving accuracy in consumer reports remain.

According to CFPB and nationwide CRAs, examples of the changes that  CRAs have made as a result of oversight include the following:

Changes as a result of CFPB supervision. According to CFPB, as a  result of supervisory findings, one or more CRAs have implemented  or changed policies and procedures related to ensuring accuracy and  dispute investigations. These include (1) establishing a data- governance structure to oversee furnisher monitoring, such as by  developing policies and procedures for ongoing and systemic  screening of furnishers; (2) implementing systems to forward relevant  dispute documents submitted by consumers to furnishers; and (3)  implementing policies and procedures to ensure consideration of all  supporting material submitted by consumers.

Changes as a result of CFPB and FTC enforcement. As a result of  CFPB’s and FTC’s enforcement, the two agencies directed a few  CRAs to revise the procedures they use to match data using  personally identifiable information. For example, CFPB directed two  background-screening CRAs to revise procedures for assuring  accuracy, such as by using algorithms to distinguish records by  middle name and to match common names and nicknames. In  another example, FTC directed a background-screening CRA that  required an exact match of a consumer’s last name and a nonexact  match of first name, middle name, and date of birth to put in place  reasonable procedures to ensure maximum possible accuracy.

Changes as a result of state oversight. According to the three  nationwide CRAs, they have implemented measures as a result of  their 2015 settlements with multiple state Attorneys General. For  example, they stated they monitor data furnishers’ dispute responses  and take corrective actions against data furnishers for noncompliance  with their dispute investigation responsibilities. Additionally, they  established special handling procedures for disputes involving mixed  files, fraud, and identity theft and provided CRA employees with  discretion to resolve such disputes, rather than relying on furnishers’  responses.

In addition to the changes described above, representatives at various  CRAs said they had quality assurance processes in place to help ensure  that furnished data are accurate and that furnishers are responsive to  disputes.

Monitoring of furnished data. Representatives from four CRAs said  that they use various mechanisms to monitor furnished data to detect  potential inaccuracies and take corrective actions against furnishers  that do not comply with data furnishing standards. For example,  representatives from three CRAs told us they compare data  submissions against industry patterns and historical trends—such as  data submission history over the past 6 months—to identify anomalies  that would suggest erroneous data and take actions such as rejecting  incoming data and returning data for correction. Representatives from  one of these CRAs said that they analyze why a furnisher deviates  from industry trends and help the furnisher identify and implement  changes. Representatives from four CRAs told us that they provide  regular reports, such as monthly reports, on data quality to furnishers.  We reported previously that such steps may improve the quality of the  information received from furnishers but cannot ensure the accuracy  of such data.

Monitoring of dispute investigations. Representatives from four  CRAs said they have processes in place to help ensure that  furnishers are responsive to disputes. For example, representatives  from one CRA said that the automated system they use to correspond  with furnishers about disputes automatically identifies illogical  furnisher responses; the CRA contacts the furnisher to confirm the  accuracy of those responses. Representatives from four CRAs told us  that they monitor furnisher responses to disputes, such as dispute  trends by furnisher type and the rate at which furnishers do not  respond to disputes.

Although CRAs have made changes to improve processes for ensuring  accuracy and addressing inaccuracies, CFPB and industry stakeholders  said that challenges remain in these areas. First, CFPB staff told us that  the consumer reporting market has historically had comparatively less  regulatory intervention than other regulated markets. As a result, the staff  said that it has been challenging to change CRAs’ approach to a  proactive one, whereby the CRAs proactively address compliance and  change practices, as opposed to a defensive, reactive approach in  response to consumer disputes and lawsuits. CFPB staff explained that  this has been a focus of CFPB’s supervision and said that its examination  findings have demonstrated that CRAs can take actions to improve  accuracy. Further, representatives from three consumer groups said that  consumer report inaccuracy remains a challenge because CRAs lack  incentives to be responsive to consumers, in part because the CRAs’  customers are the users of consumer reports, such as banks and  employers, rather than the consumers themselves. Additionally, two  industry stakeholders identified gaps in furnisher responsibilities for  ensuring accuracy as a challenge. Representatives from one of these  stakeholders, a state agency, said that furnishers often do not know their  responsibilities for ensuring the accuracy of their data. Representatives  from the other stakeholder, a CRA, said that while the CRA has  implemented policies and procedures to ensure accuracy in response to  CFPB’s supervision, furnishers might not have implemented similar  policies and procedures to ensure the accuracy of the data provided.

Consumer reports affect the lives of millions of Americans because of the  role they play in many important decisions, such as whether a lender  decides to extend credit and at what terms or whether an employer offers  a candidate a job. Therefore, it is important for CRAs to produce reports  that are accurate and for consumers to have appropriate procedures  available to correct any inaccuracies in their consumer reports, including  disputing inaccuracies. We found that opportunities exist for CFPB to  improve its oversight of CRAs.

As part of its supervision, CFPB has directed CRAs it has examined to  make specific changes based on examination findings related to FCRA  requirements for (1) reasonable procedures for assuring accuracy and (2)  reasonable investigation of consumer disputes. However, CFPB has not  defined its expectations for how CRAs can comply with these  requirements. Providing additional information to CRAs about its  expectations for key FCRA requirements could help CFPB achieve its  vision of promoting a consumer reporting system where CRAs maintain  and distribute accurate data, supplemented by effective dispute resolution  processes. Additionally, such information could help to promote  consistency and transparency in CFPB’s supervisory approach.

We are making two recommendations to CFPB:  The Director of CFPB should communicate to CRAs its expectations  regarding reasonable procedures for assuring maximum possible  accuracy of consumer report information. (Recommendation 1)

The Director of CFPB should communicate to CRAs its expectations  regarding reasonable investigations of consumer disputes.  (Recommendation 2)

We provided a draft of this report to CFPB, the Federal Reserve, FDIC,  FTC, NCUA, and OCC for review and comment. We received written  comments from CFPB, which are summarized below and reprinted in  appendix II. CFPB, the Federal Reserve, FDIC, and FTC provided  technical comments, which we incorporated as appropriate. In email  responses, officials indicated that NCUA and OCC did not have any  comments on the draft of this report.

In its written comments, CFPB neither agreed nor disagreed with the  recommendations. CFPB stated that it has made oversight of the  consumer reporting market a top priority and that its supervisory reviews  of CRAs have focused on evaluating their systems for assuring the  accuracy of data used to prepare consumer reports. CFPB noted that  CRAs have made significant advances to, among other things, promote  greater accuracy.

With respect to the first recommendation—that CFPB should  communicate to CRAs its expectations regarding reasonable procedures  for assuring maximum possible accuracy—CFPB noted that case law  includes interpretations of the reasonableness standard and provides  guidance to CRAs about how the standard applies to various factual  scenarios. CFPB also noted that it and FTC have settled enforcement  actions regarding the reasonableness standard in which each agency  provided examples of how it applied the standard and the relevant case  law to the facts of each matter and described a consent order with two  background-screening companies that made clear that a lack of certain  written procedures was not reasonable. Additionally, CFPB noted that its  examination procedures discuss factors that would be considered in  evaluating compliance with the reasonable procedures standard and that  it publishes “Supervisory Highlights” that document key examination  findings.

While we agree that case law may provide information to CRAs regarding  how courts have interpreted the reasonableness standard in specific  circumstances, as we note in the report, there may be a lack of clarity  about the extent to which all case law fully reflects CFPB’s expectations.  Absent additional information from CFPB, the current case law and case- by-case enforcement actions may not best serve to enable CRAs to  proactively address compliance practices. More direct communication of  CFPB’s expectations can provide CRAs with clearer information on what  they should be doing and what actions might constitute a FCRA violation.  Similarly, while FTC and CFPB have settled actions with certain CRAs  regarding reasonable procedures, such settlements may be applicable  only to the specific facts and circumstances and the parties involved in  those cases. CFPB’s examination procedures provide information on  factors that would be considered in evaluating compliance and areas that  may be reviewed in examinations, but they do not provide information on  CFPB’s oversight expectations regarding how CRAs may comply with the  FCRA requirement for reasonable procedures. Likewise, while CFPB’s  Supervisory Highlights provide information on key examination findings,  the Supervisory Highlights do not represent CFPB’s expectations for how  CRAs may or should comply with the reasonableness standard. For  example, the Supervisory Highlights state that the legal violations  described are based on particular facts and circumstances and may not  lead to such findings under different facts and circumstances.

With respect to the second recommendation—that CFPB should  communicate to CRAs its expectations regarding reasonable  investigations of consumer disputes—CFPB stated that what qualifies as  a “reasonable investigation” has been articulated in court cases and  noted that an FTC report summarizes how the reasonable investigations  standard has been interpreted by courts and FTC. While we acknowledge  that FTC may have interpreted and the courts may have ruled on this  issue, CFPB has not communicated to CRAs specific information on what  may and may not qualify as a “reasonable investigation.” CFPB also  stated that it issued a bulletin in September 2013 that is relevant to this  recommendation. However, in that bulletin, CFPB restated FCRA  requirements and emphasized their importance, but it did not provide  further information on what practices may represent a “reasonable  investigation” or what it expects of CRAs.

CFPB noted that it has and will continue to communicate its expectations  to CRAs. As stated in our report, communicating information about  CFPB’s compliance expectations and ways in which CRAs could comply  could help to ensure that CRAs receive complete and clear information  about how to comply with key FCRA requirements. CFPB could provide  such information in several ways; for example, CFPB has put consumer  reporting issues on its rulemaking agenda since 2015. We maintain that  providing additional information to CRAs about its expectations for key  FCRA requirements could help CFPB to promote consistency and  transparency in its supervisory approach and that the recommendations  should be addressed.

We are sending copies of this report to the appropriate congressional  committees and financial regulators, and other interested parties. This  report will also be available at no charge on our website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or OrtizA@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in appendix  III.

Appendix I: Objectives, Scope, and Methodology

Our objectives for this review were to (1) describe the current oversight  framework for consumer reporting agencies (CRA), (2) examine how the  Consumer Financial Protection Bureau (CFPB) has overseen CRAs and  entities that furnish consumer data, (3) examine how other federal  agencies, including the Federal Trade Commission (FTC) and the  prudential regulators, have overseen CRAs and entities that furnish  consumer data, and (4) identify what is known about the causes of  inaccuracies in consumer reports and the processes that are in place to  help ensure accuracy.

Some information has not been included in this public report because  CFPB determined it was information prohibited by law from public  disclosure. This report omits such information, but we will be issuing a  nonpublic version of this report that includes all the information. Although  the information provided in this report is more limited, it addresses the  same objectives as the sensitive nonpublic report and uses the same  methodology.

To describe the oversight framework for CRAs, we identified and  reviewed relevant federal laws and their application for CRAs and  institutions that furnish data to CRAs (called furnishers). We identified and  reviewed laws focused on the accuracy of consumer reports, the security  of consumer information, and the use and sharing of consumer reports.  These laws include the Fair Credit Reporting Act (FCRA) and its  implementing regulation, Regulation V, the Gramm-Leach-Bliley Act, the  Dodd–Frank Wall Street Reform and Consumer Protection Act, the  Federal Trade Commission Act, and the Economic Growth, Regulatory  Relief, and Consumer Protection Act. We interviewed staff from CFPB,  FTC, and the prudential regulators—the Board of Governors of the  Federal Reserve System, the Federal Deposit Insurance Corporation, the  National Credit Union Administration, and the Office of the Comptroller of  the Currency—about applicable laws and regulations for CRAs and  furnishers and their oversight authority over CRAs and furnishers.

Additionally, we interviewed five categories of stakeholders to learn about  federal and state oversight over CRAs: state agencies such as Attorney  General offices and regulators, CRAs, groups representing state  agencies, industry groups representing CRAs, and consumer groups. We  selected four states—Maine, Maryland, New York, and Ohio—for a more  in-depth review. We chose these states because they had laws and  regulations related to consumer reporting or had oversight activities  involving CRAs, such as prior enforcement actions. We interviewed staff  from state regulatory agencies in Maine, Maryland, and New York, as well  as staff from the New York Office of the Attorney General. In addition, we  received written responses to our questions from the Ohio Office of the  Attorney General. In each case, we asked questions about state oversight  of CRAs, including the relevant state laws and state enforcement,  rulemaking, and supervisory authorities. We interviewed three nationwide  CRAs and four smaller or specialty CRAs that produce or compile  consumer reports covering the credit and background-screening markets  about federal and state oversight, including applicable laws. We selected  these CRAs because of potential differences in oversight based on their  size and market. In our selection, we considered the size of the CRA and  the number of consumer complaints in CFPB’s database. We also  interviewed two industry groups representing CRAs (the Consumer Data  Industry Association and the National Association of Professional  Background Screeners); two groups representing states (the Conference  of State Bank Supervisors and the National Conference of State  Legislatures); and four consumer groups (Consumers Union, the National  Association of Consumer Advocates, the National Consumer Law Center,  and U.S. Public Interest Research Group). We asked these groups about  federal and state authorities for overseeing CRAs. We selected these  groups because, based on our analysis of publicly available information  and interviews with federal agencies, they are the primary organizations  representing stakeholders in our review, such as CRAs, or have existing  work, such as reports or testimonies, related to CRAs. The groups we  included and the views they represent reflect a range of stakeholders but  do not necessarily reflect the full scope of the industry.

To examine how CFPB has overseen CRAs and furnishers, we  interviewed CFPB staff about CFPB’s supervision and enforcement  strategies and activities, and we reviewed relevant documents, including  supervisory and examination documents. To examine CFPB’s  supervisory strategies and activities, we reviewed CFPB’s supervisory  plans that document how CFPB determined which CRAs and furnishers  to examine and which compliance areas to examine. We also reviewed  CFPB’s public reports, such as Supervisory Highlights, and nonpublic  examination documents to evaluate CFPB’s supervisory activities for both  CRAs and furnishers. To learn about CFPB’s enforcement strategies and  enforcement activities in the consumer reporting market, we reviewed the  types of enforcement actions available to CFPB for violations of relevant  laws, and we identified specific enforcement actions CFPB brought  against CRAs and furnishers for violations related to FCRA and  Regulation V from 2012 through 2018. We identified these enforcement  actions by reviewing CFPB’s publicly available enforcement activities on  its website, and we corroborated our results with CFPB. We also  interviewed stakeholders, including CRAs, consumer groups, state  agencies, and state groups, to obtain their views on CFPB’s oversight.

To examine how FTC and the prudential regulators have overseen CRAs  and furnishers, we interviewed staff from FTC and the prudential  regulators to discuss the agencies’ oversight and enforcement activities.  To learn about FTC’s enforcement strategies and activities in the  consumer reporting market, we reviewed the types of enforcement  actions available to FTC for violations of relevant laws, interviewed FTC  staff regarding the process for initiating investigations and the  investigations FTC conducted, and identified specific enforcement actions  brought against CRAs and furnishers for violations related to FCRA,  Regulation V, and FTC’s Furnisher Rule from 2010 through 2018. We  identified these enforcement actions by reviewing FTC’s publicly available  enforcement activities on its website, and we corroborated our results  with FTC. To learn about prudential regulators’ activities, we reviewed the  prudential regulators’ policies and procedures for examining furnishers  and interviewed regulators’ staff. We also collected information from the  regulators about their FCRA-related findings for furnishers from 2013  through 2018.

To identify what is known about the causes of inaccuracies in consumer  reports and the processes that are currently in place to help ensure  accuracy, we conducted interviews with stakeholders. In particular, we  interviewed staff from CFPB, FTC, the prudential regulators, and the state  agencies to learn about what they believe are the causes of inaccuracies  in consumer reports and the options available to consumers to address  inaccuracies. Similarly, we interviewed staff at three nationwide CRAs  and four smaller or specialty CRAs about the causes of inaccuracies and  the processes they have in place for ensuring accuracy and addressing  inaccuracies, including the processes in place to meet FCRA  requirements for addressing consumer disputes about consumer report  information. Additionally, we spoke with staff from four consumer and two  industry groups (described above) to gain their perspectives on the  causes of inaccuracies and processes in place to address them.

We also conducted a literature search on the causes of inaccuracies in  consumer reports and processes in place to help ensure accuracy. The  search covered academic literature and court cases from 2008 through  2018 and used subject and keyword searches of various databases, such  as ProQuest, Westlaw, and CQ. The literature search resulted in limited  relevant information. However, we identified reports from CFPB and FTC  that included information on the causes of inaccuracies in consumer  reports, as well as information CFPB has published, such as Supervisory  Highlights, on the processes CRAs have in place to help ensure  accuracy. Additionally, through our interviews, we identified information  that stakeholders, such as the National Consumer Law Center, have  published on these issues.

We conducted this performance audit from July 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Comments from the Bureau of Consumer Financial Protection

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kevin Averyt (Assistant Director),  Weifei Zheng (Analyst in Charge), Yue Pui Chin, Sergio Enriquez, Marc  Molino, Stephen Ruszczyk, Kelsey Sagawa, Jessica Sandler, Jennifer  Schwartz, and Farrah Stone made key contributions to this report.

Consumer reporting agencies collect vast amounts of information on people, such as their debt and work histories. They package the information into reports and sell it.

We looked at inaccuracies in those reports, which can have real consequences—especially for job seekers or people who need credit. Government and industry representatives said errors can happen in several ways. For example, agencies might match data to the wrong people if they share common names.

We recommended the Consumer Financial Protection Bureau tell agencies what it considers reasonable procedures for assuring accuracy and investigating disputes.