The Dodd-Frank Act amends the Fair Credit Reporting Act (FCRA) to require companies that use credit scores to include those scores, and related information, in adverse action and Risk-Based Pricing Notices provided to consumers. Yesterday, the Federal Reserve Board (FRB) and Federal Trade Commission (FTC) proposed new rules to implement these provisions. Highlights of the proposals include (a) no proposed changes to the “Credit Score Exception Notices” under the Risk-Based Pricing Rule—meaning that lenders may continue to use existing notices following the effective date of the new requirements; (b) new credit score disclosure language for the Regulation B sample adverse action notices, which could require the disclosure of up to nine reason codes in adverse action notices; and (c) a clarifying statement in the proposals that only one credit score need be disclosed in connection with an adverse action or a Risk-Based Pricing Notice. The proposals are silent on proposed mandatory compliance dates, and, to the extent that a July 21, 2011 compliance date for the new Risk-Based Pricing Notice would present challenges, we recommend that covered persons consider commenting on the proposals. Comments on the proposals will be due 30 days after the notices are published in the Federal Register.
BACKGROUND TO THE PROPOSED RULES
Section 1100F of the Dodd-Frank Act amended section 615 of the FCRA to add credit score disclosure obligations in connection with adverse action and Risk-Based Pricing Notices.
- New Disclosure Requirements for Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports. The FCRA requires a person who takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report to provide certain information to the consumer.
Section 1100F amended this section of the FCRA to add a new requirement that the person “provide to the consumer written or electronic disclosure (A) of a numerical credit score as defined in section 609(f)(2)(A) [of the FCRA] used by such person in taking any adverse action based in whole or in part on any information in a consumer report; and (B) of the information set forth in subparagraphs (B) through (E) of section 609(f)(1).” Consequently, section 1100F amended the FCRA to require new disclosures by users of consumer reports. Specifically; when a user takes any adverse action based in whole or in part on information contained in a consumer report, the user must provide to the consumer:
- a “numerical credit score … used … in taking any adverse action”:
- the range of possible credit scores under the model used;
- the factors that adversely affected the credit score of the consumer, which should be ranked in the order of their importance and should not exceed four factors—unless the number of credit inquiries is a factor and is not already reflected in the top four, in which case, five factors should be disclosed (i.e., the top four, plus inquiries);
- the date on which the credit score was created; and
- the name of the person or entity that provided the credit score or credit file upon which the credit score was based.
The content of this disclosure is similar to what is currently required under the FCRA in connection with certain mortgage loan applications. See FCRA § 609(g) (requiring mortgage lenders to provide borrowers with a “Notice to Home Loan Applicant” that includes a credit score and the key factors contributing to that score).
- Risk-Based Pricing Notices. The “Risk-Based Pricing” provisions in FCRA section 615(h) require users who, based on a consumer report, grant, extend, or provide credit on material terms that are materially less favorable than the most favorable terms available to a substantial portion of consumers from or through that person to provide certain disclosures to consumers. Such users will be required, in addition to other notice requirements required by FCRA section 615(h)(5), to include a statement in the notice informing the consumer of: “(i) a numerical credit score as defined in section 609(f)(2)(A), used by such person in making the credit decision described in paragraph (1) based in whole or in part on any information in a consumer report; and (ii) the information set forth in subparagraphs (B) through (E) of section 609(f)(1).”
Last year, the FRB and FTC issued a rule implementing the Risk-Based Pricing provisions of FCRA section 615(h), that became effective January 1, 2011. See 75 Fed. Reg. 2,724 (Jan. 15, 2010) (final rulemaking notice). The Risk-Based Pricing Rule requires lenders to provide Risk-Based Pricing Notices to borrowers, requires specific content to be provided in these notices and also provides model forms that lenders can use as a “safe harbor.” See 16 C.F.R. § 640.4 (content of notices); 16 C.F.R. pt. 640, App. (model forms).
- Effective Date. Section 1100F will be effective on the Designated Transfer Date, July 21, 2011.
Yesterday’s action consisted of two separate notices of proposed rulemaking. In the first of the notices, the FRB proposed to amend its sample adverse action notices under Regulation B to provide for the additional disclosure of credit scores and supporting information as required by section 1100F.1 In the second notice, the FRB and FTC together proposed to amend the Risk-Based Pricing Rule to allow the additional content required by section 1100F.2
- Proposed Amendments to the Regulation B Sample Adverse Action Notices. The FRB has proposed to amend the sample adverse action notices under Regulation B to add the following language:
We also obtained your credit score from this consumer reporting agency and used it in making our credit decision. Your credit score is a number that reflects the information in your credit report. Your credit score can change, depending on how the information in your credit report changes.
Your credit score: ___________________
Scores range from a low of _____________ to a high of ______________
Key factors that adversely affected your credit score: _________________________________
[Number of recent inquiries on credit report]
In addition, the FRB has proposed to amend its Official Staff Commentary under Regulation B to add the following language:
The FCRA also requires a creditor to disclose, as applicable, a credit score it used in taking adverse action along with related information, including the key factors that adversely affected the consumer’s credit score. Disclosing the key factors that adversely affected the consumer’s credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit.
This proposed Commentary would mean that lenders may have to disclose up to nine (9) separate reason codes in their adverse action notices, to comply with the ECOA requirement that they disclose the four principal reasons for taking adverse action, as well as the FCRA requirement that they disclose the up-to-five factors that adversely affected the credit score.
- Proposed Amendments to the Risk-Based Pricing Rule. The FRB and FTC are proposing to amend the Risk-Based Pricing Rule to provide for the inclusion of credit scores and related information in a Risk-Based Pricing Notice.
Essentially the Agencies have proposed to add two new model form notices to the Rule: one to be used in connection with credit applications and the other to be used in connection with the review of existing accounts.
Credit Score Exception Notices Are Unchanged
Importantly, the Agencies have not proposed any modifications to the existing model forms. This means that the model credit score exception notices may continue to be used, in their existing form, following the effective date of the new credit score disclosure requirement. According to the Agencies, “[n]othing in section 1100F of the Dodd-Frank Act or this proposal limits the ability of creditors to provide these exception notices in lieu of the general Risk-Based Pricing notice.” This would mean that lenders who have chosen to comply with the Risk-Based Pricing Rule by sending credit score exception notices would not need to change their current practices or notices in response to this rulemaking.
Only One Score Must Be Disclosed
In the notice of proposed rulemaking, the Agencies also clarified that, where multiple credit scores are obtained or used in connection with a credit transaction, only one score need be sent in connection with the revised Risk-Based Pricing Notice. Because the statutory language is identical with respect to adverse action notices, the Agencies’ interpretation should also apply to the adverse action notice provisions. Specifically, the adverse action notice and the Risk-Based Pricing Notice provisions of the FCRA are identically worded, and they both require disclosure “of a numerical credit score … used by such person in” making a decision. Compare FCRA § 615(a)(2)(A) with § 615(h)(5)(E)(i). In the context of the Risk-Based Pricing Rule, the Agencies stated unequivocally that “[s]ection 1100F of the Dodd-Frank Act only requires a person to disclose a single credit score that is used by the person in making the credit decision,” and this interpretation should apply equally with respect to the adverse action provisions.
Mandatory Compliance Date
In connection with the initial Risk-Based Pricing rulemaking, the Agencies stated that no compliance would be required, until a final rule was completed: “[j]oint rulemaking by the FTC and the Board will establish the parameters for compliance, including the requirements for consumer notice, and will state the date for compliance.” See http://www.ftc.gov/os/statutes/041201factainterltr.pdf. The rulemaking notice here, however, does not prescribe or propose a delayed compliance date: “The Agencies believe it is important to have implementing regulations and revised model forms in place by July 21, 2011. This will help … facilitate uniform compliance when section 1100F of the Dodd-Frank Act becomes effective.” As a result, to the extent that the new requirements would present compliance challenges for regulated entities, we encourage regulated entities to submit comments, urging the Agencies to delay the mandatory compliance date beyond July 21, 2011—that is, to take the same approach with the Risk-Based Pricing amendments as the Agencies took with the initial rule.