The Consumer Financial Protection Bureau (“CFPB”) has sent warning letters to several nationwide specialty consumer reporting agencies (“CRAs”), notifying the CRAs that the CFPB believes that the CRAs are not complying with the Fair Credit Reporting Act (“FCRA”) provisions designed to ensure easy consumer access to free annual credit reports and requiring a response within 30 days. The CFPB also has issued a Bulletin on the same topic. The warning letters and Bulletin underscore the importance that the CFPB is placing on the FCRA’s free credit report provisions.

The FCRA requires nationwide specialty CRAs to provide free annual credit reports to consumers, and to establish a “streamlined process” to facilitate consumer access to those reports. (Nationwide specialty CRAs are defined by the FCRA to include those CRAs that maintain files relating to medical records or payments, tenant history, check writing history, employment history and insurance claim history.) This streamlined process must include a toll-free telephone number, which must be posted on the CRA’s Web site and listed in the telephone directory. CRAs also must implement “reasonable procedures” to anticipate, and respond to, the volume of consumers who will use the streamlined process and must provide consumers with clear instructions on how to request reports.1

“Today, the CFPB is reminding these companies that they must follow the law and provide consumers with easy access to their free annual report,” CFPB Director Richard Cordray said in a press release accompanying the publication of the letters and Bulletin. The CFPB has repeatedly urged consumers to obtain a free copy of their credit report every year, as permitted by law, and also has made the free credit report requirement a focus of its consumer reporting agency examination manual.2

The warning letters cite several violations of the streamlined process requirement, including:

  • Failing to provide a toll-free number in the CRA’s Yellow Pages listings and on its Web site so consumers may request a free annual file report;
  • Lacking “adequate capacity” to accept consumer disclosure requests; and
  • Failing to provide “clear and easily understandable information and instructions to consumers.”

The warning letters instruct the recipients to review their disclosures and informational listings to ensure compliance, and to contact the CFPB within 30 days to “advise [the CFPB] of the steps you have taken or will take to ensure compliance…or, if you believe these legal requirements do not apply…provide an explanation.”3 In this respect, the warning letters depart from those issued by other regulatory agencies, which typically instruct the recipient to review its policies or procedures, but do not require a response.4 By requiring companies to respond with a justification for their actions within 30 days, these warning letters more closely resemble a Civil Investigative Demand.

The CFPB’s Bulletin similarly highlights the requirement to establish a “streamlined process” for ordering free annual reports. The Bulletin details the CFPB’s expectations for nationwide specialty CRAs:

  1. Operating a toll-free telephone number that:
    1. Is published in any telephone directory in which any telephone number for the CRA is published; and
    2. Is clearly and prominently posted on any Web site related to the specialty CRA’s consumer reporting business, along with instructions for requesting disclosures by any available alternative means;
  2. Ensuring the specialty CRA has “adequate capacity to accept requests from a reasonably anticipated volume of consumers”;
  3. Collecting “only as much personal information from a consumer requesting a disclosure as is reasonably necessary to identify the consumer properly”;
  4. Providing “clear and easily understandable information and instructions” for consumers, including but not limited to: a status update related to the consumer’s request, a “help” or “frequently asked questions” Web page section, and a statement when the consumer’s identity cannot be verified with instructions for how to complete an annual file disclosure request;
  5. Using or disclosing personally identifiable information collected from a consumer during the “consumer’s request for an annual or other disclosure required by the FCRA from the entity that the consumer made through the streamlined process only in ways permitted by Regulation V,” which implements the FCRA; and
  6. For those consumers who use other methods of making disclosure requests, honoring such requests or providing instructions for consumers on how to use the streamlined process.

The Bulletin may be accessed here:

The CFPB’s press release may be accessed here: