CFPB Supervisory Highlights Issue 32 - Consumer Reporting

CONSUMER FINANCIA L PROTE CTION BU REAU | APRIL 2024 S upervis ory Highlights: consumer reporting companies and fur nis hers Issue 32, Spring 2024

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 1 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) Table of c ont ent s Table of contents......................................................................................................... 1 1. Introduction........................................................................................................... 2 2. Supervi sory Ob serva tion s................................................................................... 4 2.1 Consumer Reporting Co mpanies............................................................. 4 2.2 Furnisher s................................................................................................. 7 3. Supervi sory P rogram Develop ment s................................................................ 11 3.1 Recent CFP B Supervis ory Pro gram Devel opm ents................................ 11 4. Remedial Actio ns................................................................................................ 13 4.1 Public Enf orcement A ction s................................................................... 13

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 2 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) 1. Introdu ction Credit r eportin g is c ritica l to consum ers’ a bility to acce ss credi t and other produ cts a nd se rvice s and often is used as a factor in re ntal and emp loyment d etermi nations. Accuracy in con sum er report s is of vita l imp ortan ce to the c redit reporti ng syst em and to consume rs. Inaccurate infor mation on a co nsumer report can have si gnificant co nsequences fo r consumers and may, among oth er things, l ead them to r ec eiv e produ cts or s ervices on les s favor able ter ms or imped e their ability to ac cess credi t or open a b ank acco unt. In accura cy in the cre dit repor ting sy stem is a long - standing issue that remains a pr oblem today. Accordin gly, t he C FPB c ontinu es to pri oritiz e exa mina tions of c onsum er rep orting c ompa nies (CRCs) and furnishe rs. CRCs are c ompanies th at re gularly eng age in whole or in part in t he pr actice o f asse mbli ng o r evaluatin g inf ormati on abo ut consu mers f or th e purpos e of pro viding consume r repor ts to t hir d partie s. 1 Furnishers are entiti es, su ch as ba nks, l oan se rvice rs, and oth ers, that furnish informatio n to the CR Cs fo r in clusion in consu mer r eports. CRCs and furnishers p lay a crucial role in e nsur ing the accur acy and i ntegrity of i nformation contai ned in consu mer reports. They also have an imp ortant ro le in the in vestigati on of consume r dispu tes r elatin g to th e accurac y of inform ation in co nsumer reports. The Fair Cre dit Report ing Act (F CRA) 2 and its i mplementing regulatio n, Regulati on V, 3 subj ect CRC s and furnis hers to requ ir emen ts relati ng to the ir roles i n the cr edit repor ting sys tem, includi ng the requ irement to rea sonab ly in vestigat e dispu tes an d certai n accuracy - relat ed r equi rem ent s. The FCRA and Regulation V als o im pose ob li g ati o ns in conne ction wi th, amo ng o ther thi ngs, co nsum er - al leg ed iden t ity theft and — most rec entl y — adv erse inf ormatio n result ing from human trafficking in cluding on consum er report s of huma n - trafficking vict ims. In recent revi ews of CR Cs, examin er s have continued to find de ficienci es in CRCs’ complia nce with the accurac y and i dentity theft requi remen ts of t he FCRA and Regulation V. 4 For ex am ple, examiner s found so me CRCs w ere engaged in the pract ice of automatically d ecli ning to 1 The term “con sumer report ing compa ny” as used in this pub lication means the same a s “consumer reporting agency,” as de fined in t he Fair Cr edit Repor ting Act, 15 U.S.C. § 1681a(f), inc luding nati onwid e consumer rep orting agencies as defi ned in 15 U.S.C § 1681a(p) a nd nationwid e specialty consumer rep orting ag encies as d efined in 15 U.S.C § 1681a (x). 2 15 U.S.C. § 1681 et seq. 3 12 C.F.R. Par t 1022. 4 If a supervi sory matter i s referr ed to the Office of Enforceme nt, Enforcement may cite addit ional violations based on these facts or uncover additional in formation that cou ld impact the concl usion as to what viol ations may exist.

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 3 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) implement identity theft blo c ks upon r ecei pt of th e req uisi te docu men tati on based o n overb road disqualifyin g criteria and with out a n indivi dual ized dete rminati on t hat there i s a statu tory basis to de c li ne the block, in violat ion of the FCRA. Examine rs als o fou nd some CRCs v io late d Regulat ion V’s human traffickin g requirem ents, e ffective as of July 25, 2022, b y failing to timely block, or in some cases failing to block all, adve rse ite ms of informat ion identified by th e consume r as resulti ng fro m human tr affickin g. In recent revi ews of fu rnish ers, exa min ers have c onti nued to f ind d eficienc ies in furni shers’ complian ce with the accura cy and dispute inv estigation r equ irem ent s of t he F CRA a nd Regulat ion V. E xaminers foun d several furni sher s violat ed the F CRA d uty to p romptl y upda te or corre ct inf ormation determined to be incomple te or inac curate, including, fo r exam ple, by conti nuing to report fra udulen t acco unts to C RCs as valid (i.e., non - fra udul ent) a ccoun ts for several years af ter d eterm ining th e accoun ts wer e frau dulent. Examiners also found that some furnishers viola ted the FCR A, after re ceiving an ide ntity t heft repor t from a consum er a t the appropr iate addres s, by continuing to furnish inf ormati on identifi ed in the report as resul ting from id entity t heft wit hout the fu rni shers knowing o r being inf ormed by the consumer that the information wa s, in fact, correct. The find ings in thi s report co ver selec t examinatio ns in conne ction with c redit repo rting and furnishing t hat were completed fr om April 1, 2023, throu gh De cember 31, 2023. To maintain the anon ymity of the su per vised ins tituti ons di scusse d in Supervisory H ighlights, refer enc es to instit utions gener ally are in th e plur al and related findings may pertain to one or more institu tions.

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 4 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) 2. Supervi sor y Obser vati ons 2.1 Consumer Reporting Co mpanies In recent revi ews of CR Cs, e xamin ers foun d defici encies in C RCs’ co mplian ce with FC RA and Regulation V identity the ft block, human trafficki ng submission and accuracy requireme nt s. 2.1.1 CRC duty to blo ck the reportin g of inf ormation resultin g from a n allege d identi fy theft The FCR A requir es CRC s to bl ock th e repor ting of any in formati on in a consum er’s fil e that the consume r iden tifie s as in formati on that result ed from a n all eged id entity t heft n ot later than four busin ess day s afte r the CRC recei ves cer tain doc umen tation re lating to the alle ged identity the ft. S uch document ation inclu des appropr iate proo f of the co nsumer’s ide ntity, a cop y of an identity theft r eport, ide ntification of the informa tion that res ulted from the all eged identity theft, a nd a sta temen t by the con sum er that such i nformat ion d oes not r elate t o any tra nsac tion by the con sume r. 5 A CRC ma y declin e to block, o r rescind a ny bl ock of, info rmati on if the CRC reasona bly d etermin es tha t: the in forma tion wa s block ed in error o r a bloc k was re queste d by the consumer in erro r; the in formati on wa s block ed, o r the block was r equeste d, on th e basis of a materia l misr epres enta tion of f act by th e cons umer relevan t to t he requ est to blo ck; or the consume r obtain ed possess ion of go od s, ser vice s or money a s a res ult o f th e b lo cke d transacti on (s). 6 In recent revi ews of C RCs, exa min ers foun d that CRCs fail ed t o timely i mplem ent bl ocks of informa tion af ter r eceivi ng the req uisite docum enta tion rel ating t o an al leged iden tity t heft, withou t other wise mak ing a reason able de termin ation with re spect t o one o f the sta tutory bases for declinin g to block such in formation. Examiners found that the CRCs i nstead maintai ned policies purs uant to whic h the CRCs au tomatically declined to bl ock informa tion if the associate d acco unt(s) of the co nsume r met any o ne o f a set of overbr oad disqualifying crite ria that we re not su fficien tly ta ilored t o sup port a reasonable deter mination regar ding any o f the statuto ry declin ation bas es. 5 15 U.S.C. § 1681c - 2(a); see 15 U.S.C. § 1681a(q)(4) a nd 12 C.F.R. § 102 2.3(i) (1) (defini ng “id entity theft report”). 6 15 U.S.C. § 1681c - 2(c).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 5 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) In resp onse to these fin din gs, CRC s were directe d to c ease t he practi ce of a utomati cally declining to i mplement b locks based on overbroa d disqualifyin g criteria without an individual ized determin ation that t here is a statut ory basis to d ecline. C RCs a lso w er e dir ect ed to imple ment re vision s to th e CRCs ’ polici es to ensure c omplia nce wit h FC RA ide ntity thef t block obliga tions, inclu ding any circumst ances in wh ich the CRCs may reasonab ly request addit ional infor mation or docu mentation to de termine th e validi ty of an alleg ed ident ity theft and any circumsta nces i n which t here is a valid basi s to declin e to block. 2.1.2 CRC duty to pro mptly noti fy c onsumers after decl ining to implem ent, o r rescind, an i dentity bl ock The FCR A requir es CRC s to p romptl y notify the af fecte d consum er if th e CRC d eclin es to bl ock, or resc inds a blo ck of, infor mation that the consu mer iden tifies a s infor mation resul ting f rom an all eged i den tity th eft. 7 CRCs m ust notify the c onsu mer in th e same ma nne r as CRC s are required to notify c onsumers o f a reinsert ion of info rmation i nto a consumer’ s file — i.e., in writing within fi ve b usiness days and b y providing cer tain inf ormation, i ncluding the name and address of th e furnisher of t he identified inf ormat ion if reasonab ly available and a notice that the con sumer ha s the rig ht to add a sta temen t to the consum er’s fil e dis puting th e ac cura cy or completenes s of such inf ormation. 8 In recent revi ews of C RCs, exa min ers foun d that CRCs fail ed t o provi de the r equisi te noti ce within five busin ess days of declining t o block inf ormation — in som e instan ces du e to syst em issues an d in oth ers d ue to huma n err or. Examiners also found that CRCs system atically faile d to timely provid e consu mers wi th th e releva nt fu rnishe r’s conta ct info rma tion an d/or no tice regardin g the c onsum er’s ri ght to a dd a sta temen t to the c onsum er’s fil e dispu ting t he accu rac y or com pleten ess of th e furni shed in formati on. In resp onse to these fin din gs, CRC s were directe d to r evise th eir pol icies to ensu re compl ianc e with FCR A identi ty th eft block n otic e obliga tion s and updat e noti ce tem plates to i nclu de the requisite info rmat ion fo r co ns umer s. 2.1.3 CRC duty to pro vide v ictims of identity theft wi th summari es of ri ghts The FCRA requires CR Cs, upon a consu mer contacti ng the CR C and expressing a belief that they are a vi ctim of fra ud o r identi ty thef t, to p rovide t he cons umer wi th a s um mary of righ ts 7 15 U.S.C. § 1681c - 2(c)(2). 8 Id. (referencing t he notice r equir ements of 15 U.S.C. § 1681i(a)(5)(B)).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 6 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) contai ning all of the inform ation require d by th e CFPB in its model su mm ary of ri ghts, 9 along with inf ormation abo ut how to requ est more de tailed i nformation f rom the CFPB. 10 In rece nt reviews of CRCs, exam iner s found t hat CR Cs faile d to com ply wit h this provisi on, ei ther by failing to inclu de requir ed informa tion in summa ries of rig hts or by failing to provide t he summary of righ ts to eli gibl e cons umer s entire ly. In resp onse to these fin din gs, CRC s are u pdatin g their sy stems to ensu re tha t they pr ovide the requ ired summary of rig hts. 2.1.4 CRC duty to blo ck advers e info rmation resul ting fro m hum an t raffickin g Regula tion V require s CRCs t o block a dve rse ite ms of inf orma tion iden tif ied by a con sum er or their re presenta tiv e as re sulting f rom a s evere f orm of t rafficki ng in perso ns or sex traffick ing, as defined in th e regulation. 11 CRCs must block such i tems within f our busine ss days of rece iving a consume r’s submi ssion, exce pt in limi ted circu mstan ces where additional info rmatio n is necessa ry to com plet e the su bmissi on. 12 In recen t revie ws of C RCs, ex amin ers foun d tha t CRCs failed to timely block identified adver se items of i nformation wi thin the appli cab le four business days. CRCs bl ock ed some but not all it ems identified in a qualifyi ng consume r submissio n and in other instance s failed to implement a b loc k enti rely. In resp onse to these fin din gs, CRCs w ere directe d to r evise th eir com plianc e proce sses t o ensur e that th ey proce ss all human trafficki ng block requ ests in accorda nce w ith the requi remen ts of Regulat ion V. 2.1.5 CRC duty to foll ow reaso nable procedu res to a ssure maximum possib le accuracy The FCRA re quires tha t, wher ever a C RC “pr epar es a consu mer r eport it s ha ll foll ow reasona ble proced ures to ass ure maximum po ssible ac curacy of th e informati on concerning the indiv idual about w hom the r eport r elate s.” 13 In recen t revi ews of C RCs, exami ner s fo und that CRC s’ 9 Consumer Fin. P rot. Bur eau, Appendix I to Pa rt 1022 – Summary of Consumer Identity Theft Rights, https://www.consumerfi nance.gov/ru les - poli cy/re gulat ions/ 1022 /i. 10 15 U.S.C. § 1681g(d) (2). 11 12 C.F.R. § 1022.142(c). 12 1 2 C.F.R. § 1022.142(e)(1). 13 15 U.S.C. § 1681 e(b).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 7 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) accuracy pr ocedures fail ed to com ply with this o bligation beca use the CRC s (1) failed to adequat ely mon itor dispu te metric s that w ould s ugge st a furn isher m ay no longe r be a sou rce of reliable, verifia ble inf ormation abou t consum ers, and (2) conti nued to includ e infor mation in consume r repor ts that wa s provide d by un relia ble furn ishers without impl ementing proc edures to assure the ac curacy of in formation provided by unreliable fu rnishers. S pecifically, t he CRCs did not m onito r metri cs an d thresh olds tie d to o bjectiv e measu res of in acc uracy o r unr eliabili ty. Moreove r, th e CRCs ma inta ined data from furnis hers t hat re spond ed to dispu tes in ways t hat sugges ted that t he furn is hers we re no lon ger sou rces of reliabl e, ve rifia ble in formation abou t consume rs. For exam ple, C RCs rece ive d fur nisher di spute res ponse data indic ating that, for several mont hs, furni she rs faile d to res pond to a ll or nea rly a ll disput es, or respon ded t o all dispute s in the s ame manner. Despite observin g t his dis pu te res pon se beh avi or by the se furnis hers, CR Cs con tinued t o inclu de inf orma tion from t hes e furnis hers i n consum er rep orts. In resp onse to these fin din gs, C RCs were direc ted to r evis e their accu racy proc edures t o identi fy and monito r furnishe rs and take cor rective a ction regardi ng da ta from f urn ishers w hose disput e respons e beha vior ind icates the furn isher i s not a sourc e of relia ble, verifia ble inf orma tion a bout consume rs. 2.2 Furnishers In recent revi ew s of f urnis he rs, examiners found d eficiencie s in furnish e rs’ complian ce with FCRA and Regulation V accuracy, dispu te in vestiga tion and identity the ft requireme nts. 2.2.1 Furnishe r duty t o promp tly cor rect an d update information dete rmined to be i ncomplet e or inac curate Examiner s are continu ing to find tha t furni shers a re violating t he FC RA duty to prom ptly correc t and update furnished informatio n after deter mining that s uch infor mation is incomplete or inac curate. 14 Specifically, in recent revi ews of auto loan furnishers, ex ami n ers found tha t furnishers cont inued t o furnish incomplete or inac curate information f or several mo nths, and i n some cas es year s, aft er the furn ish ers det ermine d, thr ough eith er dis pute ha nd l ing or identification of system ic issues, th e information was furni shed incompl etely or inac curately. For exa mple, exa min ers fou nd that f urnis hers contin ued to re port da tes of first del inqu ency inaccura tely f or sev eral m onths af ter de termini ng that they w ere re porting in accura tely due t o various sy st em coding i ssues. Examiners als o found th at after dete rmining ac counts were in a bankru ptcy sta tus an d theref ore s hould hav e been repo rted as c urrent with dates of first 14 15 U.S.C. § 168 1s - 2(a)(2).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 8 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) delinquenc y that r eflect t he bank ruptcy f iling dat es, furnish ers failed t o update the dat es of first delinquenc y for the a ccoun ts to t he bankru ptcy fil ing da tes. By fail ing to upd ate th e date s of first delinqu enc y for the acco unts in b ankruptcy when t hey dete rmined the accou nts were in bankrup tcy, the furn ishers fa iled to prom ptly u pdate or c orre ct inform atio n they ha d determi ned to be i ncomplete or inaccurate. I n resp o nse to these fi ndi ngs, fu rni sher s are updating their inte rnal contro ls related to prom ptly co rre ct ing or up dat i ng furnished in formatio n after deter mining it i s incomplet e or inaccu rate and e ngaging in loo kbacks t o remedia te the fu rnishing of the previousl y impact ed accounts. Exami ners als o found t ha t auto loan furni shers d id n ot promp tly sen d corr ections or upda tes to CRCs after determining that acco unts with le ase returns were paid - in - full. When leased ca rs were re turned t o deale rship s, furn ishers update d th eir syst ems of r ecord t o refle ct that t he accou nts had been p aid - in - full. However, examiner s found that t he furnishers fa iled to up da te the info rmati on furn ished to C RCs to refl ect that t he acco unts w ere pai d - in - full. In response to these fin dings, furnis her s are cond uctin g look back s to ensu re that correcti ons or upd ates are furnishe d for imp acted account s and are i mplement ing interna l cont rols to ensure t hey promptl y corr ect or up da te furnis hed inf ormat ion a fter dete rminin g it is in com plete or inaccu rate. In additi on, in review s of deposit fu rnis hers, ex am iners foun d tha t furni shers c ontinu ed to report f raudul ent acc ounts t o CRC s for sev eral yea rs aft er dete rminin g the accoun ts were fraudulent. Whi le, i n some inst anc es, f urni sher s clo sed the acco unts dete rmine d to be fraud ulent, they co ntinued to furnish the accounts as v alid (i.e., non - fraudule nt) acco unts and failed to n ot ify CRC s tha t th e acc oun ts sh ould b e delet ed beca use they wer e fr audul en t. By not instruc ting C RCs to del ete t he acco unts pr omptly after de terminin g th ey were fra udul ent, t he furnishers fail ed to prom ptly correc t or update fur nished informa tion dete rmin ed t o be inaccur ate or incomp lete. In resp onse to these fin din gs, furn ishers cond ucted l ookba cks to ensure t hey del eted all accounts t hey dete rmine d to be open ed fraudul en tly and upda ted their policie s and pro cedures relate d to notif ying CRCs whe n account s are det er min ed to be f raud ulen t t o ens ure t he ac cou nts are de leted. 2.2.2 Furnishe r duty t o notify CRCs o f direct di sputes Examiner s are continu ing to find tha t furni shers are viol ating t he FC RA duty to n otify C RCs tha t the accu racy o r compl eten ess of item s being furni shed by them ar e sub ject to di sput e. 15 Specific ally, in recent r eviews of deposi t furnish ers, exa min ers found that f urnishers who 15 15 U.S.C. § 168 1s - 2(a)(3).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 9 SUPER VISOR Y HIG HLIG HTS, ISSU E 32 (SPRING 2024) receive d dire ct dispu tes from cons umers w ere con tinuin g to fu rnish th e dis puted inf orma tion to CRCs without notifyin g t he CRC s that th e inform ation w as sub ject to di spute. In resp onse to these fin din gs, furn ishers a re u pdatin g their p olici es to mak e clea r that t hey wil l pro vide not ices o f di rec t disp ute s to CRCs. 2.2.3 Furnishe r duty t o conduc t reaso nable inv estigat ions of direct disputes Exami ners are c ontinu ing to fin d tha t furni shers are vi olating t he Reg ulati on V du ty to c onduct a reason able in vesti gation of direc t dispu tes. 16 Specificall y, in recent r eview s of aut o loan furnishers, exa miner s found evide nce that furn is hers fail ed to in vestiga te d irect di sputes that did not sa tisfy those fu rni shers ’ ex traneous id entity verifica tion re quirements. R egulation V specifically defines what a consumer mus t include in a dis pute n otice t o tri gger a furn ish er’s duty to invest igate. Alth ough these dis putes met the Regulation V require ments for a dir ect disp ute, examin ers foun d evid ence tha t the fu rni shers did not in vestiga te th e dispu tes becau se the con sumer ha d not sa tisfi ed addi tiona l identi ty verifica tion requi remen ts of t he furni sher. Howeve r, Reg ulation V does n ot perm it a furnish er to es tablis h additi onal requirem ents beyond what the regulat ion requires i n order to i nitiate a direct dispute inve stig ation by th e fu rnis he r. Also, in recen t review s of de bt collec tion f urnish ers, examiners fou nd that when th e furnish ers receive d a dir ect dispu te they simply delet ed the t radelin e, rath er than conductin g an investigation. As the Bur eau has previo usly expla ined, simply d eletin g tradelines i n response to a direct di sput e does n ot satisfy furn ishers ’ res ponsibili ty to conduct a reas onable in vesti gation with re sp ec t to th e dis put ed i nfo rmat ion. 17 After i dentifi cati on of th ese is sues, f urnish ers w ere directed to upda te their polic ies and proced ures to ensure they co nduct reaso nable investiga tions of dir ect di spute s. 2.2.4 Furnishe r duty t o provide notice of deli nquency of accounts Examiner s are continu ing to find tha t furni she rs are vi olating the FC RA duty to notify CRCs of the d ates of first delin quency on applicable accounts. 18 Specifically, in recent re views of auto loan fur nishers, e xaminers found that furni shers inacc urately re ported dates of first delin quenc y 16 12 C.F.R. § 10 22.43(e)(1). 17 CFPB Bulletin 2014 - 01 (Feb. 27, 201 4). 18 15 U.S.C. § 168 1s - 2(a)(5).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 10 SUPER VISORY HIGH LIG HTS, ISSU E 32 (SPRING 2024) to CRCs d ue to va rious c oding i ssues. For exa mpl e, examin ers fo und t hat codin g err ors re sulted in furni shers in accura tel y reporti ng date s of first delin quenc y a s the fi rst da y of the s tatemen t cycle f ollowin g the con sumer ’s miss ed pay ment, r ather t han 30 days aft er the m issed pa ymen t due date. Examiners also fou nd that auto loan furnis hers repor ted inaccurat e dates of f irst delinquenc y for a cco unt s by r epor ting the dates of first del inqu enc y as more recent than t hey should have bee n, including b y changing th e date s of first delin quenc y for ac c ounts that remai ned delinquent month afte r month (i.e., accou nts for whi ch the dates of first delin quenc y should not have bee n changed). In respo nse to the se findings, furnishers are conduct ing lookbac ks to identif y and re mediate impacted accounts and upda ting their p olici es and proced ures to en sure t hat they report dates of first delin quenc y accu rately. 2.2.5 Furnishe r duty not to fu rnish i nformati on tha t purports to relate to a co nsumer u pon re ceipt of an i dent ity theft repo rt Examiner s are continu ing to find tha t furni she rs are vi olatin g the FC RA’s requi rement that if a consume r submi ts an i den tity thef t repor t at the a ddres s specif ied by the furn isher fo r rec eiving such rep orts s tating t hat in forma tion main tain ed by tha t furni sher tha t purp orts t o relate to the consume r resul ted fr om identi ty th eft, th e furni sher may not furn ish such in format ion to a ny CRC, unless th e furnishe r subseq uentl y knows or is inform ed by the consum er that the informa tion i s corr ect. 19 Specif ically, in recent revi ews of auto loan fu rnishe rs, examin ers found that furn ish ers who r eceive d identi ty th eft report s at a qualifying address co nti nued to f urni sh informa tion i dentifi ed in the rep ort bef ore knowi ng or being in form ed by th e consum er that the informa tion wa s corr ect. In respo nse t o these fin din gs, furn ishers a re u pdatin g their p olici es and pr ocedu res to ens ure that inf ormati on sub ject to t his re quir ement is n ot furni shed prior to t he compl etion of an invest igation and determinatio n of validi ty. 19 15 U.S.C. § 168 1s - 2(a)(6)(B).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 11 SUPER VISORY HIGH LIG HTS, ISSU E 32 (SPRING 2024) 3. Supervi sor y Progr am Devel opment s 3.1 Recent CFPB Supervi sory Program Developments Set f orth be low are selec t su pervisi on pro gram d evel opment s includin g ad visory opini ons, t hat hav e been issu ed regardi ng credit report ing since our last r egular edi tion of Supervisory Highligh ts. 3.1.1 CFPB issue d a dv isory opini on on fai r cre dit rep orting: backgroun d scr eening On Janu ary 11, 2024, t he CFPB issu ed an advisory opinion t o affirm th at, when prep aring consume r repor ts, a CRC that re ports pu blic recor d infor mati on is not using rea sona ble pro ce dur e s to assu re max imum poss ible a ccuracy und er the FC RA if it d oes not have p rocedur es in place t hat: (1) prev ent re porting in fo rmation that is du plica tive or that h as been expung ed, sealed, or o therwis e legall y restricte d from public a ccess; and (2) inclu de any existi ng disposi tion in forma tion i f it rep orts ar rests, crimi nal charges, evicti on proc eeding s, or oth er court filings. 20 Th e advisory o pinion als o highlights that, whe n CR Cs in clud e ad ver se informa tion in consu mer reports: (1) th e occurr ence of the ad verse event s tarts t he runn ing of the repor ting period f or a dverse it ems un der FC RA secti on 60 5(a)(5); (2) t hat peri od is no t restart ed or re open ed by th e occu rrenc e of subs equent events; and (3) a non - convict ion dispo sition of a cr iminal ch arge cannot be repo rte d bey ond t he s ev en - year perio d that b egins t o run at th e time of t he c harge. C RC s thus mus t ensure that they d o not report adv erse informa tion beyond t he rep orting p erio d in FCR A secti on 60 5(a)(5) and m ust at al l tim es have reasonab le procedu res in plac e to preve nt reporting o f infor mation that is duplicat ive or legal ly restrict ed fro m publi c acces s and t o ensur e that an y existin g dis positi on informa tion i s incl uded if court filin gs are report ed. 20 The adv isory opinion is av aila ble at: cfpb fair - credi - reporting - backgr ound - screening2 024 - 01.pdf (consumerfinanc e.gov).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 12 SUPER VISORY HIGH LIG HTS, ISSU E 32 (SPRING 2024) 3.1.2 CFPB is sues ad visory opini on o n file disclosur es On January 11, 2024, the CFPB is sued an ad visory opi nion to addr ess cer tain obl igation s that CR Cs have un der se ction 609(a) of the FC RA. 21 Th e advi sory o pinion un der scores t hat, t o trigge r a CR C’ s fil e disclosure r equirement un der FCRA section 609 (a), a con sum er does not need to use s pecific langua ge, such as “com plete f ile” or “file.” Th e advisory o pinion also highlig hts th e requir emen ts regar ding t he infor ma tion tha t must be d iscl osed to a consu mer under FC RA sectio n 609(a). I n addition, th e advisory opi nion affirms that CR Cs must disc lose to a consu mer bo th the o riginal sourc e and an y inter mediary or vendor so urce (or sourc es) that provide the it em of infor mation to the CRC under FC RA sect ion 60 9(a). 21 The adv isory opinion is av aila ble at: cfpb fair - credit - reporting - file - disclo sure20 24 - 01.p df (consumerfinanc e.gov).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 13 SUPER VISORY HIGH LIG HTS, ISSU E 32 (SPRING 2024) 4. Remedi al A ctions 4.1 Public Enforcement Ac tions The CFPB’s su perviso ry a ctions re sulted i n and s uppo rted th e below en forcem ent ac tion s relat ed to credit repo rting or fur nishing. 4.1.1 Toyota Mo tor Credi t Corpo ratio n On Novembe r 20, 2023, t he CFPB i ssued an order ag ainst Toyot a Motor Cre dit Corpor ation (“Toyo ta M otor Cred it”), wh ich is th e U nite d S tates - base d au to - fi nancing arm o f Toyota Motor Corpora tion a nd one of the lar gest ind irect a uto l enders in the c ountry. To yota Mot or Cr edit provides financing for vehic les and opt ional “add - on” p roduc ts and s ervice s sold with the vehicles. These add - ons include Guaran teed A sset P rotecti on, whic h can waive some of a consumer ’s remaining loan balance if the ir car is tot aled, sto len or damaged when the y still owe money on the loan eve n with c ar insurance, and Credit Life an d Accident al Health, which is designed to pay a r emaining balance if the co nsumer dies or become s disabled. T he CFPB fo und that Toy ota Mot or Cr edit viola ted t he C onsumer Financial P rotec tion Act of 2010 by: (1) unfairly and abus ively maki ng it unre asonabl y difficult for con sumers to ca ncel unwan ted add - ons, includ ing when co nsumers complaine d that de alers h ad forced ad d - ons on consu mers w ithout their consent; (2) unfairl y failin g to ensure consu mers receiv ed refunds of unearned Guaranteed Asset P rotecti on and Credit Life and Accidental Health premiums when t hey paid off t heir loan s early o r ended lease agreements early, maki ng the product s no longer of any value to consumer s; and (3) unfairly faili ng to pro vide accurate refunds t o consumers w ho canceled the ir vehicl e servic e agre ements a s a resul t of fla wed sy stem logi c. Th e CFPB a lso fo und tha t Toyota Moto r C redit vio late d the FCRA and its impleme nting Reg ulation V b y (1) failing to promptly correct n egati ve inf orma tion it had sent t o CRC s, where the n egati ve information wa s falsely reporting customer accounts as delinquent even though customers had already returned their vehicles; and (2) failing to maintai n reasonable policies and procedures to ensure relat ed payme nt information i t sent to CRCs was accurat e. The ord er requi res Toy ota Mo tor Cr edit to pay $48 million i n consumer redress and a $1 2 million ci vil mone y penalty. 22 The order also require s Toyota Mot or Cred it to sto p its un lawful practic es and c ome int o compl ianc e wit h the 22 The Order is availabl e at: cfpbtoyota - motor - credit - cor porat ion - conse nt - order20 23 - 11.pd f (consumerfinanc e.gov).

SUPERVISORY H IGHLIGHTS, ISSUE 32, S PRING (2024) 14 SUPER VISORY HIGH LIG HTS, ISSU E 32 (SPRING 2024) law and prohibits in centi ve - based employee compensation or performanc e measurem ents in relat ion to add - on products. 4.1.2 TransUni on, Trans Union LLC, and Trans Union Interacti v e, Inc. On Octobe r 12, 2023, the CFPB issued an order agains t TransU nion, pare nt company of o ne of the t hree n ati onw ide CRC s, and two of its subs idiaries, T rans Union LLC, and TransU nion Interacti ve, Inc. (collecti vely, T ransUni on), w hich are h eadquar tered in Ch icago, Il linois. Security fre ezes and l ocks blo ck certa in thi rd pa rties, su ch as len der s, from accessing c onsume rs’ credit re port s to pre vent a pot ential i denti ty thief from o btainin g new c redi t in thos e consum ers’ names. Starting in Se ptember 2018, F ederal law h as requi red nationw ide CRCs to provid e securi ty freez es as a fr ee servi ce, wh er eas locks are a feature of certai n paid pro ducts. Th e CFPB found that TransUnio n, from as early as 200 3, failed to timely p lace or remove securit y freezes and lock s on th e credit r eports of tens of tho usand s of consu mers w ho r equest ed them, including cer t ain vuln era ble consu mers; in so me cases, thos e requ ests wer e left unm et for months or yea rs. The CFPB found TransUnio n’s failure to place or remove secur ity freezes in a timely ma nner o ccurr ed as a result of pro blems, i ncludin g syste ms issu es, that T ran sU nion knew ab out bu t failed to addr ess for y ears. The CFPB found t hat Tr ansUnion’s failure to p lace or remo ve security f reezes in a t imely manner violate d the FCRA, and TransU nion’s failur e to place or remov e both se curity freez es and l ocks in a timely manne r was unfair i n violat ion of the Consu mer Financial Pr otection Ac t of 2010. Fu rther, the CFPB found th at TransU nion engaged in dece ptive ac ts and p ractic es by fa lsely t ellin g certa in con sumer s that t heir requ ests ha d been successful wh en they had not. In addition, the CF PB found th at from about 20 16 to 2020, TransU nion failed t o exclude certain cons umers, includ ing act ive - duty mili tary and oth er potential vict ims of ident ity theft, from pre - scre ened s olicita tion lists in viola tion of FC RA. Th e CFPB’s orde r require s TransUnio n to pay $3 mi llion to consumers in redress and $ 5 million i n civil pen alti es. 23 TransU nion must also take steps to address and prevent unlawful co nduct, includ ing conveni ng a committee to identif y and addres s tech n olog y p roblems th at can aff ect consume rs. 23 A copy of the Consent Orde r is availab le at: https://w ww.consum erfinanc e.gov/e nforcem ent/ac tions/tra nsunion - trans - uni on - llc - a nd - tra nsunio n - interactive - i nc/