Consumer Compliance Outlook > 2023 > Fourth Issue 2023

Consumer Compliance Outlook: Fourth Issue 2023

Top Federal Reserve Compliance Violations in 2022 Under the Fair Credit Reporting Act and the Equal Credit Opportunity Act

By Dolores Collazo, Senior Financial Institution Policy Analyst, Board of Governors of the Federal Reserve System

As announced in the First Issue 2023, Consumer Compliance Outlook (CCO) is regularly publishing data-driven articles that leverage the Federal Reserve System’s supervisory information from consumer compliance examinations of state member banks.¹ The articles analyze this information at an aggregate level to review top-cited violations, root causes, common pitfalls, and sound practices to mitigate risks.

As the Federal Reserve examination data in Table 1 indicate, the top consumer compliance violations in 2022 include violations of Regulation B, which implements the Equal Credit Opportunity Act (ECOA), and provisions of the Fair Credit Reporting Act (FCRA). More specifically, the violations involved the adverse action notice (AAN) requirements of Regulation B and the FCRA, the Regulation B spousal signature requirements for individual, creditworthy applicants, and the Regulation B requirement to provide a copy of all appraisals and other written valuations to applicants for a first-lien, dwelling-secured mortgage, as well as a notice of the right to obtain these documents not later than three business days after receiving an application for credit secured by a first lien on a dwelling.

Table 1: Top Consumer Violations in 2022 for State Member Banks

Note: These data were based on 211 examinations, in which examiners cited 402 violations.

This is a two-part article: The first section discusses the technical regulatory requirements, the root causes of violations, and common pitfalls, while the second section discusses sound practices and compliance management system enhancements that may mitigate the risks of violating these provisions.

PART 1: COMMON FCRA AND ECOA VIOLATIONS

The format for the common violations articles is to first list the regulatory requirements (either by quoting the verbatim text or by summarizing it) and then discuss the violations, root causes, and sound practices.

REGULATORY REQUIREMENTS

Fair Credit Reporting Act

Adverse Action Notice Requirements §615(a) Duties of users taking adverse actions on the basis of information contained in consumer reports

If a user of a consumer report takes adverse action, as defined in FCRA §603(k), with respect to any consumer based, in whole or in part, on information in the report, the user must provide the consumer an AAN with the following information:

• Notice of the adverse action taken based on information obtained from a consumer reporting agency
• Notice of the consumer’s right to:
  • Obtain a free copy of the person’s consumer report from the consumer reporting agency providing the information if requested within 60 days
  • Dispute with a consumer reporting agency the accuracy or completeness of any information in a consumer report furnished by the consumer reporting agency

• The name, address, and telephone number of the consumer reporting agency that furnished the report to the person
• A statement that the consumer reporting agency did not make the credit decision and is unable to provide to the consumer the specific reasons why the adverse action was taken

If a credit score was a factor in taking adverse action, the following information must be provided:

• The numerical credit score used and the date on which it was created
• The range of possible credit scores under the model used
• The key factors that adversely affected the credit score
• The name of the person or entity providing the credit score or the information upon which score was created

Examiners cited violations for not providing an accurate or complete AAN to affected applicants. Common violations included:

• Not including the range of possible credit scores under the scoring model used. Disclosing the range of scores is critical because different models use different ranges.
• Not providing an AAN when taking adverse action based, in whole or in part, on information in a consumer report.
• Taking adverse action based, in whole or in part, on a credit score, but not including the credit score disclosures specified in FCRA §609(f)(1) in the AAN. The credit score does not have to be the primary reason adverse action is taken. The credit score disclosures are required whenever a score is used in the decision to take adverse action.

Common issues include inadequate training, controls, and procedures.

An FCRA AAN alerts consumers that adverse action was taken because of negative information in their credit reports and provides them the right to obtain a free copy of their reports so they can review them and file disputes if the reports contain inaccurate information.² To comply, users of consumer reports and credit scores must know the scope of transactions subject to FCRA AAN requirements.

For credit transactions, the FCRA applies the definition of adverse action in §701(d)(6) of the ECOA.³ This includes taking adverse action on an existing credit account.⁴ For example, many creditors periodically conduct reviews of their consumer accounts, which often include pulling credit reports. Suppose, for example, a credit card issuer reviews the credit reports of its consumer accounts and reduces the credit limit for any account showing 60-day or 90-day late payments with other creditors. Because the creditor is taking adverse action on a credit account based, in whole or part, on information in a consumer report, an FCRA AAN is required.

For noncredit transactions, FCRA adverse action includes taking negative action, based, in whole or in part, on information in a consumer report, for:

• an existing noncredit account during account review to determine if the consumer continues to meet the terms of the account;
• applications and transactions initiated by a consumer, such as a consumer applying to a financial institution to open a checking account;
• insurance policies; and
• employment decisions.⁵

When a creditor is required to provide AANs under both the FCRA and ECOA/Regulation B, the notices may be combined to facilitate compliance and reduce regulatory burden. Model AANs are available in Appendix C of Regulation B (forms C-1 through C-6), including combined FCRA/ECOA forms.

REGULATORY REQUIREMENTS

Regulation B — Equal Credit Opportunity Act

12 C.F.R. §1002.9(a) Notification of action taken, ECOA notice, and statement of specific reasons

(1) When notification is required. A creditor shall notify [a consumer] applicant of action taken within:

(i) 30 days after receiving a completed application concerning the creditor’s approval of, counteroffer to, or adverse action on the application;

(ii) 30 days after taking adverse action on an incomplete application, unless notice is provided in accordance with paragraph (c) of this section;

(iii) 30 days after taking adverse action on an existing account; or

(iv) 90 days after notifying the applicant of a counteroffer if the applicant does not expressly accept or use the credit offered.

In contrast to the FCRA, which is generally limited to consumer transactions, Regulation B adverse action requirements apply to both consumer and business transactions. For these provisions, examiners cited financial institutions for failing to provide timely AANs in accordance with the regulation. A creditor must provide an AAN to the applicant within 30 days after receiving a complete credit application. This requires bank staff to know when a credit application is “complete.” The commentary clarifies that a completed application is defined “in terms that give a creditor the latitude to establish its own information requirements.”⁶ Thus, members of an institution’s lending staff must ensure they understand their institution’s definition of a completed application, which starts the 30-day clock if adverse action is being taken.

For business credit applications, §1002.9(a)(3)(ii) provides these requirements:

• For businesses with gross revenues of $1 million or less in the preceding fiscal year, the general adverse action requirements apply, except that:
  • the notice of action taken may be given orally or in writing;
  • the creditor may disclose an applicant’s right to the statement of reasons at the time of application instead of when adverse action is taken, if the creditor lets the applicant know they have 60 days to request the reasons, and the disclosure includes the ECOA notice; and
  • for an application taken entirely by telephone, the creditor may provide an oral statement of the action taken and the applicant’s right to the statement of reasons for adverse action.⁷

• Businesses with gross revenues greater than $1 million in the preceding fiscal year must:
  • notify the applicant, within a reasonable time, orally or in writing, of the action taken; and
  • provide the statement of reasons for adverse action in writing and the ECOA notice if the applicant makes a written request for the reasons within 60 days of the notice.⁸

Also, if the applicant provides sufficient data for a credit decision, even though information is missing, the creditor may evaluate the application, make its credit decision, and notify the applicant accordingly. If credit is denied because the application is incomplete, an AAN is required.⁹ If the creditor requires additional information, it may send a notice of incompleteness.¹⁰

In addition to the timing requirements, the violations cited involved not providing an accurate and complete AAN. Financial institutions should remember that AANs should include the following information:

• The specific reasons for the action taken¹¹
• The creditor’s name and address
• The ECOA notice regarding prohibited discrimination
• The name and address of the creditor’s federal agency that administers compliance

Instead of providing the reasons for the action taken, a creditor may provide a disclosure of the applicant’s right to receive the specific reasons. For this option, the notice must indicate that the applicant should request the reasons within 60 days of the disclosure date. The creditor should respond within 30 days of the applicant’s request.

The root causes of these violations include inadequate training and failing to implement controls to ensure procedures are consistently followed.

REGULATORY REQUIREMEMENTS

Regulation B — Equal Credit Opportunity Act

12 C.F.R. §1002.7(d) Signature of spouse or other person

(1) Rule for qualified applicant. Except as provided in this paragraph, a creditor shall not require the signature of an applicant’s spouse or other person, other than a joint applicant, on any credit instrument if the applicant qualifies under the creditor’s standards of creditworthiness for the amount and terms of the credit requested. A creditor shall not deem the submission of a joint financial statement or other evidence of jointly held assets as an application for joint credit.

Examiners cited financial institutions that required individual, creditworthy applicants to obtain the signature of their spouse or another person as a condition of their loan in violation of the regulation. Comments 7(d)(1)-1, -2, and -3 to Regulation B clarify the requirements for evaluating individual, creditworthy applicants:

• The creditor cannot require the applicant to provide a cosigner.
• A “joint applicant” is someone who applies contemporaneously with the applicant for joint credit, not someone required as a condition for the loan.
• A person’s intent to be a joint applicant must be evidenced at the time of application. Signatures on a joint financial statement confirming the information is accurate and complete are not sufficient to establish intent to apply for joint credit.

The regulation has an exception when a loan is secured by collateral jointly owned with a spouse, and the spouse’s signature is necessary under state law to reach the collateral in the event of default.¹² If state law requires the spouse’s signature on both the security instrument and the note, the creditor may require the spouse’s signature on both. But if state law requires the spouse’s signature only on the security instrument, the creditor may not require the spouse to cosign or guarantee the note evidencing the credit agreement.¹³

The root causes of these violations include inadequate training and the lack of controls to ensure that procedures are properly implemented.

REGULATORY REQUIREMENTS

Regulation B — Equal Credit Opportunity Act

12 C.F.R. §1002.14(a) Providing appraisals and other valuations

(1) In general. A creditor shall provide an applicant a copy of all appraisals and other written valuations developed in connection with an application for credit that is to be secured by a first lien on a dwelling. A creditor shall provide a copy of each such appraisal or other written valuation promptly upon completion, or three business days prior to consummation of the transaction (for closed-end credit) or account opening (for open-end credit), whichever is earlier. …

(2) Disclosure. For applications subject to paragraph 14(a)(1) of this section, a creditor shall mail or deliver to an applicant, not later than the third business day after the creditor receives an application for credit that is to be secured by a first lien on a dwelling, a notice in writing of the applicant’s right to receive a copy of all written appraisals developed in connection with the application. In the case of an application for credit that is not to be secured by a first lien on a dwelling at the time of application, if the creditor later determines the credit will be secured by a first lien on a dwelling, the creditor shall mail or deliver the same notice in writing not later than the third business day after the creditor determines that the loan is to be secured by a first lien on a dwelling.

Examiners cited financial institutions for not appropriately providing applicants a copy of appraisals or valuations¹⁴ associated with a first-lien mortgage application. In several cases, inadequate training and inadequate procedures were the root causes.

In certain instances, applicants may waive the timing requirements prescribed in Regulation B, except where otherwise prohibited by law:

• An applicant may waive the timing requirements and agree to receive any copy at or before consummation or account opening.
• The institution must obtain a waiver at least three business days prior to consummation or account opening unless the waiver pertains only to an appraisal or valuation with clerical changes from a previous version provided to the applicant three or more business days prior to consummation or account opening.
• If an applicant provides a waiver and the transaction is not consummated or the account not opened, the institution must obtain the waiver no later than 30 days after that determination is made.

Violations were also cited for disclosure errors. In these instances, the creditor failed to mail or deliver a notice in writing of the applicant’s right to receive a copy of all written appraisals or valuations developed in connection with the application, no later than the third business day after the creditor receives an application for a mortgage loan that is to be secured by a first lien on a dwelling.¹⁵ In cases where it was not known at the time of application but was later determined during the application process that the loan would be secured by a first lien on a dwelling, financial institutions failed to provide the disclosure no later than the third business day after that determination.¹⁶

The root causes of these violations were often insufficient training and inadequate procedures and controls.

PART 2 – SOUND PRACTICES TO MITIGATE COMPLIANCE RISKS

The first part of this article explored the technical requirements of Regulation B and the FCRA. This part will highlight sound practices that can help institutions ensure compliance with those requirements.

Table 2 lists sound compliance practices that examiners have observed at financial institutions and recommend.

TABLE 2: Sound Compliance Practices

Financial institutions should determine through a review of their product offerings which sound practices best align with their operations and risk profile.

CONCLUDING REMARKS

The discussion here of the top violations and sound practices to mitigate risks provides information to financial institutions on areas in which they may have a higher risk of violations and how to respond. Specific issues and questions should be raised with your primary regulator.

RESOURCES

• Dolores Collazo, “Advanced Topics in Adverse Action Notices Under the Equal Credit Opportunity Act,” CCO (Fourth Issue 2021)
• Sarah Ammermann, “Adverse Action Notice Requirements Under the ECOA and the FCRA,” CCO (Second Quarter 2013)
• Carol Evans and Surya Sen, “Regulation B and Marital Status Discrimination: Are You in Compliance?,” CCO (Fourth Quarter 2008)
• Interagency FCRA Examination Procedures

• Consumer Financial Protection Circular 2023-03, “Adverse Action Notification Requirements and Proper Use of the CFPB’s Sample Forms Provided in Regulation B”
• Consumer Financial Protection Circular 2022-03, “Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms”

ENDNOTES

¹ Governor Michelle W. Bowman, “Introducing Our New Format,”CCO(First Issue 2023).

² 15 U.S.C. §1681m(a)(4). See also Senate Hearing 108-579 (May 20, 2003).

³ 15 U.S.C. §1681a(k). See also §1002.2(c) of Regulation B.

⁴15 U.S.C. §1691(d)(6).

⁵ 15 U.S.C. §1681a(k)(1)(B). Congress added the catch-all provision in §1681a(k)(1)(B)(iv) to the FCRA in 1996 to overturn an FTC interpretation that stated that refusing to accept payment by check or rent an apartment based on a consumer report did not require an adverse action notice under the FCRA. See House Report No. 103-486 at 33 (1994): (“Additionally, the definition contains a catch-all phrase that makes clear that any action taken or determination made with respect to a consumer application or a consumer-initiated transaction that is adverse to the interest of the consumer constitutes an adverse action. This catch-all would include, for example, a refusal to cash a check, lease real estate, or open a new transaction account based on a consumer report. This new definition is intended to overturn a prior interpretation by the Federal Trade Commission (FTC), 55 Fed. Reg. 18826 (May 4, 1990), that refusal to accept payment by check or rent an apartment based on a consumer report does not trigger an adverse action notice under the FCRA.”) See also 76 FR 41590, 41597 (July 15, 2011); and 40 Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations at p. 84 (2011): (“A business that takes adverse action against a consumer in a context other than credit, insurance, or employment (e.g., a residential landlord), based in whole or in part on a consumer report, must also provide an adverse action notice.”)

⁶ See Comment 2(f)-6 of Regulation B.

⁷ 12 C.F.R. §1002.9(a)(3)(i).

⁸ 12 C.F.R. §1002.9(a)(3)(ii).

⁹ 12 C.F.R. §1002.9(c)(1)(i).

¹⁰ 12 C.F.R. §1002.9(c)(1)(ii) and 9(c)(2).

¹¹ Comment 9(b)(2)-1 of Regulation B clarifies that the “regulation does not mandate that a specific number of reasons be disclosed, but disclosure of more than four reasons is not likely to be helpful to the applicant.”

¹² 12 C.F.R. §1002.7(d)(4).

¹³ Comment 7(d)(4)-1 of Regulation B.

¹⁴ Regulation B defines a valuation as “any estimate of the value of a dwelling developed in connection with an application for credit,” 12 C.F.R. §1002.14(b)(3).

¹⁵ 12 C.F.R. §1009.14(b).

¹⁶ 12 C.F.R. §1009.14(b).