Why You Need an FCRA Compliance Manual and What It Should Include

Fair Credit Reporting Act (FCRA) lawsuits have been on the rise. In 2020, FCRA lawsuits increased by 5.3% over 2019, outpacing lawsuits filed under the Fair Debt Collection Practices and the Telephone Consumer Protection Act, which were down -17.6% and -3.3%, respectively.1 This trend will likely continue, and with the Consumer Financial Protection Bureau stepping up enforcement actions it is more important than ever for background screeners to review and improve their FCRA compliance procedures. This should start with a FCRA Compliance Manual.

 [article_ad]

Why Are FCRA Compliance Manuals Important?

For CRAs, liability under the FCRA often turns on whether they have “reasonable procedures” for compliance. In fact, that term appears in the FCRA fifteen times, starting with:

“It is the purpose of this title to require that [CRAs] adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information in accordance with the requirements of this title.” (15 U.S.C. § 1681(b))

Good FCRA Compliance Manuals allow CRAs to document their reasonable compliance procedures and if properly implemented can insulate them from liability for unintended FCRA violations.

How Can a FCRA Compliance Manual Insulate a Background Screener From FCRA Liability?

The FCRA is not a “strict liability” statute like many other consumer protection laws. However, several burden shifting provisions in the FCRA can have the effect of making CRAs who lack reasonable compliance procedures strictly liable for violations.

For example, §1681(a) prohibits a CRA from issuing an investigative consumer report unless consumer disclosures are made, and §1681(b) requires the CRA to give the consumer written disclosure of the “nature and scope of the investigation” within a specified period of time. However, §1681d(c) provides a CRA who has violated §1681d(a) or (b) with a defense to liability if they have a “reasonable procedure” for compliance:

“No person may be held liable for any violation of subsection (a) or (b)… if he shows by a preponderance of the evidence that at the time of the violation he maintained reasonable procedures to assure compliance with subsection (a) or (b)…”

So how does a CRA who violated §1681(a) or (b) show “by a preponderance of the evidence” that it maintained “reasonable procedures” to assure compliance with those subsections? Theoretically a CRA who lacks a FCRA Compliance Manual could have an employee testify regarding its procedures at trial. But a CRA with a properly drafted FCRA Manual might be able to avoid trial altogether by using the Manual in support of a motion for summary judgment.

Another section of the FCRA which applies to CRAs who issue investigative consumer reports is §1681d(d)(4):

“A [CRA] shall not prepare or furnish an investigative consumer report on a consumer that contains information that is adverse to the interest of the consumer and that is obtained through a personal interview with a neighbor, friend, or associate of the consumer or with another person with whom the consumer is acquainted or who has knowledge of such item of information, unless

(A) the [CRA] has followed reasonable procedures to obtain confirmation of the information from an additional source that has independent and direct knowledge of the information; or

(B) the person interviewed is the best possible source of the information.”

In a lawsuit brought under §1681d(d)(4) a CRA who did not interview the person who was the best possible source of information would need to establish that it followed reasonable procedures for obtaining confirmation of the information from an additional source that has independent and direct knowledge of the information. Unless those procedures are in writing the CRA could have difficulty making this showing.

Reasonable Procedures for Proper Content of Reports and Ensuring Permissible Purpose

§1681e(a) requires CRAs to have “reasonable procedures” for ensuring that reports (i) do not contain information prohibited from being reported; and (ii) are furnished only to those with “permissible purpose”:

“Every consumer reporting agency shall maintain reasonable procedures designed to avoid violations of section…§1681c…and to limit the furnishing of consumer reports to the purposes listed under section… §1681b…”

Accordingly, §1681e(a) provides a CRA who has mistakenly reported a record of an arrest which predated the report by more than 7 years with a defense to liability if it can show it maintained reasonable procedures for avoiding this type of error. Similarly §1681e(a) provides a CRA who has mistakenly issued a consumer report to a person who lacks permissible purpose with a defense to liability if it can show it maintained reasonable procedures for avoiding the error. A CRA who maintains a FCRA Compliance Manual containing these procedures should be able to make this showing if the CRA can demonstrate that its employees were adequately trained to follow them.

Thankfully §1681e(a) provides CRAs with a roadmap for their reasonable procedures for ensuring permissible purpose:

“These procedures shall require that prospective users…identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. Every [CRA] shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report.”

Reasonable Procedures for Resellers of Consumer Reports

§1681e(e)(2)(A) and (B) govern persons (including CRAs) who resell reports or information from reports issued by other CRAs (e.g., TransUnion, Equifax or Experian). Those CRAs must:

“(A) establish and comply with reasonable procedures designed to ensure that the report (or information) is resold … only for a purpose for which the report may be furnished under … §1681b…, including by requiring that each person to which the report (or information) is resold and that resells or provides the report (or information) to any other person

(i) identifies each end user of the resold report (or information);

(ii) certifies each purpose for which the report (or information) will be used; and

(iii) certifies that the report (or information) will be used for no other purpose; and

(B) Before reselling the report, make reasonable efforts to verify the identifications and certifications made under subparagraph (A).”

Thus, §1681e(e)(2)(A) provides a CRA who has mistakenly resold information from another CRAs report to a person who lacks permissible purpose with a defense to liability if they can show they employed these reasonable procedures.

§1681e(b) - The Most Important Reasonable Procedure

The most important reasonable procedure a CRA can have for avoiding FCRA liability is imposed by §1681e(b):

“Whenever a consumer reporting agency prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”

Compliance with §1681e(b) is important because it is the basis for most lawsuits against CRAs. Unfortunately, however, §1681e(b) does not tell CRAs what “reasonable procedures” they must follow to ensure the “maximum possible accuracy” of their reports. So, what “reasonable procedures” does a CRA need to avoid §1681e(b) liability? In a class action lawsuit this can be the “Million Dollar Question”. This is discussed further below.

Reasonable Procedures for Reinvestigations of Consumer Disputes

Even when the FCRA does not use the term “reasonable procedure” the concept can apply. For example, §1681i(a), which requires CRAs to conduct reinvestigations after receiving consumer disputes, states in part:

“…if the completeness or accuracy of any item of information contained in a consumer’s file...is disputed by the consumer…the CRA shall…conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate and record the current status of the disputed information, or delete the item…”

Similarly, §1681i(a)(5)(C) states:

“A [CRA] shall maintain reasonable procedures designed to prevent the reappearance in a consumer’s file, and in consumer reports on the consumer, of information that is deleted [due to a reinvestigation].”

A CRA whose FCRA Compliance Manual describes its reinvestigation procedures and procedures for preventing the reappearance of deleted information can successfully defend a lawsuit brought under §1681i(a) or §1681i(a)(5)(C) provided it properly implements those procedures.

“Strict Procedures” for CRAs Who Issue Reports for Employment

Under §1681k(a) CRAs who issue reports for employment purposes can be subject to a “strict procedures” requirement:

“A [CRA] which furnishes a consumer report for employment purposes and which for that purpose complies and reports items of information on consumers which are matters of public record and are likely to have an adverse effect upon a consumer’s ability to obtain employment shall

(1) at the time such public record information is reported to the user of such consumer report, notify the consumer of the fact that public record information is being reported by the [CRA], together with the name and address of the person to whom such information is being reported; or

(2) maintain strict procedures designed to ensure that whenever public record information which is likely to have an adverse effect on a consumer’s ability to obtain employment is reported it is complete and up to date.”

This means that unless the CRA choses to notify the subject of its report that it is reporting public record information it must maintain “strict procedures” designed to ensure the public record information which could adversely affect the subject’s employment prospects is complete and up to date when reported. Unless those “strict procedures” are spelled out in the CRA’s FCRA Compliance Manual they could be difficult to prove.

Why FCRA Compliance Procedures Should Be In Writing

The FCRA does not require CRAs to have written FCRA Compliance Manuals and CRAs who lack them can prevail when sued. But a CRA’s likelihood of success in litigation is greatly increased if it has a well drafted and properly implemented Compliance Manual.

A typical document request in a lawsuit alleging a CRA violated §1681e(b) reads:

“REQUEST NO. 5: Produce all documents that set forth the policies and procedures that You rely upon to prepare consumer reports while assuring maximum possible accuracy of consumers’ criminal history information.”

A CRA who lacks written procedures for complying with §1681e(b) would have nothing to produce in response to this request, providing the plaintiff an argument that the CRA has no procedures for assuring maximum possible accuracy of its reports. The CRA would be left arguing that despite the lack of written guidance its employees know how to ensure the maximum possible accuracy of information in its reports. Defense of the lawsuit will depend on the vagaries of employees’ understandings of how things are supposed to be done. Conversely, the CRA whose FCRA Compliance Manual includes its reasonable procedures for §1681e(b) compliance will produce the Manual and should be well-suited to defend the lawsuit. This could make the difference between winning or losing, or a large or small settlement.

How FCRA Compliance Procedures Alone Can Overcome Liability

FCRA liability often hinges not on the error, but on the CRA’s failure to maintain reasonable procedures to avoid the error. A CRA who follows reasonable procedures can prevail despite an error.

In Nelski v. TransUnion, 86 Fed. App’x 840 (6th Cir. 2004) there was no dispute that the report contained an erroneous past due account and that the plaintiff was injured due to the error. Regardless, the case turned on the reasonableness of TransUnion’s procedures for assuring the maximum possible accuracy of the report. The Court held that the reasonableness of procedures under §1681e(b) is “determined by reference to what a reasonably prudent person would do under the circumstances.” TransUnion prevailed because plaintiff could not show its procedures were unreasonable.

In Oses v. CoreLogic SafeRent, LLC, 171 F. Supp. 3d 775 (N.D. Ill. 2016) CoreLogic issued a report which erroneously characterized plaintiff’s drug charge as a robbery. Plaintiff sued CoreLogic under §1681k(a) arguing that CoreLogic lacked strict procedures designed to ensure that public record information likely to have an adverse effect on his ability to obtain employment was complete and up to date. At summary judgment CoreLogic demonstrated that it did maintain strict procedures. Specifically, CoreLogic showed that its procedure was to obtain criminal records directly from the courthouse but that in plaintiff’s case the court records mistakenly described plaintiff’s drug charge as a robbery.

The Court ruled for CoreLogic, finding that it was “undisputed that a SafeRent employee traveled to the Cook County courthouse and collected the record at issue using its standard procedures

for transcribing and auditing information from the courts.” The Court held that the “…error is of no significance for purposes of §1681k(a)(2), which concerns only the strictness of the procedures the defendant maintains, not any errors it may have committed in spite of those procedures.”

These cases demonstrate that a CRA who issues a report containing errors can prevail in FCRA litigation if demonstrates it had reasonable procedures for avoiding the error. If these procedures are spelled out in a FCRA Compliance Manual and the CRA has trained its employees to follow them, its likelihood of success will be significantly improved.

What Should Be Included in an FCRA Compliance Manual?

At a minimum, a CRA’s FCRA Compliance Manual should cover the following topics.

Investigative Consumer Report Procedures

A CRA who issues investigative consumer reports should have procedures for complying with §1681d(a) and (b) regarding consumer disclosure and disclosure upon the consumer’s request of the "nature and scope of the investigation". The CRA should also have procedures for complying with §1681d(4) so if the person interviewed is not the best possible source of information the CRA can demonstrate it has reasonable procedures for obtaining confirmation of the information from an additional source that has independent and direct knowledge of the information.

Permissible Purposes & Report Content Procedures

CRAs should have procedures for complying with §1681e(a) to ensure reports (i) do not contain information prohibited from being reported (e.g., arrest records which predate reports by more than 7 years); and (ii) are furnished to only those with permissible purpose.

Reseller Procedures

A CRA who is a reseller should have procedures for complying with §1681e(e)(2)(A)&(B) documenting how it ensures (a) reports are resold to only those with permissible purpose; (b) those to whom reports are resold (i) identify end user, (ii) certify purpose, and (iii) certify reports will be used for no other purpose; and (c) the CRA’s reasonable efforts to verify these identifications and certifications.

Procedures for Assuring Maximum Possible Accuracy

CRAs should have procedures for complying with §1681e(b) to assure the maximum possible accuracy of the information in their reports such as standards for matching records to the consumers, properly classifying crimes in reports, and procedures for situations where records are unclear or conflicting.

Consumer Dispute and Reinvestigation Procedures

CRAs should have procedures for fielding consumer disputes and conducting investigations of disputed items in reports under §1681i(a) as well as procedures to prevent the reappearance of

deleted information under §1681i(a)(5)(C). Reinvestigation procedures should include procedures for responding to third party disputes, including rules for ensuring the third party is authorized to act for the consumer. Reinvestigation procedures should specify standards for conducting reinvestigations, standards for responding to frivolous or irrelevant disputes, procedures for timely notifying consumers of the results of reinvestigations, procedures for continued disputes, and procedures for reinsertion of previously deleted records.

"Strict Procedures" for Employment Reports

CRAs who issue reports for employment purposes should include §1681k(a)(2) "strict procedures" to ensure that public record information likely to have an adverse effect on a consumer’s employment is complete and up to date unless they opt to notify consumers that they are reporting public record information pursuant to §1681k(a)(1).

Other Recommended FCRA Compliance Manual Provisions

Other recommended FCRA Compliance Manual provisions include:

Procedures for responding to requests for reports and/or files;

rules and procedures for complying with state-specific credit and criminal reporting laws;

rules and procedures for complying with municipal credit and criminal reporting laws;

employee training procedures; and

compliance audit procedures.

Conclusion

A properly drafted and implemented FCRA Compliance Manual can help a CRA efficiently comply with the FCRA while insulating them from liability when things go wrong. Preparation of the Manual requires a deep dive into the CRA’s operational procedures by qualified management and legal counsel. It also requires the education and training of the employees who must comply with the Manual. This investment will pay off greatly if litigation arises or the CFPB comes calling.

About the Author

Mr. Messer provides comprehensive legal representation to CRAs and related companies throughout the nation in litigation, compliance and transactional matters. A former Illinois Special Assistant Attorney General, Mr. Messer has extensive trial and appellate experience and is admitted to practice before many federal district courts. He has earned a national reputation for defending lawsuits brought under the FCRA and other consumer protection laws. He has conducted many trials and has substantial class action experience. Mr. Messer is a nationally recognized author and speaker and an active member of the Professional Background Screeners Association. Feel free to contact Mr. Messer at (312) 334-3440 or jmesser@messerstrickler.com to discuss legal matters or a FCRA Compliance Manual for your company.