FCRA compliance means meeting the duties the Fair Credit Reporting Act places on your business based on its role in the credit and background reporting system. The Act reaches three groups: consumer reporting agencies that compile reports, furnishers that feed them data, and users that pull reports to make decisions about people. Each group has different obligations, and the penalties are serious. A willful violation exposes you to statutory damages of $100 to $1,000 per incident plus punitive damages and attorney fees with no cap, even when the consumer can’t prove a dollar of actual harm.
Figure Out Which Role You Play
Your compliance duties follow from what you do with consumer information, not from what industry you’re in.
A consumer reporting agency (CRA) is any entity that regularly collects or evaluates consumer information and sells reports to third parties.1Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction Equifax, Experian, and TransUnion are the visible examples, but the category also captures specialty agencies that track narrower slices of consumer history such as check-writing, rental, or medical payment records.2Consumer Financial Protection Bureau. What Are Specialty Consumer Reporting Agencies and What Types of Information Do They Collect The framework applies the same way to all of them.
A furnisher is any company that reports information to a CRA: banks, card issuers, auto lenders, collection agencies, landlords, and similar entities. A furnisher cannot report information it knows or has reasonable cause to believe is inaccurate, and it has to investigate consumer disputes about data it supplied.3Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
A user is any business that pulls a consumer report. Lenders, employers, insurers, and landlords are the usual users. Before accessing a report, a user must have a permissible purpose defined by statute and must certify that purpose to the CRA.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
Many businesses wear more than one hat. A bank is a furnisher when it reports account activity and a user when it pulls a report to underwrite a loan. Map each activity to the right role before you build your compliance program around it.
Pulling a Report: The Permissible Purpose Requirement
The FCRA doesn’t allow open access to consumer files. A user can pull a report only for a reason the statute recognizes. The common ones are evaluating a credit application the consumer submitted, underwriting insurance, screening a rental application, and reviewing an existing account.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Employment checks qualify, but with the added rules below. Courts can order reports, and government agencies can access them in limited circumstances.
Pulling a report without a permissible purpose is itself a violation, and obtaining one under false pretenses is a federal crime. Document why each pull was permissible at the time it happened; that record is what defends the pull later.
Accuracy and Dispute Handling
CRAs must follow reasonable procedures to ensure the maximum possible accuracy of information in the reports they issue.5Office of the Law Revision Counsel. 15 USC 1681e – Compliance Procedures The standard is “reasonable procedures,” not perfection, but ignoring a known accuracy problem is not reasonable.
Furnishers carry a parallel duty on the input side: don’t report data you know is wrong, and if you learn that data you already reported was inaccurate, notify the CRA and correct the record.3Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies When a consumer disputes an item with the CRA, the agency has 30 days from receiving the notice to investigate and either verify, correct, or delete it.6Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy Consumers can also dispute directly with the furnisher, which triggers its own investigation obligation.
Most day-to-day FCRA friction lives here. A lender reports a late payment, the consumer disputes it, and the lender is legally required to look into it. Blowing off the investigation, or running a token one, is where negligence cases come from.
Employment Background Checks Have Extra Rules
Employment is where users most often trip. If you use consumer reports to hire, promote, or terminate, a two-step notice process applies.
Before You Pull the Report
Give the applicant or employee a clear written disclosure, on a standalone document, that you may obtain a consumer report for employment purposes. Get their written authorization before ordering it.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The standalone requirement is not a formality. Bundling the disclosure inside a job application or employee handbook violates the statute, and courts have certified class actions on that specific mistake.
Before You Take Adverse Action
If the report contains something that could push you toward a negative decision — rejecting a candidate, passing on a promotion, or firing someone — send a pre-adverse action notice first. Include a copy of the consumer report and a summary of the person’s FCRA rights.7Federal Trade Commission. Using Consumer Reports: What Employers Need to Know The point is to give the person a chance to review the report and challenge errors before you decide. Only after that reasonable window can you send the final adverse action notice.
Adverse Action Notices Apply Beyond Credit
Any user that makes a decision negatively affecting a consumer based on report information owes an adverse action notice. That covers denying credit, raising interest rates, declining a rental applicant, or refusing insurance coverage.8Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
The notice must contain:
- A clear statement of the adverse decision.
- The name, address, and phone number of the CRA that provided the report, along with a statement that the CRA did not make the decision and cannot explain it.
- If a credit score was used, the score itself, the range of possible scores under that model, and the key factors that hurt the score.
- A statement that the consumer can obtain a free copy of the report from that CRA within 60 days and can dispute any inaccurate information.
Missing this notice, or sending a version that skips one of the required elements, is one of the most common violations. Businesses outside consumer lending often don’t realize the obligation reaches them at all.
Disposing of Consumer Report Information
Anyone who holds consumer report information — CRA, furnisher, or user — must take reasonable steps to protect it at disposal. The FTC’s Disposal Rule spells out what reasonable looks like.9eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records For paper, that means shredding, burning, or pulverizing documents so they can’t be reconstructed. For electronic media, it means destroying or erasing the data so it can’t be recovered. The rule doesn’t require one specific method, but whatever method you use has to actually prevent unauthorized access.
What Noncompliance Costs
FCRA penalties scale with intent, and both civil and criminal exposure are on the table.
Willful Violations
For an intentional violation, a consumer can recover statutory damages between $100 and $1,000 per violation without proving any actual loss. Courts can add punitive damages with no statutory cap, plus attorney fees and costs.10Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Anyone who pulls a report under false pretenses or knowingly without a permissible purpose faces minimum liability of $1,000 or actual damages, whichever is greater. In class actions, the per-violation figures multiply quickly.
Negligent Violations
For a violation caused by negligence rather than intent — sloppy procedures, untrained staff, a missed notice — the consumer can recover actual damages plus attorney fees and costs.11Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance No statutory minimum, no punitive damages. The consumer has to show real harm, typically a denied loan, a lost job, or emotional distress tied to the mistake.
Criminal Exposure
Knowingly and willfully obtaining consumer report information under false pretenses is a federal crime carrying a fine and up to two years in prison.12Office of the Law Revision Counsel. 15 USC 1681q – Obtaining Information Under False Pretenses The target is anyone who lies about identity or fabricates a permissible purpose to reach someone’s file.
How Long a Claim Stays Alive
Consumers can sue in any U.S. district court regardless of the amount at stake. The statute of limitations is the earlier of two years from discovery of the violation or five years from the date it occurred.13Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery rule matters for compliance planning: if inaccurate data has been sitting on a report for years, the two-year clock can start the day the consumer finds it. The five-year outer limit is the backstop.
Because the discovery rule keeps old conduct exposed, retention of your compliance records — permissible-purpose certifications, dispute investigations, adverse action notices sent, disposal logs — should outlast the transactions themselves. When a claim surfaces, those records are what turn a willful case into, at worst, a negligence case, and a negligence case into no case at all.