No single agency regulates the credit bureaus. Authority is split across several federal and state actors, all working from the same statute: the Fair Credit Reporting Act. The Consumer Financial Protection Bureau has been the lead federal regulator since 2011, though its examinations and enforcement work have been sharply curtailed since early 2025. The Federal Trade Commission, federal banking regulators, and state attorneys general all hold their own enforcement power, and you can sue a bureau directly in federal court when the law is violated. Knowing who does what tells you where to complain, who is likely to act, and when litigation is the better route.
The Law Behind Every Regulator: the FCRA
Every layer of oversight traces back to the Fair Credit Reporting Act, the federal statute that governs how consumer reporting agencies collect, maintain, and share your financial information.1Federal Trade Commission. Fair Credit Reporting Act The FCRA requires bureaus to follow reasonable procedures aimed at producing the most accurate reports possible, restricts who can access your report, caps how long negative items can appear, and gives you the right to dispute errors.
A bureau can only release your report for a recognized purpose: evaluating a credit application, underwriting insurance, screening for employment with your written consent, assessing eligibility for a government license, or a legitimate business need tied to a transaction you started. Court orders and child support agencies also qualify.2Office of the Law Revision Counsel. 15 U.S.C. 1681b – Permissible Purposes of Consumer Reports Anything outside those categories is illegal.
Bankruptcies drop off after ten years. Most other adverse items — late payments, collections, civil judgments, paid tax liens — must come off after seven years.3Office of the Law Revision Counsel. 15 U.S.C. 1681c – Requirements Relating to Information Contained in Consumer Reports Criminal convictions have no time limit.
When you dispute an error, the bureau must run a reasonable investigation, usually within 30 days, and then verify, correct, or delete the item.4Office of the Law Revision Counsel. 15 U.S.C. 1681i – Procedure in Case of Disputed Accuracy The window can stretch to 45 days if you send additional documentation or if the dispute follows your free annual report.5Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report? The bureau then has five business days to send you the results.
The Consumer Financial Protection Bureau
The CFPB became the lead federal regulator for credit reporting in July 2011, when the Dodd-Frank Act moved FCRA rulemaking authority out of seven agencies into a single bureau.6Consumer Financial Protection Bureau. Fair Credit Reporting (Regulation V) Consolidation gave the CFPB two tools the other regulators do not have in the same combination: supervisory authority to conduct on-site examinations of the largest bureaus, and enforcement authority to bring legal actions and impose civil penalties.
Both tools were active as recently as January 2025. The CFPB issued a consent order against Equifax carrying a $15 million civil penalty, finding the company routinely failed to initiate reinvestigations, did not forward relevant information to furnishers, improperly reinserted deleted items without notice, and sent results letters that misdescribed what the investigation found.7Consumer Financial Protection Bureau. Equifax Inc. Consent Order That same month, the bureau sued Experian, alleging it failed to forward more than two million disputes to furnishers within the required five business days and deleted more than 100,000 disputed tradelines instead of investigating them.8Consumer Financial Protection Bureau. Experian Information Solutions Complaint
Why the CFPB’s Current Status Matters to You
The CFPB’s ability to continue this work is now in question. Beginning in February 2025, the bureau’s acting leadership issued stop-work orders, closed ongoing supervisory examinations, and terminated employees, contracts, and enforcement cases. A Government Accountability Office report described these steps as an effort to fulfill the agency’s statutory duties “as a smaller, more efficient operation” in response to executive orders.9Government Accountability Office. Consumer Financial Protection Bureau: Status of Reorganization Some actions, including employee terminations, remain in litigation.
Congress has not repealed the CFPB’s authority, but the agency’s capacity to exercise it through examinations and enforcement is significantly reduced as of this writing. The practical effect for you: other regulators and private lawsuits carry more weight right now than they have at any point since the CFPB was created.
The Federal Trade Commission
The FTC held primary enforcement authority over credit reporting before the CFPB existed, and Dodd-Frank preserved all of that enforcement power even as it moved rulemaking to the newer bureau.1Federal Trade Commission. Fair Credit Reporting Act The FTC has sued credit bureaus, charged companies with furnishing inaccurate data, and pursued report users who failed to notify consumers of adverse decisions.10Federal Trade Commission. Credit Reporting With CFPB supervision diminished, the FTC’s role as a backstop enforcer matters more than it has in over a decade.
The FTC also sets data security standards for bureaus. Under the Safeguards Rule, financial institutions that handle consumer information, including consumer reporting agencies, must develop and maintain a written information security program with administrative, technical, and physical safeguards appropriate to the data they hold.11Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Amendments that took effect in May 2024 added a breach notification requirement: when a security breach affects 500 or more consumers, the institution must report it to the FTC within 30 days of discovery.12Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
Banking Regulators and the Furnishers Behind the Data
A credit report is only as accurate as the information fed into it, and that information comes from furnishers: banks, credit card companies, mortgage servicers, collection agencies, and other businesses that report your account activity. The FCRA prohibits a furnisher from reporting information it knows or has reasonable cause to believe is inaccurate. If a furnisher later discovers it sent wrong or incomplete data, it must promptly notify the bureau and provide corrections. When a bureau forwards your dispute to a furnisher, the furnisher must investigate, review the information you provided, and report results back. If the data was wrong, the furnisher must correct the record with every nationwide bureau it reported to.13Office of the Law Revision Counsel. 15 U.S.C. 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies
Federal banking regulators such as the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation oversee furnisher compliance at the banks and financial institutions they supervise.14Federal Trade Commission. Consumer Reports: What Information Furnishers Need to Know This matters because disputing with a bureau is sometimes not enough. If the furnisher keeps sending the same bad data, the error will reappear. Knowing that furnishers carry an independent legal obligation to investigate lets you escalate to the furnisher itself, and to that furnisher’s regulator, when a bureau-level dispute goes nowhere.
State Attorneys General and State Laws
Federal law is the floor, not the ceiling. State attorneys general have explicit authority to enforce the FCRA in federal court on behalf of their residents. A state can sue to stop violations and recover damages of up to $1,000 per willful or negligent violation, plus attorney fees.15Office of the Law Revision Counsel. 15 U.S.C. 1681s – Administrative Enforcement State AGs and state regulators can also enforce the Consumer Financial Protection Act’s ban on unfair, deceptive, or abusive practices by financial companies, including credit bureaus.16Consumer Financial Protection Bureau. CFPB Bolsters Enforcement Efforts by States
States also pass their own consumer reporting statutes on top of federal law. A CFPB interpretive rule has clarified that FCRA preemption of state law is narrow: states retain broad flexibility to, for example, prohibit bureaus from including medical debt, eviction records, or arrest records in reports, or to require that bureaus provide information in languages other than English.17Consumer Financial Protection Bureau. The Fair Credit Reporting Act’s Limited Preemption of State Laws The specifics vary by state, but consumers in states with active attorneys general and strong supplementary laws have an enforcement layer that operates independently of what the federal government does.
Your Own Right to Sue
Filing regulatory complaints is not your only option. The FCRA gives you a private right of action, meaning you can sue a bureau, furnisher, or report user directly in federal court without waiting for any agency to act. What you can recover depends on whether the violation was willful or merely negligent.
For willful violations, you can recover either your actual damages or statutory damages between $100 and $1,000 per violation, whichever is greater. On top of that, the court can award punitive damages in whatever amount it deems appropriate, plus attorney fees and court costs.18Office of the Law Revision Counsel. 15 U.S.C. 1681n – Civil Liability for Willful Noncompliance For negligent violations, recovery is limited to actual damages you can prove, plus attorney fees and costs.19Office of the Law Revision Counsel. 15 U.S.C. 1681o – Civil Liability for Negligent Noncompliance The distinction matters: willful cases can produce meaningful recoveries even when your provable financial loss is small, while negligent cases require documented harm like a denied loan or higher interest rate.
You must file within two years of discovering the violation, or five years from the date it occurred, whichever comes first.20Office of the Law Revision Counsel. 15 U.S.C. 1681p – Jurisdiction of Courts; Limitation of Actions The statutory attorney-fee provision is what makes these cases viable for most consumers, because a successful plaintiff recovers reasonable fees by law and consumer rights attorneys will often take FCRA cases on contingency. The bar for proving willful noncompliance is higher than it sounds. A bureau that runs some dispute process, even a bad one, may not meet the willfulness threshold. If you are considering litigation, the strength of your documentation from the dispute stage will be the foundation of the case.
Where to File a Complaint
The most direct way to get regulatory attention is the CFPB’s online complaint portal, which accepts complaints about credit reports and other consumer financial products. You describe the problem, the CFPB forwards it to the company, and the company generally responds within 15 days.21Consumer Financial Protection Bureau. Learn How the Complaint Process Works In more complex cases, the company may say a response is in progress and provide a final answer within 60 days. The CFPB shares complaint data with other state and federal agencies to support their own supervision and enforcement.22Consumer Financial Protection Bureau. Submit a Complaint Even with the bureau’s reduced operations, the portal has remained functional, and complaints on file create a documented record that can support a later lawsuit or a state AG investigation.
Monitoring Your Reports and Locking Them Down
You are entitled to check your credit reports regularly at no cost. The three nationwide bureaus have permanently extended a program that lets you pull your report from each bureau once a week for free through AnnualCreditReport.com. Equifax is additionally offering six free reports per year through 2026 on the same site.23Federal Trade Commission. Free Credit Reports Federal law also guarantees free credit freezes and unfreezes at all three bureaus, a right established by the Economic Growth, Regulatory Relief, and Consumer Protection Act in 2018.24Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts A freeze blocks new creditors from accessing your report entirely, which is the single most effective tool for preventing identity thieves from opening accounts in your name. Lifting it when you need to apply for credit takes minutes online.