Last week, the Consumer Financial Protection Bureau (CFPB or Bureau) released the spring edition of its Supervisory Highlights report, providing a high-level overview of alleged unfair, deceptive, or abusive acts or practices identified by the agency during examinations from April 1, 2023 to December 31, 2023. According to the report, examiners have continued to find deficiencies in consumer reporting agencies’ (CRAs) compliance with the accuracy and identity theft requirements of the Fair Credit Reporting Act (FCRA) as well as deficiencies in furnishers’ compliance with the accuracy and dispute investigation requirements.

According to the CFPB, the most significant compliance issues identified by examiners during their supervisory activities were:

• As to CRAs, they had failed to:
  • block the reporting of information resulting from an alleged identity theft;
  • notify consumers after declining to implement an identity block;
  • provide victims of identity theft with summaries of rights;
  • block adverse information resulting from human trafficking; and
  • follow reasonable procedures to assure maximum possible accuracy.
• As to furnishers, they had failed to:
  • promptly correct and update information determined to be incomplete or inaccurate;
  • notify CRAs of direct disputes through the use of an appropriate compliance condition code;
  • conduct reasonable investigations of direct disputes;
  • provide notice of delinquency of accounts; and
  • not furnish information that purports to relate to a consumer upon receipt of an identity theft report.

The Bureau has been active as of late in the consumer reporting sphere. As discussed here, earlier this year the Bureau issued two “advisory opinions” addressing the CFPB’s views of the obligations of CRAs under the FCRA. First, the CFPB advised that in order to assure “maximum possible accuracy” under § 607(b) of the FCRA, a CRA that provides background check reports must have procedures in place that: (1) prevent reporting public record information that is duplicative or that has been expunged, sealed, or otherwise legally restricted from public access; and (2) include any existing disposition information if it reports arrests, criminal charges, eviction proceedings, or other court filings. Second, the CFPB advised that under § 609(a) of the FCRA, CRAs responding to file disclosure requests must also disclose to a consumer “the sources” of information, including both the original source and any intermediary or vendor sources.