The CFPB has released the Spring 2024 edition of Supervisory Highlights.  The report discusses CFPB examinations in connection with credit reporting and furnishing that were completed from April 1, 2023 through December 31, 2023.

Key findings by CFPB examiners are described below.

Examinations of credit reporting companies (CRCs) found the following deficiencies:

• CRCs failed to timely implement blocks of information after receiving the requisite information relating to an alleged identity theft, without otherwise making a reasonable determination with respect to one of the permitted bases for declining to block such information as provided in the Fair Credit Reporting Act (FCRA) and Regulation V.  CRCs instead maintained policies pursuant to which they automatically declined to block information if the customer’s associated account met any one of a set of overbroad disqualifying criteria that were not sufficiently tailored to support a reasonable determination regarding any of the statutory declination bases.  CRCs were directed to cease the practice of automatically declining to implement blocks based on overbroad disqualifying criteria without an individualized determination that there is statutory basis to decline.  
• CRCs failed to provide the requisite notice within five business days of declining to block information (in some instances due to system issues and in others due to human error) and systematically failed to timely provide consumers with the relevant furnisher’s contact information and/or notice regarding the consumer’s right to add a statement to the consumer’s file disputing the accuracy or completeness of the furnished information. CRCs were directed to revise their policies to ensure compliance with FCRA identity theft block notice obligations and update notice templates to include the requisite information for consumers.
• CRCs failed to comply with the requirement to provide the consumer with a summary of rights containing all of the information required in the CFPB’s model summary of rights when a CRC is contacted by a consumer who expresses a belief that they are a victim of fraud or identity theft.  CRCs failed to comply with this requirement by failing to include required information in summaries of rights or by failing to provide the summary of rights to eligible consumers entirely.  In response to these findings, CRCs are updating their systems to ensure that they provide the required summary of rights.
• CRCs failed to block adverse items of information within the applicable four business days from the date that the consumer or their representative identified the information as resulting from human trafficking. CRCs blocked some but not all items identified in a qualifying consumer submission or failed to implement a block entirely.  CRCs were directed to revise their compliance processes to ensure that they process all human trafficking block requests in accordance with the requirements of Regulation V.
• CRCs failed to comply with the requirement for a CRC to follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates when preparing a consumer report by (1) failing to adequately monitor dispute metrics and thresholds tied to objective measures of inaccuracy or unreliability that would suggest a furnisher may no longer be a source of reliable, verifiable information about consumers, and (2) continuing to include information in consumer reports that was provided by unreliable furnishers without implementing procedures to assure the accuracy of information provided by unreliable furnishers.  CRCs also maintained data from furnishers that responded to disputes in ways that suggested that the furnishers were no longer sources of reliable, verifiable information such as furnisher dispute response data indicating that, for several months, furnishers failed to respond to all or nearly all disputes, or responded to all disputes in the same manner.  Despite this furnisher data, CRCs continued to include information from these furnishers in consumer reports.  CRCs were directed to revise their accuracy procedures to identify and monitor furnishers and take corrective action regarding data from furnishers whose dispute response behavior indicates the furnisher is not a source of reliable, verifiable information about consumers.

Examinations of furnishers found the following deficiencies:

• Furnishers are violating the FCRA duty to promptly correct and update furnished information after determining that such information is incomplete or inaccurate:
  • In examinations of auto loan furnishers, examiners found that furnishers continued to furnish incomplete or inaccurate information after they determined, through either dispute handling or identification of systemic issues, that the information was furnished incompletely or inaccurately.  For example, examiners found that furnishers continued to report dates of first delinquency inaccurately for several months after determining that they were reporting inaccurately due to various system coding issues.  Examiners also found that after determining accounts were in a bankruptcy status and should have been reported as current with dates of first delinquency that reflect the bankruptcy filing dates, furnishers failed to update the dates of first delinquency for the accounts to the bankruptcy filing dates.  By failing to update the dates of first delinquency for the accounts in bankruptcy when they determined the accounts were in bankruptcy, the furnishers failed to promptly update or correct information they had determined to be incomplete or inaccurate.  In response to these findings, furnishers are updating their internal controls related to promptly correcting or updating furnished information after determining it is incomplete or inaccurate and engaging in lookbacks to remediate the furnishing of the previously impacted accounts.  Examiners also found that auto loan furnishers did not promptly send corrections or updates to CRCs after determining that accounts with lease returns were paid-in-full.  When leased cars were returned to dealerships, furnishers updated their systems of record to reflect that the accounts had been paid-in-full but failed to update the information furnished to CRCs to reflect that the accounts were paid-in-full.  In response to these findings, furnishers are conducting lookbacks to ensure that corrections or updates are furnished for impacted accounts and are implementing internal controls to ensure they promptly correct or update furnished information after determining it is incomplete or inaccurate.
  • In examinations of deposit furnishers, examiners found that furnishers continued to report fraudulent accounts to CRCs after determining the accounts were fraudulent.  While some accounts determined to be fraudulent were closed, furnishers continued to report the accounts as valid (i.e., non-fraudulent) accounts and failed to notify CRCs that the accounts should be deleted because they were fraudulent.  By not instructing CRCs to delete the accounts promptly after determining they were fraudulent, the furnishers failed to promptly correct or update furnished information determined to be inaccurate or incomplete.  In response to these findings, furnishers conducted lookbacks to ensure they deleted all accounts they determined to be opened fraudulently and updated their policies and procedures related to notifying CRCs when accounts are determined to be fraudulent to ensure the accounts are deleted.
• Furnishers are violating the FCRA requirement to notify CRCs that the accuracy or completeness of items being furnished by them are subject to dispute.  In examinations of deposit furnishers, examiners found that furnishers who received direct disputes from consumers were continuing to furnish the disputed information to CRCs without notifying the CRCs that the information was subject to dispute.  In response to these findings, furnishers are updating their policies to make clear that they will provide notices of direct disputes to CRCs.
• Furnishers are violating the Regulation V requirement to conduct a reasonable investigation of direct disputes:
  • In examinations of auto loan furnishers, examiners found evidence that furnishers failed to investigate direct disputes that did not satisfy those furnishers’ extraneous identity verification requirements.  Although these disputes met the Regulation V requirements for what a consumer must include in a dispute notice to trigger a furnisher’s duty to investigate, examiners found evidence that the furnishers did not investigate the disputes because the consumer had not satisfied additional identity verification requirements of the furnisher.
  • In examinations of debt collection furnishers, examiners found that when the furnishers received a direct dispute they simply deleted the tradeline, rather than conducting an investigation.
  • Furnishers were directed to update their policies and procedures to ensure they conduct reasonable investigations of direct disputes.
• Furnishers are violating the FCRA requirement to notify CRCs of the dates of first delinquency on applicable accounts.  In examinations of auto loan furnishers, examiners found that furnishers inaccurately reported dates of first delinquency to CRCs due to various coding issues, such as coding errors that resulted in inaccurately reporting dates of first delinquency as the first day of the statement cycle following the consumer’s missed payment, rather than 30 days after the missed payment due date.  Examiners also found that auto loan furnishers reported inaccurate dates of first delinquency for accounts by reporting the dates of first delinquency as more recent than they should have been, including by changing the dates of first delinquency for accounts that remained delinquent month after month.  In response to these findings, furnishers are conducting lookbacks to identify and remediate impacted accounts and updating their policies and procedures to ensure that they report dates of first delinquency accurately.
• Furnishers are violating the FCRA requirement that if a consumer submits an identity theft report at the address specified by the furnisher for such reports stating that information maintained by the furnisher purporting to relate to the consumer resulted from identity theft, the furnisher may not furnish such information to any CRC unless the furnisher subsequently knows or is informed by the consumer that the information is correct.  In examinations of auto loan furnishers, examiners found that furnishers who received identity theft reports at a qualifying address continued to furnish information identified in the report before knowing or being informed by the consumer that the information was correct.  In response to these findings, furnishers are updating their policies and procedures to ensure that information subject to this requirement is not furnished prior to the completion of an investigation and determination of validity.

[View source.]