Background The Consumer Reporting Process Information on consumers is exchanged through a consumer reporting process that includes consumers, CRAs, furnishers of consumer information, and users of consumer reports (see fig. 1). Consumers are individuals whose information is collected by CRAs and shared by CRAs with users of consumer reports to make decisions about eligibility, such as for credit, insurance, or employment. Information about consumers is generated through their participation in markets for goods and services—such as the use of banking or insurance products. CRAs are companies that regularly assemble or evaluate consumer information for the purpose of providing consumer reports to third parties. CRAs obtain data from a wide variety of sources, including data furnishers, such as banks and mortgage lenders, and public records. They can generate revenue by selling consumer reports to third parties. In 2012, CFPB estimated that the consumer reporting market consisted of more than 400 CRAs. CFPB estimated in 2015 that the three nationwide CRAs—which also are the three largest CRAs—held information on about 208 million Americans. Data furnishers are companies that report consumer information to CRAs. Examples of furnishers include banks, payday lenders, mortgage lenders, collection agencies, automobile-finance lenders, and credit card issuers. The information provided by furnishers may include personally identifiable information such as names, addresses, Social Security numbers, and employment data and account status and credit histories. A furnisher may provide CRAs with consumer information on multiple types of products. For example, a financial institution may provide account information on student loans as well as bank deposits. Furnishing of information to CRAs is generally voluntary; therefore, a furnisher is not required to submit all of the records about a consumer’s activity on an account to CRAs. Some accounts may only be reported when the payment history turns negative, such as when the debt is transferred to debt collection. Users of consumer reports include banks, credit card companies, landlords, employers, and other entities that use consumer reports to determine individual consumers’ eligibility for housing, employment, or products and services such as credit and insurance. Companies use consumer information compiled in consumer reports to screen for consumer risks and behaviors. For example, banks and credit unions may rely on consumer reports to assess the risk of opening new accounts. Some companies may act as both furnishers and consumer report users. During the consumer reporting process, a consumer does not necessarily interact with the CRA; however, if consumers discover inaccurate or incomplete information on their consumer reports as a result of, for example, being denied credit, they can file a dispute with the CRA, the furnisher, or both. Consumers may also request copies of their consumer reports from CRAs directly, and CRAs may provide consumers with certain disclosures about how their information is being shared. Different types of CRAs compile different types of reports using the data they obtain. The three nationwide CRAs produce credit reports and credit scores that can be used to qualify consumers for credit. Credit reports generally contain personally identifiable information, employment information, account status and credit histories, and inquiries made about consumers’ credit histories (see fig. 2). Other CRAs, called specialty CRAs, provide a variety of specialized reports used for making decisions on employment, rental housing, or other purposes. For example, reports from a specialty background-screening CRA may include some of the same information as a credit report but may also contain criminal history, education verification, and employment history. Laws and Regulations Governing Consumer Reporting Several federal laws govern the consumer reporting industry, including the accuracy, security, use, and sharing of consumer report information. The Fair Credit Reporting Act (FCRA) is the primary federal law governing the collection, assembly, and use of consumer reports. FCRA was enacted to improve the accuracy and integrity of consumer reports, and promote the consumer reporting agencies’ adoption of reasonable procedures regarding the confidentiality, accuracy, relevancy, and proper use of consumer information. FCRA has been amended several times since it was enacted in 1970. When FCRA was originally enacted, FCRA imposed certain requirements on CRAs and users of consumer reports. Amendments to FCRA, pursuant to the Consumer Credit Reporting Reform Act of 1996 and the Fair and Accurate Credit Transactions Act of 2003, expanded the duties of CRAs, including requirements for dispute investigations, and imposed duties on data furnishers, such as requirements related to data accuracy and dispute investigations. FCRA Provisions Governing Consumer Report Accuracy FCRA requires CRAs and furnishers to take steps regarding the accuracy of the information contained in consumer reports. In addition, FCRA’s implementing regulation—Regulation V—as well as FTC’s Furnisher Rule more specifically outline furnishers’ responsibilities regarding accuracy. FCRA requires CRAs to follow reasonable procedures to assure “maximum possible accuracy” of the information concerning the individual to whom the report relates when preparing consumer reports. FCRA prohibits furnishers from reporting information that they know or have reasonable cause to believe is inaccurate, unless the furnisher has clearly and conspicuously specified to consumers an address whereby consumers can notify the furnisher that specific information is inaccurate. Regulation V and FTC’s Furnisher Rule require furnishers to have reasonable written policies and procedures in place regarding the accuracy and integrity of the information they provide to a CRA, where accuracy means that the information is for the right person and reflects the terms of the account and the consumer’s performance on the account. They also require furnishers to consider and incorporate, as appropriate, guidelines such as internal controls for accuracy and integrity of furnished information. FCRA requires CRAs and furnishers to address disputes consumers submit to them about the completeness or accuracy of information in their consumer reports. FCRA requires CRAs and Regulation V and FTC’s Furnisher Rule require furnishers to conduct reasonable investigations of a consumer’s dispute to determine the accuracy of the disputed information. As part of the process, CRAs and furnishers are required to consider all relevant information, including information provided by the consumer. Laws Governing Security of Consumer Data The Gramm-Leach-Bliley Act (GLBA), provisions in the Federal Trade Commission Act, and provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), among other laws, govern the security of consumer data. Congress enacted GLBA in part to protect the privacy and security of nonpublic personal information that individuals provide to financial institutions. Many financial institutions furnish consumer data to CRAs. In a prior report, FTC staff told us that CRAs themselves might be considered financial institutions under GLBA if they collect, maintain, and report on consumer information. GLBA includes a provision directing FTC and certain federal regulators—including the Federal Reserve, FDIC, and OCC—to establish standards relating to administrative, technical, and physical safety for customer records. Specifically, GLBA directs these federal agencies to establish appropriate standards for financial institutions under their jurisdiction to ensure the security and confidentiality of customer records and information; protect against any anticipated threats or hazards to the security or integrity of such records; and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. Provisions in the Federal Trade Commission Act prohibiting unfair or deceptive acts or practices and provisions in the Dodd-Frank Act prohibiting unfair, deceptive, or abusive acts or practices also may apply to CRAs’ protection of consumer data. Specifically, section 5 of the Federal Trade Commission Act prohibits “unfair or deceptive acts or practices” in or affecting commerce. In the context of privacy and security, these provisions require companies to represent practices to consumers in a truthful manner. For example, we reported previously that FTC has found companies that alleged they were following certain security protections, but did not in fact have such security features, to have engaged in unfair or deceptive practices. Similarly, the Dodd- Frank Act prohibits providers of consumer financial products or services from engaging in “unfair, deceptive, or abusive acts or practices.” For example, we reported previously that CFPB has alleged that claims to consumers that transactions are safe and secure while simultaneously lacking basic security practices can constitute “unfair, deceptive, or abusive acts or practices.” Laws Governing Use and Sharing of Consumer Information FCRA, GLBA, and the Economic Growth, Regulatory Relief, and Consumer Protection Act govern how consumer information may be used and shared. However, as we have previously reported, consumers have limited legal rights to control what personal information is collected and how it is maintained, used, and shared. For example, consumers generally cannot exercise choice in the consumer reporting market—such as by choosing which CRAs maintain their information—and do not have legal rights to delete their records with CRAs. FCRA permits CRAs to provide users of consumer reports the report only if the user has a “permissible purpose,” such as to process a credit application, screen a job applicant, or underwrite an insurance policy, subject to additional limitations where the credit or insurance transaction is not initiated by the consumer. FCRA also prohibits a person from using or obtaining a consumer report for any purpose other than that specified to the CRA when the user obtained the report. Further, FCRA requires that CRAs take steps to validate the legitimacy of users and their requests for consumer report information. FCRA and Regulation V also allow consumers to opt out of allowing CRAs to share their information with third parties for prescreened offers and limits the ability of affiliated companies to market products or services to consumers using shared consumer data. GLBA contains provisions regarding the use and sharing of consumer information that apply to CRAs. GLBA restricts the sharing of nonpublic personal information collected by or acquired from financial institutions. In particular, generally a nonaffiliated third party that receives nonpublic personal information from a financial institution faces restrictions on how it may further share or use the information. For example, a third party that receives nonpublic personal information from a financial institution to process consumer account transactions may not use the information for marketing purposes or sell it to another entity for marketing purposes. Consumers can prevent certain users from accessing their consumer reports by placing a security freeze on their consumer reports, which generally prevents the opening of new lines of credit in the consumer’s name (provided the creditor checks the consumer’s credit). Consumers may place a credit freeze at the three nationwide CRAs free of charge. Oversight of CRAs Is Shared among CFPB and Other Federal and State Agencies Federal and state agencies share oversight of CRAs and furnishers. At the federal level, CFPB has supervisory authority over certain CRAs and shares enforcement and rulemaking authority with FTC for certain statutes applicable to all CRAs. At the state level, state Attorney General offices have enforcement authority to oversee CRAs, and some state agencies have limited supervisory authority under state laws. Federal agencies that have oversight authority for data furnishers are CFPB, FTC, and prudential regulators—the Federal Reserve, FDIC, NCUA, and OCC. Their oversight authority depends on the size as well as the type of the furnisher, such as if the furnisher is a nonbank institution, depository institution, or credit union. CFPB Has Supervisory Authority over Certain CRAs and Shares Enforcement Authority with FTC for All CRAs CFPB is the only federal agency with supervisory authority over CRAs, but it generally shares enforcement authority over CRAs with FTC as well as rulemaking authority for certain statutes applicable to all CRAs (see table 1). CFPB’s supervisory authority includes the authority to perform examinations to assess compliance with FCRA and other Federal consumer financial laws and to detect and assess risk to consumers and markets. CFPB may issue matters requiring attention (MRA) based on its examinations. MRAs identify corrective actions that result from examination findings that require the attention of the supervised institution’s board of directors or principals, including violations of Federal consumer financial laws. According to CFPB, MRAs are not legally enforceable, but CFPB can use them to determine future supervisory work or the need for potential enforcement actions. CFPB’s supervisory authority is generally limited to CRAs that qualify as larger participants in the consumer reporting market. In 2012, CFPB defined larger participants of the consumer reporting market to include CRAs with more than $7 million in annual receipts resulting from consumer reporting activities. CFPB’s authority does not extend to CRAs that do not participate in activities involving the use of consumer information to make decisions regarding financial products or services. For example, a specialty CRA that only provides consumer reports regarding a consumer’s employment history may not be considered a larger participant for the purposes of CFPB supervision, even if the CRA’s annual receipts from this activity are more than $7 million. In the preamble to its 2012 rule defining larger participants, CFPB stated that the threshold of more than $7 million is consistent with the objective of supervising market participants that have a significant impact on consumers and is appropriate in light of the highly concentrated nature of the consumer reporting market. In particular, CFPB estimated that out of about 410 CRAs, 30 CRAs met the threshold. Of those 30 CRAs, CFPB estimated that the six largest CRAs generated approximately 85 percent of industry receipts. While CFPB generally has supervisory authority over only larger- participant CRAs, CFPB and FTC generally share enforcement authority over CRAs. For example, they both enforce CRA compliance with most provisions of FCRA and provisions in other laws related to unfair or deceptive acts or practices. Both agencies have similar enforcement tools, including investigation, civil penalties, monetary relief for consumers, and requirements for a company to conduct or refrain from conducting certain acts. CFPB and FTC entered into a memorandum of understanding to coordinate their enforcement efforts, and staff from both agencies told us they take additional actions to coordinate their enforcement activities. For example, FTC staff said that CFPB and FTC maintain a log of each agency’s investigations to avoid duplication. Additionally, CFPB and FTC staff said they hold periodic coordination meetings to discuss their enforcement activities. FTC staff told us that because CFPB possesses supervisory authority over the three largest CRAs, FTC has focused its FCRA enforcement efforts on other CRAs. However, FTC staff said that to the extent that the largest CRAs offer nonfinancial products or services, such as employment or tenant background screening, FTC will also investigate these activities. CFPB and FTC each have certain rulemaking authority in connection with statutes that may apply to CRA activities, but generally CFPB has broader authority than FTC. Generally, CFPB has broad authority to issue regulations for Federal consumer financial laws, including most provisions of FCRA, which are applied to all CRAs. FTC has specific rulemaking authority that may apply to CRAs under FCRA, the Federal Trade Commission Act, and GLBA. For example, FTC’s rule related to safeguarding the security and confidentiality of customer records under GLBA applies to CRAs. State Agencies Have Enforcement Authority over CRAs, and Some State Laws Provide Limited Supervisory Authority State agencies, such as state Attorney General offices, have enforcement authority to oversee CRAs, and some state agencies have limited supervisory authority under state laws. Federal laws establish enforcement authority for state agencies over CRAs. Under FCRA and the Dodd-Frank Act’s provisions prohibiting unfair, deceptive, or abusive acts and practices, state Attorney General offices (or another official or agency designated by the state) have certain enforcement authority over some companies, including certain CRAs. However, states are required to coordinate enforcement actions with CFPB and FTC. In addition to enforcement authority under federal laws, state agencies may have enforcement authority under their state laws that apply to CRAs. Staff from state agencies in four selected states—Ohio, New York, Maine, and Maryland—told us that their states’ Attorney General offices have enforcement authority over CRAs under state laws prohibiting unfair or deceptive acts or practices. In addition, according to the National Consumer Law Center, every state has a consumer protection law that prohibits deceptive acts or practices and many states prohibit unfair acts or practices, and the enforcement of such state laws typically is the responsibility of a state enforcement agency, such as the state Attorney General offices. Some state Attorney General offices have used their enforcement authority under FCRA and state laws prohibiting unfair or deceptive acts or practices to investigate and take enforcement actions against CRAs. For example, the three nationwide CRAs entered into two separate settlements with 30 state Attorney General offices in 2015 in which the CRAs agreed to implement a number of specific reforms, including reforms related to consumer report accuracy and dispute processes. Under these settlements, the state Attorney General offices claimed the CRAs violated FCRA and the states’ laws prohibiting unfair or deceptive acts or practices. Additionally, representatives of several states’ Attorney General offices told us in connection with a prior report that they launched a joint investigation into whether a nationwide CRA violated state laws in a 2017 data breach, including state laws prohibiting unfair or deceptive practices. In addition to the enforcement authority state Attorney General offices have under state laws prohibiting unfair or deceptive acts or practices, some state laws provide state agencies, such as financial regulators and consumer protection bureaus, with oversight authority over CRAs. Our interviews with staff from four selected states’ agencies—Ohio, New York, Maine, and Maryland—indicated that CRA oversight authority given to state agencies under state laws varies. Staff from Ohio’s Office of the Attorney General told us that Ohio does not have specific laws that provide Ohio state regulators with supervisory, rulemaking, or enforcement authority over CRAs, apart from Ohio laws prohibiting unfair or deceptive acts or practices that provide the Office of the Attorney General with enforcement authority. New York’s financial regulator told us that state laws provide the agency with supervisory, enforcement, and rulemaking authority over institutions that provide financial products and services, including certain CRAs. The agency issued a rule in 2018 requiring CRAs reporting on consumers within the state to register with the agency annually and provide information as required by the agency. Staff from Maine’s consumer protection agency told us that under Maine law, the agency has supervisory and enforcement authority over CRAs operating within the state. Agency staff told us that the agency examines certain CRAs every 2 years for compliance with Maine’s consumer reporting laws, such as by reviewing records and documents provided by CRAs. Maryland’s financial regulator told us that Maryland’s laws provide the agency with enforcement and rulemaking authority over CRAs but not supervisory authority. The agency can adopt regulations in order to administer provisions of Maryland statutes, such as procedures for ensuring accuracy in consumer reports. Additionally, agency staff said that the agency can investigate CRAs using its enforcement authority but cannot conduct supervisory examinations of CRAs. Representatives from several CRAs we interviewed told us that their supervision by state regulators has been limited. Representatives from two CRAs told us that a state agency has examined them. Representatives from three other CRAs we interviewed said they had limited encounters with state-level agencies. However, as previously stated, CFPB, FTC, and state agencies generally have enforcement authority over CRAs regarding consumer financial protection. CFPB, FTC, and Prudential Regulators Share Oversight of Data Furnishers CFPB, FTC, and the prudential regulators—the Federal Reserve, FDIC, NCUA, and OCC—share federal oversight of data furnishers for compliance with FCRA, among other Federal consumer financial laws. These furnishers include insured depository institutions and credit unions and nondepository institutions, such as student and mortgage loan servicers. Federal agencies generally split oversight of furnishers based on their charter type and asset size. Oversight of furnishers that are depository institutions or credit unions. CFPB and the prudential regulators have supervisory and enforcement authority over insured depository institutions and credit unions for compliance with FCRA and other federal consumer financial laws (see table 2). The Dodd-Frank Act generally divided authority between CFPB and the prudential regulators based on an institution’s charter type and the value of an institution’s total assets. Assets of more than $10 billion. In general, CFPB has enforcement and supervisory authority for insured depository institutions and credit unions (as well as their affiliates) that have more than $10 billion in total assets for compliance with many Federal consumer financial laws.However, a prudential regulator that is authorized to enforce a Federal consumer financial law may recommend that CFPB initiate an enforcement action, and if CFPB does not, the prudential regulator may initiate an enforcement action. Assets of $10 billion or less. In general, the four prudential regulators have enforcement and supervisory authority over insured depository institutions or credit unions with total assets of $10 billion or less. If, however, CFPB believes that an institution in this category has violated a Federal consumer financial law, it must notify the appropriate prudential regulator in writing and recommend action. Additionally, regardless of an institution’s asset size, CFPB generally has rulemaking authority for many Federal consumer financial laws that apply to insured depository institutions and insured credit unions. However, prudential regulators have limited rulemaking authority as related to furnishing activities for certain provisions specifically retained pursuant to the Dodd-Frank Act and FCRA. CFPB generally has supervisory and enforcement authority over insured depository institutions and insured credit unions, as well as their affiliates, that have more than $10 billion in total assets, for compliance with Federal consumer financial laws as defined under the Dodd-Frank Wall Street Reform and Consumer Protection Act. CFPB has broad rulemaking authority under many Federal consumer financial laws that apply to depository institutions and credit unions, with limited exceptions. The Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, and Office of the Comptroller of Currency (collectively called the prudential regulators) generally have supervisory and enforcement authority for Federal consumer financial laws (as defined under the Dodd-Frank Wall Street Reform and Consumer Protection Act) for insured depository institutions and credit unions that have $10 billion or less in total assets. The prudential regulators also have limited rulemaking authority related to furnishing activities under certain Federal consumer financial laws, including parts of FCRA. Oversight of furnishers that are nondepository institutions. CFPB and FTC share oversight of nondepository institutions. In general, CFPB has supervisory authority over certain types of nondepository financial institutions for compliance with FCRA and other Federal consumer financial laws (see table 3). Such institutions include certain kinds of mortgage market participants, private student lenders, and payday lenders. CFPB also has supervisory authority over institutions in markets for consumer financial products or services that it defines as larger participants. For example, CFPB has issued rules defining larger participants for automobile-financing and consumer debt-collection markets. CFPB and FTC share enforcement authority for many different types of nondepository institutions, such as mortgage lenders, payday lenders, debt collectors, and telecommunication companies. FTC additionally has enforcement authority over other nondepository institutions for which CFPB does not have enforcement authority, such as automobile dealers. FTC staff told us that, similar to their coordination efforts for CRAs, FTC and CFPB coordinate their enforcement activities with respect to furnishers. CFPB has rulemaking authority for most consumer financial laws, including FCRA, that may apply to furnishers that are nondepository institutions. In comparison to CFPB, FTC has specific rulemaking authority under FCRA, the Federal Trade Commission Act, and GLBA to promulgate rules that may apply to nondepository institution furnishers. CFPB has supervisory authority over certain nondepository institutions. It shares enforcement authority with FTC for certain nondepository institutions and has broad rulemaking authority for Federal consumer financial laws which apply to many institutions, including those for which it has supervisory jurisdiction. CFPB’s Oversight Has Prioritized Supervision of CRAs Based on Perceived Risk, but CFPB Has Not Defined Supervisory Expectations CFPB’s Supervision Has Prioritized Certain CRAs and Has Focused on Data Accuracy and Dispute Investigations According to CFPB, in its oversight of the consumer reporting market, CFPB has prioritized CRAs representing the greatest potential risks to consumers. Additionally, CFPB has generally focused on certain compliance areas, particularly data accuracy and investigations conducted in response to consumer disputes. On an annual basis, CFPB updates its plans for supervision of CRAs and furnishers for the next 1 to 2 years. According to CFPB, it assesses specific risks in the market and determines entities and compliance areas to examine. In making these determinations, CFPB stated that it considers factors such as market presence, consumer complaints, its prior supervisory examinations and findings, and its resources. Supervisory Priorities for CRAs and Data Furnishers According to CFPB, since the start of its supervisory program for the consumer reporting market in 2012, CFPB has prioritized CRAs that pose the greatest risks to consumers and the marketplace for examinations. Specifically, CFPB staff told us that CFPB has prioritized CRAs that represent a significant share of the market and the largest volume of consumer complaints submitted to CFPB’s complaint database. CFPB has also examined one or more specialty CRAs. CFPB stated that in determining which specialty CRAs to examine, it considered factors such as the CRAs’ market share in the particular consumer reporting products they offer. According to CFPB, in setting supervisory priorities, supervision staff also consulted with stakeholders and considered CFPB’s resources and findings from prior examinations that may have indicated weaknesses. CFPB staff said that when CFPB began examining CRAs, its supervisory approach was to examine their compliance management systems first before focusing on other compliance areas. The staff said that the compliance management system reviews helped CFPB to learn about how CRAs operate. Based on the compliance management reviews, CFPB determined that it could review data accuracy, dispute investigations, and other compliance areas by examining the mechanisms CRAs use to comply with FCRA. After examining compliance management systems, CFPB prioritized examining other aspects of compliance related to data accuracy (including processes for monitoring furnishers) and dispute investigations, as well as performing follow-up examinations in those areas. CFPB staff stated that they have chosen to focus on data accuracy and dispute investigations because these were the largest problem areas based on CFPB’s assessment of complaint data. Additionally, CFPB identified compliance with the FCRA obligations regarding data accuracy and effective and efficient dispute resolution as agency priorities for the consumer reporting market. CFPB has also examined other CRA compliance areas, including procedures related to suppression and reinsertion of information that CRAs found to be inaccurate, unverifiable, or obsolete; procedures for ensuring a permissible purpose for obtaining consumer reports; and compliance management systems related to data security. According to CFPB, when determining compliance areas for examination, the agency considered factors such as its data on complaints, the extent to which it had previously examined the areas, and concerns identified in prior examinations. In February 2019, we found that CFPB’s examination process did not routinely include an assessment of CRAs’ data security risks, and we recommended that CFPB’s prioritization specifically account for data security risk. In conducting its examinations, CFPB has focused on assessing CRA procedures for complying with FCRA rather than on the extent of inaccuracy in consumer reports. For example, according to a 2017 CFPB report, CFPB directed one or more CRAs to establish quality control programs to regularly assess the accuracy of information included in consumer reports and to develop systems to measure the accuracy of consumer reports and identify patterns and trends in errors. CFPB staff said CFPB has not monitored the extent of inaccuracy in consumer reports produced by the CRAs it examines. They stated that FCRA requires CRAs and furnishers to follow reasonable procedures with regard to accuracy but does not require or identify acceptable thresholds for accuracy. CFPB staff explained that CFPB’s supervisory program has therefore focused on evaluating CRAs’ compliance with FCRA requirements for reasonable procedures with regard to accuracy and identifying weaknesses in such procedures. According to CFPB, in prioritizing examinations of data furnishers, the agency has primarily considered the furnishers’ market shares, the number of disputes CRAs received about the furnishers, and the number of complaints CFPB received in its complaint database. CFPB has prioritized large furnishers within their respective markets. For example, CFPB identified one or more student loan servicers furnishing data to CRAs that had large shares of the student loan servicing market. CFPB has also prioritized furnishers with high dispute rates relative to other furnishers within their markets. For example, CFPB identified one or more credit card issuers with higher dispute rates compared to their peers, based on CFPB’s review of dispute data provided by CRAs. According to CFPB, it has also considered the results of prior CFPB examinations and input from agency stakeholders. As with CRAs, CFPB’s examinations of furnisher activities have focused on accuracy and dispute investigations. In its Supervisory Highlights from March 2017, CFPB stated that the accuracy of consumer report information is a CFPB priority and that furnishers play an important role in ensuring the accuracy of consumer report information through the dispute process. For example, CFPB stated that furnishers’ timely response to consumer disputes may reduce the effect that inaccurate negative information on a consumer report may have on the consumer. Examination Results for CRAs and Furnishers From 2013 through 2018, CFPB examined several CRAs. Many of these examinations evaluated CRA compliance with accuracy and dispute investigation obligations under FCRA, such as by assessing data governance systems, quality control programs, and furnisher oversight and data monitoring. Additionally, some examinations evaluated other FCRA compliance areas, including ensuring that users had permissible purposes for requesting consumer reports and preventing reinsertion of previously deleted information. CFPB’s examinations related to data accuracy and dispute investigation obligations resulted in supervisory findings that CFPB directed CRAs to take actions to address. CFPB found that one or more CRAs had minimal compliance mechanisms in place to meet requirements for data accuracy and for dispute investigations (see table 4 for examples of CFPB’s supervisory findings and directed actions in these areas). For example, CFPB found that one or more CRAs lacked quality control policies and procedures to test compiled consumer reports for accuracy and had insufficient monitoring and oversight of furnishers that provided information used in the reports. CFPB also found that one or more CRAs did not review evidence that consumers provided to support their disputes and relied entirely on the furnishers to investigate the disputes. CFPB directed specific changes in some CRAs’ policies and procedures for ensuring data accuracy and conducting dispute investigations, including increasing oversight of incoming data from furnishers, developing internal processes to monitor furnisher dispute responses to detect those that may present higher risk of inaccurate data, and enforcing the CRAs’ obligation to investigate consumer disputes, including review of relevant information provided by consumers. In addition, CFPB directed one or more CRAs to establish quality control programs that regularly assess the accuracy and integrity of compiled consumer reports. In follow-up reviews of some of its supervisory findings, CFPB found that one or more CRAs took actions that resulted in improvements in policies and procedures. For example, CFPB has found that one or more CRAs established quality control programs, including developing tests to identify the extent to which consumer reports are produced using information for the wrong consumer. For other findings, CFPB determined that one or more CRAs had not taken actions to address the findings, or CFPB had not yet conducted follow-up examinations to determine if they had been addressed. From 2013 through 2018, CFPB conducted examinations of several data furnishers. These furnishers were involved in various consumer financial markets, such as automobile loan servicing, debt collection, mortgage servicing, and student loan servicing. CFPB staff told us that until 2017, CFPB generally examined furnishers’ compliance with FCRA as part of its assessment of compliance with other Federal consumer financial laws and regulations. CFPB staff said that in 2017, CFPB began conducting examinations specifically focused on furnishing activities under FCRA and Regulation V. CFPB stated that this change was made because the review of furnishers’ practices under FCRA and Regulation V was resource-intensive and merited dedicated resources. In a 2017 report, CFPB stated that it had found numerous furnisher violations of FCRA and Regulation V related to data accuracy and dispute investigations and that it directed furnishers to take corrective actions (see table 5 for examples of CFPB’s supervisory findings and directed actions). For example, CFPB found that certain furnishers failed to establish, implement, and maintain reasonable written policies and procedures consistent with Regulation V regarding the accuracy and integrity of the information furnished; provided information to CRAs despite having reasonable cause to believe the information was inaccurate; and lacked policies for their employees on how to conduct reasonable investigation of consumer disputes. In some cases, CFPB’s furnisher examinations conducted from 2013 through 2018 resulted in findings related to FCRA and Regulation V that CFPB directed the furnishers to take actions to address. For example, CFPB directed furnishers to develop reasonable written policies and procedures regarding accuracy, to promptly update the information provided to CRAs after determining that the information was not complete or accurate, and to update and implement policies and procedures to ensure disputes are handled in accordance with FCRA requirements. CFPB staff told us that the agency decides whether to investigate based on consideration of factors such as consumer complaints, extent of effects on consumers, and severity of misconduct. CFPB staff told us that, in many cases, CFPB has chosen to identify and correct FCRA violations and weaknesses in compliance management systems at CRAs through supervisory activity rather than enforcement investigations. However, CFPB has also investigated and used enforcement remedies, such as civil penalties and injunctive relief, against CRAs and furnishers that violated FCRA or Regulation V. From 2012 through 2018, CFPB settled 26 enforcement actions for violations related to FCRA and Regulation V, including four settlements involving CRAs and 16 settlements involving furnishers. Although CFPB found other FCRA violations in its investigations of these companies, such as those related to permissible purpose for obtaining consumer reports and disclosure issues, most of the violations related to data accuracy and dispute investigations. For example, two of the four FCRA-related settlements with CRAs involved dispute investigations or data accuracy procedures. Of the 16 settlements with furnishers for alleged violations related to FCRA and Regulation V, all contained violations related to the furnishers’ obligations regarding data accuracy or dispute investigations. CFPB’s settlements contained findings similar to its supervisory examination findings. For example, CFPB found that a CRA failed to investigate consumer disputes, and another CRA failed to take steps to ensure its consumer reports were accurate. For furnishers, CFPB found violations including furnishers that failed to establish and implement reasonable written policies and procedures regarding the accuracy and integrity of information provided to CRAs, as well as furnishers that provided inaccurate or incomplete information about consumers to CRAs or failed to conduct reasonable investigations of consumer disputes. CFPB Has Not Defined Expectations for CRA Accuracy and Dispute Investigation Procedures CFPB has not defined its expectations—including views on appropriate practices—for how CRAs can comply with key FCRA requirements. Among other provisions, FCRA requires CRAs to (1) follow reasonable procedures when preparing a consumer report to assure maximum possible accuracy of consumer report information and (2) conduct reasonable investigations of consumer disputes. However, FCRA does not define what would constitute such reasonable policies and procedures or investigations or stipulate the types of procedures or investigations that would meet the requirements for CRAs. While CFPB has not defined its expectations for these two key FCRA requirements for CRAs, it has adopted Regulation V, which, as required by statute, includes information on CFPB’s requirements and guidelines in these areas for furnishers. Regulation V includes requirements and guidelines for reasonable policies and procedures concerning the accuracy and integrity of furnished consumer information and requirements for reasonable investigations of consumer disputes filed directly with the furnishers. In its supervision of furnishers, CFPB has examined furnishers for compliance with the requirements of Regulation V—for example, it has found in examinations that furnishers violated Regulation V’s requirement to establish written policies and procedures regarding the accuracy of consumer information furnished to a CRA. Although CFPB has not similarly established guidelines or otherwise provided information on its supervisory expectations for CRAs, CFPB has found specific weaknesses in CRA practices. In particular, CFPB has cited one or more CRAs for specific deficiencies related to determinations of noncompliance with FCRA provisions regarding reasonable procedures for accuracy and dispute investigations. For example, CFPB has directed one or more CRAs to take specific actions to improve their accuracy procedures. In addition, CFPB found one or more CRAs’ data governance programs to be decentralized and informal, and it directed the CRAs to develop and implement written policies and procedures to formalize the programs. However, CFPB has not issued any information on its supervisory expectations indicating that “reasonable procedures” include having formal written policies and procedures. CFPB also has identified FCRA violations related to reasonable dispute investigations. For example, CFPB determined that one or more CRAs failed to review and consider documentation attached by consumers to disputes and relied entirely on furnishers to investigate a dispute—therefore violating FCRA requirements for reasonable investigations and for reviewing and considering all relevant information submitted by the consumer—and directed the CRAs to independently investigate consumer disputes. However, CFPB has not issued any information on its supervisory expectations to help interpret FCRA’s requirement for CRAs to conduct a reasonable investigation of disputes and to review and consider all relevant information, including the expectation that CRAs investigate consumer disputes independently. Based on the FCRA requirements alone, it may be unclear to CRAs and others that these FCRA requirements include performing independent investigations. For example, representatives from one large CRA we interviewed stated that the company is not required to conduct an independent investigation. FCRA instructs CFPB to enact regulations that are necessary to carry out the purposes of the act, which could include issuing implementing regulations for CRAs regarding data accuracy and dispute investigations. Additionally, a 2018 policy statement issued by CFPB and the prudential regulators explains that information on supervisory expectations serves to articulate an agency’s general views regarding appropriate practices. The policy statement further states that it is important for such information to provide insight to industry, as well as to supervisory staff, in a transparent way that helps to ensure consistency in the supervisory approach. According to CFPB’s Supervisory Highlights from March 2017, CFPB’s vision for the consumer reporting system is a system in which furnishers provide and CRAs maintain and distribute data that are accurate, supplemented by an effective dispute management and resolution process for consumers. According to the same CFPB publication, this vision is rooted in the obligations and rights set forth in FCRA and Regulation V. One reason why accuracy guidelines exist for furnishers but not CRAs is that the Fair and Accurate Credit Transactions Act of 2003 added a provision to FCRA requiring the prudential regulators and FTC to establish and maintain guidelines for furnishers regarding the accuracy of consumer data furnished to CRAs and to prescribe regulations requiring furnishers to establish reasonable policies and procedures for implementing the guidelines. In 2011, CFPB adopted these regulations as part of Regulation V after assuming rulemaking authority from the other agencies. Neither the Fair and Accurate Credit Transactions Act of 2003 nor any other statutory provision within FCRA includes a similar provision for the agencies to establish and maintain guidelines or provide information concerning supervisory expectations regarding the accuracy of consumer data CRAs maintain, and CFPB has not established guidelines or defined supervisory expectations for CRAs. Since 2015, CFPB’s long-term rulemaking agenda has stated that it will evaluate possible policy responses to consumer reporting issues, including potential additional rules or amendments to existing rules governing consumer reporting accuracy and dispute processes. However, as of May 2019, CFPB had not conducted any rulemaking related to these topics. CFPB staff said that a substantial body of case law exists to guide CRAs regarding what practices may be considered compliant with FCRA requirements, including with respect to provisions for reasonable procedures for accuracy and performing reasonable dispute investigations. The staff also said that CFPB staff look to relevant case law when assessing CRA compliance with FCRA during examinations, and that supervisory findings serve to communicate to a supervised CRA how CFPB has applied FCRA during an examination. Providing information to CRAs about its supervisory expectations for these two key FCRA requirements—and ways in which CRAs could comply—could help CFPB to facilitate CRA compliance with FCRA and achieve agency objectives for the consumer reporting system. Without information about its expectations, CFPB’s supervision lacks transparency about what practices it considers appropriate or expects CRAs to adopt to comply with key FCRA requirements. Absent such information from CFPB, representatives from four CRAs we interviewed told us that they look to other sources to understand what CFPB will consider to be noncompliant during examinations and to determine if they are meeting FCRA requirements for maintaining reasonable procedures. These sources include publicly available information such as court cases, presentations from industry associations, CFPB publications highlighting supervisory actions, and public enforcement actions. While CFPB can communicate with individual CRAs during examinations and by directing corrective actions, the impact of such interactions is limited to specific CRAs rather than helping to ensure consistency in its supervisory approach by providing transparent insights to the industry. While relevant case law could provide CRAs with some information regarding practices that have been determined to be compliant with FCRA requirements, there may be a lack of clarity about the extent to which all case law fully reflects CFPB’s expectations. By communicating information about its expectations and ways in which CRAs could comply, CFPB could help ensure that CRAs receive complete and consistent information about how to interpret key FCRA requirements. Further, defining its expectations regarding how CRAs can meet key FCRA requirements could help CFPB promote consistency in its supervisory approach by providing examiners with information on the agency’s interpretation of FCRA provisions. FTC Enforcement Targets Smaller CRAs, and Prudential Regulators Examine Some Furnishers’ FCRA Compliance FTC Enforcement Actions Have Focused on Smaller CRAs’ Data Accuracy, Dispute Investigation, and Data Security Practices FTC’s enforcement actions since 2010 have targeted smaller CRAs. FTC staff told us that because CFPB has supervisory authority over the larger CRAs, FTC has focused its FCRA enforcement efforts on other CRAs. Additionally, our review of FTC’s enforcement actions showed that FTC generally took enforcement actions against specialty CRAs that are smaller than the nationwide CRAs, such as CRAs conducting background screening. However, FTC staff also told us that they do not use a specific size threshold to initiate investigations against CRAs or furnishers and that they conduct their enforcement on a case-by-case basis, focusing on violations or potential violations of applicable laws. Prior to taking an enforcement action against a company, FTC conducts an investigation to determine if the company has violated a law. Using its investigative authority, FTC can compel companies to produce documents, testimony, and other materials to assist in its investigations. To determine whether to initiate investigations, FTC staff said they consider several sources, including leads from consumer advocacy groups and other FTC investigations, tips from whistleblowers, and monitoring of media reports. FTC staff also said that FTC regularly monitors its consumer complaint database to identify the types of complaints that consumers file and to determine if the activity described in the complaint indicates potential noncompliance with laws and regulations. FTC also can start investigations based on requests, such as by a member of Congress. FTC staff said that the agency targets its investigations based on the extent to which the potential noncompliance may affect a large number of consumers. For example, staff said FTC targets companies for investigation where inaccuracies may be occurring on a large scale. In addition, as we reported in February 2019, FTC staff said that when determining whether to initiate an investigation related to privacy and data security matters, they consider factors such as the companies’ size and the sensitivity of the data in the companies’ networks. FTC staff said that the consumer reporting market is a high priority for FTC, and that the accuracy of consumer reports and CRA activities has been a large part of FTC’s enforcement priorities. FTC staff said that they initiated about 160 FCRA investigations from 2008 through 2018. FTC staff stated that of the approximately 160 investigations, about 70 related to CRAs or companies, such as data brokers and companies selling public records, that FTC investigated to determine if they were engaged in conduct that would render them CRAs. Additionally, the staff said that about 20 of the approximately 160 investigations related to furnishers, about 55 related to users of consumer reports, and about 15 related to companies that fall under provisions of FCRA that do not require that the entity be a CRA, furnisher, or user. FTC staff stated that among these investigations, FTC investigated specialty CRAs, such as background- screening and check-authorization companies, and furnishers, such as debt collectors, lenders, and telecommunications companies. After an investigation, FTC may initiate an enforcement action if it has reason to believe that a law is being or has been violated. From 2010 through 2018, FTC took 30 enforcement actions related to FCRA, including against 14 CRAs, six furnishers, and two companies that acted as both a CRA and furnisher. Of the 30 enforcement actions, 14 contained issues related to data accuracy or disputes and two contained issues related to data security. In total, 20 of the 30 enforcement actions contained issues related to other consumer reporting topics, such as provision of consumer reports without permissible purpose. FTC staff told us that all of the enforcement actions related to FCRA involved injunctive relief. Additionally, some enforcement actions involved civil penalties. For example, in one action, a CRA was ordered to pay civil penalties for failing to use reasonable procedures to ensure the maximum possible accuracy of information it provided to its customers, and for failing to reinvestigate consumer disputes, as required by FCRA. FTC alleged that the CRA failed to take reasonable steps to ensure that the information in the reports was current and reflected updates, such as the expungement of criminal records. FTC staff said that there is no overarching definition regarding the FCRA provision for reasonable procedures for assuring maximum possible accuracy and that FTC determines on a case-by-case basis whether a violation has occurred. FTC staff also said that FTC’s enforcement actions provide industry with information on unacceptable practices and that the enforcement actions are closely monitored by the consumer reporting industry. In addition to enforcement actions related to FCRA, FTC staff told us that FTC took five actions against CRAs for unfair or deceptive acts or practices related to data security in the past 10 years. FTC alleged that all five CRAs failed to employ reasonable and appropriate security measures to protect sensitive consumer information. Prudential Regulators Said They Examine Some Furnishers’ FCRA Compliance in Conjunction with Other Laws and Regulations As discussed previously, the prudential regulators have supervisory and enforcement authority for FCRA over depository institutions and credit unions with total assets of $10 billion or less, some of which act as furnishers. The four prudential regulators told us they do not perform standalone examinations of these financial institutions for FCRA compliance. Rather, they examine for FCRA compliance in conjunction with other consumer financial laws and regulations and as part of examining an institution’s compliance with federal consumer protection laws and regulations. For example, OCC staff told us that if an examiner reviews an institution’s general compliance management system and identifies compliance, procedural, or other weaknesses related to FCRA, then the examiner would look at those issues more closely. Staff from the four prudential regulators told us they take a risk-based approach to determine the scope of examinations. They said that the approach includes consideration of factors such as an institution’s asset size, record of FCRA compliance, and trends in consumer complaints. As part of their compliance examinations from 2013 through 2018, staff from FDIC, the Federal Reserve, and NCUA said their agencies identified multiple FCRA- and Regulation V-related findings, including findings not related to financial institutions’ furnishing activities. FDIC staff said that examiners identified more than 1,200 violations related to FCRA and Regulation V at around 800 institutions, but found that the majority of the violations posed a low level of concern to the institution and consumers. Of these violations, FDIC staff stated that 106 related to furnisher obligations under Regulation V regarding the accuracy and integrity of information furnished to CRAs and that those types of violations were among the five most frequently cited violation topics related to FCRA and Regulation V. Federal Reserve staff said that in examinations that reviewed compliance with FCRA and Regulation V, Federal Reserve examiners cited FCRA and Regulation V about 210 times for an aggregate of about 4,200 related violations. Of these, Federal Reserve staff said the agency cited FCRA and Regulation V provisions related to furnisher accuracy about 20 times and cited an aggregate of about 3,600 violations. NCUA staff stated that NCUA identified 160 FCRA violations at around 150 credit unions. NCUA staff explained that 20 of the violations related to furnisher accuracy and that these types of violations were not among the five most frequently cited violation topics related to FCRA. OCC staff told us that OCC identified no findings related to FCRA or Regulation V from 2013 to 2018. Three prudential regulators stated that they consider the risk that a FCRA or Regulation V violation poses to the depository institution, including risk to consumers. For example, FDIC staff stated that the violations they cited may have had a small but negative effect on consumers, or may have the potential to have a negative effect in the future if uncorrected. FDIC staff added that such violations may also pose compliance and legal risks to the institution. NCUA staff stated that they require corrective action for any FCRA violation, and that they consider the pervasiveness of violations—particularly a risk of systemic or repeated violations—in determining the appropriate supervisory action. Stakeholders Identified Various Causes for Inaccuracies in Consumer Reports, and Several Processes Exist to Help Promote Accuracy Stakeholders Primarily Attributed Inaccuracies to CRAs Matching Data to the Wrong Consumer Files and Errors in Source Data CFPB, FTC, and industry stakeholders attributed inaccuracies in consumer reports to several causes, including (1) CRAs matching data to the wrong consumer files due to missing, inaccurate, or inconsistent personally identifiable information; (2) errors in furnished data; (3) timing of data updates; and (4) identity fraud or theft. In particular, CFPB, FTC, and industry stakeholders most frequently cited CRAs mismatching data and errors in furnished data as the primary causes of consumer report inaccuracies. Matching Furnished Data to the Wrong Consumer Files Several industry stakeholders identified CRAs’ mismatching of furnished data or public records to consumer files as a major source of inaccuracies in consumer reports. Two of the consumer groups we interviewed— Consumers Union and the National Consumer Law Center—also cited mismatching of data to consumer files as a source of inaccuracies in reports they published. In addition, FTC and CFPB reported in separate studies in 2012 that mismatching is a key source of inaccuracies in consumer reports. When CRAs do not correctly match data to the appropriate consumer files, the consumer’s file may contain data pertaining to another consumer. Alternatively, data can be excluded from the “correct” consumer’s file. For example, if one consumer’s report contains information about a different consumer’s debt payment history or collections activity, this information would also be missing from the file of the consumer who generated that activity. CFPB reported in its 2012 study that inconsistent, inaccurate, or incomplete personally identifiable information can cause errors in matching furnished data to the correct consumer’s file. CFPB, FTC, and industry stakeholders—three CRAs, a CRA industry group, and a consumer group—identified multiple reasons why personally identifiable information in data furnished to CRAs may be inconsistent, inaccurate, or incomplete, including the following examples: Consumers may use variations of their names when establishing an account with financial institutions (such as Kathy and Katherine). Consumers may change their names as a result of divorce or marriage, but the name change may not be reflected in furnished data. Consumers with suffixes in their names (such as junior or senior) may not consistently use suffixes in their applications. Furnishers may omit personally identifiable information. Furnishers may input consumers’ information incorrectly during data entry. In addition, CFPB stated in its 2012 report that matching public records to consumers’ files can be particularly challenging for CRAs because public records rarely contain Social Security numbers. The processes CRAs have in place to match data to consumers’ files may also contribute to inaccuracies in consumer reports. Generally, CRAs use various combinations of personally identifiable information to match data to consumers. For example, representatives from one CRA said the CRA uses at least the name and address to conduct matches. These representatives said that where only name and address are used, the address is required to be an exact match while the name can be a logical variation determined by the CRA’s algorithm. Representatives from another CRA said that the CRA matches public record information using at least the full name and date of birth but not the Social Security number because it is difficult to obtain. According to a CFPB report, the three nationwide CRAs—as part of their settlements with multiple state Attorney General offices—now require name, address, and Social Security number or date of birth to be present in public records furnished to them and use that personally identifiable information to conduct matches. Representatives from three consumer groups attributed consumer report inaccuracies to how CRAs make such matches. For example, representatives of two consumer groups said that CRAs could reduce inaccuracies arising from mismatching by using stricter requirements, such as requiring both Social Security number and date of birth, in addition to names and addresses, or only matching data to consumers if all nine digits of the Social Security number are present. Altogether, the errors originating from consumers or furnishers, as well as processes that CRAs have in place for matching, affect the accuracy of consumer reports (see fig. 3). CFPB and representatives from several industry stakeholders identified errors in furnished data as a primary cause of consumer report inaccuracies. Even when a CRA matches data to the correct consumer file, the consumer report can still contain inaccuracies if the information a furnisher provided to the CRA regarding the consumer contained errors (see fig. 4). CFPB has reported and a few CRAs told us that CRAs conduct quality checks to identify issues including blank fields or logical inconsistencies in furnished data, such as reporting of new account balance for closed consumer accounts. The CRA can reject furnished data or ask furnishers to provide corrected data. However, a CFPB report and a few industry stakeholders we interviewed identified weaknesses in furnisher and CRA processes as contributing to errors in furnished data. Two of the consumer groups we interviewed—Consumers Union and the National Consumer Law Center—also cited weaknesses in furnisher and CRA processes as contributing to errors in furnished data in reports they published. Processes for handling consumer transactions. CFPB reported that problems with processes used by furnishers include failing to update records, failing to post a payment, and misattributing ownership of an account to an individual who is only an authorized user. Processes for handling data accuracy. CFPB also reported and a few stakeholders told us that some furnishers lack processes for ensuring the accuracy of data submitted to CRAs and some CRAs lack processes for ensuring the accuracy of furnished data. CFPB reported and representatives from a few industry stakeholders said that timing of data updates in furnished data and court records could be a source of potential inaccuracies. For example, representatives from one CRA said that an address or name change can take up to two billing cycles to be reflected in a consumer report. Additionally, representatives from a CRA industry group told us that online court records, where CRAs may obtain data, often lag behind paper court records. Representatives from one consumer group pointed to the timing of when furnishers report debt as a source of potential inaccuracies. Identity Fraud or Theft CFPB, the National Consumer Law Center, and Consumers Union have reported that identity fraud and theft are causes of inaccuracies in consumer reports. Additionally, representatives from one CRA also told us that identity fraud and theft are primary causes of inaccuracies. For example, identity thieves can create new credit accounts in a consumer’s name and let the debt go unpaid. Such debts then may be reflected in the consumer’s account and be reported to CRAs if not identified by the furnisher as resulting from fraudulent activity. Consumers Can Dispute Potential Inaccuracies in Their Consumer Reports with CRAs or Furnishers Consumers can dispute the accuracy or completeness of their consumer reports with the CRAs that produced the consumer reports, with the data furnishers, or both. As stated previously, FCRA requires CRAs to conduct reasonable investigations of consumer disputes; FCRA, Regulation V, and FTC’s Furnisher Rule, as applicable, generally also require furnishers to conduct reasonable investigations of consumer disputes. If consumers are dissatisfied with the results of the investigations conducted by the CRAs or furnishers, they have a few options, discussed in detail below. FCRA requires CRAs and furnishers to take specific steps to respond to consumer disputes. When a consumer files a dispute with the CRA, the CRA must investigate the dispute internally, and once the CRA notifies the furnisher of the dispute, the furnisher must also investigate the disputed information (see fig. 5). If the CRA’s internal investigation or the furnisher’s investigation finds that the disputed item is inaccurate, incomplete, or cannot be verified, the CRA must delete the disputed item from the consumer’s file or modify the information and notify the furnisher of the action taken. The CRA must notify the consumer of the investigation results. Representatives from six of the CRAs we interviewed said that they consider disputes resolved when they or the furnishers complete their investigations and notify consumers of the results, even if the consumer does not agree with the results. If a furnisher does not conduct an investigation and report to the CRA within the time frame required by FCRA, then the CRA must remove the disputed information from the consumer’s file. Certain furnisher processes for investigating a dispute received from a CRA and a dispute received directly from the consumer are similar under FCRA. When a furnisher investigates a dispute received from a CRA, the furnisher must report the results of the investigation to the CRA that forwarded the dispute. If the furnisher receives the dispute directly from a consumer, then it must investigate the dispute and report the results of the investigation to the consumer, generally within 30 days (see fig. 6). In both cases, the furnisher must provide corrected information to every CRA to which it provided the information. CRAs may have differing dispute investigation processes in place because of regulatory requirements or because of how they obtained their data. Under FCRA, the nationwide CRAs are required to maintain an automated system through which furnishers can report incomplete or inaccurate information in a consumer’s file. The nationwide CRAs share the use of an automated system that sends disputes to furnishers and receives furnishers’ responses to the disputes. Other CRAs are not required by FCRA to use an automated system. Representatives from one CRA told us that the CRA uses email and phone calls to send disputes to and receive responses from furnishers. Representatives from a CRA industry group, as well as representatives from a background- screening CRA, said that compared to CRAs that obtain information from furnishers, background-screening CRAs generally obtain records from courts and therefore conduct their dispute investigations by confirming court records and contacting court officials. Consumers have several options to address potential inaccuracies in their consumer reports if they disagree with the results of a CRA or furnisher investigation, but these options have potential limitations, according to the stakeholders we interviewed. Placing a consumer statement on the report. Under FCRA, if the investigation does not resolve the dispute (where the dispute is filed with a CRA), the consumer may place a statement regarding the nature of the dispute on the consumer report, such as why the consumer disagreed with the reported item. According to the three nationwide CRAs, such statements alert creditors to the consumer’s disagreement. However, the statement does not modify or remove the information that the consumer perceived to be inaccurate from the consumer report, and users of the consumer report may or may not consider the consumer’s statement in their decision-making. Resubmitting disputes to CRAs or furnishers. Consumers who believe their disputes have not been satisfactorily resolved may choose to resubmit disputes regarding the same items that they disputed previously to CRAs or to the furnishers. If a consumer submits a dispute and does not provide sufficient information to investigate the disputed information or resubmits a dispute and does not provide additional or new supporting information, a CRA or furnisher may determine that the dispute is frivolous or irrelevant and does not warrant an investigation. Representatives from one CRA told us that if the CRA receives a dispute from a consumer about an item that was previously disputed, it would review consumer records to see if it has verified the consumer’s information previously. If so, the CRA would ask the consumer to provide additional documentation or to contact the furnisher to obtain support for the dispute. In some cases, consumers may turn to third parties that submit disputes on their behalf. Representatives from one CRA said that the CRA does not investigate disputes that certain third parties submit on behalf of consumers because these third parties dispute the same items repeatedly. Representatives from another CRA said that the CRA reviews third-party dispute requests to determine if the third party has proper authorization from consumers to act on their behalf. Submitting complaints to federal and state agencies. Consumers can submit complaints about inaccuracies in their consumer reports to federal and state agencies, such as CFPB and state Attorney General offices. CFPB has stated that it forwards these complaints to CRAs and works with them to obtain responses within 15 days. Staff from several state agencies we interviewed generally told us that after receiving complaints, they contact CRAs about the complaints to obtain responses but do not compel CRAs to take specific actions. CFPB has reported that CRAs handle complaints similarly to consumer disputes. As a result, although complaints are separate from the dispute process required under FCRA, the effectiveness of this option also depends on the same CRA processes for addressing inaccuracies. However, representatives from two consumer groups said that submitting complaints to CFPB through its consumer complaint database has helped consumers resolve inaccuracies in their reports. Representatives from one consumer group said the publication of complaints in CFPB’s database helps to hold CRAs accountable and incentivizes CRAs to respond. Taking private legal action. Under FCRA, consumers have private rights of action—or ability to litigate—against CRAs and furnishers, under certain provisions. Consumers have brought legal claims against CRAs and furnishers for failure to follow reasonable procedures to assure maximum possible accuracy or conduct a reasonable investigation of a dispute. Under FCRA, consumers can sue a furnisher for failure to conduct a proper investigation when notified by a CRA that a consumer has disputed information provided by the furnisher. However, before initiating suit, the consumer must first dispute the information with the CRA. A consumer may initiate a dispute through a CRA even if the consumer has previously initiated a dispute with the furnisher. Representatives from two consumer groups and one state agency told us that in general, consumer barriers to litigation include that it is time-consuming and has potentially high legal costs and that consumers might be unaware of their legal rights. Oversight Has Led CRAs to Make Changes to Promote Accuracy, but Challenges to Consumer Report Accuracy Remain As a result of CFPB and FTC oversight and settlements with multiple state Attorneys General, the nationwide CRAs and several other CRAs have made changes in their policies and procedures to improve data accuracy and processes for addressing inaccuracies in consumer reports. However, CFPB and a few industry stakeholders said that challenges to improving accuracy in consumer reports remain. According to CFPB and nationwide CRAs, examples of the changes that CRAs have made as a result of oversight include the following: Changes as a result of CFPB supervision. According to CFPB, as a result of supervisory findings, one or more CRAs have implemented or changed policies and procedures related to ensuring accuracy and dispute investigations. These include (1) establishing a data- governance structure to oversee furnisher monitoring, such as by developing policies and procedures for ongoing and systemic screening of furnishers; (2) implementing systems to forward relevant dispute documents submitted by consumers to furnishers; and (3) implementing policies and procedures to ensure consideration of all supporting material submitted by consumers. Changes as a result of CFPB and FTC enforcement. As a result of CFPB’s and FTC’s enforcement, the two agencies directed a few CRAs to revise the procedures they use to match data using personally identifiable information. For example, CFPB directed two background-screening CRAs to revise procedures for assuring accuracy, such as by using algorithms to distinguish records by middle name and to match common names and nicknames. In another example, FTC directed a background-screening CRA that required an exact match of a consumer’s last name and a nonexact match of first name, middle name, and date of birth to put in place reasonable procedures to ensure maximum possible accuracy. Changes as a result of state oversight. According to the three nationwide CRAs, they have implemented measures as a result of their 2015 settlements with multiple state Attorneys General. For example, they stated they monitor data furnishers’ dispute responses and take corrective actions against data furnishers for noncompliance with their dispute investigation responsibilities. Additionally, they established special handling procedures for disputes involving mixed files, fraud, and identity theft and provided CRA employees with discretion to resolve such disputes, rather than relying on furnishers’ responses. In addition to the changes described above, representatives at various CRAs said they had quality assurance processes in place to help ensure that furnished data are accurate and that furnishers are responsive to disputes. Monitoring of furnished data. Representatives from four CRAs said that they use various mechanisms to monitor furnished data to detect potential inaccuracies and take corrective actions against furnishers that do not comply with data furnishing standards. For example, representatives from three CRAs told us they compare data submissions against industry patterns and historical trends—such as data submission history over the past 6 months—to identify anomalies that would suggest erroneous data and take actions such as rejecting incoming data and returning data for correction. Representatives from one of these CRAs said that they analyze why a furnisher deviates from industry trends and help the furnisher identify and implement changes. Representatives from four CRAs told us that they provide regular reports, such as monthly reports, on data quality to furnishers. We reported previously that such steps may improve the quality of the information received from furnishers but cannot ensure the accuracy of such data. Monitoring of dispute investigations. Representatives from four CRAs said they have processes in place to help ensure that furnishers are responsive to disputes. For example, representatives from one CRA said that the automated system they use to correspond with furnishers about disputes automatically identifies illogical furnisher responses; the CRA contacts the furnisher to confirm the accuracy of those responses. Representatives from four CRAs told us that they monitor furnisher responses to disputes, such as dispute trends by furnisher type and the rate at which furnishers do not respond to disputes. Although CRAs have made changes to improve processes for ensuring accuracy and addressing inaccuracies, CFPB and industry stakeholders said that challenges remain in these areas. First, CFPB staff told us that the consumer reporting market has historically had comparatively less regulatory intervention than other regulated markets. As a result, the staff said that it has been challenging to change CRAs’ approach to a proactive one, whereby the CRAs proactively address compliance and change practices, as opposed to a defensive, reactive approach in response to consumer disputes and lawsuits. CFPB staff explained that this has been a focus of CFPB’s supervision and said that its examination findings have demonstrated that CRAs can take actions to improve accuracy. Further, representatives from three consumer groups said that consumer report inaccuracy remains a challenge because CRAs lack incentives to be responsive to consumers, in part because the CRAs’ customers are the users of consumer reports, such as banks and employers, rather than the consumers themselves. Additionally, two industry stakeholders identified gaps in furnisher responsibilities for ensuring accuracy as a challenge. Representatives from one of these stakeholders, a state agency, said that furnishers often do not know their responsibilities for ensuring the accuracy of their data. Representatives from the other stakeholder, a CRA, said that while the CRA has implemented policies and procedures to ensure accuracy in response to CFPB’s supervision, furnishers might not have implemented similar policies and procedures to ensure the accuracy of the data provided. Conclusions Consumer reports affect the lives of millions of Americans because of the role they play in many important decisions, such as whether a lender decides to extend credit and at what terms or whether an employer offers a candidate a job. Therefore, it is important for CRAs to produce reports that are accurate and for consumers to have appropriate procedures available to correct any inaccuracies in their consumer reports, including disputing inaccuracies. We found that opportunities exist for CFPB to improve its oversight of CRAs. As part of its supervision, CFPB has directed CRAs it has examined to make specific changes based on examination findings related to FCRA requirements for (1) reasonable procedures for assuring accuracy and (2) reasonable investigation of consumer disputes. However, CFPB has not defined its expectations for how CRAs can comply with these requirements. Providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB achieve its vision of promoting a consumer reporting system where CRAs maintain and distribute accurate data, supplemented by effective dispute resolution processes. Additionally, such information could help to promote consistency and transparency in CFPB’s supervisory approach. Recommendations for Executive Action We are making two recommendations to CFPB: The Director of CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy of consumer report information. (Recommendation 1) The Director of CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes. (Recommendation 2) Agency Comments and Our Evaluation We provided a draft of this report to CFPB, the Federal Reserve, FDIC, FTC, NCUA, and OCC for review and comment. We received written comments from CFPB, which are summarized below and reprinted in appendix II. CFPB, the Federal Reserve, FDIC, and FTC provided technical comments, which we incorporated as appropriate. In email responses, officials indicated that NCUA and OCC did not have any comments on the draft of this report. In its written comments, CFPB neither agreed nor disagreed with the recommendations. CFPB stated that it has made oversight of the consumer reporting market a top priority and that its supervisory reviews of CRAs have focused on evaluating their systems for assuring the accuracy of data used to prepare consumer reports. CFPB noted that CRAs have made significant advances to, among other things, promote greater accuracy. With respect to the first recommendation—that CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy—CFPB noted that case law includes interpretations of the reasonableness standard and provides guidance to CRAs about how the standard applies to various factual scenarios. CFPB also noted that it and FTC have settled enforcement actions regarding the reasonableness standard in which each agency provided examples of how it applied the standard and the relevant case law to the facts of each matter and described a consent order with two background-screening companies that made clear that a lack of certain written procedures was not reasonable. Additionally, CFPB noted that its examination procedures discuss factors that would be considered in evaluating compliance with the reasonable procedures standard and that it publishes “Supervisory Highlights” that document key examination findings. While we agree that case law may provide information to CRAs regarding how courts have interpreted the reasonableness standard in specific circumstances, as we note in the report, there may be a lack of clarity about the extent to which all case law fully reflects CFPB’s expectations. Absent additional information from CFPB, the current case law and case- by-case enforcement actions may not best serve to enable CRAs to proactively address compliance practices. More direct communication of CFPB’s expectations can provide CRAs with clearer information on what they should be doing and what actions might constitute a FCRA violation. Similarly, while FTC and CFPB have settled actions with certain CRAs regarding reasonable procedures, such settlements may be applicable only to the specific facts and circumstances and the parties involved in those cases. CFPB’s examination procedures provide information on factors that would be considered in evaluating compliance and areas that may be reviewed in examinations, but they do not provide information on CFPB’s oversight expectations regarding how CRAs may comply with the FCRA requirement for reasonable procedures. Likewise, while CFPB’s Supervisory Highlights provide information on key examination findings, the Supervisory Highlights do not represent CFPB’s expectations for how CRAs may or should comply with the reasonableness standard. For example, the Supervisory Highlights state that the legal violations described are based on particular facts and circumstances and may not lead to such findings under different facts and circumstances. With respect to the second recommendation—that CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes—CFPB stated that what qualifies as a “reasonable investigation” has been articulated in court cases and noted that an FTC report summarizes how the reasonable investigations standard has been interpreted by courts and FTC. While we acknowledge that FTC may have interpreted and the courts may have ruled on this issue, CFPB has not communicated to CRAs specific information on what may and may not qualify as a “reasonable investigation.” CFPB also stated that it issued a bulletin in September 2013 that is relevant to this recommendation. However, in that bulletin, CFPB restated FCRA requirements and emphasized their importance, but it did not provide further information on what practices may represent a “reasonable investigation” or what it expects of CRAs. CFPB noted that it has and will continue to communicate its expectations to CRAs. As stated in our report, communicating information about CFPB’s compliance expectations and ways in which CRAs could comply could help to ensure that CRAs receive complete and clear information about how to comply with key FCRA requirements. CFPB could provide such information in several ways; for example, CFPB has put consumer reporting issues on its rulemaking agenda since 2015. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendations should be addressed. We are sending copies of this report to the appropriate congressional committees and financial regulators, and other interested parties. This report will also be available at no charge on our website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or OrtizA@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology Our objectives for this review were to (1) describe the current oversight framework for consumer reporting agencies (CRA), (2) examine how the Consumer Financial Protection Bureau (CFPB) has overseen CRAs and entities that furnish consumer data, (3) examine how other federal agencies, including the Federal Trade Commission (FTC) and the prudential regulators, have overseen CRAs and entities that furnish consumer data, and (4) identify what is known about the causes of inaccuracies in consumer reports and the processes that are in place to help ensure accuracy. Some information has not been included in this public report because CFPB determined it was information prohibited by law from public disclosure. This report omits such information, but we will be issuing a nonpublic version of this report that includes all the information. Although the information provided in this report is more limited, it addresses the same objectives as the sensitive nonpublic report and uses the same methodology. To describe the oversight framework for CRAs, we identified and reviewed relevant federal laws and their application for CRAs and institutions that furnish data to CRAs (called furnishers). We identified and reviewed laws focused on the accuracy of consumer reports, the security of consumer information, and the use and sharing of consumer reports. These laws include the Fair Credit Reporting Act (FCRA) and its implementing regulation, Regulation V, the Gramm-Leach-Bliley Act, the Dodd–Frank Wall Street Reform and Consumer Protection Act, the Federal Trade Commission Act, and the Economic Growth, Regulatory Relief, and Consumer Protection Act. We interviewed staff from CFPB, FTC, and the prudential regulators—the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency—about applicable laws and regulations for CRAs and furnishers and their oversight authority over CRAs and furnishers. Additionally, we interviewed five categories of stakeholders to learn about federal and state oversight over CRAs: state agencies such as Attorney General offices and regulators, CRAs, groups representing state agencies, industry groups representing CRAs, and consumer groups. We selected four states—Maine, Maryland, New York, and Ohio—for a more in-depth review. We chose these states because they had laws and regulations related to consumer reporting or had oversight activities involving CRAs, such as prior enforcement actions. We interviewed staff from state regulatory agencies in Maine, Maryland, and New York, as well as staff from the New York Office of the Attorney General. In addition, we received written responses to our questions from the Ohio Office of the Attorney General. In each case, we asked questions about state oversight of CRAs, including the relevant state laws and state enforcement, rulemaking, and supervisory authorities. We interviewed three nationwide CRAs and four smaller or specialty CRAs that produce or compile consumer reports covering the credit and background-screening markets about federal and state oversight, including applicable laws. We selected these CRAs because of potential differences in oversight based on their size and market. In our selection, we considered the size of the CRA and the number of consumer complaints in CFPB’s database. We also interviewed two industry groups representing CRAs (the Consumer Data Industry Association and the National Association of Professional Background Screeners); two groups representing states (the Conference of State Bank Supervisors and the National Conference of State Legislatures); and four consumer groups (Consumers Union, the National Association of Consumer Advocates, the National Consumer Law Center, and U.S. Public Interest Research Group). We asked these groups about federal and state authorities for overseeing CRAs. We selected these groups because, based on our analysis of publicly available information and interviews with federal agencies, they are the primary organizations representing stakeholders in our review, such as CRAs, or have existing work, such as reports or testimonies, related to CRAs. The groups we included and the views they represent reflect a range of stakeholders but do not necessarily reflect the full scope of the industry. To examine how CFPB has overseen CRAs and furnishers, we interviewed CFPB staff about CFPB’s supervision and enforcement strategies and activities, and we reviewed relevant documents, including supervisory and examination documents. To examine CFPB’s supervisory strategies and activities, we reviewed CFPB’s supervisory plans that document how CFPB determined which CRAs and furnishers to examine and which compliance areas to examine. We also reviewed CFPB’s public reports, such as Supervisory Highlights, and nonpublic examination documents to evaluate CFPB’s supervisory activities for both CRAs and furnishers. To learn about CFPB’s enforcement strategies and enforcement activities in the consumer reporting market, we reviewed the types of enforcement actions available to CFPB for violations of relevant laws, and we identified specific enforcement actions CFPB brought against CRAs and furnishers for violations related to FCRA and Regulation V from 2012 through 2018. We identified these enforcement actions by reviewing CFPB’s publicly available enforcement activities on its website, and we corroborated our results with CFPB. We also interviewed stakeholders, including CRAs, consumer groups, state agencies, and state groups, to obtain their views on CFPB’s oversight. To examine how FTC and the prudential regulators have overseen CRAs and furnishers, we interviewed staff from FTC and the prudential regulators to discuss the agencies’ oversight and enforcement activities. To learn about FTC’s enforcement strategies and activities in the consumer reporting market, we reviewed the types of enforcement actions available to FTC for violations of relevant laws, interviewed FTC staff regarding the process for initiating investigations and the investigations FTC conducted, and identified specific enforcement actions brought against CRAs and furnishers for violations related to FCRA, Regulation V, and FTC’s Furnisher Rule from 2010 through 2018. We identified these enforcement actions by reviewing FTC’s publicly available enforcement activities on its website, and we corroborated our results with FTC. To learn about prudential regulators’ activities, we reviewed the prudential regulators’ policies and procedures for examining furnishers and interviewed regulators’ staff. We also collected information from the regulators about their FCRA-related findings for furnishers from 2013 through 2018. To identify what is known about the causes of inaccuracies in consumer reports and the processes that are currently in place to help ensure accuracy, we conducted interviews with stakeholders. In particular, we interviewed staff from CFPB, FTC, the prudential regulators, and the state agencies to learn about what they believe are the causes of inaccuracies in consumer reports and the options available to consumers to address inaccuracies. Similarly, we interviewed staff at three nationwide CRAs and four smaller or specialty CRAs about the causes of inaccuracies and the processes they have in place for ensuring accuracy and addressing inaccuracies, including the processes in place to meet FCRA requirements for addressing consumer disputes about consumer report information. Additionally, we spoke with staff from four consumer and two industry groups (described above) to gain their perspectives on the causes of inaccuracies and processes in place to address them. We also conducted a literature search on the causes of inaccuracies in consumer reports and processes in place to help ensure accuracy. The search covered academic literature and court cases from 2008 through 2018 and used subject and keyword searches of various databases, such as ProQuest, Westlaw, and CQ. The literature search resulted in limited relevant information. However, we identified reports from CFPB and FTC that included information on the causes of inaccuracies in consumer reports, as well as information CFPB has published, such as Supervisory Highlights, on the processes CRAs have in place to help ensure accuracy. Additionally, through our interviews, we identified information that stakeholders, such as the National Consumer Law Center, have published on these issues. We conducted this performance audit from July 2018 to July 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Bureau of Consumer Financial Protection Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Kevin Averyt (Assistant Director), Weifei Zheng (Analyst in Charge), Yue Pui Chin, Sergio Enriquez, Marc Molino, Stephen Ruszczyk, Kelsey Sagawa, Jessica Sandler, Jennifer Schwartz, and Farrah Stone made key contributions to this report.