This month, with overwhelming support from the financial services industry and consumer groups, President Bush signed into law the Fair and Accurate Credit Transactions Act of 2003 (the FACT Act). Passage of this legislation was a top priority for ICBA this year because it was the vehicle by which the seven federal standards for credit reporting were permanently reauthorized, resulting in a major benefit to community banks and their customers. Without these uniform federal credit reporting standards banks would face a compliance nightmare of a myriad of state credit reporting laws that would ultimately affect the consumer's access to credit -a lose-lose situation for everyone.
The new law is a win-win. And the most significant win is that it preempts state laws by establishing one set of federal credit reporting standards. It is appropriately balanced with consumer protection provisions designed to combat identity theft (a top consumer and industry concern) while remaining sensitive to the regulatory burden of community banks. That is not to say that banks will have no additional compliance obligations, but the FACT Act contains provisions that hold everyone accountable. It places obligations not just on banks and other creditors and reporters of customer information, but on the consumer and the credit bureaus as well.
The law permanently reauthorizes existing FCRA provisions and preempts state law in the following areas:
Below are some additional key provisions of the new law. For each of these provisions state laws are preempted, therefore states may not impose additional or different obligations.
IDENTITY THEFT PREVENTION
Fraud Alerts. Consumers who suspect that they have been or are about to be the victim of identity theft may request that the credit bureau place a fraud alert in their credit file which may remain from 90 days to as long as 7 years. For customers with fraud alerts, creditors must take reasonable steps to verify the consumer's identity. Regulations defining appropriate proof of identity will be prescribed by the Federal Trade Commission.
Providing Information to Victims of Identity Theft. To document fraudulent transactions, victims of identity theft can request that a creditor provide them with copies of records when an account has been opened in their name. The information must be provided within 30 days and at no charge to the victim. The request must be in writing with proof of identification. The bank can decline to provide the information, for example, if it is not confident of the true identity of the requester. It is important to note that this provision of the law does not impose any new record keeping requirements on banks or other creditors.
Blocking Information Resulting from Identity Theft (Tradeline Blocking). Information that a consumer indicates is the result of an identity theft will be blocked by the credit bureau, and the credit bureau will notify the furnisher of the information of the block. Banks and other furnishers must have reasonable procedures to respond to a credit bureau notification to prevent the refurnishing of blocked information. A creditor may not sell, transfer or place for collection any debt that it has been notified has been blocked by a nationwide credit bureau.
Red Flag Guidelines and Regulations. The federal banking agencies and the FTC will jointly establish guidelines identifying patterns, practices and activities that may indicate identity theft. Creditors will be required to have reasonable procedures to implement these guidelines.
IMPROVEMENTS IN USE AND ACCURACY OF CREDIT INFORMATION
Free Consumer Credit Reports. Consumers may request one free credit report from each credit bureau during any 12-month period. Regulations will establish a centralized source, such as a toll free number, through which consumers may request the free credit report. Existing state laws regarding free credit reports are grandfathered. The effective date will be the date that the final regulations are effective. Credit scores will also be made available to the consumer upon request for a reasonable fee.
Risk Based Pricing Notice. When a creditor makes an offer of credit with terms that are materially less favorable than generally available terms and based on information contained in the consumer's credit report, the creditor must notify the consumer. Material terms would include, interest rates, advanced deposit or prepayment requirements, points, fees, and prepayment penalties. It is important to note that Congress does not intend that every consumer receive a notice for every term change that occurs. The Federal Trade Commission and the Federal Reserve Board must jointly prescribe flexible rules addressing the form, content, time and manner of delivery of the notice.
Notification of Negative Information. Creditors that regularly report information to a national credit bureau, and report negative information about a consumer, must provide the consumer with a written notice. Only one notice is required with respect to the same customer. The notice may not be made in any initial disclosures under the Truth in Lending Act, but it may be included on any other disclosures or statement provided to the customer. The Federal Reserve Board must prescribe a model disclosure within six months. The new notice does not require creditors to actually report negative information, it only requires that the customer be given notice that negative information may be reported.
Direct Reinvestigation. If a creditor receives a notice disputing the accuracy of information in a credit report, it must conduct an investigation. If the information reported is inaccurate, the creditor must notify each credit bureau to which it furnished the information. The specific circumstances under which a creditor will be required to reinvestigate a dispute will be set forth in regulations jointly prescribed by the federal banking agencies, NCUA and the Federal Trade Commission.
Furnisher Liability. Creditors must have procedures to ensure the accuracy of the information they report, and are prohibited from reporting any information that they know or have reasonable cause to believe is inaccurate. Therefore, based on a bank's procedures, if the bank has specific knowledge that would cause a reasonable person to doubt the accuracy of the information, it must not be reported.
Affiliate Sharing. A bank or other creditor may not use information that it receives from an affiliate, and vice versa to make a solicitation for marketing purposes unless it complies with certain notice and opt out requirements. The law does not prevent information sharing, but it does prevent use of customer information for marketing if the customer opts out. The opt-out would be effective for a period of five years. This does not limit solicitations from entities with whom the consumer has a "pre-existing business relationship," or when information is used to perform services on behalf of the bank by an affiliate, when information is used to respond to an inquiry from the consumer, or when information is used to respond to solicitations authorized by the consumer. The notice to the consumer can be made together with other required disclosures.
The new law also: