Consumer Reporting Agency Obligations Under the FCRA

The definition is functional: regularly engaging, for fees or on a cooperative basis, in assembling or evaluating consumer credit information or other information on consumers to furnish consumer reports, communications bearing on creditworthiness, character, reputation, characteristics, or mode of living, used or expected to be used for credit, employment, insurance, housing, or other eligibility determinations. Obvious members: the nationwide Big Three, background screeners, tenant-screening services, check/deposit-account verifiers (specialty CRAs). Accidental members: a fraud-score vendor whose clients use scores to deny account openings; an identity-verification service marketed for onboarding decisions; a gig platform sharing driver records with other platforms; an AI hiring-signal product. The 'expected to be used' element means marketing language matters, sell a signal 'for tenant decisions' and you have expectations. The regime is not severable: CRA status brings accuracy procedures, dispute infrastructure, permissible-purpose gating, and adverse-action support obligations wholesale, which is why product counsel should review any data product adjacent to eligibility decisions before launch, not after the first demand letter.

1681e(b): reasonable procedures to assure maximum possible accuracy of the information reported. Courts read this as more than parroting furnisher data when problems are knowable: matching logic that requires more than name-plus-birthdate (mixed files from loose matching are the classic claim, especially for common names and Jr./Sr. households); handling of dismissed, expunged, and sealed records (reporting them is the tenant/background-screening litigation staple); currency of data at report time (re-verifying public records rather than reselling stale database copies); and full-file identifiers to reduce misattribution. The 2021 TransUnion v. Ramirez decision (terrorist-list mismatches) shaped standing doctrine but also memorialized how coarse matching becomes mass error. For screeners, the operational floor is: strict match thresholds with human review of near-misses, procurement of disposition data (not just arrest records), suppression pipelines wired to clean-slate and expungement feeds, and audit sampling of report accuracy as a measured KPI, because 'we relied on our data supplier' is not a procedures defense.

1681i: on a consumer's dispute, the CRA must conduct a reasonable reinvestigation within 30 days (45 in limited cases), free of charge; forward all relevant information provided by the consumer to the furnisher; consider it; delete or modify information found inaccurate, incomplete, or unverifiable; and notify the consumer of results with a copy of the revised file. Frivolous-dispute determinations require notice with reasons. Reinserted information needs furnisher certification and consumer notice within five business days. The litigation and CFPB findings target the gap between this text and industry practice: dispute handling reduced to automated code transmission (e-OSCAR ACDVs) without conveying the consumer's actual documents, 'parroting' furnisher verification without independent review, and template rejections. The CFPB's orders against the Big Three and its 2022 circular emphasized that reinvestigation must be substantive. Design consequence: dispute operations need document-handling capacity, furnisher escalation paths, and quality review, sized to volume, because each mishandled dispute is a freestanding claim with statutory damages.

Permissible purposes (1681b): court order or subpoena; the consumer's written instruction; credit transactions; employment (with the specific 1681b(b) consent-and-certification machinery); insurance underwriting; licensing and government benefits; legitimate business need in transactions the consumer initiates or account review; and specified government/child-support uses. CRAs must maintain reasonable procedures to verify users' identities and certified purposes and to limit furnishing accordingly, selling reports to uncertified users is a direct violation with criminal exposure for knowing violations. Obsolescence (1681c): most adverse information ages out at seven years, bankruptcies at ten; arrest records not resulting in conviction follow the seven-year rule (states often shorter); the caps lift for credit transactions of $150,000+, life insurance of $150,000+, and jobs paying $75,000+, exceptions screeners sometimes over-rely on. Note convictions: FCRA allows them indefinitely, but state law frequently does not, another place the state matrix, not the federal statute, sets the real limit.

File disclosure: on request, all information in the consumer's file, sources, and report recipients (two years back for employment, one otherwise), free after adverse action, when unemployed and job-seeking, on public assistance, for fraud suspicion, and annually from nationwide and nationwide-specialty CRAs (the AnnualCreditReport.com channel; the Big Three now offer free weekly reports). Adverse-action support: users must be able to cite you, so consumer contact channels with adequate capacity are obligatory (understaffed toll-free lines have drawn enforcement). For nationwide CRAs: security freezes (free, since the 2018 EGRRCPA), one-year fraud alerts, active-duty alerts, and human trafficking victim block procedures (2022 rule). Identity-theft blocks under 1681c-2 require blocking reported theft-related information within four business days of a proper request. Smaller and specialty CRAs inherit proportionate versions of most of this, tenant screeners and background-check firms must run disclosure and dispute operations regardless of size, and 'we're a startup' has never appeared in the statute.