United States
Hong KongFCRA and credit reports
The Fair Credit Reporting Act governs how consumer reports are obtained and used. A permissible purpose is required to pull one, agencies have 30 days to investigate a dispute, and risk-based pricing notices are required where credit is offered on worse terms.
FCRA dates from 1970 and governs the report rather than the loan. It is the reason a borrower has any control over what is said about them.
Permissible purpose
A consumer report may only be pulled for a reason the statute permits, and a credit application is one of them.
Pulling a report out of curiosity, or on someone who has not applied, is a violation. So is pulling one on a person the originator hopes will apply.
Disputes
A consumer may dispute an item and the reporting agency has 30 days to investigate.
An item that cannot be verified must be deleted. That is the mechanism behind the advice to dispute errors well before applying, since 30 days can outlast a rate lock.
Risk-based pricing
Where a borrower is granted credit on materially less favorable terms than a substantial proportion of consumers get, and the reason lies in their credit report, a notice is required. Start early.
Adverse action means credit was refused or terms were changed unfavourably. Risk-based pricing means credit was granted, but priced worse. Both come from the credit report and they are separate notices.
Adverse action disclosures
Where a report contributed to a denial, the applicant must be told the credit score used, the range, the key factors affecting it, and which agency supplied the report.
They must also be told they may obtain a free copy and dispute inaccuracies.
Accuracy obligations run both ways
A furnisher of information must not report data it knows to be inaccurate, and must investigate disputes passed to it by an agency.
That matters for servicers, who furnish payment history every month.
Common questions
What is a permissible purpose under FCRA?
A defined reason for obtaining a consumer report. A credit application is one; curiosity is not.
How long does a credit dispute take?
A reporting agency has 30 days to investigate, and unverifiable items must be deleted.
What is a risk-based pricing notice?
A notice required where credit is granted on materially less favorable terms because of credit report information.
How does risk-based pricing differ from adverse action?
Adverse action means credit was refused or worsened. Risk-based pricing means it was granted but priced worse.
What must an adverse action notice disclose about the credit report?
The score used, the range, the key factors, the agency that supplied it, and the right to a free copy and to dispute.