When a Mortgage Lender Has a Permissible Purpose to Pull a Credit Report

A credit report is not a general-purpose research tool. Under the FCRA, a person who obtains or uses a consumer report must have a permissible purpose. For a mortgage loan originator, that usually means the report is connected to a real credit transaction involving the consumer, or the consumer has provided the required written instructions. Having access to a lender portal or a consumer’s name and address does not itself authorize a credit pull.

The credit-transaction purpose

FCRA section 604(a)(3) allows a consumer report to be furnished for use in connection with a credit transaction involving the consumer, when the report is to be used to review or collect an account, or for another listed statutory purpose. A mortgage application being evaluated by a creditor is a typical credit-transaction context. The request must still concern the consumer who is the subject of the report and the actual transaction under review.

This means a lender should be able to connect each inquiry to a documented application, account review, or other lawful basis. An MLO should follow the institution’s process for obtaining the borrower’s application information and any required authorization. A credit bureau or reseller may ask the user to identify the purpose, but the user remains responsible for ensuring the purpose is genuine and documented.

Written instructions

The FCRA separately permits a consumer reporting agency to furnish a consumer report pursuant to the consumer’s written instructions. In the mortgage setting, a properly worded authorization may support the report request. This is not permission to obtain reports for unrelated purposes; the report still must be used consistently with the instructions and applicable privacy and consumer-reporting requirements.

A lender should obtain authorization through its approved application workflow, retain evidence of the authorization, and limit access to staff who need the report for the credit transaction. An informal oral statement, a broad marketing opt-in, or a signature on a document unrelated to credit reporting should not be treated casually as blanket permission. The institution’s policies should make clear which disclosures and signatures establish its process.

Prohibited curiosity and pretext

A report cannot be pulled merely because someone is a prospective customer, a real-estate lead, an employee, a family member, or a person whose finances interest the MLO. FCRA section 604(f) prohibits a person from using or obtaining a consumer report unless it is obtained for a permissible purpose. The CFPB’s advisory opinion emphasizes that permissible purposes are consumer-specific and that disclaimers cannot cure the absence of a real purpose.

For example, a mortgage broker cannot pull an old client’s report to see whether the client may be ready to refinance if there is no current permissible purpose or valid written instruction. Nor should staff pull reports for all names in a real-estate open-house sign-in sheet simply to identify likely borrowers. A campaign or business-development goal does not create a credit-transaction purpose by itself.

Permissible purpose is not the same as a hard inquiry

A hard inquiry may be visible to other report users and can affect a score, while a soft inquiry generally is not used in the same way for scoring. But the terminology does not replace the FCRA analysis. A soft pull is still access to consumer-report information and still requires an appropriate legal basis. Likewise, a consumer’s consent does not authorize a lender to use a report for a purpose outside the scope of the consent and applicable law.

Practical controls for an MLO

• Confirm there is an actual credit transaction involving the consumer or obtain valid written instructions.
• Use the correct consumer identity; do not pull a report on a similarly named person to resolve a lead record.
• Follow the lender’s approved authorization, vendor, and access-control process.
• Record the transaction or instructions that support the inquiry.
• Do not use a report for marketing, curiosity, or another purpose unrelated to the permissible basis.
• Escalate questions about repeat pulls, joint applicants, co-borrowers, or stale applications to compliance.

Example

A borrower completes a mortgage application and signs the lender’s credit-report authorization. The lender pulls the report to evaluate the requested loan. That is connected to a credit transaction and supported by the borrower’s instructions. Months later, after the application is withdrawn and the borrower has no active account, the MLO wants to pull a new report to see if the borrower’s score improved. The original authorization may not make that unrelated future pull permissible; the lender should confirm a current purpose or obtain new valid instructions.

Exam takeaways

For a fact pattern, identify the user, the consumer, the intended use, and the statutory permissible purpose. The most common answer is a report used in connection with a genuine consumer credit transaction. Then rule out mere curiosity, marketing, or a purpose attached only by a disclaimer. Remember that the FCRA regulates both obtaining and using the report, not just what the consumer reporting agency does.