The FCRA and Commercial Loans

The Fair Credit Reporting Act (FCRA) regulates the collecting and furnishing of credit information and imposes disclosure requirements in connection with accessing credit reports. The FCRA is law and only a few parts of the law have implementing regulations, so the FCRA can be somewhat difficult to interpret at times.

One of the most common questions we’re asked is whether the FCRA applies to commercial loans. There’s not a straightforward answer to this, and although the FCRA is generally limited to consumer purpose transactions, it also applies in some cases to commercial purpose transactions involving a consumer.

But, if there is a “consumer,” how can this be a commercial loan? The answer is that the FCRA defines a “consumer” as just an “individual.” There’s no requirement that the consumer/individual be obtaining a product or service specifically for a consumer purpose.

Does this mean that the bank must have a permissible purpose before pulling a credit report on an individual guarantor for a loan to a business entity? The answer to this is conclusively ‘yes’—there always must be some permissible purpose before pulling any consumer report on any individual. The question is whether the application itself is enough of a permissible purpose, since the individual is just a guarantor. For this, we turn to the Advisory Opinion to Tatelbaum which concludes that if an individual has any kind of personal liability on a business loan, including just a guarantee, there would be permissible purpose by means of the application for credit.

What about during the term of the loan? Many banks regularly pull consumer reports on individuals throughout the term of the loan, and there’s a question as to whether the need to review constitutes a permissible purpose. In the Advisory Opinion to Gowen the Federal Trade Commission (FTC) concludes that in order to have valid permissible purpose, the bank would need to have some authority to change the terms of the loan as a result of the review; for example, if the bank had the authority to terminate the loan if the report contained certain negative information. On the other hand, if the bank is just “reviewing” the report to potentially offer the borrower different terms, then it would generally not be allowed, “unless the contract expressly provides for such action.”

As a caveat, however, these opinions are merely informal guidance, and are not binding on the FTC any of the bank regulators. While plenty of banks do rely on advisory opinions, we still recommend getting written authorization from the individual before pulling credit. In fact, we’d recommend this in every case, for any consumer report pulled. This way, the bank can rely on that written authorization as a valid permissible purpose to pull the consumer report, rather than having to justify that one of the other permissible purposes apply. Said another way, the bank always has a permissible purpose to obtain a consumer report if the individual authorizes this in writing. The full list of permissible purposes can be found in Section 604(a) of the FCRA.

Besides permissible purpose questions, another common question we get is whether an adverse action notice must be provided in a commercial context. The general rule in the FCRA is that if the bank obtains a consumer report and takes adverse action based in whole or in part on any information in the report, it must give the consumer an adverse action notice. The catch here is how the FCRA defines an “adverse action,” which does not include guarantors.

Thankfully, the FTC clarifies in the Advisory Opinion to Stinneford the confusion over whether all consumers (individuals) receive adverse action notices, or if guarantors are treated differently. If the consumer is only a guarantor (i.e., secondarily liable on the loan), then an adverse action notice would not be required to be provided to the guarantor. This is true even if the application is being denied based on information in the guarantor’s consumer report. On the other hand, if the individual is a co-borrower (i.e., primarily liable on the loan), then an adverse action notice would be required.

If trying to figure out the difference between the two sounds like way too much work, the bank is welcome to provide an adverse action notice in both cases. Note, however, that any time the bank provides multiple FCRA adverse action notices, each individual should receive a separate adverse action notice with the credit score disclosures associated with just her or his own report. In other words, the individual should never receive the credit score information of another co-applicant.