INTRODUCTION
If you use consumer reports (sometimes called “credit reports”) to make credit decisions, you have legal obligations under the Fair Credit Reporting Act, known as the FCRA and the Risk-Based Pricing Rule. In particular:
- if you deny a consumer credit based on information in a consumer report, you must provide an “adverse action” notice to the consumer.
- if you grant credit, but on less favorable terms based on information in a consumer report, you must provide a “risk-based pricing” notice.
When they receive these notices, consumers can contact the consumer reporting agency (“CRA”) that supplied the information to you to ensure their consumer report is accurate.
The Federal Trade Commission and the Consumer Financial Protection Bureau have each published a Risk-Based Pricing Rule. The rules are identical in substance. The FTC’s Rule is summarized here. If you are not subject to the FTC’s jurisdiction, contact your regulator about your obligations.
Table of Contents
Your Obligations When Taking Adverse Action
Credit Granted on Materially Less Favorable Terms
Substantial Proportion of Consumers
When Should Consumers be Notified?
Credit Score Disclosure Exception
Who Should Send Risk-Based Pricing Notices?
Other Uses of Consumer Reports
ADVERSE ACTION
If you take adverse action against a consumer based on information in a consumer report, you must tell the consumer. The most common type of adverse action is a denial of credit. Adverse action is defined in the Equal Credit Opportunity Act and the FCRA to include:
- a denial or revocation of credit
- a refusal to grant credit in the amount or terms requested
- a negative change in account terms in connection with an unfavorable review of a consumer’s account 5 U.S.C. § 1691(d)(6); FCRA § 603(k)
Denying a consumer’s request for additional credit under an existing account generally isn’t considered an adverse action but changing the terms of the existing account can be.
Your Obligations When Taking Adverse Action
If you take adverse action based on information in a consumer report, you must tell the consumer. Your notice may be oral, written or electronic; it must contain certain information: FCRA § 615(a)
- the name, address and phone number of the CRA (including a toll-free number for nationwide CRAs) that supplied the report
- a statement that the CRA didn’t make the adverse decision and can’t explain why the decision was made
- notice of the consumer's right to a free copy of their report from the CRA if they ask for it within 60 days FCRA § 612
- notice of the consumer's right to dispute the accuracy or completeness of any information provided by the CRA FCRA § 611
- the consumer’s credit score, if a score was used
RISK-BASED PRICING RULE
Risk-based pricing occurs when lenders offer different interest rates and loan terms to borrowers, based on individual creditworthiness. The Risk-Based Pricing Rule requires you to notify consumers if they are getting worse terms because of information in their credit report. An alternative way of complying with the Rule is to give a credit score disclosure notice to all customers, regardless of the terms on which you granted them credit (“credit score disclosure exception” notice). Rule § 640.5(e) Information about the credit score disclosure exception is below. Model forms are available for each type of notice.
The Federal Trade Commission, the Consumer Financial Protection Bureau, and the federal banking agencies each have published a Risk-Based Pricing Rule. The substance of the rules is identical. This publication summarizes the FTC’s Rule.
Who Must be Notified?
You must notify consumers when you have used information in their credit report to offer them credit on materially less-favorable terms than the best material terms available to most consumers. Rule § 640.3(a)
Credit Granted on Materially Less Favorable Terms
“Materially less favorable terms,” the phrase used in the Rule, generally means a higher annual percentage rate (APR). When there is no APR, the material term is the one that has the most significant financial impact on the consumer and varies based on information in a consumer report. Other examples: a deposit charged by a telephone company or utility, or an annual membership fee for a charge card where some people are charged more than others who have higher credit ratings. Rule § 640.2(o)
You are not required to send a risk-based pricing notice if a person applies for credit under specific terms and is granted credit on those terms. For example, if someone gets an application for credit offered at a 12 percent interest rate, and applies for — and is granted — the credit, no notice is required even if you give some consumers a 10 percent interest rate. But if the application states that credit will be granted at a rate between 8 percent and 12 percent, a risk-based pricing notice would be required for the consumers who are granted more expensive credit. Rule § 640.5(a)
Proportion of Consumers
You must send risk-based pricing notices to consumers if you don’t give them the best terms you provide to a substantial number of other consumers. You can determine this by directly comparing the material terms offered to each consumer with the material terms offered to others for a specific type of credit product. Rule § 640.3(b) Because direct comparisons can be difficult, the Rule spells out other ways to determine who should get a notice. Special rules are available for credit card issuers. Rule § 640.3(c)
- 60/40 Credit Score Proxy Method. If you use a credit score to grant credit, you may look at a representative sample of customers to whom you have granted credit and determine the credit score that 40 percent of your customers are above and 60 percent are below. You must give a notice to new customers whose score is below the cut-off, Rule § 640.3(b)(1)(i), and you must recalculate the cut-off number every two years. Rule § 640.3(b)(1)(iii)(C) If you use more than one credit score to make credit decisions — for example, by choosing the low, median, high, most recent, or by calculating the average score — you must use the same method to make the calculation. If you don’t always use the same method, use one of the methods that you regularly use.
First-time credit grantors can base the cut-off score on market research, third-party data, and other sources, but must calculate their own score within one year. Rule § 640.3(b)(1)(iii)(B)
If you use the 60/40 credit score proxy method, you must give a notice to people for whom no credit score is available. Rule § 640.3(b)(1)(iv)
Whether you are a new or established creditor, if you give the best credit terms to more than 40 percent of people, you may set your cut-off score based on the approximate percentage of people to whom you haven’t granted credit on the most favorable terms.
- Tiered Pricing with Four or Fewer Levels. If you offer credit at four or fewer levels, you must give a risk-based pricing notice to every consumer who doesn’t qualify for the top tier of pricing. For example, if a company offers credit with APRs of 8 percent, 10 percent, 12 percent, and 14 percent, and selects the APR based on a consumer’s credit information, all consumers granted credit at 10 percent, 12 percent, or 14 percent must get a notice. Rule § 640.3(b)(2)(ii)
- Tiered Pricing with Five or More Levels. If you offer credit at five or more pricing levels, you must give a notice to all consumers, except those in the top two tiers of pricing and any other tiers that make up more than 30 percent but less than 40 percent of the total tiers. Rule § 640.3(b)(2)(iii)
Here are some examples:
| Number of Tiers | % per Tier | Top Tiers (up to 40% of tiers): No Notification |
Bottom Tiers: Must Be Notified |
|---|---|---|---|
| 5 | 20% |
Top 2 tiers = 40% |
3-5 All consumers but those in the top two tiers must get the notice. |
| 6 | 16.7% |
Top 2 tiers = 33.3% |
3-6 All consumers but those in the top two tiers must get the notice. |
| 7 | 14.2% |
Top 2 tiers = 28.4% |
3-7 In this example, the Top 3 tiers = 42.6%. Only consumers in tiers that make up less than 40% of the total are exempted from the notice. Because the top three tiers make up more than 40% of tiers, all consumers but those in the top two tiers must get the notice. |
| 8 | 12.5% |
Top 3 tiers = 37.5% |
4-8 All consumers but those in the top three tiers must get the notice. |
| 9 | 11.1% |
Top 3 tiers = 33.3% |
4-9 All consumers but those in the top three tiers must get the notice. |
- Price Raised During Account Review. Regardless of the prices charged to other customers, if you raise someone’s APR on credit already extended based on information in their report, you must send them a risk-based pricing notice. § 640.3(d)
Co-Signers
For transactions involving multiple consumers — say, a joint mortgage or co-signers for a loan — determining whether each consumer needs to be notified separately depends on several factors:
- if credit scores are used to set credit terms, you must give each consumer a risk-based pricing notice. The notice must have only that consumer’s credit score, not the score(s) of other applicant(s).
- if a credit score is not used and the consumers have different addresses, you must send separate notices to each consumer. If a credit score isn’t used and the consumers have the same address, you may send a joint notice. Rule § 640.6(c)
Separate notices are required under the circumstances described above whether you are using a regular risk-based pricing notice or the credit score disclosure exception.
When Should Consumers be Notified?
The timing for a risk-based pricing notice depends on the type of credit extended.
- For a closed-end credit plan, like a one-time transaction, notice must be given before the consumer becomes contractually obligated. 12 CFR § 226.2(a)(13) Notice cannot be given before the consumer is notified about the decision to extend credit. Rule § 640.4(c)(1)(i)
- For an open-end credit plan, where a person will make repeated charges, like using a credit card, notice must be given before the person makes the first transaction. Notice cannot be given before someone is notified about the decision to extend them credit. Rule § 640.4(c)(1)(ii) Where open-end credit is granted to finance the contemporaneous purchase of goods or services, like opening a store credit card at the cash register, notice must be given within 30 days after the decision to grant credit or when the first mailing goes out to the person after the credit-granting decisions has been made — whichever is earlier. Rule § 640.4(c)(3)
- For an account review that results in an increase in someone’s APR, notice must be given when the decision is made; or, to the extent the law permits you to raise someone’s interest rate without advance notice, no later than five days after the effective date of the rate change. Rule § 640.4(c)(1)(iii)
What Should the Notice Say?
A risk-based pricing notice must be clear and conspicuous. It can be oral, written, or electronic. Model forms are available; if you use them, you will have complied with the requirements regarding the contents of the notice. Rule § 640.4(b)
A risk-based pricing notice must tell the consumer:
- that a consumer report includes information about the consumer’s credit history and the type of information included in that history
- the terms offered were based on information from a consumer report
- the terms offered may be less favorable than those offered to consumers with better credit histories
- to make sure the information in their consumer report is accurate, and that they have the right to dispute information that’s inaccurate
- the identity of each CRA that furnished a consumer report used in the credit decision
- that federal law gives the consumer the right to a free copy of a consumer report from the CRA(s) identified in the notice for 60 days after the consumer got the notice;
- how to get a consumer report from the CRA with contact information (including a toll-free number, where applicable) for the CRA
- to visit the website of the Consumer Financial Protection Bureau for more information about consumer reports; Rule § 640.4(a)(1) 1
If you use credit scores, special requirements apply. If you get and use one credit score in your determination, you must include the information below. If you get two or more credit scores and use only one in your determination — for example, the low, middle, high, or most recent score — you must include the score used and the information below in your notice. If you get and use two or more credit scores — for example, if you average the scores — you must include at least one of the scores and the information below. You may include more than one of the scores you used, but you must include the information below for each score.
- that a credit score is a number based on information in a consumer report, that the consumer’s credit score was used to set the terms of credit offered, and that a credit score can change over time to reflect changes in the consumer’s credit history
- the credit score you used to make your credit decision
- the range of possible credit scores under the model used to generate the credit score
- four of the key factors that adversely affected the credit score; if one of the key factors was the number of inquiries to the consumer’s report, you must list five key factors
- the date the credit score was created
- the name of the CRA or person who provided the credit score
For a risk-based pricing notice following an account review, include all the relevant terms above except the statement that the terms offered may be less favorable than those offered to people with better credit histories, as well as statements that:
- an account review was conducted using information from a consumer report
- as a result of the review, the APR rate on the account increased. Rule § 640.4(a)(2)
Credit Score Disclosure Exception
You can satisfy the requirements of the Risk-Based Pricing Rule by giving a credit score notice to every consumer, regardless of the terms on which you granted them credit. The notice must include the person’s credit score and information about credit and credit scores. Rule § 640.5(e) Unlike other risk-based pricing notices, a credit score disclosure must be in writing and separate from other information; it also must be clear and conspicuous. Rule § 640.5(e)(2) You must send the notice as soon as practicable after you request the credit score from a CRA. Timing is outlined above in “When Should Consumers Be Notified?” Rule § 640.5(e)(3)
If you get two or more credit scores and use only one of them in your determination, like the low, middle, high, or most recent score, your notice must include the score you used and the information below. If you get and use two or more credit scores — say you average the scores — your notice must include at least one of the scores and the information below. You may include more than one of the scores you used, but you must include the information below for each score. Rule § 640.5(e)(4) If you don’t use a credit score to make your decision, you may buy a score and the required score distribution and other contextual information about that score from a source that regularly sells credit scores.
Special rules apply for mortgages and other extensions of credit secured by one to four units of residential real property. Consult Rule § 640.5(d) for more information.
If you choose this alternative, the credit score disclosure exception notice must tell the consumer:
- a consumer report (or credit report) is a record of the consumer's credit history and includes information about whether the consumer pays their obligations on time and how much they owe creditors
- a credit score is a number that is based on information in a consumer report and that it can change over time to reflect changes in the consumer's credit history
- their credit score can affect whether they can get credit and what the cost will be
- their current credit score or the most recent credit score that previously was calculated by the CRA to grant credit
- the range of possible credit scores under the model used to generate the credit score
- the distribution of credit scores among people under that scoring model presented as a bar graph of at least six bars showing the percentage of people with credit scores within the range of scores reflected in each bar (use of a graph or statement from the CRA that gave you the score is satisfactory)
- the date the credit score was created
- the name of the CRA or person who provided the credit score
- to verify the accuracy of the information in the consumer report and has the right to dispute inaccurate information in the report
- federal law gives them the right to get copies of their consumer reports directly from the CRAs, including a free report from each of the nationwide CRAs once during any 12-month period
- contact information for the central source — www.annualcreditreport.com — for free annual consumer reports
- they may visit the websites of the Consumer Financial Protection Bureau and Federal Trade Commission for more information about consumer reports
If you use the credit score disclosure exception notice, but a credit score isn’t available for a particular consumer from your usual CRA and you don’t get a credit score from another CRA, you must provide a notice that tells the consumer:
- a consumer report (or credit report) includes information about the consumer's credit history and the type of information included in that history
- a credit score is a number that is based on information in a consumer report and that a credit score can change over time in response to changes in the consumer's credit history
- credit scores are important because people with higher credit scores generally get more favorable credit terms
- not having a credit score can affect whether they can get credit and what the cost will be
- their credit score was not available from a CRA — which you must identify by name — generally due to insufficient information about the person's credit history
- to verify the accuracy of the information in their consumer report and has the right to dispute inaccurate information
- federal law gives them the right to get copies of his or her consumer reports directly from the CRAs, including a free consumer report from each of the nationwide CRAs once during any 12-month period
- contact information for the central source — www.annualcreditreport.com — for free annual consumer reports
- they may visit the website of the Consumer Financial Protection Bureau for more information about consumer reports
Rule § 640.5(f)
Who Should Provide Risk-Based Pricing Notices?
In general, you must provide a risk-based pricing notice if you use a consumer report in connection with an application for — or grant of credit for — personal, family, or household purposes to someone on less favorable terms than you grant to others. (See “Who Must Be Notified?”) Rule § 640.1(a) Consumers are entitled to only one notice per transaction; they are entitled to another notice only if the APR increases during an account review. Rule § 640.6(a)
Where a credit contract is assigned or sold, the consumer still gets only one notice; the assignee or buyer isn’t required to send another notice. For example, if an initial creditor extends credit to a consumer and then immediately sells the credit contract, the initial creditor must give the notice, not the creditor who bought the contract. Rule § 640.6(b) One caveat: Special rules for some auto sales transactions allow the dealer, rather than the creditor, to provide notice; see Rule § 640.4(c)(2) for more information.
THE COST OF NON-COMPLIANCE
If you don’t comply with the FCRA and the Risk-Based Pricing Rule, you may be sued by the Federal Trade Commission, Consumer Financial Protection Bureau, state governments, or in some cases, consumers. The FCRA provides for maximum penalties of $4,857 per violation in the case of lawsuits brought by the FTC. FCRA §§ 616, 617, 621
_______________
1 Certain auto dealers should tell the consumer to visit the website of the Federal Trade Commission, not the Consumer Financial Protection Bureau for more information about consumer reports. Refer to Section 1029 of the Dodd-Frank Act, 12 U.S.C. § 5519, for more information on auto dealers under the FTC's jurisdiction.
Your Opportunity to Comment
The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal compliance and enforcement activities. Each year, the Ombudsman evaluates the conduct of these activities and rates each agency’s responsiveness to small businesses. Small businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.
The FTC works for the consumer to prevent fraudulent, deceptive, and unfair practices in the marketplace and to provide information to businesses to help them comply with the law. For free information, visit the BCP Business Center, business.ftc.gov. To file a complaint, visit ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. Watch a video, How to File a Complaint, to learn more. The FTC enters consumer complaints into the Consumer Sentinel Network, a secure online database and investigative tool used by hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.
December 2013
Other Uses of Consumer Reports
ADVERSE ACTION
If you take adverse action against a consumer based on information in a consumer report, you must tell the consumer. The most common type of adverse action is a denial of credit. Adverse action is defined in the Equal Credit Opportunity Act and the FCRA to include:
- a denial or revocation of credit
- a refusal to grant credit in the amount or terms requested
- a negative change in account terms in connection with an unfavorable review of a consumer’s account 5 U.S.C. § 1691(d)(6); FCRA § 603(k)
Denying a consumer’s request for additional credit under an existing account generally isn’t considered an adverse action but changing the terms of the existing account can be.
Your Obligations When Taking Adverse Action
If you take adverse action based on information in a consumer report, you must tell the consumer. Your notice may be oral, written or electronic; it must contain certain information: FCRA § 615(a)
- the name, address and phone number of the CRA (including a toll-free number for nationwide CRAs) that supplied the report
- a statement that the CRA didn’t make the adverse decision and can’t explain why the decision was made
- notice of the consumer's right to a free copy of their report from the CRA if they ask for it within 60 days FCRA § 612
- notice of the consumer's right to dispute the accuracy or completeness of any information provided by the CRA FCRA § 611
- the consumer’s credit score, if a score was used
RISK-BASED PRICING RULE
Risk-based pricing occurs when lenders offer different interest rates and loan terms to borrowers, based on individual creditworthiness. The Risk-Based Pricing Rule requires you to notify consumers if they are getting worse terms because of information in their credit report. An alternative way of complying with the Rule is to give a credit score disclosure notice to all customers, regardless of the terms on which you granted them credit (“credit score disclosure exception” notice). Rule § 640.5(e) Information about the credit score disclosure exception is below. Model forms are available for each type of notice.
The Federal Trade Commission, the Consumer Financial Protection Bureau, and the federal banking agencies each have published a Risk-Based Pricing Rule. The substance of the rules is identical. This publication summarizes the FTC’s Rule.
Who Must be Notified?
You must notify consumers when you have used information in their credit report to offer them credit on materially less-favorable terms than the best material terms available to most consumers. Rule § 640.3(a)
Credit Granted on Materially Less Favorable Terms
“Materially less favorable terms,” the phrase used in the Rule, generally means a higher annual percentage rate (APR). When there is no APR, the material term is the one that has the most significant financial impact on the consumer and varies based on information in a consumer report. Other examples: a deposit charged by a telephone company or utility, or an annual membership fee for a charge card where some people are charged more than others who have higher credit ratings. Rule § 640.2(o)
You are not required to send a risk-based pricing notice if a person applies for credit under specific terms and is granted credit on those terms. For example, if someone gets an application for credit offered at a 12 percent interest rate, and applies for — and is granted — the credit, no notice is required even if you give some consumers a 10 percent interest rate. But if the application states that credit will be granted at a rate between 8 percent and 12 percent, a risk-based pricing notice would be required for the consumers who are granted more expensive credit. Rule § 640.5(a)
Proportion of Consumers
You must send risk-based pricing notices to consumers if you don’t give them the best terms you provide to a substantial number of other consumers. You can determine this by directly comparing the material terms offered to each consumer with the material terms offered to others for a specific type of credit product. Rule § 640.3(b) Because direct comparisons can be difficult, the Rule spells out other ways to determine who should get a notice. Special rules are available for credit card issuers. Rule § 640.3(c)
- 60/40 Credit Score Proxy Method. If you use a credit score to grant credit, you may look at a representative sample of customers to whom you have granted credit and determine the credit score that 40 percent of your customers are above and 60 percent are below. You must give a notice to new customers whose score is below the cut-off, Rule § 640.3(b)(1)(i), and you must recalculate the cut-off number every two years. Rule § 640.3(b)(1)(iii)(C) If you use more than one credit score to make credit decisions — for example, by choosing the low, median, high, most recent, or by calculating the average score — you must use the same method to make the calculation. If you don’t always use the same method, use one of the methods that you regularly use.
First-time credit grantors can base the cut-off score on market research, third-party data, and other sources, but must calculate their own score within one year. Rule § 640.3(b)(1)(iii)(B)
If you use the 60/40 credit score proxy method, you must give a notice to people for whom no credit score is available. Rule § 640.3(b)(1)(iv)
Whether you are a new or established creditor, if you give the best credit terms to more than 40 percent of people, you may set your cut-off score based on the approximate percentage of people to whom you haven’t granted credit on the most favorable terms.
- Tiered Pricing with Four or Fewer Levels. If you offer credit at four or fewer levels, you must give a risk-based pricing notice to every consumer who doesn’t qualify for the top tier of pricing. For example, if a company offers credit with APRs of 8 percent, 10 percent, 12 percent, and 14 percent, and selects the APR based on a consumer’s credit information, all consumers granted credit at 10 percent, 12 percent, or 14 percent must get a notice. Rule § 640.3(b)(2)(ii)
- Tiered Pricing with Five or More Levels. If you offer credit at five or more pricing levels, you must give a notice to all consumers, except those in the top two tiers of pricing and any other tiers that make up more than 30 percent but less than 40 percent of the total tiers. Rule § 640.3(b)(2)(iii)
Here are some examples:
| Number of Tiers | % per Tier | Top Tiers (up to 40% of tiers): No Notification |
Bottom Tiers: Must Be Notified |
|---|---|---|---|
| 5 | 20% |
Top 2 tiers = 40% |
3-5 All consumers but those in the top two tiers must get the notice. |
| 6 | 16.7% |
Top 2 tiers = 33.3% |
3-6 All consumers but those in the top two tiers must get the notice. |
| 7 | 14.2% |
Top 2 tiers = 28.4% |
3-7 In this example, the Top 3 tiers = 42.6%. Only consumers in tiers that make up less than 40% of the total are exempted from the notice. Because the top three tiers make up more than 40% of tiers, all consumers but those in the top two tiers must get the notice. |
| 8 | 12.5% |
Top 3 tiers = 37.5% |
4-8 All consumers but those in the top three tiers must get the notice. |
| 9 | 11.1% |
Top 3 tiers = 33.3% |
4-9 All consumers but those in the top three tiers must get the notice. |
- Price Raised During Account Review. Regardless of the prices charged to other customers, if you raise someone’s APR on credit already extended based on information in their report, you must send them a risk-based pricing notice. § 640.3(d)
Co-Signers
For transactions involving multiple consumers — say, a joint mortgage or co-signers for a loan — determining whether each consumer needs to be notified separately depends on several factors:
- if credit scores are used to set credit terms, you must give each consumer a risk-based pricing notice. The notice must have only that consumer’s credit score, not the score(s) of other applicant(s).
- if a credit score is not used and the consumers have different addresses, you must send separate notices to each consumer. If a credit score isn’t used and the consumers have the same address, you may send a joint notice. Rule § 640.6(c)
Separate notices are required under the circumstances described above whether you are using a regular risk-based pricing notice or the credit score disclosure exception.
When Should Consumers be Notified?
The timing for a risk-based pricing notice depends on the type of credit extended.
- For a closed-end credit plan, like a one-time transaction, notice must be given before the consumer becomes contractually obligated. 12 CFR § 226.2(a)(13) Notice cannot be given before the consumer is notified about the decision to extend credit. Rule § 640.4(c)(1)(i)
- For an open-end credit plan, where a person will make repeated charges, like using a credit card, notice must be given before the person makes the first transaction. Notice cannot be given before someone is notified about the decision to extend them credit. Rule § 640.4(c)(1)(ii) Where open-end credit is granted to finance the contemporaneous purchase of goods or services, like opening a store credit card at the cash register, notice must be given within 30 days after the decision to grant credit or when the first mailing goes out to the person after the credit-granting decisions has been made — whichever is earlier. Rule § 640.4(c)(3)
- For an account review that results in an increase in someone’s APR, notice must be given when the decision is made; or, to the extent the law permits you to raise someone’s interest rate without advance notice, no later than five days after the effective date of the rate change. Rule § 640.4(c)(1)(iii)
What Should the Notice Say?
A risk-based pricing notice must be clear and conspicuous. It can be oral, written, or electronic. Model forms are available; if you use them, you will have complied with the requirements regarding the contents of the notice. Rule § 640.4(b)
A risk-based pricing notice must tell the consumer:
- that a consumer report includes information about the consumer’s credit history and the type of information included in that history
- the terms offered were based on information from a consumer report
- the terms offered may be less favorable than those offered to consumers with better credit histories
- to make sure the information in their consumer report is accurate, and that they have the right to dispute information that’s inaccurate
- the identity of each CRA that furnished a consumer report used in the credit decision
- that federal law gives the consumer the right to a free copy of a consumer report from the CRA(s) identified in the notice for 60 days after the consumer got the notice;
- how to get a consumer report from the CRA with contact information (including a toll-free number, where applicable) for the CRA
- to visit the website of the Consumer Financial Protection Bureau for more information about consumer reports; Rule § 640.4(a)(1) 1
If you use credit scores, special requirements apply. If you get and use one credit score in your determination, you must include the information below. If you get two or more credit scores and use only one in your determination — for example, the low, middle, high, or most recent score — you must include the score used and the information below in your notice. If you get and use two or more credit scores — for example, if you average the scores — you must include at least one of the scores and the information below. You may include more than one of the scores you used, but you must include the information below for each score.
- that a credit score is a number based on information in a consumer report, that the consumer’s credit score was used to set the terms of credit offered, and that a credit score can change over time to reflect changes in the consumer’s credit history
- the credit score you used to make your credit decision
- the range of possible credit scores under the model used to generate the credit score
- four of the key factors that adversely affected the credit score; if one of the key factors was the number of inquiries to the consumer’s report, you must list five key factors
- the date the credit score was created
- the name of the CRA or person who provided the credit score
For a risk-based pricing notice following an account review, include all the relevant terms above except the statement that the terms offered may be less favorable than those offered to people with better credit histories, as well as statements that:
- an account review was conducted using information from a consumer report
- as a result of the review, the APR rate on the account increased. Rule § 640.4(a)(2)
Credit Score Disclosure Exception
You can satisfy the requirements of the Risk-Based Pricing Rule by giving a credit score notice to every consumer, regardless of the terms on which you granted them credit. The notice must include the person’s credit score and information about credit and credit scores. Rule § 640.5(e) Unlike other risk-based pricing notices, a credit score disclosure must be in writing and separate from other information; it also must be clear and conspicuous. Rule § 640.5(e)(2) You must send the notice as soon as practicable after you request the credit score from a CRA. Timing is outlined above in “When Should Consumers Be Notified?” Rule § 640.5(e)(3)
If you get two or more credit scores and use only one of them in your determination, like the low, middle, high, or most recent score, your notice must include the score you used and the information below. If you get and use two or more credit scores — say you average the scores — your notice must include at least one of the scores and the information below. You may include more than one of the scores you used, but you must include the information below for each score. Rule § 640.5(e)(4) If you don’t use a credit score to make your decision, you may buy a score and the required score distribution and other contextual information about that score from a source that regularly sells credit scores.
Special rules apply for mortgages and other extensions of credit secured by one to four units of residential real property. Consult Rule § 640.5(d) for more information.
If you choose this alternative, the credit score disclosure exception notice must tell the consumer:
- a consumer report (or credit report) is a record of the consumer's credit history and includes information about whether the consumer pays their obligations on time and how much they owe creditors
- a credit score is a number that is based on information in a consumer report and that it can change over time to reflect changes in the consumer's credit history
- their credit score can affect whether they can get credit and what the cost will be
- their current credit score or the most recent credit score that previously was calculated by the CRA to grant credit
- the range of possible credit scores under the model used to generate the credit score
- the distribution of credit scores among people under that scoring model presented as a bar graph of at least six bars showing the percentage of people with credit scores within the range of scores reflected in each bar (use of a graph or statement from the CRA that gave you the score is satisfactory)
- the date the credit score was created
- the name of the CRA or person who provided the credit score
- to verify the accuracy of the information in the consumer report and has the right to dispute inaccurate information in the report
- federal law gives them the right to get copies of their consumer reports directly from the CRAs, including a free report from each of the nationwide CRAs once during any 12-month period
- contact information for the central source — www.annualcreditreport.com — for free annual consumer reports
- they may visit the websites of the Consumer Financial Protection Bureau and Federal Trade Commission for more information about consumer reports
If you use the credit score disclosure exception notice, but a credit score isn’t available for a particular consumer from your usual CRA and you don’t get a credit score from another CRA, you must provide a notice that tells the consumer:
- a consumer report (or credit report) includes information about the consumer's credit history and the type of information included in that history
- a credit score is a number that is based on information in a consumer report and that a credit score can change over time in response to changes in the consumer's credit history
- credit scores are important because people with higher credit scores generally get more favorable credit terms
- not having a credit score can affect whether they can get credit and what the cost will be
- their credit score was not available from a CRA — which you must identify by name — generally due to insufficient information about the person's credit history
- to verify the accuracy of the information in their consumer report and has the right to dispute inaccurate information
- federal law gives them the right to get copies of his or her consumer reports directly from the CRAs, including a free consumer report from each of the nationwide CRAs once during any 12-month period
- contact information for the central source — www.annualcreditreport.com — for free annual consumer reports
- they may visit the website of the Consumer Financial Protection Bureau for more information about consumer reports
Rule § 640.5(f)
Who Should Provide Risk-Based Pricing Notices?
In general, you must provide a risk-based pricing notice if you use a consumer report in connection with an application for — or grant of credit for — personal, family, or household purposes to someone on less favorable terms than you grant to others. (See “Who Must Be Notified?”) Rule § 640.1(a) Consumers are entitled to only one notice per transaction; they are entitled to another notice only if the APR increases during an account review. Rule § 640.6(a)
Where a credit contract is assigned or sold, the consumer still gets only one notice; the assignee or buyer isn’t required to send another notice. For example, if an initial creditor extends credit to a consumer and then immediately sells the credit contract, the initial creditor must give the notice, not the creditor who bought the contract. Rule § 640.6(b) One caveat: Special rules for some auto sales transactions allow the dealer, rather than the creditor, to provide notice; see Rule § 640.4(c)(2) for more information.
OTHER USES OF CONSUMER REPORTS
If you use consumer reports to make employment, insurance, or housing decisions, you have different obligations. For more information, read:
- Using Consumer Reports: What Employers Need to Know
- Consumer Reports: What Insurers Need to Know
- Consumer Reports: What Landlords Need to Know.
For information about all your obligations as a user of consumer reports, read FCRA Appendix C to Part 601—Prescribed Notice of User Responsibilities.
THE COST OF NON-COMPLIANCE
If you don’t comply with the FCRA and the Risk-Based Pricing Rule, you may be sued by the Federal Trade Commission, Consumer Financial Protection Bureau, state governments, or in some cases, consumers. The FCRA provides for maximum penalties of $4,857 per violation in the case of lawsuits brought by the FTC. FCRA §§ 616, 617, 621
_______________
1 Certain auto dealers should tell the consumer to visit the website of the Federal Trade Commission, not the Consumer Financial Protection Bureau for more information about consumer reports. Refer to Section 1029 of the Dodd-Frank Act, 12 U.S.C. § 5519, for more information on auto dealers under the FTC's jurisdiction.
Your Opportunity to Comment
The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal compliance and enforcement activities. Each year, the Ombudsman evaluates the conduct of these activities and rates each agency’s responsiveness to small businesses. Small businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.
The FTC works for the consumer to prevent fraudulent, deceptive, and unfair practices in the marketplace and to provide information to businesses to help them comply with the law. For free information, visit the BCP Business Center, business.ftc.gov. To file a complaint, visit ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. Watch a video, How to File a Complaint, to learn more. The FTC enters consumer complaints into the Consumer Sentinel Network, a secure online database and investigative tool used by hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.
[Note: Edited January 2024 to reflect Inflation-Adjusted Civil Penalty Maximums.]