by Leonard A. Bellavia, Esq.

The Fair Credit Reporting Act (“FCRA”) restricts a business’s ability to obtain, use, and share credit reports.  In addition to these restrictions, FCRA requires businesses to provide certain notices to consumers applying for credit.  Generally, companies should only obtain credit reports from consumers when they have express permission to do so.  Issues arise when consumers make inquiries about obtaining financing when they are not physically present at the place of business.  In these cases, it is imperative that the company has processes in place to obtain consumers’ written consent or otherwise show they have permission to obtain credit reports on behalf of consumers.  Otherwise, consumers may claim the company violated FCRA by accessing their credit reports without prior consent.

You will need to determine whether your company will accept credit applications from consumers that are not physically present at the place of business.  There are inherent risks associated with accessing credit reports when the applicant is not on the premises that you will need to balance with business considerations such as customer expectations, convenience, and pressure from competitors.  If you choose to accept credit applications and obtain credit reports for consumers prior to them visiting your place of business, you will need to consider implementing the following safeguards in order to stay complaint with FCRA.  For inquiries initiated over the internet, make sure your website requires credit applicants provide “digital authorization,” such as a box applicants check signifying they consent to the dealership accessing their credit reports.  Also, you should only accept credit applications that applicants submit through an encrypted system, such as a form on your website, and not unencrypted media such as email.  If the applicant submits an inquiry over the telephone, you should consider asking the applicant to make an inquiry over a secured, encrypted, media such as your website.  If the applicant is unable to do so, your staff should note on the credit application the date and time they received the application and ask the applicant to send a facsimile authorizing your company to access their credit report.

Once the applicant visits your offices, you should have him or her complete a credit application, sign it, and retain a copy in the applicant’s file.  You are required to provide adverse action notices or credit score disclosures regardless of whether the consumer initiated a credit inquiry at your business or remotely, and your processes regarding credit applications submitted by telephone or the internet should incorporate your company’s Red Flags Rule and Safeguards Rule compliance programs.

To ensure that your company’s credit application policies and procedures are FCRA compliant, please call us at 516-873-3000.