1. The FCRA, ECOA and the
Consumer Financial Protection Bureau:
Two Areas of Ambiguity the Bureau May Address
Presented by
Joshua A. del Castillo & Kenyon D. Harbison
for
Financial Institutions Committee
Business Law Section
State Bar of California
January 8, 2013

2. Presentation Preview 1
• The Fair Credit Reporting Act
• The Transfer Authority From the FTC to the CFPB
• How the CFPB is Stepping Up Enforcement
• Two Case Studies in Ambiguity: Potential Issues the CFPB Might Resolve
• FCRA Adverse Action Notices and Commercial Transactions
• Adverse Action Notices to Guarantors
• The Equal Credit Opportunity Act
• Notices to Guarantors under the FCRA and ECOA
• Conclusions

3. 2
The Fair Credit Reporting Act

4. 3
Used with permission of the artist. All rights reserved.

5. Review of the FCRA’s Broad Coverage 4
• The FCRA covers the popular conception of “credit reports.”
• But the focus of the FCRA is more broadly on consumer reports information of many
types and as used for many purposes:
o Insurance
o E.g., a report obtained from a credit bureau during a claims proceeding.
o Employment
o E.g., an employment history reports, including a listing of accidents.
o Other business transactions, such as:
o rental transactions and tenant histories;
o medical records or payments;
o insurance claims;
o check-writing history.

6. Key Abbreviated Definitions 5
• Consumer: an individual.
• Person: an individual, partnership, corporation, etc.
• Consumer reporting agency (“CRA”): any person who, for profit or not, regularly
assembles or evaluates consumer credit or other information to furnish it to third parties.
• Note: may be implied, no federal registration or licensing required.
• Consumer report: any communication by a CRA about a consumer’s creditworthiness,
character or reputation, used or expected to be used even in part to establish eligibility for:
• credit or insurance to be used primarily for personal, family or household purposes;
• employment purposes; or
• other permissible purposes such as court subpoenas, to determine government benefit
eligibility, existing credit obligations, or as otherwise directed by a consumer.

7. Distinction: Not a Consumer Report 6
• The following examples are not consumer reports:
• Aggregated/blind data;
• Mere ID data;
• Data not from a CRA;
• Data not intended to be used for an FCRA permissible purpose (e.g., law enforcement).
• Also statutorily excluded under FCRA 603(d)(2)(A):
• Transaction and experience information solely about the consumer/reporter interaction;
• Such communications as between affiliated companies;
• What would otherwise be a consumer report, which is shared as between affiliated
companies after a notice and opportunity to opt out;
• Other statutory exclusions:
• Point of sale credit approvals (FCRA 603(d)(2)(3));
• Employment agency communications after a consumer opt out (FCRA 603(o)).
• Note: May still be regulated information under the Gramm-Leach-Bliley Act (“GLBA”).

8. Key Benefits / Duties of the FCRA 7
Consumer Reporting Agency Duties:
• Protect data (identity theft);
Consumer Benefits:
• Prevent uses for impermissible purposes;
• Ease access to credit data;
• Maintain accurate data;
• Ease ability to correct/dispute data.
• Investigate disputes;
• Report only prescribed data.
User Duties:
• Use for permissible purposes only;
• Notify consumers of adverse decisions.
Furnisher Duties:
• Provide accurate data;
• Investigate disputes.

9. Consumer Reporting Agency Duties 8
• Most sections in the FCRA relate to the duties of CRAs.
• “Gatekeeper” relating to use of consumer report info for permissible purposes.
• Exclusion of info from consumer reports (e.g., paid tax liens > seven years old).
• Help prevent and remedy identity theft (some req’s apply to Nationwide CRA’s only).
• Disclosures to consumers on request, including free annual disclosures.
• Initial point of contact for most consumer disputes, and related reinvestigations; must
notify the information furnisher of the dispute and relevant information within 5 days.
• Restrictions on employment reports/information, and on investigative reports.
• Criminal penalties for employees who make unauthorized disclosures.
• Disclosures to the government for counterintelligence and anti-terrorism purposes.

10. Duties of “Users” of Consumer Reports 9
• The sections relating to users nevertheless contain many rules, some of which are:
• Permissible Purposes: concurrent duty only to obtain and use for such a purpose,
including certification to the CRA.
• Restrictions on the manner and circumstances in which “prescreened” offers based on
consumer reports may be made to consumers.
• Requirements relating to notices a user must give a consumer when it takes “adverse
action” based on a consumer report, including credit score and key decision factors.
• Special rules for employment/investigative consumer reports exist, including consent,
and notification to a consumer before taking adverse action.
• ID Theft Rules: “Red Flag” rule to spot potential ID theft, “reasonable” belief in ID
before granting credit if a fraud alert is in place, and policies to know the ID.

11. Duties of Furnishers of Information to CRAs 10
• No private right of action for most violations, such as.
• Duty to provide accurate information, may not furnish if “reasonable cause”
exists to believe it is inaccurate;
• Duty to correct and update;
• Duty to not furnish information resulting from ID theft to a CRA;
• Duty to respond to direct disputes from a consumer;
• Duty to provide notice to consumer when negative information is furnished;
• Duty to investigate disputed information when notified by a CRA of a dispute and to
respond to a CRA in time for the CRA to respond to a disputing consumer.
• “Reasonableness” has been required by courts, including the Fourth Circuit.

12. Enforcement of the FCRA 11
CFPB Enforcement of this and other consumer financial law statutes:
• $5,000 per day penalties for negligent violations;
• $25,000 per day for reckless violations;
• Up to $1 million per day penalties for “knowing” violations.
FTC Enforcement:
• $2,500 per violation for knowing violations that are part of a pattern or practice.
State Enforcement:
• $1,000 for negligent or willful violations, per violation.
Private Right of Action:
• Not as to all aspects of the FCRA (e.g., user adverse action, most furnisher duties);
• Negligent violations: actual damages, attorneys fees;
• Willful violations: no need to prove actual damages; statutory damages of $100 to
$1,000 per transaction, punitive damages, attorneys’ fees

13. 12
The Transfer of Regulatory and Some Enforcement
Authority From the FTC to the CFPB

14. The Process of Empowerment for the CFPB 13
• July 21, 2010 – Dodd-Frank Wall Street Reform and Consumer Protection Act
created the Consumer Financial Protection Bureau (“CFPB”), in a portion of Dodd-
Frank called the “Consumer Financial Protection Act,” (12 USC 5481 et seq.).
• The CFPB was given broad regulatory and enforcement authority relating to many
federal consumer financial protection laws, including all sections of the FCRA except
Section 615(e) (red flags rules for users) and Section 628 (disposal of records).
• In July 2011 the FTC rescinded its previous commentary on the FCRA and in its
place published a “Staff Report” that kept much of it, but also made changes.
• In January 2012 the CFPB entered into a Memorandum of Understanding with the
FTC relating to the FTC’s parallel enforcement of certain acts, including the FCRA.

15. 14
The CFPB is Stepping Up Enforcement

16. The CFPB Has Reformulated and
15
Republished Regulations B & V
• On December 21, 2011 the CFPB restated, and on December 30, 2011 the CFPB
republished the FRB’s FCRA “Regulation V” as 12 CFR 1022.1 et seq.
• (It also republished ECOA regulation B.)
• Per the CFPB, the new regulation “substantially duplicates the…regulations
promulgated…by the Board, the FDIC, the FTC, the NCUA, the OCC, and the OTS.”

17. Participated in Amicus Briefing on the
16
Constitutionality of a Provision of the FCRA
• The CFPB is formally committed to filing amicus briefs even in private cases involving
federal consumer financial protection laws, and so far has filed at least six.
• This summer it participated in an amicus brief relating to the constitutionality of an
FCRA provision relating to how long criminal records can remain in a consumer report.

18. First Legal Enforcement Action Filed 17
• On July 18, 2012 the CFPB filed its first actual legal enforcement action, relating to a
California law firm that offered mortgage assistance relief services to consumers.

19. Major Settlement with American Express 18
• On October 1, 2012 without filing an actual lawsuit, the CFPB entered into a major
consent decree with various American Express entities, including banking entities, to:
• Pay $85 million to 250,000 consumers in restitution for violations of various
statutes, including the FCRA;
• Pay $27.5 million in civil penalties to the CFPB.
• Violations Related To:
• Deceiving consumers into thinking they were getting reward points;
• Charging unlawful late fees;
• Age-based discrimination relating to new account applicants (ECOA violation);
• Failing to report consumer disputes to CRAs (FCRA violation);
• Misleading consumers into believing paying old debt first would improve scores.

20. CFPB Now Producing
19
Examination Standards
• September 2012: the CFPB issued its examination procedures for non-depository
institutions that are “larger participants.”
• Permits supervision of co’s w/annual gross of > $7mil from consumer reporting:
i.e., the Nationwide Consumer Reporting Agencies, Transunion, etc.
• October 24, 2012: the CFPB published its debt collection examination procedures,
including significant reference to overlap between the FCRA and the FDCPA.
• October 31, 2012: the CFPB published version 2 of its Supervision and Examination
Manual, including extensive commentary on examination for FCRA compliance.
• December 17, 2012: the CFPB published its education loan examination procedures,
including reference to and overlap with the FCRA.

21. Bulletins Regarding Compliance 20
• November 29, 2012: CFPB issued a bulletin warning that nationwide consumer reporting
agencies must comply immediately with the annual disclosure provisions of the FCRA.
• NCRAs:
• Transunion
• Experian
• Equifax

22. New Report on Credit Reporting System 21
• In December 2012 the CFPB published a new report titled “Key Dimensions and
Processes in the U.S. Credit Reporting System.”
• CFPB initial focus with regard to the FCRA is on consumer reporting agencies.
• Examples:
• e-OSCAR system by which NCRAs report disputes to fu
•nishers does not have mechanism for transmitting supporting documents, which
is an FCRA violation;
• Previous slide about non-compliance w/free annual report requirements.
• The “Key Dimensions” report promises to be the basis of increased future regulatory
action, and a precursor to a greater focus on users and furnishers, including banks.

23. The CFPB’s Deadline to Update FCRA-
22
Required Forms has Arrived
• Pursuant to regulations promulgated by the CFPB last year, January 1, 2013 was the
deadline to revise FCRA notices to reflect the enhanced role of the CFPB.
• Pertains to the following required FCRA notices:
• Summary of Consumer Rights
• Notice of Furnisher Responsibilities
• Notice to Users of Consumer Reports of Their Obligations Under the FCRA

24. 23
Two Case Studies in Ambiguity:
Potential Issues the CFPB Might Resolve

25. 24
Case Study One:
Adverse Actions and Commercial Transactions

26. 25
Used with permission of the artist. All rights reserved.

27. What is an Adverse Action? (The FCRA’s
26
ECOA Cross-Referenced Definition)
• "Adverse Action" is defined in the FCRA by reference to the Equal Credit Opportunity Act
(“ECOA”) (of which more in a few minutes), as a:
• “[D]enial or revocation of credit, a change in the terms of [existing credit]…or a refusal
to grant credit in substantially the amount or on substantially the terms requested."
• And also pursuant to terms in the FCRA, as:
• An adverse action in connection with insurance (e.g., denial, cancellation, or change in
terms of coverage), employment (e.g., denial), and licenses (e.g., charge increase); and
• (Catch-all): An action taken or determination made re: an application made by, or a
transaction that was initiated by, a Consumer and adverse to the interests of the Consumer.
• Note: the additional terms means the FCRA definition is arguably broader than ECOA’s.

28. Adverse Action Notices Under the FCRA 27
• Purpose: Provide applicants with notice of the adverse action, along with info
relating to the CRA that provided the Report, and info relating to the consumer's credit
score (if applicable) and rights to obtain and dispute credit information.
• Required: Only where creditor takes any adverse action with respect to a consumer
"based in whole or in part" on information contained within a consumer report.
• Form: No specific form of adverse action notice is prescribed by the FCRA, but
Section 615(a) requires notice of:
• the adverse action;
• any credit score or range of scores used, the date the score was provided, who
provided it, and key factors adversely affecting it;
• the CRA’s contact information and a statement it did not make the decision;
• notice of the right to obtain a free credit report from the applicable CRA;
• notice of the right to dispute the accuracy of the consumer report.

29. Case Study: What about commercial
28
transactions under the FCRA?
• Open Issue: One of the longstanding issues under the FCRA is whether a credit report
obtained on an individual obtained in connection with a commercial transaction is a
“consumer report” thereby bringing the transaction within the ambit of the statute, for the
purposes of the adverse action notice requirement.
• I.e., an individual’s credit/consumer information is evaluated in connection with a
business transaction (sole proprietorship, guarantors, etc.).
• Note: This question presumes the applicant is in fact an individual consumer and not a
corporation or other business entity, to which the FCRA plainly does not apply.

30. View One: Consumer Reports May Not Be
29
Delivered in Commercial Transactions
• FCRA does not apply to transactions where no individual credit is evaluated.
• Some case law, much of it developed in the context of loan origination, suggests that the
FCRA does not apply to a consumer report on an individual obtained in any way in
connection with a commercial transaction.
• These cases generally take position that FCRA was not intended to regulate reports in
commercial transactions, and that only credit transaction in which a Consumer Report (as
defined by statute) can exist is for personal, family, or household expenses.
• The FTC’s 1990 Commentary also took this position at pages 562 and 567.

31. View Two: Consumer Reports May Be
30
Delivered in Commercial Transactions
• Contrary case law looks to the purpose for which credit information was collected (e.g.
for inclusion in a consumer report), not the purpose for which it is ultimately used.
• These cases typically do not address the context of loan origination; instead developed
from cases where use of a Consumer Report was used for impermissible purpose, often a
circumstance involving improper conduct.

32. Before the CFPB, the Latter Line of Cases
31
Had Received Regulatory Endorsement
• View Two Endorsed: This line of cases recently received regulatory endorsement from
FTC, which rescinded it 1990 Commentary to the contrary effective July 26, 2011.
• Separately, the July 2011 FTC staff report states that "a report from a CRA on the
personal credit of a consumer to a business credit grantor is a 'consumer report'
regardless of the purpose for which the information may in fact be used."
• So far nothing has changed with the CFPB:
• In implementing the new Regulation V, the CFPB indicated it was not making
changes at that time.
• However, there is also no indication the CFPB has officially adopted the staff
commentary of the FTC, and the National Consumer Law Center was advocating as
recently as June 2012 that it do so.

33. 32
Case Study Two:
ECOA, Commercial Transactions, and
Adverse Action Notices to Guarantors

34. What is ECOA? 33
• The Equal Credit Opportunity Act, enacted in 1974, is another federal consumer
financial statute.
• Explicitly and primarily creditor-focused, unlike the FCRA.
• Under ECOA it is unlawful for any creditor to discriminate against any applicant,
with respect to any aspect of a credit transaction, on the basis of:
• race;
• color;
• religion;
• national origin;
• sex, marital status;
• or age (provided the applicant has the capacity to contract).

35. Adverse Action Notices Under ECOA 34
• Required: In any transaction where adverse action is taken, regardless of whether a
consumer report is provided and reviewed.
• Each "applicant against whom adverse action is taken" is entitled to statement as
to reasons for action.
• Applicant: “[A]ny person who requests or who has received an extension of credit
from a creditor, and includes any person who is or may become contractually liable
regarding an extension of credit.“
• Form: No form of Adverse Action Notice is prescribed (with the exception of
standard ECOA disclaimer). However, the FRB has created combined ECOA and
FCRA adverse action notice forms which may be used, at least where personal credit is
concerned, as a form of "safe harbor.“ The CFPB has kept these forms.

36. ECOA Applies to Commercial Transactions 35
• Applicability: ECOA applies both to consumer and to business transactions for which an
application (absent any credit or other consumer report) has been submitted to the creditor.
• Timing of Adverse Action Notices:
• For business applicants w/ ≤ $1 million in gross revenues, with exceptions, a creditor
may provide oral/written notice within the timeframe applicable to consumer applicants.
• For business applicants w/ > $1 million in gross revenues, the creditor may comply with
the above rule, or within a “reasonable time.”
• Two Problems:
• Are relaxed reqs for larger businesses truly applicable? Imagine a $15 million property
secured by a $10 million loan to a single asset entity, but ≤ $1 million in gross revenues.
• Which party's revenue should be examined? “Borrower" may not be established until
time of closing (e.g., LBO, real estate transaction w/holding company or an SAE). Who
is the "applicant"? The sponsor? Consider the definition of "applicant" under ECOA.

37. ECOA, FCRA, and Guarantors 36
• ECOA and Guarantors: The general rule under ECOA is guarantors are not “applicants”
for commercial credit, and, therefore, are not entitled to adverse action notices.
• The Seventh Circuit has ruled any other interpretation would make no sense.
• However, some courts have held or implied otherwise.
• An old FTC staff letter confirms the common-sense and Seventh Circuit view, but
ambiguity nevertheless remains.
• This letter was actually written in the context of an inquiry w/regard to the
FCRA, which incorporates the ECOA definition of adverse action, making this
issue more generally applicable to both statutes.
• Note: The CFPB has not yet spoken on this issue either.

38. Conclusions 37
• There is no indication of fundamental change coming from the CFPB thus far, including
as to adverse action notices in commercial transactions, and with regard to guarantors.
• There are indications that CFPB rulemaking and commentary may result in changes in
statutory interpretation and application. CFPB has not kicked into “4th gear” yet.
• Ongoing Sources of Authority in Order of Persuasion:
• Statute (as amended five times from 1970 to 2010);
• Rulemaking: the CFPB’s revised Regulations B & V;
• Existing case law relating to the FCRA and ECOA;
• Federal Trade Commission Materials;
• 2011 Staff Report on FCRA: Replaced the Official Commentary;
• Existing FTC staff opinion letters re: FCRA and ECOA;
• Records of enforcement actions;
• New guidance by the CFPB to the extent it exists;
• Existing custom/practice.

39. Bio: Joshua A. del Castillo
• Joshua A. del Castillo is senior counsel in Allen Matkins’ Los
Joshua A. del Castillo
Los Angeles Office Angeles office, and practices in the firm's Bankruptcy &
Creditors’ Rights, Litigation, and Banking and Financial
Phone: 213.955.5591 Institutions groups.
Facsimile: 213.620.8816 • Joshua serves as the lead attorney for Allen Matkins’
jdelcastillo@allenmatkins.com Consumer Finance and Regulatory Compliance sub-group. In
this capacity, he regularly defends institutional lenders and
other creditors in consumer finance and regulatory
compliance litigation, including in Fair Credit Reporting Act,
Real Estate Settlement Procedures Act, Truth in Lending Act,
Focus and other federal and state consumer finance litigation. In
Bankruptcy and Creditors’ Rights addition, he provides specific regulatory compliance advice in
the non-litigation context regarding a variety of federal and
Litigation state consumer finance matters, an area of increased focus in
Banking and Financial Institutions the wake of the enactment of the Dodd-Frank Wall Street
Reform and Consumer Protection Act.
Education
J.D., University of Southern California
M.A., University of Michigan
B.A., University of Southern California

40. Bio: Kenyon D. Harbison
• Kenyon Harbison practices in the areas of real estate,
Kenyon D. Harbison insurance, and general litigation, including litigation in
Los Angeles Office bankruptcy courts. He has worked in all phases of litigation,
including appeal in state, federal, and federal bankruptcy
Phone: 213.955.5661 court proceedings. His cases have involved commercial lease
Facsimile: 213.620.8816 disputes, insurance recovery, soil contamination, construction
kharbison@allenmatkins.com defect litigation, and partnership disputes.
• Kenyon also serves as a leading attorney for Allen Matkins’
Consumer Finance and Regulatory Compliance sub-group. In
this capacity, he defends institutional lenders and other
creditors in consumer finance and regulatory compliance
Focus litigation, including in Fair Credit Reporting Act, Real Estate
Settlement Procedures Act, Truth in Lending Act, and other
Litigation federal and state consumer finance litigation. In addition, he
Banking and Financial Institutions provides specific regulatory compliance advice in the non-
Construction litigation context regarding a variety of federal and state
consumer finance matters, an area of increased focus in the
wake of the enactment of the Dodd-Frank Wall Street Reform
and Consumer Protection Act.
Education • At UCLA School of Law, Kenyon was a staff member and a
J.D., University of California, Los Angeles managing editor of the UCLA Law Review, was a student
instructor of legal writing, and was made a member of The
B.A., Yale University Order of the Coif. He also served as a research assistant to
Professor Joanna Schwartz and he externed for the Honorable
Paul Boland of the California Court of Appeal, Second District.
After practicing law at Allen Matkins for nearly a year, Kenyon
took a leave of absence and clerked for the Honorable
Florence-Marie Cooper of the U.S. District Court, Central
District of California, after which he returned to Allen Matkins.