Federal Reserve And FTC Publish Final Credit Score Disclosure Rules

The Dodd-Frank Act amends the Fair Credit Reporting Act (FCRA) to require companies that use credit scores to include those scores, and related information, in adverse action and Risk-Based Pricing Notices provided to consumers. This morning, the Federal Reserve Board (FRB) and Federal Trade Commission (FTC) published final rules to implement these provisions. Highlights of the rules include: (a) no proposed changes to the "Credit Score Exception Notices" under the Risk-Based Pricing Rule—meaning that lenders may continue to use existing notices following the effective date of the new requirements; (b) new credit score disclosure language for the Regulation B sample adverse action notices which will require the disclosure of up to nine reason codes; and (c) a variety of interpretations of the FCRA, including guidance on when adverse action notices are required under the FCRA and interpretations of the definition of "credit score." Compliance with the new adverse action notification provisions is required by July 21, 2011, and compliance with the revised Risk-Based Pricing notification provisions is required by August 15, 2011.

Background to the Final Rules

Section 1100F of the Dodd-Frank Act amended section 615 of the FCRA to add credit score disclosure obligations in connection with adverse action and Risk-Based Pricing Notices. " New Disclosure Requirements for Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports. The FCRA requires a person who takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report to provide certain information to the consumer. Section 1100F amended this section of the FCRA to add a new requirement that the person "provide to the consumer written or electronic disclosure (A) of a numerical credit score as defined in section 609(f)(2)(A) [of the FCRA] used by such person in taking any adverse action based in whole or in part on any information in a consumer report; and (B) of the information set forth in subparagraphs (B) through (E) of section 609(f)(1)." Consequently, section 1100F amended the FCRA to require new disclosures by users of consumer reports. Specifically, when a user takes any adverse action based in whole or in part on information contained in a consumer report, the user must provide to the consumer:

• a "numerical credit score ... used ... in taking any adverse action";
• the range of possible credit scores under the model used;
• the factors that adversely affected the credit score of the consumer, which should be ranked in the order of their importance and should not exceed four factors—unless the number of credit inquiries is a factor and is not already reflected in the top four, in which case, five factors should be disclosed (i.e., the top four, plus inquiries);
• the date on which the credit score was created; and
• the name of the person or entity that provided the credit score or credit file upon which the credit score was based.

The content of this disclosure is similar to what is currently required under the FCRA in connection with certain mortgage loan applications. See FCRA § 609(g) (requiring mortgage lenders to provide borrowers with a "Notice to Home Loan Applicant" that includes a credit score and the key factors contributing to that score).

• Risk-Based Pricing Notices. The "Risk-Based Pricing" provisions in FCRA section 615(h) require users who, based on a consumer report, grant, extend, or provide credit on material terms that are materially less favorable than the most favorable terms available to a substantial portion of consumers from or through that person to provide certain disclosures to consumers. Such users will be required, in addition to other notice requirements required by FCRA section 615(h)(5), to include a statement in the notice informing the consumer of: "(i) a numerical credit score as defined in section 609(f)(2)(A), used by such person in making the credit decision described in paragraph (1) based in whole or in part on any information in a consumer report; and (ii) the information set forth in subparagraphs (B) through (E) of section 609(f)(1)."
  
  

  Last year, the FRB and FTC issued a rule implementing the Risk-Based Pricing provisions of FCRA section 615(h), that became effective January 1, 2011. See 75 Fed. Reg. 2,724 (Jan. 15, 2010) (final rulemaking notice). The Risk-Based Pricing Rule requires lenders to provide Risk-Based Pricing Notices to borrowers, requires specific content to be provided in these notices and also provides model forms that lenders can use as a "safe harbor." See 16 C.F.R. § 640.4 (content of notices); 16 C.F.R. pt. 640, App. (model forms).

• Effective Date. Section 1100F will be effective on the Designated Transfer Date, July 21, 2011.

In March, the FRB and FTC published two separate notices of proposed rulemaking. In the first of the notices, the FRB proposed to amend its sample adverse action notices under Regulation B to provide for the additional disclosure of credit scores and supporting information as required by section 1100F. In the second notice, the FRB and FTC together proposed to amend the Risk-Based Pricing Rule to allow the additional content required by section 1100F.

The Final Rules

This morning, the FRB and FTC published in the Federal Register final rulemaking notices that were substantially similar to the proposed rules, but that also included several important interpretations of the FCRA adverse action notification requirements and the definition of "credit score." See http://www.gpo.gov/fdsys/pkg/FR-2011-07- 15/pdf/2011-17585.pdf (Regulation B notice); http://www.gpo.gov/fdsys/pkg/FR-2011-07-15/pdf/2011-17649.pdf (FCRA notice).

• Amendments to the Regulation B Sample Adverse Action Notices. The FRB has amended the sample adverse action notices under Regulation B to add the following language:

We also obtained your credit score from this consumer reporting agency and used it in making our credit decision. Your credit score is a number that reflects the information in your consumer report. Your credit score can change, depending on how the information in your consumer report changes.

The contact information regarding the entity that provided the score is optional. For example, if the entity providing the score is also the consumer reporting agency that provided the consumer report on which the adverse action is based, this disclosure would not be necessary. The FRB notes in the preamble to the Final Rule that, where the lender obtains consumer reports from multiple consumer reporting agencies and provides contact information for all of those consumer reporting agencies, but only discloses one score to the consumer, the lender must specifically include the name of the consumer reporting agency that provided the score — i.e., it is not enough to state that "we also obtained your credit score from this consumer reporting agency" if you are disclosing a score from only one of the consumer reporting agencies that provided you with a consumer report.

In addition, the FRB has amended its Official Staff Commentary under Regulation B to add the following language:

The FCRA also requires a creditor to disclose, as applicable, a credit score it used in taking adverse action along with related information, including up to four key factors that adversely affected the consumer's credit score (or up to five factors if the number of inquiries made with respect to that consumer report is a key factor). Disclosing the key factors that adversely affected the consumer's credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit.

This Commentary means that lenders may have to disclose up to nine (9) separate reason codes in their adverse action notices, to comply with the ECOA requirement that they disclose the four principal reasons for taking adverse action, as well as the FCRA requirement that they disclose the up-to-five factors that adversely affected the credit score.

• Compliance Date for Adverse Action Revisions. The FRB's Regulation B revision becomes effective on August 15, 30 days after its publication in the Federal Register FCRA, but the FRB indicates that, as a practical matter, the adverse action credit score disclosure provisions are "self-effectuating and will become legally effective on July 21, 2011, even if there are no implementing rules or model forms."

• Amendments to the Risk-Based Pricing Rule. The FRB and FTC have amended the Risk-Based Pricing Rule to provide for the inclusion of credit scores and related information in a Risk-Based Pricing Notice.

Essentially the Agencies added two new model form notices to the Rule: one to be used in connection with credit applications and the other to be used in connection with the review of existing accounts.

Importantly, the Agencies have not modified the existing model forms. This means that the model credit score exception notices may continue to be used, in their existing form, following the effective date of the new credit score disclosure requirement. The Agencies noted that "eliminating the credit score disclosure exception notice would fundamentally change the structure of the risk-based pricing rules and may substantially affect compliance costs." The Agencies believed that substantial changes to the Risk-Based Pricing Rule were not appropriate, "[g]iven that rulemaking authority will be transferred to the [Consumer Financial Protection Bureau] on July 21, 2011."

Lenders who have chosen to comply with the Risk-Based Pricing Rule by sending credit score exception notices do not need to change their current practices or notices in response to this rulemaking.

• Compliance Date for Risk-Based Pricing Revisions. The FTC and FRB indicate that compliance with the revised Risk-Based Pricing Rule will be required on August 15, 2011. See 76 Fed. Reg. 41,602, 41,611 (July 15, 2011).

Key Interpretations

The FRB and FTC included several interpretations of the FCRA in their rulemaking notices in response to comments made by the public.

Risk-Based Pricing Rule Interpretations

Because the Agencies have authority to administer the Risk-Based Pricing Rule—at least until responsibility for the FCRA transfers to the Consumer Financial Protection Bureau (CFPB) on July 21, 2011—the interpretations contained in the Supplementary Information for the Final Risk-Based Pricing Rule should be accorded deference by a court or another regulator.

• Definition of "Credit Score." The Agencies make clear that a score that is not used to predict creditworthiness is not a "credit score" and need not be disclosed: "scores not used to predict the likelihood of certain credit behaviors, however, such as insurance scores or scores used to predict the likelihood of false identity, are not credit scores by definition, and thus are not required to be disclosed."

• "Use" of a Credit Score. The Agencies stated that a score must be disclosed only if it is "used" in the pricing decision, but that use "use" is fairly low bar—essentially if the score played any role in the decision, it must be disclosed: "a creditor that obtains a credit score and engages in risk-based pricing would need to disclose that score, unless the credit score played no role in setting the material terms of credit."

• Multiple Credit Scores. The Agencies clarified again, however, that, where many scores are used, only one score need be disclosed: "[S]ection 1100F of the Dodd-Frank Act only requires a person to disclose a single credit score that is used by the person in making the credit decision."

• Multiple Consumers. The Agencies addressed again the issues relating to notices to be provided to multiple consumers. First, they reiterated that "[a] creditor ... must provide a risk-based pricing notice to all co-applicants, and not only to the applicant whose credit score was used in setting the material terms of credit."

• Separate Disclosures. In addition, they stated that separate credit score disclosure notices must be provided to each applicant for privacy reasons, but recognized "that creditors may not be able to prevent co-applicants from accessing each other's risk-based pricing notices." This seems to be an acknowledgment by the Agencies that, while lenders should separate the notices provided to joint borrowers, it would be very difficult to ensure that co-borrowers do not actually view each other's notices. (Interestingly, the Agencies stated that they "do not believe co-applicants necessarily choose, merely by applying for credit together, to share sensitive information with one another." This seems to contradict earlier statements by the FRB in the Regulation B context to the effect that "[w]hen a person agrees to be a co-applicant, guarantor, or similar party, however, there is (or should be) a general understanding that information will be shared." 68 Fed. Reg. 13,144, 13,151 (Mar. 18, 2003).)

• No Credit Score. The Agencies clarify that there is no obligation to disclose a credit score to a consumer who has no credit score: "The creditor cannot and is not required to disclose credit score information if an applicant has no credit score." Note, however, that those lenders who are complying with the Risk- Based Pricing Rule by providing credit score disclosure exception notices to all applicants must provide a "No Score Available Notice" (existing Model Form B-5) to all applicants for whom the lender cannot obtain a credit score.

• Stapling Credit Score Information to the Current Risk-Based Pricing Model Form. The Agencies permit a lender who is currently sending Risk-Based Pricing notices to continue to use the existing Model Form B-1 or B-2 and staple the relevant credit score information to the existing form: "[T]he Agencies believe that a creditor will be deemed to have used H-6 or B-6 if it staples or appends to H-1 or B-1 the credit score information contained in the section 'Your Credit Score and Understanding Your Credit Score' that is contained on the second page of H-6 and B-6."

Adverse Action Notice Interpretations

The FRB's Final Rule on adverse action notices is an amendment to Regulation B under the Equal Credit Opportunity Act. Nonetheless, the FRB included several interpretations with respect to the duties of lenders, and others, under the FCRA. The FRB does not have any independent authority to make rules under the FCRA. As a result, whether the FRB's interpretations of the FCRA outside of the risk-based pricing context are to be given any deference, beyond their power to persuade, remains to be seen.

• No Credit Score. A lender is not required to include a credit score in the adverse action notice if the consumer has no score, but the lender may, at its option provide a notice that no score was available: "The creditor cannot disclose credit score information if an applicant has no credit score. Nothing in section 1100F of the Dodd-Frank Act prevents a creditor, however, from providing the applicant notice that no credit score was available from a consumer reporting agency, although section 1100F does not require such notice."

• Key Factors. The FRB's notice clarifies that "key factors" are still "key" and must be disclosed, even if the factors do not substantially affect the score: "Section 1100F of the Dodd-Frank Act expressly requires disclosure of the top four (or five) key factors that adversely affected the credit score, whether or not the effect was substantial."

• Guarantors and Co-Signers. The FRB makes clear that no adverse action notice is required to be provided to a guarantor or a co-signer under Regulation B or the FCRA: "Under section 701(d)(6) of the ECOA and § 202.2(c) of Regulation B, only an applicant can experience adverse action. Further, a guarantor or cosigner is not deemed an applicant under § 202.2(e). Sections 603(k)(1)(A) and 603(k)(1)(B)(2) of the FCRA provide that adverse action has the same meaning for purposes of the FCRA as is provided in the ECOA and Regulation B in the context of a credit application. Therefore, a guarantor or co-signer would not receive an adverse action notice under the ECOA or the FCRA."

• Multiple Scores. A lender only needs to disclose one credit score in an FCRA adverse action notice: "When a creditor obtains multiple scores but only uses one in making the decision, the creditor must disclose the credit score that it used... Section 1100F of the Dodd-Frank Act does not specify what credit score should be disclosed in such cases, but only requires a person to disclose a single credit score that is used by the person in making the credit decision. A creditor would comply with the statute by disclosing any of the credit scores that it used. The Board expects that creditors will have policies and procedures to determine which of the multiple credit scores was used in taking adverse action."

• Proprietary Scores that Include Non-Credit Information. The FRB makes clear that proprietary scores do not need to be disclosed if they include factors from outside of a consumer report: "If a creditor uses a proprietary score that is based on one or more factors that are not information obtained from a consumer reporting agency, this proprietary score is not a credit score for purposes of section 1100F of the Dodd- Frank Act and thus does not need to be disclosed to the consumer."

• Creditors Using Proprietary Scores May be Able to Disclose an Off-the-Shelf Score. The FRB states that a proprietary score that includes only consumer report information might be a "credit score" under the FCRA. In that case, if the lender uses a proprietary score in combination with an off-the-shelf score, such as a FICO score, obtained from a consumer reporting agency, the lender may disclose the off-the-shelf score to the consumer. For example, if the lender incorporates the off-the-shelf score into its proprietary model, it may disclose the off-the-shelf score. Or, if the lender uses both a proprietary and off-the-shelf score in its underwriting, it may disclose the off-the-shelf score.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved