FCRA Compliance Management & Risk Mitigation 3 — Questions and Answers
Question 1: An organization implements a 'compliance by design' approach to FCRA. Which practice BEST exemplifies this principle?
- Reviewing consumer reports after employees have already used them
- Embedding permissible-purpose checks into the system workflow before a report can be pulled (Correct answer)
- Training employees annually on FCRA rules
- Conducting quarterly legal reviews of adverse action letters
Correct answer: Embedding permissible-purpose checks into the system workflow before a report can be pulled
Compliance by design integrates controls into processes so violations become technically difficult, rather than relying solely on after-the-fact review.
Question 2: Under FCRA's reinvestigation requirements, if a CRA determines that disputed information is accurate, which action must it take before closing the dispute?
- Delete the item from the consumer's file as a precaution
- Notify the consumer of the right to add a statement of dispute to their file (Correct answer)
- Require the furnisher to resubmit the tradeline within 5 days
- File a report with the CFPB regarding the consumer's dispute
Correct answer: Notify the consumer of the right to add a statement of dispute to their file
When a CRA verifies information as accurate, it must inform the consumer they may submit a 100-word statement of dispute for inclusion in their file.
Question 3: Which scenario represents a 'mixed file' risk and a corresponding FCRA compliance obligation for a CRA?
- A consumer with two open mortgages where both appear on the same report
- Two consumers with similar names whose credit information is commingled in one file, requiring the CRA to maintain matching procedures to prevent mismerging (Correct answer)
- A consumer who has both positive and negative tradelines in their file
- A creditor receiving a report containing information from multiple bureaus
Correct answer: Two consumers with similar names whose credit information is commingled in one file, requiring the CRA to maintain matching procedures to prevent mismerging
Mixed files occur when a CRA merges data from different individuals, and CRAs must maintain reasonable name/SSN matching procedures to prevent this.
Question 4: A compliance program uses key risk indicators (KRIs) for FCRA monitoring. Which KRI would BEST signal elevated furnisher compliance risk?
- The number of new accounts opened per month
- A spike in consumer disputes alleging the same type of furnishing error from a single creditor (Correct answer)
- The average credit score of the consumer base
- Monthly revenue from credit monitoring subscription sales
Correct answer: A spike in consumer disputes alleging the same type of furnishing error from a single creditor
Clustered disputes pointing to the same error type from one furnisher indicate a systemic data quality problem requiring escalated review.
Question 5: Under FCRA, when must a furnisher provide notice to a consumer before reporting negative information to a CRA for the first time?
- At least 30 days before first reporting
- The notice may be given at the time of or before the first derogatory furnishing (Correct answer)
- Negative information may be reported without any prior consumer notice
- Only if the account is more than 90 days past due
Correct answer: The notice may be given at the time of or before the first derogatory furnishing
Section 623(a)(7) requires financial institutions to provide a negative-information notice at the time of or before the first report of delinquency.
Question 6: A risk manager is evaluating FCRA exposure from a recently acquired subsidiary. Which discovery would represent the HIGHEST compliance risk?
- The subsidiary uses manual adverse action letter generation
- The subsidiary has no documented permissible-purpose certification process for its employee background checks (Correct answer)
- The subsidiary pulls credit reports monthly for existing customers
- The subsidiary has a dispute log with no overdue items
Correct answer: The subsidiary has no documented permissible-purpose certification process for its employee background checks
Absence of a permissible-purpose certification process for background checks creates direct FCRA liability for impermissible consumer report use.
Question 7: Which element is REQUIRED in an adverse action notice when a consumer report was a factor in the decision?
- The exact credit score that triggered the denial
- The name, address, and telephone number of the CRA that provided the report (Correct answer)
- A detailed explanation of every negative tradeline considered
- The creditor's internal underwriting guidelines
Correct answer: The name, address, and telephone number of the CRA that provided the report
FCRA Section 615 mandates that adverse action notices include the CRA's contact information so consumers can request their file and dispute inaccuracies.
FCRA Compliance Management & Risk Mitigation 3
An organization implements a 'compliance by design' approach to FCRA.
Which practice BEST exemplifies this principle?