Insights

Just two weeks before the July 21, 2011 effective date of the Dodd-Frank Act (DFA) Section 1100F credit score disclosure requirements, the Federal Reserve Board (FRB or Board) and the Federal Trade Commission (FTC) published final versions of model notices under the Risk-Based Pricing Rule (RBP). The FRB also issued final amendments to the ECOA Regulation B model forms to incorporate changes to FCRA adverse action notices as a result of the DFA.

The final versions of the notices are similar to those the agencies published for comment in March, 2011; however, there are some changes to the RBP model notices, as discussed below.

In addition, based on public comments, the agencies expanded the Supplementary Information accompanying the model forms, and answered a number of questions regarding the use and disclosure of credit scores under the new requirements.

This article discusses some of the highlights of the agencies’ commentary. However, readers are advised to refer for guidance to the entire text of the agencies’ Supplementary Information to both the RBP Rule and the ECOA-FCRA Model Forms.

ECOA-FCRA Model Forms – FRB Comments

Use of a Credit Score. The DFA disclosures are triggered when the user of a consumer report uses a credit score in taking adverse action based in whole or in part on a consumer report. The FRB explained that the credit score disclosures are required unless a credit score played no role in the adverse action determination. If the credit score was a factor in the adverse action decision, even if it was not a significant factor, the creditor will have used the credit score for purposes of the DFA. Because there is a low threshold for “use” of a credit score, creditors may choose to give the DFA credit score disclosures when there is some ambiguity regarding whether a credit score obtained by the creditor was considered in an adverse action determination.

If no credit score on a consumer is available, there is no use and therefore no requirement to give the consumer a DFA credit score disclosure, but a creditor may choose to tell the consumer that no score was available.

Key Factors. The DFA expressly requires disclosure of the top four (or five, if one is inquiries) key factors that adversely affected the credit score. The Board stated that these factors must be listed, regardless of whether the effect of those factors was substantial.

The FRB previously stated that disclosing the key factors that adversely affected the consumer’s credit score does not satisfy the ECOA requirement to disclose specific reasons for denying or taking other adverse action on an application or extension of credit. The Board rejected requests that creditors be permitted to provide the list of key factors or specific reasons only once when the key factors that adversely affected the consumer’s credit score are the same as the specific reasons for taking adverse action.

The FRB also explained that the FCRA requires disclosure of the number of inquiries as a key factor, regardless of whether it is one of the top four key factors.

Proprietary Credit Scores. In response to commenters’ requests, the FRB provided guidance on when a proprietary score would be deemed a credit score. The FRB explained that the FCRA defines credit score, and that most credit scores that meet the FCRA definition are the scores that a creditor obtains from a consumer reporting agency. The FCRA specifically excludes some – but not all – proprietary scores. For example, the definition of credit score does not include any mortgage score or rating of an automated underwriting system that considers one or more factors in addition to credit information, including the loan-to-value ratio, the amount of down payment, or the financial assets of a consumer. If a creditor uses a proprietary score that is based on one or more factors that are not information obtained from a consumer reporting agency, this proprietary score is not a credit score for purposes of the FCRA or the DFA and thus does not need to be disclosed to the consumer.

If a creditor uses both a proprietary score that does not meet the FCRA credit score definition and a credit score from a consumer reporting agency in taking adverse action, the creditor must disclose only the credit score from the consumer reporting agency. Similarly, if the creditor uses both a proprietary score that meets the definition of a credit score, and a credit score from a consumer reporting agency in taking adverse action, the creditor could choose to disclose only the credit score obtained from the consumer reporting agency.

Form of Notice. Neither the FCRA nor the DFA credit score disclosure amendments contain any requirements with respect to form of notice or order of content. Until the CFPB came into existence on July 21, no agency had rulemaking authority under either statute. There is no legislative history on the DFA amendments. Nonetheless, in response to comments, the FRB offered guidance on these points.

Order of Content. The FRB has retained the order of content proposed in the model forms because it believes it logically progresses from more general consumer report information to more specific credit score information.

Disclosing Credit Score Information on a Separate Document. Several commenters suggested that they should be permitted to attach the form they receive from the consumer reporting agency to their adverse action notice and provide both notices to the consumer. The FRB did not (and could not) cite to any FCRA or DFA provision that requires the notices to be integrated into one document, but responded with this statement: “Providing a form with credit score information separately from an adverse action notice does not appear to be consistent with the legislation.”

Relationship to FCRA Mortgage Score Disclosure Requirements. The Board does not believe a creditor would comply with the FCRA adverse action provisions by providing a credit score disclosure exception notice or an FCRA section 609(g) notice. These notices provide different information and have different timing requirements than the adverse action notice.

Co-applicants. If a creditor uses credit scores of co-applicants in taking adverse action, the FRB expects the creditor to provide separate FCRA adverse action notices to each applicant with only the individual’s credit score on each notice. The FRB declined to adopt some commenters’ suggestion to add language to the model forms to indicate that, for co-applicants, the adverse action decision may be based on either or both of the applicants’ credit information. The Board believes that the additional language would complicate the disclosures. The Board assumes: “An applicant with strong credit who receives an adverse action notice will likely understand that the adverse action decision was based on the co-applicant’s credit information or will contact the creditor to inquire.”

Guarantors and Co-Signers. In response to questions, the FRB opined for the first time that it believes guarantors and co-signers should not receive an adverse action notice under the FCRA. This was already the rule under the ECOA, and while the FCRA adopts the ECOA definition of adverse action, it also independently requires notice to any individual against whom the user of a consumer report takes adverse action based on that report. Because the FCRA adverse action notices are administratively enforced, bank regulatory examiners can be expected to rely on the FRB’s interpretation.

The FRB also opined that a guarantor’s or co-signer’s credit score should not be disclosed to an applicant when the creditor uses the guarantor’s or co-signer’s credit score in taking adverse action.

Multiple Scores. The FRB affirmed that a creditor who used multiple credit scores in taking adverse action should disclose only one score and the DFA required information should relate to that score.

Adverse Actions Not Limited to Credit. The FCRA adverse action notice requirements apply to “any person” who takes adverse action based on a consumer report, including decisions regarding deposit accounts, insurance products, or employment. DFA does not state that the credit score disclosures are only required for adverse action decisions related to credit. Therefore, DFA disclosures are required when any person uses a credit score in taking action under the FCRA. (Author’s note: Only a “credit score” that meets the FCRA definition triggers a DFA disclosure. Scores used in non-credit decisions, such as deposit accounts and insurance, may include factors that put them outside the FCRA definition.)

Use of Forms. While the use of the model forms creates a safe harbor, the FRB observed that it expects creditors to make proper use of the forms. For example, if a creditor bases its adverse action on reports from more than one consumer reporting agency, the FRB expects that the creditor would replace the general reference to “this consumer reporting agency” with a more specific reference to the name of the consumer reporting agency from which the creditor obtained the score being disclosed, to avoid ambiguity and consumer confusion. Moreover, the Dodd-Frank Act requires disclosure of the source of the credit score. The Board does not believe that a general reference to “this consumer reporting agency” would satisfy the requirements of the statute when a creditor has based its adverse action decision on reports from multiple consumer reporting agencies.

Contact Information for the Entity That Provided the Credit Score. In response to several industry commenters, the FRB added optional language to the model forms that creditors may use to direct the consumer to the entity (which may be a consumer reporting agency or the creditor itself, for a proprietary score that meets the definition of a credit score) that provided the credit score for any questions about the credit score, along with the entity’s contact information. Because this language is optional, creditors may use or not use the additional language without losing the safe harbor.

RBP Model Notices – FRB and FTC Comments

Many of the issues addressed in the FRB and FTC (the Agencies) comments on the final RBP notices are also discussed in the FRB’s Supplementary Information to the ECOA-FCRA adverse action notice forms. Thus, the agencies provide the similar guidance on the following issues: use of a credit score, key factors, number of inquiries, proprietary credit scores, multiple credit scores, co-applicants, guarantors and co-signers. However, the forms relate to different statutory requirements, and the Supplementary Information reflects those differences. Moreover, the Agencies made some revisions to the RBP model notices.

Revisions to Content of Model Forms. Responding to consumer advocates’ suggestions for additional content related to credit scores, the Agencies added disclosures to the new RBP model forms. The Agencies revised model forms H-6 and H-7 in the Board’s rule and B-6 and B-7 in the Commission’s rule to add the statement: “We used your credit score to set the terms of credit we are offering you,” in the box entitled “What you should know about your credit score.” This statement mirrors a sentence on the current risk-based pricing notice, informing consumers that their credit report was used to set the terms of credit being offered.

Attaching the Credit Score Information to the Current Model Form. In response to an industry comment, the Agencies stated that a creditor may staple or append the credit score information using a supplemental document to a current model form on general risk-based pricing (H-1 and B-1) or account review notice (H-2 and B-2). Thus, the Agencies believe that a creditor will be deemed to have used H-6 or B-6 if it staples or appends to H-1 or B-1 the credit score information contained in the section “Your Credit Score and Understanding Your Credit Score” that is contained on the second page of H-6 and B-6.

Implementation Date for Model Forms. The Agencies take the position that DFA Section 1100F is self-effectuating and will become legally effective on July 21, 2011, even if there are no implementing rules or model forms. To provide guidance to institutions in establishing their compliance programs, the FRB and FTC final rules will become effective 30 days after the date of publication in the Federal Register.

Paperwork Reduction Act. For purposes of the PRA, the Agencies were required to estimate the number of hours that entities subject to the new requirements would need to update their systems and modify model notices to comply with the new requirements. The Agencies estimated that respondents potentially affected by the additional notice requirements would take, on average, 16 hours (2 business days) to bring their systems into compliance. Industry commenters asserted that this estimate was low. “Based on these comments, the Agencies agree that some additional time beyond 16 hours may be needed. The Agencies, therefore, have revised upward their prior burden estimate. The Agencies believe that 32 hours (4 business days) is a reasonable estimate of the average amount of time to . . . incorporate these new requirements.”

Who says regulators don’t have a sense of humor?

Anne P. Fortney is a partner in the Washington, D.C., office of Hudson Cook, LLP. Anne can be reached at 202-327-9709 or by email at afortney@hudco.com.