On November 9, 2007, bank agencies and the Federal Trade Commission (“FTC”) issued joint regulations1 to provide guidance on Sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”). Section 114 and the related regulations are not applicable to insurers and are only applicable to “financial institutions,” as defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(t).2
Section 315 of the FACT Act provides that a consumer reporting agency (“CRA”) must provide a notice of address discrepancy to a consumer report user if the address provided by the user “differs substantially” from the address the CRA has in the consumer’s file. Section 605(h)(2) requires federal agencies to issue regulations on the reasonable polices and procedures a user of a consumer report should employ when the user receives a notice of address discrepancy.
Pursuant to the authority granted in Section 605(h)(2), federal bank agencies and the FTC promulgated regulations that require users of consumer reports to develop and implement reasonable policies and procedures for when they receive a notice of address discrepancy. The FTC’s regulations which are applicable to insurers are found at 16 CFR 681.
According to 16 CFR 681.1, the policies must address how the user, upon receiving a notice of discrepancy, (1) forms a reasonable belief that the user knows the identity of the person for whom it has obtained a consumer report, regardless of whether it has a continuing relationship with the consumer, and (2) furnishes the CRA with an address for the consumer when three conditions are satisfied. 16 CFR 681.1(c), (d).
1. Reasonable Belief of Identity
Examples of reasonable policies and procedures include comparing the information in the consumer report provided by the CRA with information the user (1) obtains and uses to verify the consumer’s identity in accordance with the requirements of the “Customer Information Program” rules pursuant to 31 U.S.C. 5318(l), (2) maintains in its own records, or (3) obtains from third-party sources. 16 CFR 681.1(c)(2)(i). The user may also verify the information in the consumer report provided by the CRA with the consumer. 16 CFR 681.1(c)(2)(ii).
2. Furnish CRA with Consumer’s Address
Three conditions must be satisfied before a policy for furnishing the address to the CRA takes effect. The conditions are when the user: (1) can form a reasonable belief that the consumer report relates to the consumer about whom the user requested the report, (2) establishes a continuing relationship with the consumer, and (3) regularly and in the ordinary course of business furnishes information to the CRA from which the notice of address discrepancy relating to the consumer was obtained. 16 CFR 681.1(d)(1).
A user may reasonably confirm that the address is accurate by (1) verifying the address with the consumer about whom it has requested the report, (2) reviewing its own records to verify the address of the consumer, (3) verifying the address through third-party sources, or (4) using “other reasonable means.” 16 CFR 681.1(d)(2).
The policies and procedures regarding furnishing the consumer’s address to the CRA must provide that the user will furnish the consumer’s address as part of the information it regularly furnishes for the reporting period in which it establishes a relationship with the consumer. 16 CFR 681.1(d)(3).
These regulations will become effective November 1, 2008.
Cindy Chang is an associate in the firm’s Washington, D.C. office and a member of the insurance and reinsurance and litigation groups. Prior to joining the firm, Ms. Chang completed a clerkship with the Honorable Kathianne Knaup Crane of the Missouri Court of Appeals. She can be reached at 202-842-1081 or cchang@mmmlaw.com.
1Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003, 72 Fed. Reg. 217, 63718 (Nov. 9, 2007). The FTC regulations are codified in 16 CFR 681.
2“The term ‘financial institution’ means a State or National bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account (as defined in section 19(b) of the Federal Reserve Act) belonging to a customer.” 15 U.S.C. 1681a(t). According to section 19(b) of the Federal Reserve Act, a “transaction account” is “a deposit or account on which the depositor or account holder is permitted to make withdrawals by negotiable or transferable instrument, payment orders of withdrawal, telephone transfers, or other similar items for the purpose of making payments or transfers to third persons or others.”