Fair and Accurate Credit Transactions Act of 2003

Dear Board of Directors:

The purpose of this regulatory alert is to inform credit union officials about the Fair and Accurate Credit Transactions Act of 2003 (FACTA). Select provisions of FACTA became effective on December 1, 2004.

FACTA amends the Fair Credit Reporting Act (FCRA) to:

• help consumers combat identity theft;
• establish national standards for the regulation of consumer report information;
• assist consumers in controlling the type and amount of marketing solicitations they receive; and
• restrict the use of sensitive medical information.

FACTA helps members to combat identity theft. Consumers (members) may include initial fraud, active duty, or extended alerts on consumer reports (credit reports). The presence of these alerts imposes additional requirements on the users of credit reports. To aid members in clearing their credit reports of fraudulent identity theft transactions, credit unions must establish reasonable procedures to stop reporting on blocked information upon notification of identity theft.

FACTA provides consumers with opportunities to learn about their credit report and credit score. Credit unions must disclose a member's credit score when it is used to evaluate a residential mortgage application. Credit unions must also accompany pre-screened solicitations for credit with a disclosure that credit report information was used in making the solicitation. In addition, all consumers will be eligible to request a free annual credit report from the three nationwide consumer reporting agencies; these credits reports will become available nationwide by September 1, 2005.

FACTA also bolsters financial literacy efforts by creating a new Financial Literacy and Education Commission empowered to improve the government’s financial literacy and education programs, grants, and materials.

A brief list of key FACTA provisions follows:

• When an initial fraud alert or active duty alert is shown on a credit report, a credit union generally may not extend new credit unless it has made a reasonable attempt to verify the member's identity and to confirm the validity of the request for credit. If an extended alert is shown on a credit report, no new credit can be extended unless the credit union contacts the consumer using a reasonable contact method designated by the consumer. 15 U.S.C. §1681c-1(h) and FACTA §112(a).
• Upon written request by a consumer, a credit union must provide copies of documents related to fraudulent transactions or fraudulent accounts opened in a member's name. Before information is provided, member identity must be verified and the member may be asked to show proof of an identity theft claim. 15 U.S.C. §1681g(e) and FACTA, §151(a).
• When reporting data to consumer reporting agencies, credit unions must have reasonable procedures to stop re-reporting data derived from identity theft transactions upon notification of identity theft by a member or consumer reporting agency. 15 U.S.C. §1681s-2(a) and FACTA, §154(a).
• When using a credit score to evaluate an application for a loan secured by 1 to 4 units of residential real property, a credit union must provide the applicant with a written disclosure and information about the credit score, including its numerical value. 15 U.S.C. §1681g and FACTA, §212(c).
• Credit unions must develop, implement, and maintain appropriate measures to properly dispose of consumer information derived from credit reports. These measures must be consistent with NCUA's Guidelines for Safeguarding Member Information. 15 U.S.C. §1681w and FACTA §216 and NCUA Rules and Regulations, 12 C.F.R. §717.83.
• Credit unions must notify members if they report negative information to a consumer reporting agency. This notice must occur no later than 30 days after the information is provided to the consumer reporting agency. 15 U.S.C. §1681s-2(a)(7) and FACTA, §217(a).
• When credit is offered to a member on materially less favorable terms than it is offered to a substantial portion of other members, a credit union may need to provide a risk-based pricing notification. Notification is required if the terms of the credit are material and the offer for credit is based in whole or in part on a consumer credit report. The notification must identify the consumer reporting agency providing the credit report and provide related information. 15 U.S.C. §1681m(h) and FACTA, §311(a).
• While the risk-based pricing notification requirement became effective on December 1, 2004, implementing rules and model disclosures have not yet been issued by the Federal Trade Commission (FTC) and Federal Reserve Board. When issued, the rules will set a compliance date.

Additional sections of FACTA will take effect as implementing regulations are finalized. Key sections include:

• Red flag guidelines and regulations. 15 U.S.C. §1681m(e) and FACTA, §114.
• Accuracy and Integrity Guidelines and Regulations. 15 U.S.C. §1681s2(e) and FACTA, §312(a).
• Ability of consumer to dispute information with furnisher. 15 U.S.C. §1681s-2(a)(8) and FACTA, §312(c)
• Reconciling addresses. 15 U.S.C. §1681c(h) and FACTA, §315

Implementing regulations are being developed and published by the federal regulatory agencies. Both the NCUA website, http://www.ncua.gov/, and the FTC website, http://www.ftc.gov/os/statutes/fcrajump.htm, contain information about FACTA. The FTC website includes a copy of FACTA, the text of the Fair Credit Reporting Act as amended by FACTA, and FTC rules that may apply to credit union service organizations.

NCUA's website includes implementing regulations for FACTA. NCUA recently adopted changes to Part 717 and Part 748 of the NCUA Rules and Regulations. These changes incorporate FACTA requirements for the disposal of consumer information. NCUA has also proposed changes to Part 717 to address affiliate marketing and the use of medical information. Final and proposed Rules and Regulations are published on the NCUA website at: http://www.ncua.gov/Legal/Regs/Pages/FIRegulations.aspx

If you have further questions, please contact your NCUA Regional Office.