Consumer Reporting Agencies: CFPB Should Define Its Supervisory Expectations
Consumer reporting agencies collect vast amounts of information on people, such as their debt and work histories. They package the information into reports and sell it.
We looked at inaccuracies in those reports, which can have real consequences—especially for job seekers or people who need credit. Government and industry representatives said errors can happen in several ways. For example, agencies might match data to the wrong people if they share common names.
We recommended the Consumer Financial Protection Bureau tell agencies what it considers reasonable procedures for assuring accuracy and investigating disputes.
Credit report resting on a computer keyboard with pen and glasses
What GAO Found
Businesses and other entities use consumer reports to make decisions about consumers, such as whether they are eligible for credit, employment, or insurance. Consumer report inaccuracies can negatively affect such decisions. The Consumer Financial Protection Bureau (CFPB) and other stakeholders identified various causes of consumer report inaccuracies, such as errors in the data collected by consumer reporting agencies (CRA) and CRAs not matching data to the correct consumer.
Examples of Consumer Reporting Errors Related to Mismatched Consumer Files
In 2010, CFPB was granted supervisory and enforcement authority over CRAs. In using its oversight authorities, CFPB has prioritized CRAs that pose the greatest potential risks to consumers—such as those with significant market shares and large volumes of consumer complaints—for examination. CFPB's oversight has generally focused on assessing compliance with Fair Credit Reporting Act (FCRA) requirements regarding accuracy and the investigations CRAs conduct in response to consumer disputes. For example, since 2013, CFPB has conducted examinations of several CRAs and directed specific changes in CRAs' policies and procedures for ensuring data accuracy and conducting dispute investigations.
CFPB has not defined its expectations for how CRAs can comply with key statutory requirements. FCRA requires CRAs (1) to follow reasonable procedures for ensuring maximum possible accuracy and (2) to conduct reasonable investigations of consumer disputes. CFPB has identified deficiencies related to these requirements in its CRA examinations, but it has not defined its expectations—such as by communicating information on appropriate practices—for how CRAs can comply with these requirements. Absent such information, staff from four CRAs GAO interviewed said that they look to other sources, such as court cases or industry presentations, to understand what CFPB will consider to be noncompliant during examinations. A 2018 policy statement issued by CFPB and other regulators highlighted the important role of supervisory expectations in helping to ensure consistency in supervision by providing transparent insight to industry and to supervisory staff. By providing information to CRAs about its expectations for complying with key FCRA requirements, CFPB could help achieve its goal of accurate consumer reporting and effective dispute resolution processes. Such information also could help to promote consistency and transparency in CFPB's supervisory approach.
Why GAO Did This Study
CRAs collect data from various sources, such as banks and credit card companies, to create consumer reports that they sell to third parties. The three largest CRAs hold information on more than 200 million Americans.
The Economic Growth, Regulatory Relief, and Consumer Protection Act, enacted in 2018, included a provision for GAO to examine issues related to the consumer reporting market. This report examines, among other objectives, the causes of consumer report inaccuracies and how CFPB has overseen CRAs.
To answer these questions, GAO reviewed relevant laws, regulations, and agency documents related to CRA oversight. GAO interviewed representatives of federal agencies and stakeholders, including a nongeneralizable selection of state agencies from four states that had laws or oversight activities involving CRAs and seven CRAs selected based on size and the type of consumer reports produced. GAO also interviewed groups representing state agencies, consumers, and CRAs selected to reflect a range of stakeholders or based on their work related to CRAs.
Recommendations
CFPB should communicate to CRAs its expectations regarding (1) reasonable procedures for assuring maximum possible accuracy and (2) reasonable investigations of consumer disputes. CFPB described actions it has taken to provide information to CRAs. GAO maintains that communicating expectations in these two areas is beneficial, as discussed in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Consumer Financial Protection Bureau | The Director of CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy of consumer report information. (Recommendation 1) |
In an August 2021 update, CFPB stated that the agency communicates supervisory expectations to CRAs through exams and investigations. Additionally, CFPB reemphasized that it has taken actions to convey expectations to CRAs, including holding a joint workshop with FTC in December 2019 on consumer reporting accuracy and publishing Supervisory Highlights citing FCRA violations and the basis for such violations. As we stated in our report, corrective actions through examinations are limited to the specific entities being examined and clearer communication of supervisory expectations and the ways in which CRAs could comply could further facilitate understanding of CFPB's expectations prior to examinations. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.
|
| Consumer Financial Protection Bureau | The Director of CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes. (Recommendation 2) |
In an August 2021 update, CFPB stated that the agency communicates supervisory expectations to CRAs through exams and investigations. Additionally, CFPB reemphasized that it has taken actions to convey expectations to CRAs, including holding a joint workshop with FTC in December 2019 on consumer reporting accuracy and publishing Supervisory Highlights citing FCRA violations and the basis for such violations. As we stated in our report, corrective actions through examinations are limited to the specific entities being examined and clearer communication of supervisory expectations and the ways in which CRAs could comply could further facilitate understanding of CFPB's expectations prior to examinations. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.
|