Skip to main content

Consumer Reporting Agencies: CFPB Should Define Its Supervisory Expectations

GAO-19-459 Published: Jul 16, 2019. Publicly Released: Jul 16, 2019.
Jump To:

Fast Facts

Consumer reporting agencies collect vast amounts of information on people, such as their debt and work histories. They package the information into reports and sell it.

We looked at inaccuracies in those reports, which can have real consequences—especially for job seekers or people who need credit. Government and industry representatives said errors can happen in several ways. For example, agencies might match data to the wrong people if they share common names.

We recommended the Consumer Financial Protection Bureau tell agencies what it considers reasonable procedures for assuring accuracy and investigating disputes.

Credit report resting on a computer keyboard with pen and glasses

Credit report resting on a computer keyboard with pen and glasses

Skip to Highlights


What GAO Found

Businesses and other entities use consumer reports to make decisions about consumers, such as whether they are eligible for credit, employment, or insurance. Consumer report inaccuracies can negatively affect such decisions. The Consumer Financial Protection Bureau (CFPB) and other stakeholders identified various causes of consumer report inaccuracies, such as errors in the data collected by consumer reporting agencies (CRA) and CRAs not matching data to the correct consumer.

Examples of Consumer Reporting Errors Related to Mismatched Consumer Files


In 2010, CFPB was granted supervisory and enforcement authority over CRAs. In using its oversight authorities, CFPB has prioritized CRAs that pose the greatest potential risks to consumers—such as those with significant market shares and large volumes of consumer complaints—for examination. CFPB's oversight has generally focused on assessing compliance with Fair Credit Reporting Act (FCRA) requirements regarding accuracy and the investigations CRAs conduct in response to consumer disputes. For example, since 2013, CFPB has conducted examinations of several CRAs and directed specific changes in CRAs' policies and procedures for ensuring data accuracy and conducting dispute investigations.

CFPB has not defined its expectations for how CRAs can comply with key statutory requirements. FCRA requires CRAs (1) to follow reasonable procedures for ensuring maximum possible accuracy and (2) to conduct reasonable investigations of consumer disputes. CFPB has identified deficiencies related to these requirements in its CRA examinations, but it has not defined its expectations—such as by communicating information on appropriate practices—for how CRAs can comply with these requirements. Absent such information, staff from four CRAs GAO interviewed said that they look to other sources, such as court cases or industry presentations, to understand what CFPB will consider to be noncompliant during examinations. A 2018 policy statement issued by CFPB and other regulators highlighted the important role of supervisory expectations in helping to ensure consistency in supervision by providing transparent insight to industry and to supervisory staff. By providing information to CRAs about its expectations for complying with key FCRA requirements, CFPB could help achieve its goal of accurate consumer reporting and effective dispute resolution processes. Such information also could help to promote consistency and transparency in CFPB's supervisory approach.

Why GAO Did This Study

CRAs collect data from various sources, such as banks and credit card companies, to create consumer reports that they sell to third parties. The three largest CRAs hold information on more than 200 million Americans.

The Economic Growth, Regulatory Relief, and Consumer Protection Act, enacted in 2018, included a provision for GAO to examine issues related to the consumer reporting market. This report examines, among other objectives, the causes of consumer report inaccuracies and how CFPB has overseen CRAs.

To answer these questions, GAO reviewed relevant laws, regulations, and agency documents related to CRA oversight. GAO interviewed representatives of federal agencies and stakeholders, including a nongeneralizable selection of state agencies from four states that had laws or oversight activities involving CRAs and seven CRAs selected based on size and the type of consumer reports produced. GAO also interviewed groups representing state agencies, consumers, and CRAs selected to reflect a range of stakeholders or based on their work related to CRAs.


CFPB should communicate to CRAs its expectations regarding (1) reasonable procedures for assuring maximum possible accuracy and (2) reasonable investigations of consumer disputes. CFPB described actions it has taken to provide information to CRAs. GAO maintains that communicating expectations in these two areas is beneficial, as discussed in the report.

Recommendations for Executive Action

Agency Affected Recommendation Status
Consumer Financial Protection Bureau The Director of CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy of consumer report information. (Recommendation 1)
Closed – Implemented
In October 2022 and November 2021, CFPB issued two advisory opinions to communicate its expectations to CRAs regarding their obligations for using reasonable procedures to assure maximum possible accuracy under section 607(b) of the Fair Credit Reporting Act. Both advisory opinions identified examples of practices that contributed to failure of CRAs in maintaining reasonable procedures, and provided examples of policies and procedures that would assure maximum possible accuracy. These advisory opinions will help clarify CFPB's expectations for how CRAs can comply with this key statutory requirement.
Consumer Financial Protection Bureau The Director of CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes. (Recommendation 2)
Open – Partially Addressed
In November 2022, CFPB Issued a circular on reasonable investigation of consumer reporting disputes. The circular identified certain practices involving the failure to conduct a reasonable investigation of disputes that can violate the Fair Credit Reporting Act. Specifically, the circular stated that consumer reporting agencies and furnishers cannot avoid the obligation to conduct a reasonable investigation of disputes by making consumers satisfy demands beyond what the statute and regulations permit. It also explained that consumer reporting agencies must provide to the furnisher all relevant information regarding the dispute that it received from the consumer. The circular will help inform CRAs of CFPB's expectations regarding the provision of dispute information, but does not communicate CFPB's broader expectations regarding conducting reasonable investigations of consumer disputes.

Full Report

Office of Public Affairs


Compliance oversightConsumer complaintsConsumer protection lawsConsumersCredit reportingCredit reportsData collectionData errorsData integrityFinancial institutions