The below article is the Special Focus section of the October 2018 Compliance Journal. The full issue may be viewed by clicking here.
On May 24, 2018 President Trump signed the Economic Growth, Regulatory Relief, and Consumer Protection Act (Act) into law. Title III of the Act amends section 605A of the Fair Credit Reporting Act (FCRA) to require new notices to consumers. These new notices are required whenever a summary of rights must be provided pursuant to section 609 of the FCRA.
On September 18, 2018 the Bureau of Consumer Financial Protection (CFPB) issued an interim final rule (rule) to update its model forms for the summary of consumer identity theft rights and the summary of consumer rights (model forms) to incorporate the Act’s new notices. This article discusses the notice changes to the summary of rights and its impact on financial institutions.
Changes to Summary of Rights
The FCRA requires CFPB to prepare two consumer disclosures: the summary of consumer rights and summary of consumer identity theft rights. The rule amends CFPB’s model forms to accommodate the notice changes required by the Act.
Whenever a consumer is required to receive a summary of consumer rights, the Act’s notice requirements must be included. The amendments include changes to the minimum duration of initial fraud alerts, adjustments to update contact information for certain FCRA enforcement agencies, and notice of security freeze rights. CFPB’s rule amends its model forms to incorporate the Act’s changes.
CFPB will regard the use of the prior model forms, being those published in Appendices I and K on November 14, 2012, to constitute compliance with the FCRA provisions requiring such forms, so long as a separate page that contains the additional required information is provided in the same transmittal.
Impact Upon Financial Institutions
As discussed above, two model forms are impacted: the summary of rights of identity theft victims and summary of consumer rights. While the rule amends what must be included in each summary of rights, it does not change when they must be provided. The summary of rights of identity theft victims must be provided by a consumer reporting agency upon contact by a consumer expressing a belief that they have been a victim of fraud or identity theft. As such, financial institutions are generally not required to provide a summary of rights of identity theft victims.
The summary of consumer rights must be provided by consumer reporting agency in a number of situations. Those situations, similar to the summary of rights of identity theft victims discussed above, generally do not apply to financial institutions. However, a summary of consumer rights must be provided by those who obtain a consumer report for employment purposes. Thus, financial institutions providing a summary of consumer rights because they obtain consumer reports for employment purposes must be aware of the notice changes.
The FCRA does not require the summary of rights to be included in adverse action notices. Thus, the Act and the rule does not affect adverse action notices.
Financial institutions should verify the conditions upon which they are required to provide a summary of consumer rights under the FCRA. WBA reminds financial institutions that neither the Act nor the rule changes when a summary of rights must be provided. Thus, financial institutions likely already have procedures in place to provide a summary of rights when required. Financial institutions should verify those procedures, and consider whether their summary of rights incorporates the changes required by the Act. The Act amends the notice requirements contained within the summary of rights, and the rule implements new model forms accommodating those changes.
The Act may be found here: https://www.congress.gov/bill/115th-congress/senate-bill/2155/text
The rule may be found here: https://www.gpo.gov/fdsys/pkg/FR-2018-09-18/pdf/2018-20184.pdf
By, Ally Bates