[Federal Register Volume 76, Number 245 (Wednesday, December 21, 2011)]
[Rules and Regulations]
[Pages 79308-79378]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2011-31728]



[[Page 79307]]

Vol. 76

Wednesday,

No. 245

December 21, 2011

Part III





Bureau of Consumer Financial Protection





-----------------------------------------------------------------------





12 CFR Part 1022





Fair Credit Reporting (Regulation V); Interim Final Rule

  Federal Register / Vol. 76 , No. 245 / Wednesday, December 21, 2011 / 
Rules and Regulations  

[[Page 79308]]


-----------------------------------------------------------------------

BUREAU OF CONSUMER FINANCIAL PROTECTION

12 CFR Part 1022

[Docket No. CFPB-2011-0029]
RIN 3170-AA06


Fair Credit Reporting (Regulation V)

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Interim final rule with request for public comment.

-----------------------------------------------------------------------

SUMMARY: Title X of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (Dodd-Frank Act) transferred rulemaking authority for a 
number of consumer financial protection laws from seven Federal 
agencies to the Bureau of Consumer Financial Protection (Bureau) as of 
July 21, 2011. The Bureau is in the process of republishing the 
regulations implementing those laws with technical and conforming 
changes to reflect the transfer of authority and certain other changes 
made by the Dodd-Frank Act. In light of the transfer of certain 
rulemaking authority for the Fair Credit Reporting Act (FCRA) from the 
Board of Governors of the Federal Reserve System, Federal Deposit 
Insurance Corporation, Federal Trade Commission, National Credit Union 
Administration, Office of the Comptroller of the Currency, and Office 
of Thrift Supervision to the Bureau, the Bureau is publishing for 
public comment an interim final rule establishing a new Regulation V 
(Fair Credit Reporting). This interim final rule does not impose any 
new substantive obligations on persons subject to the existing FCRA 
regulations.

DATES: This interim final rule is effective December 30, 2011. Comments 
must be received on or before February 21, 2012.

ADDRESSES: You may submit comments, identified by Docket No. CFPB-2011-
0029 or RIN 3170-AA06, by any of the following methods:
     Electronic: http://www.regulations.gov. Follow the 
instructions for submitting comments.
     Mail: Monica Jackson, Office of the Executive Secretary, 
Bureau of Consumer Financial Protection, 1500 Pennsylvania Avenue NW., 
(Attn: 1801 L Street), Washington, DC 20220.
     Hand Delivery/Courier in Lieu of Mail: Monica Jackson, 
Office of the Executive Secretary, Bureau of Consumer Financial 
Protection, 1700 G Street NW., Washington, DC 20006.
    All submissions must include the agency name and docket number or 
Regulatory Information Number (RIN) for this rulemaking. In general, 
all comments received will be posted without change to http://www.regulations.gov. In addition, comments will be available for public 
inspection and copying at 1700 G Street NW., Washington, DC 20006, on 
official business days between the hours of 10 a.m. and 5 p.m. Eastern 
Time. You can make an appointment to inspect the documents by 
telephoning (202) 435-7275.
    All comments, including attachments and other supporting materials, 
will become part of the public record and subject to public disclosure. 
Sensitive personal information, such as account numbers or social 
security numbers, should not be included. Comments will not be edited 
to remove any identifying or contact information.

FOR FURTHER INFORMATION CONTACT: Catherine Henderson or Greg Evans, 
Office of Regulations, at (202) 435-7700.

SUPPLEMENTARY INFORMATION: 

I. Background

    The Fair Credit Reporting Act (FCRA), enacted in 1970, sets 
standards for the collection, communication, and use of information 
bearing on a consumer's creditworthiness, credit standing, credit 
capacity, character, general reputation, personal characteristics, or 
mode of living.\1\ Historically, rulemaking authority for the FCRA has 
been divided among the Board of Governors of the Federal Reserve System 
(Board),\2\ the Federal Deposit Insurance Corporation (FDIC),\3\ the 
Federal Trade Commission (FTC),\4\ the National Credit Union 
Administration (NCUA),\5\ the Office of the Comptroller of the Currency 
(OCC),\6\ and the Office of Thrift Supervision (OTS).\7\ The Dodd-Frank 
Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) \8\ 
amended a number of consumer financial protection laws, including most 
provisions of the FCRA. In addition to substantive amendments, the 
Dodd-Frank Act transferred rulemaking authority for most provisions of 
the FCRA to the Bureau of Consumer Financial Protection (Bureau), 
effective July 21, 2011.\9\ Pursuant to the Dodd-Frank Act and the 
FCRA, as amended, the Bureau is publishing for public comment an 
interim final rule establishing a new Regulation V (Fair Credit 
Reporting), 12 CFR part 1022, implementing the provisions of the FCRA 
for which the Bureau has rulemaking authority.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 1681-1681x. The FCRA has been amended numerous 
times since 1970, including in the Fair and Accurate Credit 
Transactions Act of 2003 (FACT Act) (Pub. L. 108-159).
    \2\ 12 CFR part 222.
    \3\ 12 CFR part 334.
    \4\ 16 CFR part 600.
    \5\ 12 CFR part 717.
    \6\ 12 CFR part 41.
    \7\ 12 CFR part 571.
    \8\ Public Law 111-203, 124 Stat. 1376 (2010).
    \9\ See sections 1061 and 1088 of the Dodd-Frank Act. Dodd-Frank 
section 1029 generally excludes from this transfer of authority, 
subject to certain exceptions, any rulemaking authority over a motor 
vehicle dealer that is predominantly engaged in the sale and 
servicing of motor vehicles, the leasing and servicing of motor 
vehicles, or both.
---------------------------------------------------------------------------

II. Summary of the Interim Final Rule

A. General

    The interim final rule substantially duplicates the interagency 
regulations promulgated under the FCRA by the Board, the FDIC, the FTC, 
the NCUA, the OCC, and the OTS. In addition, the interim final rule 
substantially duplicates the following FTC regulations: 16 CFR parts 
603, 610, 611, 613, 614, and 642, and associated model forms and 
disclosures. The interim final rule, published as the Bureau's new 
Regulation V, 12 CFR part 1022, reproduces the above regulations and 
associated model forms and interpretations with only certain non-
substantive, technical, formatting, and stylistic changes.
    To minimize any potential confusion, the Bureau is preserving the 
numbering of the Board's Regulation V, other than the new part number. 
This interim final rule generally incorporates the existing regulatory 
text promulgated by the Board and other agencies with identical 
regulatory text, as well as appendices (including model forms and 
clauses), and supplements. Likewise, the interim final rule generally 
incorporates the above-cited portions of the FTC's regulation 
(including model forms and clauses) and supplements. The rule has been 
edited as necessary to reflect nomenclature and other technical 
amendments required by the Dodd-Frank Act. However, this interim final 
rule does not make substantive changes to the existing regulations.

B. Specific Changes

    To minimize any potential confusion, the Bureau is preserving where 
possible the past numbering system by republishing regulations with 
Bureau part numbers that correspond to regulations in existence prior 
to the transfer of rulemaking authority or regulatory text that was 
used, in this case, by the Board. Thus, for example, Sec.  222.25 of 
the Board's existing Regulation V will correspond to Sec.  1022.25 of 
the Bureau's new Regulation V. The newly incorporated

[[Page 79309]]

Federal Trade Commission regulations are integrated as follows:

----------------------------------------------------------------------------------------------------------------
                 FTC regulation                                          Bureau regulation
----------------------------------------------------------------------------------------------------------------
16 CFR part 603.................................  12 CFR 1022.3
16 CFR part 610.................................  12 CFR 1022.130
16 CFR part 611.................................  12 CFR 1022.140
16 CFR part 613.................................  12 CFR 1022.121
16 CFR part 614.................................  12 CFR 1022.123
16 CFR part 642.................................  12 CFR 1022.54
----------------------------------------------------------------------------------------------------------------

    Likewise, the Bureau is republishing model forms and disclosures 
with Bureau designations that correspond to previous designations of 
the Board and FTC. The newly incorporated FTC model forms and 
disclosures are integrated as follows:

------------------------------------------------------------------------
           FTC form                           Bureau form
------------------------------------------------------------------------
Appendix A to 16 CFR part 698  Appendix D to 12 CFR part 1022.
 (Prescreen Opt Out Notices).
Appendix D to 16 CFR part 698  Appendix L to 12 CFR part 1022.
 (Standardized Form for
 Requesting Annual File
 Disclosures).
Appendix E to 16 CFR part 698  Appendix I to 12 CFR part 1022.
 (Summary of Consumer
 Identity Theft Rights).
Appendix F to 16 CFR part 698  Appendix K to 12 CFR part 1022.
 (General Summary of Consumer
 Rights).
Appendix G to 16 CFR part 698  Appendix M to 12 CFR part 1022.
 (Notice of Furnisher
 Responsibilities).
Appendix H to 16 CFR part 698  Appendix N to 12 CFR part 1022.
 (Notice of User
 Responsibilities).
------------------------------------------------------------------------

    The Dodd-Frank Act did not transfer certain rulemaking authority 
under the FCRA. Specifically, the Act did not transfer to the Bureau 
the authority to promulgate: rules on the disposal of consumer 
information;\10\ rules on identity theft red flags and corresponding 
interagency guidelines on identity theft detection, prevention, and 
mitigation;\11\ and rules on the duties of card issuers regarding 
changes of address.\12\ These existing provisions are not included in 
the Bureau's new Regulation V. The Act also did not transfer rulemaking 
authority under the FCRA over any motor vehicle dealer that is 
predominantly engaged in the sale and servicing of motor vehicles, the 
leasing and servicing of motor vehicles, or both, subject to certain 
exceptions.\13\
---------------------------------------------------------------------------

    \10\ See 15 U.S.C. 1681m(e); section 1088 of the Dodd-Frank Act.
    \11\ See 15 U.S.C. 1681w; section 1088 of the Dodd-Frank Act.
    \12\ See 15 U.S.C. 1681m(e); section 1088 of the Dodd-Frank Act.
    \13\ See section 1029 of the Dodd-Frank Act.
---------------------------------------------------------------------------

    References to the Board, FTC, and their administrative structures 
have been replaced with references to the Bureau. Similarly, references 
to other agencies that no longer exist (e.g., the Office of Thrift 
Supervision) have been updated as appropriate.
    In addition, certain model forms and disclosures in Appendices H 
(risk-based pricing), I (summary of consumer identity theft rights), K 
(general summary of consumer rights), M (notice of furnisher 
responsibilities), N (notice of user responsibilities), and O (identity 
theft affidavit) have updated references from the Board or FTC Web 
sites and physical addresses to the Bureau Web site and physical 
address. The revised forms are the risk-based pricing model forms, H-1 
through H-7; the summary of consumer identity theft rights, I; the 
general summary of consumer rights, K; the notice of furnisher 
responsibilities, M; the notices of user responsibilities, N; and 
identity theft affidavit, O. Accordingly, persons making use of the 
corresponding model forms from any of the other agencies' existing 
regulations will need to update their forms and disclosures.
    To mitigate the impact of these changes on users of the existing 
model forms, the Bureau is adding new Sec.  1022.1(c) regarding the use 
of model forms and disclosures generally. New Sec.  1022.1(c)(1) 
provides that the use of the model forms and disclosures in the 
Bureau's Appendices D, H, I, K, L, M, and N, or substantially similar 
forms and disclosures, constitutes compliance with the FCRA provisions 
requiring such forms and disclosures. New Sec.  1022.1(c)(2) defines 
``substantially similar'' for these purposes and also provides that, 
until January 1, 2013, the model forms in Appendices B, E, F, G, and H 
to 16 CFR part 698 (the FTC's appendices corresponding to the Bureau's 
Appendices H, I, K, M, and N, respectively), and the model forms in 
Appendix H to 12 CFR part 222 (the Board's appendix corresponding to 
the Bureau's Appendix H) are deemed substantially similar forms. The 
Bureau expects this provision to afford affected persons sufficient 
time to modify any forms and disclosures they have developed pursuant 
to the existing regulations of the Board and the FTC.
    The interim rule's Appendix K reflects updates to the Federal 
agencies that should be listed by particular categories of creditors in 
the general summary of consumer rights pursuant to Sec.  1022.1(c)(1). 
Thus, the list has been revised to reflect the elimination of the 
Office of Thrift Supervision and the grant of enforcement authority, 
with respect to the banking agencies, under the FCRA to the Bureau for 
financial institutions with total assets of more than $10 billion and 
their affiliates.\14\
---------------------------------------------------------------------------

    \14\ See Public Law 111-203, section 1025.
---------------------------------------------------------------------------

    With regard to nonbank creditors (other than affiliates of large 
financial institutions), the interim final rule has left the language 
of Appendix F to the FTC's 16 CFR part 698 unchanged for the time 
being. The Dodd-Frank Act assigns the Bureau enforcement authority with 
respect to such nonbank entities generally.\15\ The interim rule's 
Appendix K has been adjusted to focus on the Federal agencies that 
should be identified in the general summary of consumer rights pursuant 
to Sec.  1022.1(c)(1). As revised, Appendix K is therefore not intended 
to describe the allocation of enforcement authority for

[[Page 79310]]

the FCRA following Dodd-Frank, but rather to specify efficient points 
of contact. The Bureau expects that agencies that receive FCRA 
complaints or inquiries will share that information with other agencies 
as appropriate. The Bureau intends to work closely with other relevant 
Federal agencies regarding the optimal intake and routing of FCRA-
related complaints and inquiries for such nonbank entities. Thus, the 
Bureau has delayed making additional updates to Appendix K pending this 
interagency coordination.
---------------------------------------------------------------------------

    \15\ The FTC retains the FCRA enforcement authority that it 
possessed prior to the Dodd-Frank Act. See FCRA section 621(a); 
section 1088(a)(10)(A) of the Dodd-Frank Act.
---------------------------------------------------------------------------

    Throughout the interim final rule, conforming edits have been made 
to internal cross-references and addresses for filing applications and 
notices. Conforming edits have also been made to reflect the scope of 
the Bureau's authority pursuant to the FCRA, as amended by the Dodd-
Frank Act. Historical references that are no longer applicable, and 
references to effective dates that have passed, have been removed as 
appropriate.

III. Legal Authority

A. Rulemaking Authority

    The Bureau is issuing this interim final rule pursuant to its 
authority under the FCRA and the Dodd-Frank Act. Effective July 21, 
2011, section 1061 of the Dodd-Frank Act transferred to the Bureau the 
rulemaking and certain other authorities of the FTC, the Board, the 
FDIC, the NCUA, the OCC, and the OTS relating to the enumerated 
consumer laws, including most of the rulemaking authority under the 
FCRA.\16\ Likewise, effective July 21, 2011, section 1088 of the Dodd-
Frank Act made conforming amendments to the FCRA transferring 
rulemaking authority under much of the FCRA, except those regulations 
applicable to certain motor vehicle dealers,\17\ to the Bureau. 
Accordingly, this interim final rule implements most of the FCRA 
pursuant to the amended statute, as discussed further below.\18\
---------------------------------------------------------------------------

    \16\ Section 1002(12)(F) of the Dodd-Frank Act designates most 
of the FCRA as an ``enumerated consumer law.''
    \17\ See section 1029 of the Consumer Financial Protection Act 
of 2010, Title X of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act, Public Law 111-203, 124 Stat. 1376.
    \18\ Section 1066 of the Dodd-Frank Act grants the Secretary of 
the Treasury interim authority to perform certain functions of the 
Bureau. Pursuant to that authority, Treasury is publishing this 
interim final rule on behalf of the Bureau. Until this and other 
interim final rules take effect, existing regulations for which 
rulemaking authority transferred to the Bureau continue to govern 
persons covered by this rule. See 76 FR 43569 (July 21, 2011).
---------------------------------------------------------------------------

    The FCRA, as amended, authorizes the Bureau to issue regulations to 
carry out the purposes of the FCRA.\19\ The Bureau is generally 
authorized to issue regulations as ``necessary or appropriate to 
administer and carry out the purposes and objectives of [the FCRA], and 
to prevent evasions thereof or to facilitate compliance therewith.'' 
\20\ The Dodd-Frank Act does not, however, transfer to the Bureau 
rulemaking authority for FCRA sections 615(e) (``Red Flag Guidelines 
and Regulations Required'') and 628 (``Disposal of Records'').\21\ 
Thus, the Bureau's new Regulation V does not include parallel 
provisions to the other Federal agencies' rules on the disposal of 
consumer information; the rules on identity theft red flags and 
corresponding interagency guidelines on identity theft detection, 
prevention, and mitigation; and the rules on the duties of card issuers 
regarding changes of address.
---------------------------------------------------------------------------

    \19\ See 15 U.S.C. 1681s(e); Public Law 111-203, section 
1088(a)(10)(E).
    \20\ Id.
    \21\ Id.
---------------------------------------------------------------------------

B. Authority To Issue an Interim Final Rule Without Prior Notice and 
Comment

    The Administrative Procedure Act (APA) \22\ generally requires 
public notice and an opportunity to comment before promulgation of 
regulations.\23\ The APA provides exceptions to notice-and-comment 
procedures, however, where an agency for good cause finds that such 
procedures are impracticable, unnecessary, or contrary to the public 
interest or when a rulemaking relates to agency organization, 
procedure, and practice.\24\ The Bureau finds that there is good cause 
to conclude that providing notice and opportunity for comment would be 
unnecessary and contrary to the public interest under these 
circumstances. In addition, substantially all the changes made by this 
interim final rule, which were necessitated by the Dodd-Frank Act's 
transfer of FCRA authority from the agencies to the Bureau, relate to 
agency organization, procedure, and practice and are thus exempt from 
the APA's notice-and-comment requirements.
---------------------------------------------------------------------------

    \22\ 5 U.S.C. 551 et seq.
    \23\ 5 U.S.C. 553(b), (c).
    \24\ 5 U.S.C. 553(b)(3)(A), (B).
---------------------------------------------------------------------------

    The Bureau's good cause findings are based on the following 
considerations. As an initial matter, the existing FCRA regulations 
were a result of notice-and-comment rulemaking to the extent required. 
Moreover, the interim final rule published today does not impose any 
new, substantive obligations on regulated entities. Rather, the interim 
final rule makes only non-substantive, technical changes to the 
existing text of the regulation, such as renumbering, changing internal 
cross-references, replacing appropriate nomenclature, to reflect the 
transfer of authority to the Bureau, and changing the address for 
filing applications and notices. Given the technical nature of these 
changes, and the fact that the interim final rule does not impose any 
additional substantive requirements on covered entities, an opportunity 
for prior public comment is unnecessary. In addition, recodifying the 
above agencies' regulations to reflect the transfer of authority to the 
Bureau will help facilitate compliance with the FCRA and its 
implementing regulations, and the new regulations will help reduce 
uncertainty regarding the applicable regulatory framework. Using 
notice-and comment procedures would delay this process and thus be 
contrary to the public interest.
    The APA generally requires that rules be published not less than 30 
days before their effective dates. See 5 U.S.C. 553(d). As with the 
notice and comment requirement, however, the APA allows an exception 
when ``otherwise provided by the agency for good cause found and 
published with the rule.'' 5 U.S.C. 553(d)(3). The Bureau finds that 
there is good cause for providing less than 30 days notice here. A 
delayed effective date would harm consumers and regulated entities by 
needlessly perpetuating discrepancies between the amended statutory 
text and the implementing regulation, thereby hindering compliance and 
prolonging uncertainty regarding the applicable regulatory 
framework.\25\
---------------------------------------------------------------------------

    \25\ This interim final rule is one of 14 companion rulemakings 
that together restate and recodify the implementing regulations 
under 14 existing consumer financial laws (part III.C, below, lists 
the 14 laws involved). In the interest of proper coordination of 
this overall regulatory framework, which includes numerous cross-
references among some of the regulations, the Bureau is establishing 
the same effective date of December 30, 2011 for those rules 
published on or before that date and making those published 
thereafter (if any) effective immediately.
---------------------------------------------------------------------------

    In addition, delaying the effective date of the interim final rule 
for 30 days would provide no practical benefit to regulated entities in 
this context and in fact could operate to their detriment. As discussed 
above, the interim final rule published today does not impose any new, 
substantive obligations on regulated entities. Instead, the rule makes 
only non-substantive, technical changes to the existing text of the 
regulation. Thus, regulated entities that are already in compliance 
with the existing rules will not need to modify business practices as a 
result of this rule. To the extent that one-time modifications to forms 
are required, the

[[Page 79311]]

Bureau has provided an ample implementation period to allow appropriate 
advance notice and facilitate compliance without suspending the 
benefits of the interim final rule during the intervening period.

C. Section 1022(b)(2) of the Dodd-Frank Act

    In developing the interim final rule, the Bureau has conducted an 
analysis of potential benefits, costs, and impacts.\26\ The Bureau 
believes that the interim final rule will benefit consumers and covered 
persons by updating and recodifying Regulation V to reflect the 
transfer of authority to the Bureau and certain other changes mandated 
by the Dodd-Frank Act. This will help facilitate compliance with the 
FCRA and its implementing regulations and help reduce any uncertainty 
regarding the applicable regulatory framework. Although the interim 
final rule will require the modification of forms to reflect the 
transfer of authority to the Bureau, as discussed below, the interim 
final rule will not impose any new substantive obligations on consumers 
or covered persons and is not expected to have any impact on consumers' 
access to consumer financial products and services.
---------------------------------------------------------------------------

    \26\ Section 1022(b)(2)(A) of the Dodd-Frank Act addresses the 
consideration of the potential benefits and costs of regulation to 
consumers and covered persons, including the potential reduction of 
access by consumers to consumer financial products or services; the 
impact on depository institutions and credit unions with $10 billion 
or less in total assets as described in section 1026 of the Dodd-
Frank Act; and the impact on consumers in rural areas. Section 
1022(b)(2)(B) requires that the Bureau ``consult with the 
appropriate prudential regulators or other Federal agencies prior to 
proposing a rule and during the comment process regarding 
consistency with prudential, market, or systemic objectives 
administered by such agencies.'' The manner and extent to which 
these provisions apply to interim final rules and to benefits, costs 
and impacts that are compelled by statutory changes rather than 
discretionary Bureau action is unclear. Nevertheless, to inform this 
rulemaking more fully, the Bureau performed the described analyses 
and consultations.
---------------------------------------------------------------------------

    As a general matter, this interim final rule does not impose 
additional reporting, disclosure, or other requirements beyond those 
previously in existence. As noted elsewhere in this SUPPLEMENTARY 
INFORMATION, the interim final rule republishes 11 model forms with 
references to either the Board or the Federal Trade Commission replaced 
with references to the Bureau. In these cases, covered entities may 
need to make one-time revisions to their disclosures. The Bureau 
estimates that these changes will take two hours per form, per firm; 
the precise number of form changes varies with the type of affected 
firm. The Bureau thus estimates that these changes will impose a total 
cost of roughly $98,271,000 spread across approximately 214,000 firms. 
These costs may be overstated to the extent that multiple firms use the 
same software vendors, who are able to spread any costs over all of 
their affected clients. These estimates may also be overstated because 
the Bureau is giving affected firms one year to effect the changes, 
thus allowing affected firms to include the changes in routine, 
scheduled systems updates during the next year. These one-time changes 
to the affected disclosures ultimately will provide ongoing benefits to 
consumers by providing them with accurate information on whom to 
contact for additional information.
    Although not required by the interim final rule, affected firms may 
incur some costs in updating compliance manuals and related materials 
to reflect the new numbering and other technical changes reflected in 
the new Regulation V. The Bureau has worked to reduce any such burden 
by preserving the existing numbering to the extent possible, and 
believes that such costs will likely be minimal. These changes could be 
handled in the short term by providing a short, standalone summary 
alerting users to the changes and in the long term could be combined 
with other updates at the firm's convenience. The Bureau intends to 
continue investigating the possible costs to affected firms of updating 
manuals and related materials to reflect these changes and solicits 
comments on this and other issues discussed in this section.
    The interim final rule will have no unique impact on depository 
institutions or credit unions with $10 billion or less in assets as 
described in section 1026(a) of the Dodd-Frank Act. Also, the interim 
final rule will have no unique impact on rural consumers.
    In undertaking the process of recodifying Regulation V, as well as 
regulations implementing thirteen other existing consumer financial 
laws,\27\ the Bureau consulted the Federal Deposit Insurance 
Corporation, the Office of the Comptroller of the Currency, the 
National Credit Union Administration, the Board of Governors of the 
Federal Reserve System, the Federal Trade Commission, and the 
Department of Housing and Urban Development, including with respect to 
consistency with any prudential, market, or systemic objectives that 
may be administered by such agencies.\28\ The Bureau also has consulted 
with the Office of Management and Budget for technical assistance. The 
Bureau expects to have further consultations with the appropriate 
Federal agencies during the comment period.
---------------------------------------------------------------------------

    \27\ The fourteen laws implemented by this and its companion 
rulemakings are: the Consumer Leasing Act, the Electronic Fund 
Transfer Act (except with respect to section 920 of that Act), the 
Equal Credit Opportunity Act, the Fair Credit Reporting Act (except 
with respect to sections 615(e) and 628 of that act), the Fair Debt 
Collection Practices Act, Subsections (b) through (f) of section 43 
of the Federal Deposit Insurance Act, sections 502 through 509 of 
the Gramm-Leach-Bliley Act (except for section 505 as it applies to 
section 501(b)), the Home Mortgage Disclosure Act, the Real Estate 
Settlement Procedures Act, the S.A.F.E. Mortgage Licensing Act, the 
Truth in Lending Act, the Truth in Savings Act, section 626 of the 
Omnibus Appropriations Act, 2009, and the Interstate Land Sales Full 
Disclosure Act.
    \28\ In light of the technical but voluminous nature of this 
recodification project, the Bureau focused the consultation process 
on a representative sample of the recodified regulations, while 
making information on the other regulations available. The Bureau 
expects to conduct differently its future consultations regarding 
substantive rulemakings.
---------------------------------------------------------------------------

IV. Request for Comment

    Although notice and comment rulemaking procedures are not required, 
the Bureau invites comments on this notice. Commenters are specifically 
encouraged to identify any technical issues raised by the rule. The 
Bureau is also seeking comment in response to a notice published at 76 
FR 75825 (Dec. 5, 2011) concerning its efforts to identify priorities 
for streamlining regulations that it has inherited from other Federal 
agencies to address provisions that are outdated, unduly burdensome, or 
unnecessary.

V. Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA), as amended by the Small 
Business Regulatory Enforcement Fairness Act of 1996, requires each 
agency to consider the potential impact of its regulations on small 
entities, including small businesses, small governmental units, and 
small not-for-profit organizations.\29\ The RFA generally requires an 
agency to conduct an initial regulatory flexibility analysis (IRFA) and 
a final regulatory flexibility analysis (FRFA) of any rule subject to 
notice-and-comment rulemaking requirements, unless the agency certifies 
that the rule will not have a significant economic impact on a 
substantial number of small entities.\30\ The Bureau also is subject to 
certain additional procedures under the RFA involving the convening of 
a panel to consult with small business representatives prior to 
proposing a rule for which an IRFA is required.\31\
---------------------------------------------------------------------------

    \29\ 5 U.S.C. 601 et seq.
    \30\ 5 U.S.C. 603, 604.
    \31\ 5 U.S.C. 609.
---------------------------------------------------------------------------

    The IRFA and FRFA requirements described above apply only where a

[[Page 79312]]

notice of proposed rulemaking is required,\32\ and the panel 
requirement applies only when a rulemaking requires an IRFA.\33\ As 
discussed above in part III, a notice of proposed rulemaking is not 
required for this rulemaking.
---------------------------------------------------------------------------

    \32\ 5 U.S.C. 603(a), 604(a); 5 U.S.C. 553(b)(B).
    \33\ 5 U.S.C. 609(b).
---------------------------------------------------------------------------

    In addition, as discussed above, this interim final rule has only a 
minor impact on entities subject to Regulation V. Accordingly, the 
undersigned certifies that this interim final rule will not have a 
significant economic impact on a substantial number of small entities. 
The rule imposes no new, substantive obligations on covered entities 
and will require only minor, one-time adjustments to certain model 
forms, as discussed in part III above. Moreover, as noted, the per-firm 
cost estimate discussed above may be overstated to the extent that 
multiple firms use the same software vendors, who are able to spread 
costs over all of their affected clients. Small entities, in 
particular, are especially likely to rely on outside vendors for 
disclosure compliance systems and therefore may have even less burden 
in complying with the one-time changes required by this interim final 
rule.

VI. Paperwork Reduction Act

    The Bureau may not conduct or sponsor, and a respondent is not 
required to respond to, an information collection unless it displays a 
currently valid Office of Management and Budget (OMB) control number. 
This rule contains information collection requirements under the 
Paperwork Reduction Act (PRA), which have been previously approved by 
OMB, and the ongoing PRA burden for which is unchanged by this rule. 
There are no new information collection requirements in this interim 
final rule. The Bureau's OMB control number for this information 
collection is: 3170-0002.

List of Subjects in 12 CFR Part 1022

    Banks, Banking, Consumer protection, Credit unions, Fair Credit 
Reporting Act, Holding companies, National banks, Privacy, Reporting 
and recordkeeping requirements, Savings associations, State member 
banks.

Authority and Issuance

    For the reasons set forth above, the Bureau of Consumer Financial 
Protection adds part 1022 to Chapter X in Title 12 of the Code of 
Federal Regulations to read as follows:

PART 1022--FAIR CREDIT REPORTING (REGULATION V)

Subpart A--General Provisions
Sec.
1022.1 Purpose, scope, and model forms and disclosures.
1022.2 Examples.
1022.3 Definitions.
Subpart B--[Reserved]
Subpart C--Affiliate Marketing
1022.20 Coverage and definitions.
1022.21 Affiliate marketing opt-out and exceptions.
1022.22 Scope and duration of opt-out.
1022.23 Contents of opt-out notice; consolidated and equivalent 
notices.
1022.24 Reasonable opportunity to opt out.
1022.25 Reasonable and simple methods of opting out.
1022.26 Delivery of opt-out notices.
1022.27 Renewal of opt-out.
Subpart D--Medical Information
1022.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
1022.31 Limits on redisclosure of information.
1022.32 Sharing medical information with affiliates.
Subpart E--Duties of Furnishers of Information
1022.40 Scope.
1022.41 Definitions.
1022.42 Reasonable policies and procedures concerning the accuracy 
and integrity of furnished information.
1022.43 Direct disputes.
Subpart F--Duties of Users Regarding Obtaining and Using Consumer 
Reports
1022.50-1022.53 [Reserved]
1022.54 Duties of users making written firm offers of credit or 
insurance based on information contained in consumer files.
Subpart G--[Reserved]
Subpart H--Duties of Users Regarding Risk-Based Pricing
1022.70 Scope.
1022.71 Definitions.
1022.72 General requirements for risk-based pricing notices.
1022.73 Content, form, and timing of risk-based pricing notices.
1022.74 Exceptions.
1022.75 Rules of construction.
Subpart I--Duties of Users of Consumer Reports Regarding Identity Theft
1022.80-1022.81 [Reserved]
1022.82 Duties of users regarding address discrepancies.
Subparts J-L--[Reserved]
Subpart M--Duties of Consumer Reporting Agencies Regarding Identity 
Theft
1022.120 [Reserved]
1022.121 Active duty alerts.
1022.122 [Reserved]
1022.123 Proof of identity.
Subpart N--Duties of Consumer Reporting Agencies Regarding Disclosures 
to Consumers
1022.130 Definitions
1022.131-1022.135 [Reserved]
1022.136 Centralized source for requesting annual file disclosures 
from nationwide consumer reporting agencies.
1022.137 Streamlined process for requesting annual file disclosures 
from nationwide specialty consumer reporting agencies.
1022.138 Prevention of deceptive marketing of free credit reports.
Subpart O--Miscellaneous Duties of Consumer Reporting Agencies
1022.140 Prohibition against circumventing or evading treatment as a 
consumer reporting agency.
Appendix A to Part 1022 [Reserved]
Appendix B to Part 1022--Model Notices of Furnishing Negative 
Information
Appendix C to Part 1022--Model Forms for Opt-Out Notices
Appendix D to Part 1022--Model Forms for Firm Offers of Credit or 
Insurance
Appendix E to Part 1022-- Interagency Guidelines Concerning the 
Accuracy and Integrity of Information Furnished to Consumer 
Reporting Agencies
Appendices F-G to Part 1022 [Reserved]
Appendix H to Part 1022--Model Forms for Risk-Based Pricing and 
Credit Score Disclosure Exception Notices
Appendix I to Part 1022--Summary of Consumer Identity Theft Rights
Appendix J to Part 1022 [Reserved]
Appendix K to Part 1022--Summary of Consumer Rights
Appendix L to Part 1022--Standardized Form for Requesting Annual 
File Disclosures
Appendix M to Part 1022--Notice of Furnisher Responsibilities
Appendix N to Part 1022--Notice of User Responsibilities

    Authority: 12 U.S.C. 5512, 5581; 15 U.S.C. 1681a, 1681b, 1681c, 
1681c-1, 1681e, 1681g, 1681i, 1681j, 1681m, 1681s, 1681s-2, 1681s-3, 
and 1681t; Sec. 214, Public Law 108-159, 117 Stat. 1952.

Subpart A--General Provisions


Sec.  1022.1  Purpose, scope, and model forms and disclosures.

    (a) Purpose. The purpose of this part is to implement the Fair 
Credit Reporting Act (FCRA). This part generally applies to persons 
that obtain and use information about consumers to determine the 
consumer's eligibility for products, services, or employment, share 
such information among affiliates, and furnish information to consumer 
reporting agencies.
    (b) Scope. (1) [Reserved]
    (2) Institutions covered. (i) Except as otherwise provided in this 
part, this part applies to any person subject to the FCRA except for a 
person excluded from coverage of this part by section 1029 of the 
Consumer Financial Protection Act

[[Page 79313]]

of 2010, Title X of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act, Public Law 111-203, 124 Stat. 1376.
    (ii) For purposes of Appendix B to this part, financial 
institutions as defined in section 509 of the Gramm-Leach-Bliley Act 
(12 U.S.C. 6809), may use the model notices in Appendix B to this part 
to comply with the notice requirement in section 623(a)(7) of the FCRA 
(15 U.S.C. 1681s-2(a)(7)).
    (c) Model forms and disclosures. (1) Use. Appendices D, H, I, K, L, 
M, and N contain model forms and disclosures. These appendices carry 
out the directive in FCRA that the Bureau prescribe such model forms 
and disclosures. Use or distribution of these model forms and 
disclosures, or substantially similar forms and disclosures, will 
constitute compliance with any section or subsection of the FCRA 
requiring that such forms and disclosures be used by or supplied to any 
person.
    (2) Definition. Substantially similar means that all information in 
the Bureau's prescribed model is included in the document that is 
distributed, and that the document distributed is formatted in a way 
consistent with the format prescribed by the Bureau. The document that 
is distributed shall not include anything that interferes with, 
detracts from, or otherwise undermines the information contained in the 
Bureau's prescribed model. Until January 1, 2013, the model forms in 
Appendices B, E, F, G, and H to 16 CFR part 698, as those appendices 
existed as of October 1, 2011, are deemed substantially similar to the 
corresponding model forms in Appendices H, I, K, M, and N to this part, 
and the model forms in Appendix H to 12 CFR part 222, as that appendix 
existed as of October 1, 2011, are deemed substantially similar to the 
corresponding model forms in Appendix H to this part.


Sec.  1022.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  1022.3  Definitions.

    For purposes of this part, unless explicitly stated otherwise:
    (a) Act means the FCRA (15 U.S.C. 1681 et seq.).
    (b) Affiliate means any company that is related by common ownership 
or common corporate control with another company. For example, an 
affiliate of a Federal credit union is a credit union service 
corporation, as provided in 12 CFR part 712, that is controlled by the 
Federal credit union.
    (c) [Reserved]
    (d) Common ownership or common corporate control means a 
relationship between two companies under which:
    (1) One company has, with respect to the other company:
    (i) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of a company, 
directly or indirectly, or acting through one or more other persons;
    (ii) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of a company; or
    (iii) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of a company, as determined 
by the applicable prudential regulator (as defined in 12 U.S.C. 
5481(24)) (a credit union is presumed to have a controlling influence 
over the management or policies of a credit union service corporation 
if the credit union service corporation is 67% owned by credit unions) 
or, where there is no prudential regulator, by the Bureau; or
    (2) Any other person has, with respect to both companies, a 
relationship described in paragraphs (d)(1)(i) through (d)(1)(ii).
    (e) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (f) Consumer means an individual.
    (g) Identifying information means any name or number that may be 
used, alone or in conjunction with any other information, to identify a 
specific person, including any:
    (1) Name, social security number, date of birth, official state or 
government issued driver's license or identification number, alien 
registration number, government passport number, employer or taxpayer 
identification number;
    (2) Unique biometric data, such as fingerprint, voice print, retina 
or iris image, or other unique physical representation;
    (3) Unique electronic identification number, address, or routing 
code; or
    (4) Telecommunication identifying information or access device (as 
defined in 18 U.S.C. 1029(e)).
    (h) Identity theft means a fraud committed or attempted using the 
identifying information of another person without authority.
    (i)(1) Identity theft report means a report:
    (i) That alleges identity theft with as much specificity as the 
consumer can provide;
    (ii) That is a copy of an official, valid report filed by the 
consumer with a Federal, state, or local law enforcement agency, 
including the United States Postal Inspection Service, the filing of 
which subjects the person filing the report to criminal penalties 
relating to the filing of false information, if, in fact, the 
information in the report is false; and
    (iii) That may include additional information or documentation that 
an information furnisher or consumer reporting agency reasonably 
requests for the purpose of determining the validity of the alleged 
identity theft, provided that the information furnisher or consumer 
reporting agency:
    (A) Makes such request not later than fifteen days after the date 
of receipt of the copy of the report form identified in Paragraph 
(i)(1)(ii) of this section or the request by the consumer for the 
particular service, whichever shall be the later;
    (B) Makes any supplemental requests for information or 
documentation and final determination on the acceptance of the identity 
theft report within another fifteen days after its initial request for 
information or documentation; and
    (C) Shall have five days to make a final determination on the 
acceptance of the identity theft report, in the event that the consumer 
reporting agency or information furnisher receives any such additional 
information or documentation on the eleventh day or later within the 
fifteen day period set forth in Paragraph (i)(1)(iii)(B) of this 
section.
    (2) Examples of the specificity referenced in Paragraph (i)(1)(i) 
of this section are provided for illustrative purposes only, as 
follows:
    (i) Specific dates relating to the identity theft such as when the 
loss or theft of personal information occurred or when the fraud(s) 
using the personal information occurred, and how the consumer 
discovered or otherwise learned of the theft.
    (ii) Identification information or any other information about the 
perpetrator, if known.
    (iii) Name(s) of information furnisher(s), account numbers, or 
other relevant account information related to the identity theft.
    (iv) Any other information known to the consumer about the identity 
theft.
    (3) Examples of when it would or would not be reasonable to request 
additional information or documentation referenced in Paragraph

[[Page 79314]]

(i)(1)(iii) of this section are provided for illustrative purposes 
only, as follows:
    (i) A law enforcement report containing detailed information about 
the identity theft and the signature, badge number or other 
identification information of the individual law enforcement official 
taking the report should be sufficient on its face to support a 
victim's request. In this case, without an identifiable concern, such 
as an indication that the report was fraudulent, it would not be 
reasonable for an information furnisher or consumer reporting agency to 
request additional information or documentation.
    (ii) A consumer might provide a law enforcement report similar to 
the report in Paragraph (i)(1) of this section but certain important 
information such as the consumer's date of birth or Social Security 
number may be missing because the consumer chose not to provide it. The 
information furnisher or consumer reporting agency could accept this 
report, but it would be reasonable to require that the consumer provide 
the missing information. The Bureau's Identity Theft Affidavit is 
available on the Bureau's Web site (consumerfinance.gov/learnmore). The 
version of this form developed by the Federal Trade Commission, 
available on the FTC's Web site (ftc.gov/idtheft), remains valid and 
sufficient for this purpose.
    (iii) A consumer might provide a law enforcement report generated 
by an automated system with a simple allegation that an identity theft 
occurred to support a request for a tradeline block or cessation of 
information furnishing. In such a case, it would be reasonable for an 
information furnisher or consumer reporting agency to ask that the 
consumer fill out and have notarized the Bureau's Identity Theft 
Affidavit or a similar form and provide some form of identification 
documentation.
    (iv) A consumer might provide a law enforcement report generated by 
an automated system with a simple allegation that an identity theft 
occurred to support a request for an extended fraud alert. In this 
case, it would not be reasonable for a consumer reporting agency to 
require additional documentation or information, such as a notarized 
affidavit.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to:
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or email address;
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy; or
    (iv) Information that does not identify a specific consumer.
    (l) Person means any individual, partnership, corporation, trust, 
estate cooperative, association, government or governmental subdivision 
or agency, or other entity.

Subpart B--[Reserved]

Subpart C--Affiliate Marketing


Sec.  1022.20  Coverage and definitions.

    (a) Coverage. Subpart C of this part applies to any person that 
uses information from its affiliates for the purpose of marketing 
solicitations, or provides information to its affiliates for that 
purpose, other than a person excluded from coverage of this part by 
section 1029 of the Consumer Financial Protection Act of 2010, Title X 
of the Dodd-Frank Wall Street Reform and Consumer Protection Act, 
Public Law 111-203, 124 Stat. 137.
    (b) Definitions. For purposes of this subpart:
    (1) Clear and conspicuous. The term ``clear and conspicuous'' means 
reasonably understandable and designed to call attention to the nature 
and significance of the information presented.
    (2) Concise. (i) In general. The term ``concise'' means a 
reasonably brief expression or statement.
    (ii) Combination with other required disclosures. A notice required 
by this subpart may be concise even if it is combined with other 
disclosures required or authorized by Federal or state law.
    (3) Eligibility information. The term ``eligibility information'' 
means any information the communication of which would be a consumer 
report if the exclusions from the definition of ``consumer report'' in 
section 603(d)(2)(A) of the Act did not apply. Eligibility information 
does not include aggregate or blind data that does not contain personal 
identifiers such as account numbers, names, or addresses.
    (4) Pre-existing business relationship. (i) In general. The term 
``pre-existing business relationship'' means a relationship between a 
person, or a person's licensed agent, and a consumer based on:
    (A) A financial contract between the person and the consumer which 
is in force on the date on which the consumer is sent a solicitation 
covered by this subpart;
    (B) The purchase, rental, or lease by the consumer of the person's 
goods or services, or a financial transaction (including holding an 
active account or a policy in force or having another continuing 
relationship) between the consumer and the person, during the 18-month 
period immediately preceding the date on which the consumer is sent a 
solicitation covered by this subpart; or
    (C) An inquiry or application by the consumer regarding a product 
or service offered by that person during the three-month period 
immediately preceding the date on which the consumer is sent a 
solicitation covered by this subpart.
    (ii) Examples of pre-existing business relationships. (A) If a 
consumer has a time deposit account, such as a certificate of deposit, 
at a financial institution that is currently in force, the financial 
institution has a pre-existing business relationship with the consumer 
and can use eligibility information it receives from its affiliates to 
make solicitations to the consumer about its products or services.
    (B) If a consumer obtained a certificate of deposit from a 
financial institution, but did not renew the certificate at maturity, 
the financial institution has a pre-existing business relationship with 
the consumer and can use eligibility information it receives from its 
affiliates to make solicitations to the consumer about its products or 
services for 18 months after the date of maturity of the certificate of 
deposit.
    (C) If a consumer obtains a mortgage, the mortgage lender has a 
pre-existing business relationship with the consumer. If the mortgage 
lender sells the consumer's entire loan to an investor, the mortgage 
lender has a pre-existing business relationship with the consumer and 
can use eligibility information it receives from its affiliates to make 
solicitations to the consumer about its products or services for 18 
months after the date it sells the loan, and the investor has a pre-
existing business relationship with the consumer upon purchasing the 
loan. If, however, the mortgage lender sells a fractional interest in 
the consumer's loan to an investor but also retains an ownership

[[Page 79315]]

interest in the loan, the mortgage lender continues to have a pre-
existing business relationship with the consumer, but the investor does 
not have a pre-existing business relationship with the consumer. If the 
mortgage lender retains ownership of the loan, but sells ownership of 
the servicing rights to the consumer's loan, the mortgage lender 
continues to have a pre-existing business relationship with the 
consumer. The purchaser of the servicing rights also has a pre-existing 
business relationship with the consumer as of the date it purchases 
ownership of the servicing rights, but only if it collects payments 
from or otherwise deals directly with the consumer on a continuing 
basis.
    (D) If a consumer applies to a financial institution for a product 
or service that it offers, but does not obtain a product or service 
from or enter into a financial contract or transaction with the 
institution, the financial institution has a pre-existing business 
relationship with the consumer and can therefore use eligibility 
information it receives from an affiliate to make solicitations to the 
consumer about its products or services for three months after the date 
of the application.
    (E) If a consumer makes a telephone inquiry to a financial 
institution about its products or services and provides contact 
information to the institution, but does not obtain a product or 
service from or enter into a financial contract or transaction with the 
institution, the financial institution has a pre-existing business 
relationship with the consumer and can therefore use eligibility 
information it receives from an affiliate to make solicitations to the 
consumer about its products or services for three months after the date 
of the inquiry.
    (F) If a consumer makes an inquiry to a financial institution by 
email about its products or services, but does not obtain a product or 
service from or enter into a financial contract or transaction with the 
institution, the financial institution has a pre-existing business 
relationship with the consumer and can therefore use eligibility 
information it receives from an affiliate to make solicitations to the 
consumer about its products or services for three months after the date 
of the inquiry.
    (G) If a consumer has an existing relationship with a financial 
institution that is part of a group of affiliated companies, makes a 
telephone call to the centralized call center for the group of 
affiliated companies to inquire about products or services offered by 
the insurance affiliate, and provides contact information to the call 
center, the call constitutes an inquiry to the insurance affiliate that 
offers those products or services. The insurance affiliate has a pre-
existing business relationship with the consumer and can therefore use 
eligibility information it receives from its affiliated financial 
institution to make solicitations to the consumer about its products or 
services for three months after the date of the inquiry.
    (iii) Examples where no pre-existing business relationship is 
created. (A) If a consumer makes a telephone call to a centralized call 
center for a group of affiliated companies to inquire about the 
consumer's existing account at a financial institution, the call does 
not constitute an inquiry to any affiliate other than the financial 
institution that holds the consumer's account and does not establish a 
pre-existing business relationship between the consumer and any 
affiliate of the account-holding financial institution.
    (B) If a consumer who has a deposit account with a financial 
institution makes a telephone call to an affiliate of the institution 
to ask about the affiliate's retail locations and hours, but does not 
make an inquiry about the affiliate's products or services, the call 
does not constitute an inquiry and does not establish a pre-existing 
business relationship between the consumer and the affiliate. Also, the 
affiliate's capture of the consumer's telephone number does not 
constitute an inquiry and does not establish a pre-existing business 
relationship between the consumer and the affiliate.
    (C) If a consumer makes a telephone call to a financial institution 
in response to an advertisement that offers a free promotional item to 
consumers who call a toll-free number, but the advertisement does not 
indicate that the financial institution's products or services will be 
marketed to consumers who call in response, the call does not create a 
pre-existing business relationship between the consumer and the 
financial institution because the consumer has not made an inquiry 
about a product or service offered by the institution, but has merely 
responded to an offer for a free promotional item.
    (5) Solicitation. (i) In general. The term ``solicitation'' means 
the marketing of a product or service initiated by a person to a 
particular consumer that is:
    (A) Based on eligibility information communicated to that person by 
its affiliate as described in this subpart; and
    (B) Intended to encourage the consumer to purchase or obtain such 
product or service.
    (ii) Exclusion of marketing directed at the general public. A 
solicitation does not include marketing communications that are 
directed at the general public. For example, television, general 
circulation magazine, and billboard advertisements do not constitute 
solicitations, even if those communications are intended to encourage 
consumers to purchase products and services from the person initiating 
the communications.
    (iii) Examples of solicitations. A solicitation would include, for 
example, a telemarketing call, direct mail, email, or other form of 
marketing communication directed to a particular consumer that is based 
on eligibility information received from an affiliate.
    (6) You means a person described in paragraph (a) of this section.


Sec.  1022.21  Affiliate marketing opt-out and exceptions.

    (a) Initial notice and opt-out requirement. (1) In general. You may 
not use eligibility information about a consumer that you receive from 
an affiliate to make a solicitation for marketing purposes to the 
consumer, unless:
    (i) It is clearly and conspicuously disclosed to the consumer in 
writing or, if the consumer agrees, electronically, in a concise notice 
that you may use eligibility information about that consumer received 
from an affiliate to make solicitations for marketing purposes to the 
consumer;
    (ii) The consumer is provided a reasonable opportunity and a 
reasonable and simple method to ``opt out,'' or prohibit you from using 
eligibility information to make solicitations for marketing purposes to 
the consumer; and
    (iii) The consumer has not opted out.
    (2) Example. A consumer has a homeowner's insurance policy with an 
insurance company. The insurance company furnishes eligibility 
information about the consumer to its affiliated creditor. Based on 
that eligibility information, the creditor wants to make a solicitation 
to the consumer about its home equity loan products. The creditor does 
not have a pre-existing business relationship with the consumer and 
none of the other exceptions apply. The creditor is prohibited from 
using eligibility information received from its insurance affiliate to 
make solicitations to the consumer about its home equity loan products 
unless the consumer is given a notice and opportunity to opt out and 
the consumer does not opt out.
    (3) Affiliates who may provide the notice. The notice required by 
this paragraph must be provided:
    (i) By an affiliate that has or has previously had a pre-existing 
business relationship with the consumer; or

[[Page 79316]]

    (ii) As part of a joint notice from two or more members of an 
affiliated group of companies, provided that at least one of the 
affiliates on the joint notice has or has previously had a pre-existing 
business relationship with the consumer.
    (b) Making solicitations. (1) In general. For purposes of this 
subpart, you make a solicitation for marketing purposes if:
    (i) You receive eligibility information from an affiliate;
    (ii) You use that eligibility information to do one or more of the 
following:
    (A) Identify the consumer or type of consumer to receive a 
solicitation;
    (B) Establish criteria used to select the consumer to receive a 
solicitation; or
    (C) Decide which of your products or services to market to the 
consumer or tailor your solicitation to that consumer; and
    (iii) As a result of your use of the eligibility information, the 
consumer is provided a solicitation.
    (2) Receiving eligibility information from an affiliate, including 
through a common database. You may receive eligibility information from 
an affiliate in various ways, including when the affiliate places that 
information into a common database that you may access.
    (3) Receipt or use of eligibility information by your service 
provider. Except as provided in paragraph (b)(5) of this section, you 
receive or use an affiliate's eligibility information if a service 
provider acting on your behalf (whether an affiliate or a nonaffiliated 
third party) receives or uses that information in the manner described 
in paragraphs (b)(1)(i) or (b)(1)(ii) of this section. All relevant 
facts and circumstances will determine whether a person is acting as 
your service provider when it receives or uses an affiliate's 
eligibility information in connection with marketing your products and 
services.
    (4) Use by an affiliate of its own eligibility information. Unless 
you have used eligibility information that you receive from an 
affiliate in the manner described in paragraph (b)(1)(ii) of this 
section, you do not make a solicitation subject to this subpart if your 
affiliate:
    (i) Uses its own eligibility information that it obtained in 
connection with a pre-existing business relationship it has or had with 
the consumer to market your products or services to the consumer; or
    (ii) Directs its service provider to use the affiliate's own 
eligibility information that it obtained in connection with a pre-
existing business relationship it has or had with the consumer to 
market your products or services to the consumer, and you do not 
communicate directly with the service provider regarding that use.
    (5) Use of eligibility information by a service provider. (i) In 
general. You do not make a solicitation subject to Subpart C of this 
part if a service provider (including an affiliated or third-party 
service provider that maintains or accesses a common database that you 
may access) receives eligibility information from your affiliate that 
your affiliate obtained in connection with a pre-existing business 
relationship it has or had with the consumer and uses that eligibility 
information to market your products or services to the consumer, so 
long as:
    (A) Your affiliate controls access to and use of its eligibility 
information by the service provider (including the right to establish 
the specific terms and conditions under which the service provider may 
use such information to market your products or services);
    (B) Your affiliate establishes specific terms and conditions under 
which the service provider may access and use the affiliate's 
eligibility information to market your products and services (or those 
of affiliates generally) to the consumer, such as the identity of the 
affiliated companies whose products or services may be marketed to the 
consumer by the service provider, the types of products or services of 
affiliated companies that may be marketed, and the number of times the 
consumer may receive marketing materials, and periodically evaluates 
the service provider's compliance with those terms and conditions;
    (C) Your affiliate requires the service provider to implement 
reasonable policies and procedures designed to ensure that the service 
provider uses the affiliate's eligibility information in accordance 
with the terms and conditions established by the affiliate relating to 
the marketing of your products or services;
    (D) Your affiliate is identified on or with the marketing materials 
provided to the consumer; and
    (E) You do not directly use your affiliate's eligibility 
information in the manner described in paragraph (b)(1)(ii) of this 
section.
    (ii) Writing requirements. (A) The requirements of paragraphs 
(b)(5)(i)(A) and (C) of this section must be set forth in a written 
agreement between your affiliate and the service provider; and
    (B) The specific terms and conditions established by your affiliate 
as provided in paragraph (b)(5)(i)(B) of this section must be set forth 
in writing.
    (6) Examples of making solicitations. (i) A consumer has a deposit 
account with a financial institution, which is affiliated with an 
insurance company. The insurance company receives eligibility 
information about the consumer from the financial institution. The 
insurance company uses that eligibility information to identify the 
consumer to receive a solicitation about insurance products, and, as a 
result, the insurance company provides a solicitation to the consumer 
about its insurance products. Pursuant to paragraph (b)(1) of this 
section, the insurance company has made a solicitation to the consumer.
    (ii) The same facts as in the example in paragraph (b)(6)(i) of 
this section, except that after using the eligibility information to 
identify the consumer to receive a solicitation about insurance 
products, the insurance company asks the financial institution to send 
the solicitation to the consumer and the financial institution does so. 
Pursuant to paragraph (b)(1) of this section, the insurance company has 
made a solicitation to the consumer because it used eligibility 
information about the consumer that it received from an affiliate to 
identify the consumer to receive a solicitation about its products or 
services, and, as a result, a solicitation was provided to the consumer 
about the insurance company's products.
    (iii) The same facts as in the example in paragraph (b)(6)(i) of 
this section, except that eligibility information about consumers that 
have deposit accounts with the financial institution is placed into a 
common database that all members of the affiliated group of companies 
may independently access and use. Without using the financial 
institution's eligibility information, the insurance company develops 
selection criteria and provides those criteria, marketing materials, 
and related instructions to the financial institution. The financial 
institution reviews eligibility information about its own consumers 
using the selection criteria provided by the insurance company to 
determine which consumers should receive the insurance company's 
marketing materials and sends marketing materials about the insurance 
company's products to those consumers. Even though the insurance 
company has received eligibility information through the common 
database as provided in paragraph (b)(2) of this section, it did not 
use that information to identify consumers or establish selection 
criteria; instead, the financial institution used its own eligibility 
information. Therefore, pursuant to paragraph

[[Page 79317]]

(b)(4)(i) of this section, the insurance company has not made a 
solicitation to the consumer.
    (iv) The same facts as in the example in paragraph (b)(6)(iii) of 
this section, except that the financial institution provides the 
insurance company's criteria to the financial institution's service 
provider and directs the service provider to use the financial 
institution's eligibility information to identify financial institution 
consumers who meet the criteria and to send the insurance company's 
marketing materials to those consumers. The insurance company does not 
communicate directly with the service provider regarding the use of the 
financial institution's information to market its products to the 
financial institution's consumers. Pursuant to paragraph (b)(4)(ii) of 
this section, the insurance company has not made a solicitation to the 
consumer.
    (v) An affiliated group of companies includes a financial 
institution, an insurance company, and a service provider. Each 
affiliate in the group places information about its consumers into a 
common database. The service provider has access to all information in 
the common database. The financial institution controls access to and 
use of its eligibility information by the service provider. This 
control is set forth in a written agreement between the financial 
institution and the service provider. The written agreement also 
requires the service provider to establish reasonable policies and 
procedures designed to ensure that the service provider uses the 
financial institution's eligibility information in accordance with 
specific terms and conditions established by the financial institution 
relating to the marketing of the products and services of all 
affiliates, including the insurance company. In a separate written 
communication, the financial institution specifies the terms and 
conditions under which the service provider may use the financial 
institution's eligibility information to market the insurance company's 
products and services to the financial institution's consumers. The 
specific terms and conditions are: a list of affiliated companies 
(including the insurance company) whose products or services may be 
marketed to the financial institution's consumers by the service 
provider; the specific products or types of products that may be 
marketed to the financial institution's consumers by the service 
provider; the categories of eligibility information that may be used by 
the service provider in marketing products or services to the financial 
institution's consumers; the types or categories of the financial 
institution's consumers to whom the service provider may market 
products or services of financial institution affiliates; the number 
and/or types of marketing communications that the service provider may 
send to the financial institution's consumers; and the length of time 
during which the service provider may market the products or services 
of the financial institution's affiliates to its consumers. The 
financial institution periodically evaluates the service provider's 
compliance with these terms and conditions. The insurance company asks 
the service provider to market insurance products to certain consumers 
who have deposit accounts with the financial institution. Without using 
the financial institution's eligibility information, the insurance 
company develops selection criteria and provides those criteria, 
marketing materials, and related instructions to the service provider. 
The service provider uses the financial institution's eligibility 
information from the common database to identify the financial 
institution's consumers to whom insurance products will be marketed. 
When the insurance company's marketing materials are provided to the 
identified consumers, the name of the financial institution is 
displayed on the insurance marketing materials, an introductory letter 
that accompanies the marketing materials, an account statement that 
accompanies the marketing materials, or the envelope containing the 
marketing materials. The requirements of paragraph (b)(5) of this 
section have been satisfied, and the insurance company has not made a 
solicitation to the consumer.
    (vi) The same facts as in the example in paragraph (b)(6)(v) of 
this section, except that the terms and conditions permit the service 
provider to use the financial institution's eligibility information to 
market the products and services of other affiliates to the financial 
institution's consumers whenever the service provider deems it 
appropriate to do so. The service provider uses the financial 
institution's eligibility information in accordance with the discretion 
afforded to it by the terms and conditions. Because the terms and 
conditions are not specific, the requirements of paragraph (b)(5) of 
this section have not been satisfied.
    (c) Exceptions. The provisions of this subpart do not apply to you 
if you use eligibility information that you receive from an affiliate:
    (1) To make a solicitation for marketing purposes to a consumer 
with whom you have a pre-existing business relationship;
    (2) To facilitate communications to an individual for whose benefit 
you provide employee benefit or other services pursuant to a contract 
with an employer related to and arising out of the current employment 
relationship or status of the individual as a participant or 
beneficiary of an employee benefit plan;
    (3) To perform services on behalf of an affiliate, except that this 
subparagraph shall not be construed as permitting you to send 
solicitations on behalf of an affiliate if the affiliate would not be 
permitted to send the solicitation as a result of the election of the 
consumer to opt out under this subpart;
    (4) In response to a communication about your products or services 
initiated by the consumer;
    (5) In response to an authorization or request by the consumer to 
receive solicitations; or
    (6) If your compliance with this subpart would prevent you from 
complying with any provision of state insurance laws pertaining to 
unfair discrimination in any state in which you are lawfully doing 
business.
    (d) Examples of exceptions. (1) Example of the pre-existing 
business relationship exception. A consumer has a deposit account with 
a financial institution. The consumer also has a relationship with the 
financial institution's securities affiliate for management of the 
consumer's securities portfolio. The financial institution receives 
eligibility information about the consumer from its securities 
affiliate and uses that information to make a solicitation to the 
consumer about the financial institution's wealth management services. 
The financial institution may make this solicitation even if the 
consumer has not been given a notice and opportunity to opt out because 
the financial institution has a pre-existing business relationship with 
the consumer.
    (2) Examples of service provider exception. (i) A consumer has an 
insurance policy issued by an insurance company. The insurance company 
furnishes eligibility information about the consumer to its affiliated 
financial institution. Based on that eligibility information, the 
financial institution wants to make a solicitation to the consumer 
about its deposit products. The financial institution does not have a 
pre-existing business relationship with the consumer and none of the 
other exceptions in paragraph (c) of this section apply. The consumer 
has been given an opt-out notice and has elected to opt out of 
receiving such

[[Page 79318]]

solicitations. The financial institution asks a service provider to 
send the solicitation to the consumer on its behalf. The service 
provider may not send the solicitation on behalf of the financial 
institution because, as a result of the consumer's opt-out election, 
the financial institution is not permitted to make the solicitation.
    (ii) The same facts as in paragraph (d)(2)(i) of this section, 
except the consumer has been given an opt-out notice, but has not 
elected to opt out. The financial institution asks a service provider 
to send the solicitation to the consumer on its behalf. The service 
provider may send the solicitation on behalf of the financial 
institution because, as a result of the consumer's not opting out, the 
financial institution is permitted to make the solicitation.
    (3) Examples of consumer-initiated communications. (i) A consumer 
who has a deposit account with a financial institution initiates a 
communication with the financial institution's credit card affiliate to 
request information about a credit card. The credit card affiliate may 
use eligibility information about the consumer it obtains from the 
financial institution or any other affiliate to make solicitations 
regarding credit card products in response to the consumer-initiated 
communication.
    (ii) A consumer who has a deposit account with a financial 
institution contacts the institution to request information about how 
to save and invest for a child's college education without specifying 
the type of product in which the consumer may be interested. 
Information about a range of different products or services offered by 
the financial institution and one or more affiliates of the institution 
may be responsive to that communication. Such products or services may 
include the following: mutual funds offered by the institution's mutual 
fund affiliate; section 529 plans offered by the institution, its 
mutual fund affiliate, or another securities affiliate; or trust 
services offered by a different financial institution in the affiliated 
group. Any affiliate offering investment products or services that 
would be responsive to the consumer's request for information about 
saving and investing for a child's college education may use 
eligibility information to make solicitations to the consumer in 
response to this communication.
    (iii) A credit card issuer makes a marketing call to the consumer 
without using eligibility information received from an affiliate. The 
issuer leaves a voice-mail message that invites the consumer to call a 
toll-free number to apply for the issuer's credit card. If the consumer 
calls the toll-free number to inquire about the credit card, the call 
is a consumer-initiated communication about a product or service and 
the credit card issuer may now use eligibility information it receives 
from its affiliates to make solicitations to the consumer.
    (iv) A consumer calls a financial institution to ask about retail 
locations and hours, but does not request information about products or 
services. The institution may not use eligibility information it 
receives from an affiliate to make solicitations to the consumer about 
its products or services because the consumer-initiated communication 
does not relate to the financial institution's products or services. 
Thus, the use of eligibility information received from an affiliate 
would not be responsive to the communication and the exception does not 
apply.
    (v) A consumer calls a financial institution to ask about retail 
locations and hours. The customer service representative asks the 
consumer if there is a particular product or service about which the 
consumer is seeking information. The consumer responds that the 
consumer wants to stop in and find out about certificates of deposit. 
The customer service representative offers to provide that information 
by telephone and mail additional information and application materials 
to the consumer. The consumer agrees and provides or confirms contact 
information for receipt of the materials to be mailed. The financial 
institution may use eligibility information it receives from an 
affiliate to make solicitations to the consumer about certificates of 
deposit because such solicitations would respond to the consumer-
initiated communication about products or services.
    (4) Examples of consumer authorization or request for 
solicitations. (i) A consumer who obtains a mortgage from a mortgage 
lender authorizes or requests information about homeowner's insurance 
offered by the mortgage lender's insurance affiliate. Such 
authorization or request, whether given to the mortgage lender or to 
the insurance affiliate, would permit the insurance affiliate to use 
eligibility information about the consumer it obtains from the mortgage 
lender or any other affiliate to make solicitations to the consumer 
about homeowner's insurance.
    (ii) A consumer completes an online application to apply for a 
credit card from a credit card issuer. The issuer's online application 
contains a blank check box that the consumer may check to authorize or 
request information from the credit card issuer's affiliates. The 
consumer checks the box. The consumer has authorized or requested 
solicitations from the card issuer's affiliates.
    (iii) A consumer completes an online application to apply for a 
credit card from a credit card issuer. The issuer's online application 
contains a pre-selected check box indicating that the consumer 
authorizes or requests information from the issuer's affiliates. The 
consumer does not deselect the check box. The consumer has not 
authorized or requested solicitations from the card issuer's 
affiliates.
    (iv) The terms and conditions of a credit card account agreement 
contain preprinted boilerplate language stating that by applying to 
open an account the consumer authorizes or requests to receive 
solicitations from the credit card issuer's affiliates. The consumer 
has not authorized or requested solicitations from the card issuer's 
affiliates.
    (e) Relation to affiliate-sharing notice and opt-out. Nothing in 
this subpart limits the responsibility of a person to comply with the 
notice and opt-out provisions of section 603(d)(2)(A)(iii) of the Act 
where applicable.


Sec.  1022.22  Scope and duration of opt-out.

    (a) Scope of opt-out. (1) In general. Except as otherwise provided 
in this section, the consumer's election to opt out prohibits any 
affiliate covered by the opt-out notice from using eligibility 
information received from another affiliate as described in the notice 
to make solicitations to the consumer.
    (2) Continuing relationship. (i) In general. If the consumer 
establishes a continuing relationship with you or your affiliate, an 
opt-out notice may apply to eligibility information obtained in 
connection with:
    (A) A single continuing relationship or multiple continuing 
relationships that the consumer establishes with you or your 
affiliates, including continuing relationships established subsequent 
to delivery of the opt-out notice, so long as the notice adequately 
describes the continuing relationships covered by the opt-out; or
    (B) Any other transaction between the consumer and you or your 
affiliates as described in the notice.
    (ii) Examples of continuing relationships. A consumer has a 
continuing relationship with you or your affiliate if the consumer:
    (A) Opens a deposit or investment account with you or your 
affiliate;
    (B) Obtains a loan for which you or your affiliate owns the 
servicing rights;
    (C) Purchases an insurance product from you or your affiliate;

[[Page 79319]]

    (D) Holds an investment product through you or your affiliate, such 
as when you act or your affiliate acts as a custodian for securities or 
for assets in an individual retirement arrangement;
    (E) Enters into an agreement or understanding with you or your 
affiliate whereby you or your affiliate undertakes to arrange or broker 
a home mortgage loan for the consumer;
    (F) Enters into a lease of personal property with you or your 
affiliate; or
    (G) Obtains financial, investment, or economic advisory services 
from you or your affiliate for a fee.
    (3) No continuing relationship. (i) In general. If there is no 
continuing relationship between a consumer and you or your affiliate, 
and you or your affiliate obtain eligibility information about a 
consumer in connection with a transaction with the consumer, such as an 
isolated transaction or a credit application that is denied, an opt-out 
notice provided to the consumer only applies to eligibility information 
obtained in connection with that transaction.
    (ii) Examples of isolated transactions. An isolated transaction 
occurs if:
    (A) The consumer uses your or your affiliate's ATM to withdraw cash 
from an account at another financial institution; or
    (B) You or your affiliate sells the consumer a cashier's check or 
money order, airline tickets, travel insurance, or traveler's checks in 
isolated transactions.
    (4) Menu of alternatives. A consumer may be given the opportunity 
to choose from a menu of alternatives when electing to prohibit 
solicitations, such as by electing to prohibit solicitations from 
certain types of affiliates covered by the opt-out notice but not other 
types of affiliates covered by the notice, electing to prohibit 
solicitations based on certain types of eligibility information but not 
other types of eligibility information, or electing to prohibit 
solicitations by certain methods of delivery but not other methods of 
delivery. However, one of the alternatives must allow the consumer to 
prohibit all solicitations from all of the affiliates that are covered 
by the notice.
    (5) Special rule for a notice following termination of all 
continuing relationships. (i) In general. A consumer must be given a 
new opt-out notice if, after all continuing relationships with you or 
your affiliate(s) are terminated, the consumer subsequently establishes 
another continuing relationship with you or your affiliate(s) and the 
consumer's eligibility information is to be used to make a 
solicitation. The new opt-out notice must apply, at a minimum, to 
eligibility information obtained in connection with the new continuing 
relationship. Consistent with paragraph (b) of this section, the 
consumer's decision not to opt out after receiving the new opt-out 
notice would not override a prior opt-out election by the consumer that 
applies to eligibility information obtained in connection with a 
terminated relationship, regardless of whether the new opt-out notice 
applies to eligibility information obtained in connection with the 
terminated relationship.
    (ii) Example. A consumer has a checking account with a financial 
institution that is part of an affiliated group. The consumer closes 
the checking account. One year after closing the checking account, the 
consumer opens a savings account with the same financial institution. 
The consumer must be given a new notice and opportunity to opt out 
before the financial institution's affiliates may make solicitations to 
the consumer using eligibility information obtained by the financial 
institution in connection with the new savings account relationship, 
regardless of whether the consumer opted out in connection with the 
checking account.
    (b) Duration of opt-out. The election of a consumer to opt out must 
be effective for a period of at least five years (the ``opt-out 
period'') beginning when the consumer's opt-out election is received 
and implemented, unless the consumer subsequently revokes the opt-out 
in writing or, if the consumer agrees, electronically. An opt-out 
period of more than five years may be established, including an opt-out 
period that does not expire unless revoked by the consumer.
    (c) Time of opt-out. A consumer may opt out at any time.


Sec.  1022.23  Contents of opt-out notice; consolidated and equivalent 
notices.

    (a) Contents of opt-out notice. (1) In general. A notice must be 
clear, conspicuous, and concise, and must accurately disclose:
    (i) The name of the affiliate(s) providing the notice. If the 
notice is provided jointly by multiple affiliates and each affiliate 
shares a common name, such as ``ABC,'' then the notice may indicate 
that it is being provided by multiple companies with the ABC name or 
multiple companies in the ABC group or family of companies, for 
example, by stating that the notice is provided by ``all of the ABC 
companies,'' ``the ABC banking, credit card, insurance, and securities 
companies,'' or by listing the name of each affiliate providing the 
notice. But if the affiliates providing the joint notice do not all 
share a common name, then the notice must either separately identify 
each affiliate by name or identify each of the common names used by 
those affiliates, for example, by stating that the notice is provided 
by ``all of the ABC and XYZ companies'' or by ``the ABC banking and 
credit card companies and the XYZ insurance companies;''
    (ii) A list of the affiliates or types of affiliates whose use of 
eligibility information is covered by the notice, which may include 
companies that become affiliates after the notice is provided to the 
consumer. If each affiliate covered by the notice shares a common name, 
such as ``ABC,'' then the notice may indicate that it applies to 
multiple companies with the ABC name or multiple companies in the ABC 
group or family of companies, for example, by stating that the notice 
is provided by ``all of the ABC companies,'' ``the ABC banking, credit 
card, insurance, and securities companies,'' or by listing the name of 
each affiliate providing the notice. But if the affiliates covered by 
the notice do not all share a common name, then the notice must either 
separately identify each covered affiliate by name or identify each of 
the common names used by those affiliates, for example, by stating that 
the notice applies to ``all of the ABC and XYZ companies'' or to ``the 
ABC banking and credit card companies and the XYZ insurance 
companies;''
    (iii) A general description of the types of eligibility information 
that may be used to make solicitations to the consumer;
    (iv) That the consumer may elect to limit the use of eligibility 
information to make solicitations to the consumer;
    (v) That the consumer's election will apply for the specified 
period of time stated in the notice and, if applicable, that the 
consumer will be allowed to renew the election once that period 
expires;
    (vi) If the notice is provided to consumers who may have previously 
opted out, such as if a notice is provided to consumers annually, that 
the consumer who has chosen to limit solicitations does not need to act 
again until the consumer receives a renewal notice; and
    (vii) A reasonable and simple method for the consumer to opt out.
    (2) Joint relationships. (i) If two or more consumers jointly 
obtain a product or service, a single opt-out notice may be provided to 
the joint consumers. Any of the joint consumers may exercise the right 
to opt out.
    (ii) The opt-out notice must explain how an opt-out direction by a 
joint

[[Page 79320]]

consumer will be treated. An opt-out direction by a joint consumer may 
be treated as applying to all of the associated joint consumers, or 
each joint consumer may be permitted to opt out separately. If each 
joint consumer is permitted to opt out separately, one of the joint 
consumers must be permitted to opt out on behalf of all of the joint 
consumers and the joint consumers must be permitted to exercise their 
separate rights to opt out in a single response.
    (iii) It is impermissible to require all joint consumers to opt out 
before implementing any opt-out direction.
    (3) Alternative contents. If the consumer is afforded a broader 
right to opt out of receiving marketing than is required by this 
subpart, the requirements of this section may be satisfied by providing 
the consumer with a clear, conspicuous, and concise notice that 
accurately discloses the consumer's opt-out rights.
    (4) Model notices. Model notices are provided in Appendix C of this 
part.
    (b) Coordinated and consolidated notices. A notice required by this 
subpart may be coordinated and consolidated with any other notice or 
disclosure required to be issued under any other provision of law by 
the entity providing the notice, including but not limited to the 
notice described in section 603(d)(2)(A)(iii) of the Act and the Gramm-
Leach-Bliley Act privacy notice.
    (c) Equivalent notices. A notice or other disclosure that is 
equivalent to the notice required by this subpart, and that is provided 
to a consumer together with disclosures required by any other provision 
of law, satisfies the requirements of this section.


Sec.  1022.24  Reasonable opportunity to opt out.

    (a) In general. You must not use eligibility information about a 
consumer that you receive from an affiliate to make a solicitation to 
the consumer about your products or services, unless the consumer is 
provided a reasonable opportunity to opt out, as required by Sec.  
1022.21(a)(1)(ii) of this part.
    (b) Examples of a reasonable opportunity to opt out. The consumer 
is given a reasonable opportunity to opt out if:
    (1) By mail. The opt-out notice is mailed to the consumer. The 
consumer is given 30 days from the date the notice is mailed to elect 
to opt out by any reasonable means.
    (2) By electronic means. (i) The opt-out notice is provided 
electronically to the consumer, such as by posting the notice at a Web 
site at which the consumer has obtained a product or service. The 
consumer acknowledges receipt of the electronic notice. The consumer is 
given 30 days after the date the consumer acknowledges receipt to elect 
to opt out by any reasonable means.
    (ii) The opt-out notice is provided to the consumer by email where 
the consumer has agreed to receive disclosures by email from the person 
sending the notice. The consumer is given 30 days after the email is 
sent to elect to opt out by any reasonable means.
    (3) At the time of an electronic transaction. The opt-out notice is 
provided to the consumer at the time of an electronic transaction, such 
as a transaction conducted on a Web site. The consumer is required to 
decide, as a necessary part of proceeding with the transaction, whether 
to opt out before completing the transaction. There is a simple process 
that the consumer may use to opt out at that time using the same 
mechanism through which the transaction is conducted.
    (4) At the time of an in-person transaction. The opt-out notice is 
provided to the consumer in writing at the time of an in-person 
transaction. The consumer is required to decide, as a necessary part of 
proceeding with the transaction, whether to opt out before completing 
the transaction, and is not permitted to complete the transaction 
without making a choice. There is a simple process that the consumer 
may use during the course of the in-person transaction to opt out, such 
as completing a form that requires consumers to write a ``yes'' or 
``no'' to indicate their opt-out preference or that requires the 
consumer to check one of two blank check boxes; one that allows 
consumers to indicate that they want to opt out and one that allows 
consumers to indicate that they do not want to opt out.
    (5) By including in a privacy notice. The opt-out notice is 
included in a Gramm-Leach-Bliley Act privacy notice. The consumer is 
allowed to exercise the opt-out within a reasonable period of time and 
in the same manner as the opt-out under that privacy notice.


Sec.  1022.25  Reasonable and simple methods of opting out.

    (a) In general. You must not use eligibility information about a 
consumer that you receive from an affiliate to make a solicitation to 
the consumer about your products or services, unless the consumer is 
provided a reasonable and simple method to opt out, as required by 
Sec.  1022.21(a)(1)(ii) of this part.
    (b) Examples. (1) Reasonable and simple opt-out methods. Reasonable 
and simple methods for exercising the opt-out right include:
    (i) Designating a check-off box in a prominent position on the opt-
out form;
    (ii) Including a reply form and a self-addressed envelope together 
with the opt-out notice;
    (iii) Providing an electronic means to opt out, such as a form that 
can be electronically mailed or processed at a Web site, if the 
consumer agrees to the electronic delivery of information;
    (iv) Providing a toll-free telephone number that consumers may call 
to opt out; or
    (v) Allowing consumers to exercise all of their opt-out rights 
described in a consolidated opt-out notice that includes the privacy 
opt-out under the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., the 
affiliate sharing opt-out under the Act, and the affiliate marketing 
opt-out under the Act, by a single method, such as by calling a single 
toll-free telephone number.
    (2) Opt-out methods that are not reasonable and simple. Reasonable 
and simple methods for exercising an opt-out right do not include--
    (i) Requiring the consumer to write his or her own letter;
    (ii) Requiring the consumer to call or write to obtain a form for 
opting out, rather than including the form with the opt-out notice;
    (iii) Requiring the consumer who receives the opt-out notice in 
electronic form only, such as through posting at a Web site, to opt out 
solely by paper mail or by visiting a different Web site without 
providing a link to that site.
    (c) Specific opt-out means. Each consumer may be required to opt 
out through a specific means, as long as that means is reasonable and 
simple for that consumer.


Sec.  1022.26  Delivery of opt-out notices.

    (a) In general. The opt-out notice must be provided so that each 
consumer can reasonably be expected to receive actual notice. For opt-
out notices provided electronically, the notice may be provided in 
compliance with either the electronic disclosure provisions in this 
subpart or the provisions in section 101 of the Electronic Signatures 
in Global and National Commerce Act, 15 U.S.C. 7001 et seq.
    (b) Examples of reasonable expectation of actual notice. A consumer 
may reasonably be expected to receive actual notice if the affiliate 
providing the notice:
    (1) Hand-delivers a printed copy of the notice to the consumer;

[[Page 79321]]

    (2) Mails a printed copy of the notice to the last known mailing 
address of the consumer;
    (3) Provides a notice by email to a consumer who has agreed to 
receive electronic disclosures by email from the affiliate providing 
the notice; or
    (4) Posts the notice on the Web site at which the consumer obtained 
a product or service electronically and requires the consumer to 
acknowledge receipt of the notice.
    (c) Examples of no reasonable expectation of actual notice. A 
consumer may not reasonably be expected to receive actual notice if the 
affiliate providing the notice:
    (1) Only posts the notice on a sign in a branch or office or 
generally publishes the notice in a newspaper;
    (2) Sends the notice via email to a consumer who has not agreed to 
receive electronic disclosures by email from the affiliate providing 
the notice; or
    (3) Posts the notice on a Web site without requiring the consumer 
to acknowledge receipt of the notice.


Sec.  1022.27  Renewal of opt-out.

    (a) Renewal notice and opt-out requirement. (1) In general. After 
the opt-out period expires, you may not make solicitations based on 
eligibility information you receive from an affiliate to a consumer who 
previously opted out, unless:
    (i) The consumer has been given a renewal notice that complies with 
the requirements of this section and Sec. Sec.  1022.24 through 1022.26 
of this part, and a reasonable opportunity and a reasonable and simple 
method to renew the opt-out, and the consumer does not renew the opt-
out; or
    (ii) An exception in Sec.  1022.21(c) of this part applies.
    (2) Renewal period. Each opt-out renewal must be effective for a 
period of at least five years as provided in Sec.  1022.22(b) of this 
part.
    (3) Affiliates who may provide the notice. The notice required by 
this paragraph must be provided:
    (i) By the affiliate that provided the previous opt-out notice, or 
its successor; or
    (ii) As part of a joint renewal notice from two or more members of 
an affiliated group of companies, or their successors, that jointly 
provided the previous opt-out notice.
    (b) Contents of renewal notice. The renewal notice must be clear, 
conspicuous, and concise, and must accurately disclose:
    (1) The name of the affiliate(s) providing the notice. If the 
notice is provided jointly by multiple affiliates and each affiliate 
shares a common name, such as ``ABC,'' then the notice may indicate 
that it is being provided by multiple companies with the ABC name or 
multiple companies in the ABC group or family of companies, for 
example, by stating that the notice is provided by ``all of the ABC 
companies,'' ``the ABC banking, credit card, insurance, and securities 
companies,'' or by listing the name of each affiliate providing the 
notice. But if the affiliates providing the joint notice do not all 
share a common name, then the notice must either separately identify 
each affiliate by name or identify each of the common names used by 
those affiliates, for example, by stating that the notice is provided 
by ``all of the ABC and XYZ companies'' or by ``the ABC banking and 
credit card companies and the XYZ insurance companies'';
    (2) A list of the affiliates or types of affiliates whose use of 
eligibility information is covered by the notice, which may include 
companies that become affiliates after the notice is provided to the 
consumer. If each affiliate covered by the notice shares a common name, 
such as ``ABC,'' then the notice may indicate that it applies to 
multiple companies with the ABC name or multiple companies in the ABC 
group or family of companies, for example, by stating that the notice 
is provided by ``all of the ABC companies,'' ``the ABC banking, credit 
card, insurance, and securities companies,'' or by listing the name of 
each affiliate providing the notice. But if the affiliates covered by 
the notice do not all share a common name, then the notice must either 
separately identify each covered affiliate by name or identify each of 
the common names used by those affiliates, for example, by stating that 
the notice applies to ``all of the ABC and XYZ companies'' or to ``the 
ABC banking and credit card companies and the XYZ insurance 
companies;''
    (3) A general description of the types of eligibility information 
that may be used to make solicitations to the consumer;
    (4) That the consumer previously elected to limit the use of 
certain information to make solicitations to the consumer;
    (5) That the consumer's election has expired or is about to expire;
    (6) That the consumer may elect to renew the consumer's previous 
election;
    (7) If applicable, that the consumer's election to renew will apply 
for the specified period of time stated in the notice and that the 
consumer will be allowed to renew the election once that period 
expires; and
    (8) A reasonable and simple method for the consumer to opt out.
    (c) Timing of the renewal notice. (1) In general. A renewal notice 
may be provided to the consumer either:
    (i) A reasonable period of time before the expiration of the opt-
out period; or
    (ii) Any time after the expiration of the opt-out period but before 
solicitations that would have been prohibited by the expired opt-out 
are made to the consumer.
    (2) Combination with annual privacy notice. If you provide an 
annual privacy notice under the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 
et seq., providing a renewal notice with the last annual privacy notice 
provided to the consumer before expiration of the opt-out period is a 
reasonable period of time before expiration of the opt-out in all 
cases.
    (d) No effect on opt-out period. An opt-out period may not be 
shortened by sending a renewal notice to the consumer before expiration 
of the opt-out period, even if the consumer does not renew the opt out.

Subpart D--Medical Information


Sec.  1022.30  Obtaining or using medical information in connection 
with a determination of eligibility for credit.

    (a) Scope. This section applies to any person that participates as 
a creditor in a transaction, except for a person excluded from coverage 
of this part by section 1029 of the Consumer Financial Protection Act 
of 2010, Title X of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act, Public Law 111-203, 124 Stat. 137.
    (b) General prohibition on obtaining or using medical information. 
(1) In general. A creditor may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this section.
    (2) Definitions. (i) Credit has the same meaning as in section 702 
of the Equal Credit Opportunity Act, 15 U.S.C. 1691a.
    (ii) Creditor has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (iii) Eligibility, or continued eligibility, for credit means the 
consumer's qualification or fitness to receive, or continue to receive, 
credit, including the terms on which credit is offered. The term does 
not include:
    (A) Any determination of the consumer's qualification or fitness 
for employment, insurance (other than a credit insurance product), or 
other non-credit products or services;
    (B) Authorizing, processing, or documenting a payment or 
transaction

[[Page 79322]]

on behalf of the consumer in a manner that does not involve a 
determination of the consumer's eligibility, or continued eligibility, 
for credit; or
    (C) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (c) Rule of construction for obtaining and using unsolicited 
medical information. (1) In general. A creditor does not obtain medical 
information in violation of the prohibition if it receives medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit without specifically requesting medical information.
    (2) Use of unsolicited medical information. A creditor that 
receives unsolicited medical information in the manner described in 
paragraph (c)(1) of this section may use that information in connection 
with any determination of the consumer's eligibility, or continued 
eligibility, for credit to the extent the creditor can rely on at least 
one of the exceptions in Sec.  1022.30(d) or (e).
    (3) Examples. A creditor does not obtain medical information in 
violation of the prohibition if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the creditor receives information that the consumer owes a 
debt to a hospital.
    (ii) In a conversation with the creditor's loan officer, the 
consumer informs the creditor that the consumer has a particular 
medical condition.
    (iii) In connection with a consumer's application for an extension 
of credit, the creditor requests a consumer report from a consumer 
reporting agency and receives medical information in the consumer 
report furnished by the agency even though the creditor did not 
specifically request medical information from the consumer reporting 
agency.
    (d) Financial information exception for obtaining and using medical 
information. (1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit so long as:
    (i) The information is the type of information routinely used in 
making credit eligibility determinations, such as information relating 
to debts, expenses, income, benefits, assets, collateral, or the 
purpose of the loan, including the use of proceeds;
    (ii) The creditor uses the medical information in a manner and to 
an extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The creditor does not take the consumer's physical, mental, 
or behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples. (i) Examples of the types of information routinely 
used in making credit eligibility determinations. Paragraph (d)(1)(i) 
of this section permits a creditor, for example, to obtain and use 
information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts to calculate, measure, or 
verify the repayment ability of the consumer, the use of proceeds, or 
the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
may serve as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income, workers' compensation income, or other benefits related to 
health or a medical condition that is relied on as a source of 
repayment; or
    (D) The identity of creditors to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to, a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The creditor contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The 
creditor learns that both debts are more than 90 days past due. Any two 
debts of this size that are more than 90 days past due would disqualify 
the consumer under the creditor's established underwriting criteria. 
The creditor denies the application on the basis that the consumer has 
a poor repayment history on outstanding debts. The creditor has used 
medical information in a manner and to an extent no less favorable than 
it would use comparable non-medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The creditor denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the creditor's underwriting criteria. The creditor has used 
medical information in a manner and to an extent that is no less 
favorable than it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The creditor learns that the debt is 
current. The applicant meets the income and other requirements of the 
creditor's underwriting guidelines. The creditor grants the 
application. The creditor has used medical information in accordance 
with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception. (A) A consumer applies for $25,000 of credit and includes on 
the application information about a $50,000 debt to a hospital. The 
creditor contacts the hospital to verify the amount and payment status 
of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a retail department store, the creditor would 
approve the application and extend credit based on the amount and 
repayment history of the outstanding debt. The creditor, however, 
denies the application because the consumer is indebted to a hospital. 
The creditor has used medical information, here the identity of the 
medical creditor, in a manner and to an extent that is less favorable 
than it would use comparable non-medical information.
    (B) A consumer meets with a loan officer of a creditor to apply for 
a mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the creditor's established requirements for 
the requested mortgage loan. The loan officer recommends to the credit 
committee that the consumer be denied credit because the consumer has 
that disease. The credit committee follows the loan officer's 
recommendation and denies the application because the consumer has a 
potentially terminal disease. The creditor has used medical information 
in a manner inconsistent with the exception by taking into account the 
consumer's physical, mental, or behavioral health, condition, or 
history, type of treatment, or prognosis as part of a determination of

[[Page 79323]]

eligibility or continued eligibility for credit.
    (C) A consumer who has an apparent medical condition, such as a 
consumer who uses a wheelchair or an oxygen tank, meets with a loan 
officer to apply for a home equity loan. The consumer meets the 
creditor's established requirements for the requested home equity loan 
and the creditor typically does not require consumers to obtain a debt 
cancellation contract, debt suspension agreement, or credit insurance 
product in connection with such loans. However, based on the consumer's 
apparent medical condition, the loan officer recommends to the credit 
committee that credit be extended to the consumer only if the consumer 
obtains a debt cancellation contract, debt suspension agreement, or 
credit insurance product from a nonaffiliated third party. The credit 
committee agrees with the loan officer's recommendation. The loan 
officer informs the consumer that the consumer must obtain a debt 
cancellation contract, debt suspension agreement, or credit insurance 
product from a nonaffiliated third party to qualify for the loan. The 
consumer obtains one of these products and the creditor approves the 
loan. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or prognosis in setting conditions on the consumer's 
eligibility for credit.
    (e) Specific exceptions for obtaining and using medical 
information. (1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit:
    (i) To determine whether the use of a power of attorney or legal 
representative that is triggered by a medical condition or event is 
necessary and appropriate or whether the consumer has the legal 
capacity to contract when a person seeks to exercise a power of 
attorney or act as legal representative for a consumer based on an 
asserted medical condition or event;
    (ii) To comply with applicable requirements of local, state, or 
Federal laws;
    (iii) To determine, at the consumer's request, whether the consumer 
qualifies for a legally permissible special credit program or credit-
related assistance program that is:
    (A) Designed to meet the special needs of consumers with medical 
conditions; and
    (B) Established and administered pursuant to a written plan that:
    (1) Identifies the class of persons that the program is designed to 
benefit; and
    (2) Sets forth the procedures and standards for extending credit or 
providing other credit-related assistance under the program;
    (iv) To the extent necessary for purposes of fraud prevention or 
detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) Consistent with safe and sound practices, if the consumer or 
the consumer's legal representative specifically requests that the 
creditor use medical information in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances, and such request is documented by 
the creditor;
    (vii) Consistent with safe and sound practices, to determine 
whether the provisions of a forbearance practice or program that is 
triggered by a medical condition or event apply to a consumer;
    (viii) To determine the consumer's eligibility for, the triggering 
of, or the reactivation of a debt cancellation contract or debt 
suspension agreement if a medical condition or event is a triggering 
event for the provision of benefits under the contract or agreement; or
    (ix) To determine the consumer's eligibility for, the triggering 
of, or the reactivation of a credit insurance product if a medical 
condition or event is a triggering event for the provision of benefits 
under the product.
    (2) Example of determining eligibility for a special credit program 
or credit assistance program. A not-for-profit organization establishes 
a credit assistance program pursuant to a written plan that is designed 
to assist disabled veterans in purchasing homes by subsidizing the down 
payment for the home purchase mortgage loans of qualifying veterans. 
The organization works through mortgage lenders and requires mortgage 
lenders to obtain medical information about the disability of any 
consumer that seeks to qualify for the program, use that information to 
verify the consumer's eligibility for the program, and forward that 
information to the organization. A consumer who is a veteran applies to 
a creditor for a home purchase mortgage loan. The creditor informs the 
consumer about the credit assistance program for disabled veterans and 
the consumer seeks to qualify for the program. Assuming that the 
program complies with all applicable law, including applicable fair 
lending laws, the creditor may obtain and use medical information about 
the medical condition and disability, if any, of the consumer to 
determine whether the consumer qualifies for the credit assistance 
program.
    (3) Examples of verifying the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the creditor may 
verify with the surgeon that the procedure will be performed. If the 
surgeon reports that surgery will not be performed on the consumer, the 
creditor may use that medical information to deny the consumer's 
application for credit, because the loan would not be used for the 
stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the creditor may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the creditor may use that medical information to 
offer the consumer only $5,000 of credit.
    (iii) A creditor has an established medical loan program for 
financing particular elective surgical procedures. The creditor 
receives a loan application from a consumer requesting $10,000 of 
credit under the established loan program for an elective surgical 
procedure. The consumer indicates on the application that the purpose 
of the loan is to finance an elective surgical procedure not eligible 
for funding under the guidelines of the established loan program. The 
creditor may deny the consumer's application because the purpose of the 
loan is not for a particular procedure funded by the established loan 
program.
    (4) Examples of obtaining and using medical information at the 
request of the consumer. (i) If a consumer applies for a loan and 
specifically requests that the creditor consider the consumer's medical 
disability at the relevant time as an explanation for adverse payment 
history information in his credit report, the creditor may consider 
such medical information in evaluating the consumer's willingness and 
ability to repay the requested loan to accommodate the consumer's 
particular circumstances, consistent with safe and sound practices. The 
creditor may also decline to consider such medical information to 
accommodate the consumer, but may evaluate the consumer's application 
in accordance with its otherwise applicable underwriting criteria. The 
creditor may

[[Page 79324]]

not deny the consumer's application or otherwise treat the consumer 
less favorably because the consumer specifically requested a medical 
accommodation, if the creditor would have extended the credit or 
treated the consumer more favorably under the creditor's otherwise 
applicable underwriting criteria.
    (ii) If a consumer applies for a loan by telephone and explains 
that his income has been and will continue to be interrupted on account 
of a medical condition and that he expects to repay the loan by 
liquidating assets, the creditor may, but is not required to, evaluate 
the application using the sale of assets as the primary source of 
repayment, consistent with safe and sound practices, provided that the 
creditor documents the consumer's request by recording the oral 
conversation or making a notation of the request in the consumer's 
file.
    (iii) If a consumer applies for a loan and the application form 
provides a space where the consumer may provide any other information 
or special circumstances, whether medical or non-medical, that the 
consumer would like the creditor to consider in evaluating the 
consumer's application, the creditor may use medical information 
provided by the consumer in that space on that application to 
accommodate the consumer's application for credit, consistent with safe 
and sound practices, or may disregard that information.
    (iv) If a consumer specifically requests that the creditor use 
medical information in determining the consumer's eligibility, or 
continued eligibility, for credit and provides the creditor with 
medical information for that purpose, and the creditor determines that 
it needs additional information regarding the consumer's circumstances, 
the creditor may request, obtain, and use additional medical 
information about the consumer as necessary to verify the information 
provided by the consumer or to determine whether to make an 
accommodation for the consumer. The consumer may decline to provide 
additional information, withdraw the request for an accommodation, and 
have the application considered under the creditor's otherwise 
applicable underwriting criteria.
    (v) If a consumer completes and signs a credit application that is 
not for medical purpose credit and the application contains boilerplate 
language that routinely requests medical information from the consumer 
or that indicates that by applying for credit the consumer authorizes 
or consents to the creditor obtaining and using medical information in 
connection with a determination of the consumer's eligibility, or 
continued eligibility, for credit, the consumer has not specifically 
requested that the creditor obtain and use medical information to 
accommodate the consumer's particular circumstances.
    (5) Example of a forbearance practice or program. After an 
appropriate safety and soundness review, a creditor institutes a 
program that allows consumers who are or will be hospitalized to defer 
payments as needed for up to three months, without penalty, if the 
credit account has been open for more than one year and has not 
previously been in default, and the consumer provides confirming 
documentation at an appropriate time. A consumer is hospitalized and 
does not pay her bill for a particular month. This consumer has had a 
credit account with the creditor for more than one year and has not 
previously been in default. The creditor attempts to contact the 
consumer and speaks with the consumer's adult child, who is not the 
consumer's legal representative. The adult child informs the creditor 
that the consumer is hospitalized and is unable to pay the bill at that 
time. The creditor defers payments for up to three months, without 
penalty, for the hospitalized consumer and sends the consumer a letter 
confirming this practice and the date on which the next payment will be 
due. The creditor has obtained and used medical information to 
determine whether the provisions of a medically-triggered forbearance 
practice or program apply to a consumer.


Sec.  1022.31  Limits on redisclosure of information.

    (a) Scope. This section applies to any person, except for a person 
excluded from coverage of this part by section 1029 of the Consumer 
Financial Protection Act of 2010, Title X of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 137.
    (b) Limits on redisclosure. If a person described in paragraph (a) 
of this section receives medical information about a consumer from a 
consumer reporting agency or its affiliate, the person must not 
disclose that information to any other person, except as necessary to 
carry out the purpose for which the information was initially 
disclosed, or as otherwise permitted by statute, regulation, or order.


Sec.  1022.32  Sharing medical information with affiliates.

    (a) Scope. This section applies to any person, except for a person 
excluded from coverage of this part by section 1029 of the Consumer 
Financial Protection Act of 2010, Title X of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 137.
    (b) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply to a person described in paragraph (a) of this 
section if that person communicates to an affiliate:
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (c) Exceptions. A person described in paragraph (a) of this section 
may rely on the exclusions from the term ``consumer report'' in section 
603(d)(2) of the Act to communicate the information in paragraph (b) of 
this section to an affiliate:
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability Act of 
1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
1022.30 of this part; or
    (6) As otherwise permitted by order of the Bureau.

Subpart E--Duties of Furnishers of Information


Sec.  1022.40  Scope.

    Subpart E of this part applies to any person that furnishes 
information to a consumer reporting agency, except for a person 
excluded from coverage of this part by section 1029 of the Consumer

[[Page 79325]]

Financial Protection Act of 2010, Title X of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 1376.


Sec.  1022.41  Definitions.

    For purposes of this subpart and Appendix E of this part, the 
following definitions apply:
    (a) Accuracy means that information that a furnisher provides to a 
consumer reporting agency about an account or other relationship with 
the consumer correctly:
    (1) Reflects the terms of and liability for the account or other 
relationship;
    (2) Reflects the consumer's performance and other conduct with 
respect to the account or other relationship; and
    (3) Identifies the appropriate consumer.
    (b) Direct dispute means a dispute submitted directly to a 
furnisher (including a furnisher that is a debt collector) by a 
consumer concerning the accuracy of any information contained in a 
consumer report and pertaining to an account or other relationship that 
the furnisher has or had with the consumer.
    (c) Furnisher means an entity that furnishes information relating 
to consumers to one or more consumer reporting agencies for inclusion 
in a consumer report. An entity is not a furnisher when it:
    (1) Provides information to a consumer reporting agency solely to 
obtain a consumer report in accordance with sections 604(a) and (f) of 
the FCRA;
    (2) Is acting as a ``consumer reporting agency'' as defined in 
section 603(f) of the FCRA;
    (3) Is a consumer to whom the furnished information pertains; or
    (4) Is a neighbor, friend, or associate of the consumer, or another 
individual with whom the consumer is acquainted or who may have 
knowledge about the consumer, and who provides information about the 
consumer's character, general reputation, personal characteristics, or 
mode of living in response to a specific request from a consumer 
reporting agency.
    (d) Integrity means that information that a furnisher provides to a 
consumer reporting agency about an account or other relationship with 
the consumer:
    (1) Is substantiated by the furnisher's records at the time it is 
furnished;
    (2) Is furnished in a form and manner that is designed to minimize 
the likelihood that the information may be incorrectly reflected in a 
consumer report; and
    (3) Includes the information in the furnisher's possession about 
the account or other relationship that the Bureau has:
    (i) Determined that the absence of which would likely be materially 
misleading in evaluating a consumer's creditworthiness, credit 
standing, credit capacity, character, general reputation, personal 
characteristics, or mode of living; and
    (ii) Listed in section I.(b)(2)(iii) of Appendix E of this part.


Sec.  1022.42  Reasonable policies and procedures concerning the 
accuracy and integrity of furnished information.

    (a) Policies and procedures. Each furnisher must establish and 
implement reasonable written policies and procedures regarding the 
accuracy and integrity of the information relating to consumers that it 
furnishes to a consumer reporting agency. The policies and procedures 
must be appropriate to the nature, size, complexity, and scope of each 
furnisher's activities.
    (b) Guidelines. Each furnisher must consider the guidelines in 
Appendix E of this part in developing its policies and procedures 
required by this section, and incorporate those guidelines that are 
appropriate.
    (c) Reviewing and updating policies and procedures. Each furnisher 
must review its policies and procedures required by this section 
periodically and update them as necessary to ensure their continued 
effectiveness.


Sec.  1022.43  Direct disputes.

    (a) General rule. Except as otherwise provided in this section, a 
furnisher must conduct a reasonable investigation of a direct dispute 
if it relates to:
    (1) The consumer's liability for a credit account or other debt 
with the furnisher, such as direct disputes relating to whether there 
is or has been identity theft or fraud against the consumer, whether 
there is individual or joint liability on an account, or whether the 
consumer is an authorized user of a credit account;
    (2) The terms of a credit account or other debt with the furnisher, 
such as direct disputes relating to the type of account, principal 
balance, scheduled payment amount on an account, or the amount of the 
credit limit on an open-end account;
    (3) The consumer's performance or other conduct concerning an 
account or other relationship with the furnisher, such as direct 
disputes relating to the current payment status, high balance, date a 
payment was made, the amount of a payment made, or the date an account 
was opened or closed; or
    (4) Any other information contained in a consumer report regarding 
an account or other relationship with the furnisher that bears on the 
consumer's creditworthiness, credit standing, credit capacity, 
character, general reputation, personal characteristics, or mode of 
living.
    (b) Exceptions. The requirements of paragraph (a) of this section 
do not apply to a furnisher if:
    (1) The direct dispute relates to:
    (i) The consumer's identifying information (other than a direct 
dispute relating to a consumer's liability for a credit account or 
other debt with the furnisher, as provided in paragraph (a)(1) of this 
section) such as name(s), date of birth, Social Security number, 
telephone number(s), or address(es);
    (ii) The identity of past or present employers;
    (iii) Inquiries or requests for a consumer report;
    (iv) Information derived from public records, such as judgments, 
bankruptcies, liens, and other legal matters (unless provided by a 
furnisher with an account or other relationship with the consumer);
    (v) Information related to fraud alerts or active duty alerts; or
    (vi) Information provided to a consumer reporting agency by another 
furnisher; or
    (2) The furnisher has a reasonable belief that the direct dispute 
is submitted by, is prepared on behalf of the consumer by, or is 
submitted on a form supplied to the consumer by, a credit repair 
organization, as defined in 15 U.S.C. 1679a(3), or an entity that would 
be a credit repair organization, but for 15 U.S.C. 1679a(3)(B)(i).
    (c) Direct dispute address. A furnisher is required to investigate 
a direct dispute only if a consumer submits a dispute notice to the 
furnisher at:
    (1) The address of a furnisher provided by a furnisher and set 
forth on a consumer report relating to the consumer;
    (2) An address clearly and conspicuously specified by the furnisher 
for submitting direct disputes that is provided to the consumer in 
writing or electronically (if the consumer has agreed to the electronic 
delivery of information from the furnisher); or
    (3) Any business address of the furnisher if the furnisher has not 
so specified and provided an address for submitting direct disputes 
under paragraphs (c)(1) or (2) of this section.
    (d) Direct dispute notice contents. A dispute notice must include:
    (1) Sufficient information to identify the account or other 
relationship that is in dispute, such as an account number and the 
name, address, and telephone number of the consumer, if applicable;
    (2) The specific information that the consumer is disputing and an

[[Page 79326]]

explanation of the basis for the dispute; and
    (3) All supporting documentation or other information reasonably 
required by the furnisher to substantiate the basis of the dispute. 
This documentation may include, for example: a copy of the relevant 
portion of the consumer report that contains the allegedly inaccurate 
information; a police report; a fraud or identity theft affidavit; a 
court order; or account statements.
    (e) Duty of furnisher after receiving a direct dispute notice. 
After receiving a dispute notice from a consumer pursuant to paragraphs 
(c) and (d) of this section, the furnisher must:
    (1) Conduct a reasonable investigation with respect to the disputed 
information;
    (2) Review all relevant information provided by the consumer with 
the dispute notice;
    (3) Complete its investigation of the dispute and report the 
results of the investigation to the consumer before the expiration of 
the period under section 611(a)(1) of the FCRA (15 U.S.C. 1681i(a)(1)) 
within which a consumer reporting agency would be required to complete 
its action if the consumer had elected to dispute the information under 
that section; and
    (4) If the investigation finds that the information reported was 
inaccurate, promptly notify each consumer reporting agency to which the 
furnisher provided inaccurate information of that determination and 
provide to the consumer reporting agency any correction to that 
information that is necessary to make the information provided by the 
furnisher accurate.
    (f) Frivolous or irrelevant disputes. (1) A furnisher is not 
required to investigate a direct dispute if the furnisher has 
reasonably determined that the dispute is frivolous or irrelevant. A 
dispute qualifies as frivolous or irrelevant if:
    (i) The consumer did not provide sufficient information to 
investigate the disputed information as required by paragraph (d) of 
this section;
    (ii) The direct dispute is substantially the same as a dispute 
previously submitted by or on behalf of the consumer, either directly 
to the furnisher or through a consumer reporting agency, with respect 
to which the furnisher has already satisfied the applicable 
requirements of the Act or this section; provided, however, that a 
direct dispute is not substantially the same as a dispute previously 
submitted if the dispute includes information listed in paragraph (d) 
of this section that had not previously been provided to the furnisher; 
or
    (iii) The furnisher is not required to investigate the direct 
dispute because one or more of the exceptions listed in paragraph (b) 
of this section applies.
    (2) Notice of determination. Upon making a determination that a 
dispute is frivolous or irrelevant, the furnisher must notify the 
consumer of the determination not later than five business days after 
making the determination, by mail or, if authorized by the consumer for 
that purpose, by any other means available to the furnisher.
    (3) Contents of notice of determination that a dispute is frivolous 
or irrelevant. A notice of determination that a dispute is frivolous or 
irrelevant must include the reasons for such determination and identify 
any information required to investigate the disputed information, which 
notice may consist of a standardized form describing the general nature 
of such information.

Subpart F--Duties of Users Regarding Obtaining and Using Consumer 
Reports


Sec. Sec.  1022.50-1022.53  [Reserved]


Sec.  1022.54  Duties of users making written firm offers of credit or 
insurance based on information contained in consumer files

    (a) Scope. This subpart applies to any person who uses a consumer 
report on any consumer in connection with any credit or insurance 
transaction that is not initiated by the consumer, and that is provided 
to that person under section 604(c)(1)(B) of the FCRA (15 U.S.C. 
1681b(c)(1)(B)), except for a person excluded from coverage of this 
part by section 1029 of the Consumer Financial Protection Act of 2010, 
Title X of the Dodd-Frank Wall Street Reform and Consumer Protection 
Act, Public Law 111-203, 124 Stat. 137.
    (b) Definitions. For purposes of this section and Appendix D of 
this part, the following definitions apply:
    (1) Simple and easy to understand means:
    (i) A layered format as described in paragraph (c) of this section;
    (ii) Plain language designed to be understood by ordinary 
consumers; and
    (iii) Use of clear and concise sentences, paragraphs, and sections.
    (iv) Examples. For purposes of this part, examples of factors to be 
considered in determining whether a statement is in plain language and 
uses clear and concise sentences, paragraphs, and sections include:
    (A) Use of short explanatory sentences;
    (B) Use of definite, concrete, everyday words;
    (C) Use of active voice;
    (D) Avoidance of multiple negatives;
    (E) Avoidance of legal and technical business terminology;
    (F) Avoidance of explanations that are imprecise and reasonably 
subject to different interpretations; and
    (G) Use of language that is not misleading.
    (2) Principal promotional document means the document designed to 
be seen first by the consumer, such as the cover letter.
    (c) Prescreen opt-out notice. Any person who uses a consumer report 
on any consumer in connection with any credit or insurance transaction 
that is not initiated by the consumer, and that is provided to that 
person under section 604(c)(1)(B) of the FCRA (15 U.S.C. 
1681b(c)(1)(B)), shall, with each written solicitation made to the 
consumer about the transaction, provide the consumer with the following 
statement, consisting of a short portion and a long portion, which 
shall be in the same language as the offer of credit or insurance:
    (1) Short notice. The short notice shall be a clear and 
conspicuous, and simple and easy to understand statement as follows:
    (i) Content. The short notice shall state that the consumer has the 
right to opt out of receiving prescreened solicitations, and shall 
provide the toll-free number the consumer can call to exercise that 
right. The short notice also shall direct the consumer to the existence 
and location of the long notice, and shall state the heading for the 
long notice. The short notice shall not contain any other information.
    (ii) Form. The short notice shall be:
    (A) In a type size that is larger than the type size of the 
principal text on the same page, but in no event smaller than 12 point 
type, or if provided by electronic means, then reasonable steps shall 
be taken to ensure that the type size is larger than the type size of 
the principal text on the same page;
    (B) On the front side of the first page of the principal 
promotional document in the solicitation, or, if provided 
electronically, on the same page and in close proximity to the 
principal marketing message;
    (C) Located on the page and in a format so that the statement is 
distinct from other text, such as inside a border; and
    (D) In a type style that is distinct from the principal type style 
used on the same page, such as bolded, italicized, underlined, and/or 
in a color that contrasts with the color of the principal text on the 
page, if the solicitation is in more than one color.

[[Page 79327]]

    (2) Long notice. The long notice shall be a clear and conspicuous, 
and simple and easy to understand statement as follows:
    (i) Content. The long notice shall state the information required 
by section 615(d) of the Fair Credit Reporting Act (15 U.S.C. 
1681m(d)). The long notice shall not include any other information that 
interferes with, detracts from, contradicts, or otherwise undermines 
the purpose of the notice.
    (ii) Form. The long notice shall:
    (A) Appear in the solicitation;
    (B) Be in a type size that is no smaller than the type size of the 
principal text on the same page, and, for solicitations provided other 
than by electronic means, the type size shall in no event be smaller 
than 8 point type;
    (C) Begin with a heading in capital letters and underlined, and 
identifying the long notice as the ``PRESCREEN&OPT-OUT NOTICE;''
    (D) Be in a type style that is distinct from the principal type 
style used on the same page, such as bolded, italicized, underlined, 
and/or in a color that contrasts with the color of the principal text 
on the page, if the solicitation is in more than one color; and
    (E) Be set apart from other text on the page, such as by including 
a blank line above and below the statement, and by indenting both the 
left and right margins from other text on the page.


Sec. Sec.  1022.55-1022.59  [Reserved]

Subpart G--[Reserved]

Subpart H--Duties of Users Regarding Risk-Based Pricing


Sec.  1022.70  Scope.

    (a) Coverage. (1) In general. This subpart applies to any person, 
except for a person excluded from coverage of this part by section 1029 
of the Consumer Financial Protection Act of 2010, Title X of the Dodd-
Frank Wall Street Reform and Consumer Protection Act, Public Law 111-
203, 124 Stat. 137, that both:
    (i) Uses a consumer report in connection with an application for, 
or a grant, extension, or other provision of, credit to a consumer that 
is primarily for personal, family, or household purposes; and
    (ii) Based in whole or in part on the consumer report, grants, 
extends, or otherwise provides credit to the consumer on material terms 
that are materially less favorable than the most favorable material 
terms available to a substantial proportion of consumers from or 
through that person.
    (2) Business credit excluded. This subpart does not apply to an 
application for, or a grant, extension, or other provision of, credit 
to a consumer or to any other applicant primarily for a business 
purpose.
    (b) Enforcement. The provisions of this subpart will be enforced in 
accordance with the enforcement authority set forth in sections 621(a) 
and (b) of the FCRA.


Sec.  1022.71  Definitions.

    For purposes of this subpart, the following definitions apply:
    (a) Adverse action has the same meaning as in 15 U.S.C. 
1681a(k)(1)(A).
    (b) Annual percentage rate has the same meaning as in 12 CFR 
1026.14(b) with respect to an open-end credit plan and as in 12 CFR 
1026.22 with respect to closed-end credit.
    (c) Closed-end credit has the same meaning as in 12 CFR 
1026.2(a)(10).
    (d) Consumer has the same meaning as in 15 U.S.C. 1681a(c).
    (e) Consummation has the same meaning as in 12 CFR 1026.2(a)(13).
    (f) Consumer report has the same meaning as in 15 U.S.C. 1681a(d).
    (g) Consumer reporting agency has the same meaning as in 15 U.S.C. 
1681a(f).
    (h) Credit has the same meaning as in 15 U.S.C. 1681a(r)(5).
    (i) Creditor has the same meaning as in 15 U.S.C. 1681a(r)(5).
    (j) Credit card has the same meaning as in 15 U.S.C. 1681a(r)(2).
    (k) Credit card issuer has the same meaning as card issuer, as 
defined in 15 U.S.C. 1681a(r)(1)(A).
    (l) Credit score has the same meaning as in 15 U.S.C. 
1681g(f)(2)(A).
    (m) Firm offer of credit has the same meaning as in 15 U.S.C. 
1681a(l).
    (n) Material terms means:
    (1)(i) Except as otherwise provided in paragraphs (n)(1)(ii) and 
(n)(3) of this section, in the case of credit extended under an open-
end credit plan, the annual percentage rate required to be disclosed 
under 12 CFR 1026.6(a)(1)(ii) or 12 CFR 1026.6(b)(2)(i), excluding any 
temporary initial rate that is lower than the rate that will apply 
after the temporary rate expires, any penalty rate that will apply upon 
the occurrence of one or more specific events, such as a late payment 
or an extension of credit that exceeds the credit limit, and any fixed 
annual percentage rate option for a home equity line of credit;
    (ii) In the case of a credit card (other than a credit card that is 
used to access a home equity line of credit or a charge card), the 
annual percentage rate required to be disclosed under 12 CFR 
1026.6(b)(2)(i) that applies to purchases (``purchase annual percentage 
rate'') and no other annual percentage rate, or in the case of a credit 
card that has no purchase annual percentage rate, the annual percentage 
rate that varies based on information in a consumer report and that has 
the most significant financial impact on consumers;
    (2) In the case of closed-end credit, the annual percentage rate 
required to be disclosed under 12 CFR 1026.17(c) and 1026.18(e); and
    (3) In the case of credit for which there is no annual percentage 
rate, the financial term that varies based on information in a consumer 
report and that has the most significant financial impact on consumers, 
such as a deposit required in connection with credit extended by a 
telephone company or utility or an annual membership fee for a charge 
card.
    (o) Materially less favorable means, when applied to material 
terms, that the terms granted, extended, or otherwise provided to a 
consumer differ from the terms granted, extended, or otherwise provided 
to another consumer from or through the same person such that the cost 
of credit to the first consumer would be significantly greater than the 
cost of credit granted, extended, or otherwise provided to the other 
consumer. For purposes of this definition, factors relevant to 
determining the significance of a difference in cost include the type 
of credit product, the term of the credit extension, if any, and the 
extent of the difference between the material terms granted, extended, 
or otherwise provided to the two consumers.
    (p) Open-end credit plan has the same meaning as in 15 U.S.C. 
1602(i), as interpreted by the Bureau in Regulation Z (12 CFR part 
1026) and the Official Interpretations to Regulation Z (Supplement I to 
12 CFR part 1026).
    (q) Person has the same meaning as in 15 U.S.C. 1681a(b).


Sec.  1022.72  General requirements for risk-based pricing notices.

    (a) In general. Except as otherwise provided in this subpart, a 
person must provide to a consumer a notice (``risk-based pricing 
notice'') in the form and manner required by this subpart if the person 
both:
    (1) Uses a consumer report in connection with an application for, 
or a grant, extension, or other provision of, credit to that consumer 
that is primarily for personal, family, or household purposes; and
    (2) Based in whole or in part on the consumer report, grants, 
extends, or otherwise provides credit to that consumer on material 
terms that are materially less favorable than the most favorable 
material terms available to a

[[Page 79328]]

substantial proportion of consumers from or through that person.
    (b) Determining which consumers must receive a notice. A person may 
determine whether paragraph (a) of this section applies by directly 
comparing the material terms offered to each consumer and the material 
terms offered to other consumers for a specific type of credit product. 
For purposes of this section, a ``specific type of credit product'' 
means one or more credit products with similar features that are 
designed for similar purposes. Examples of a specific type of credit 
product include student loans, unsecured credit cards, secured credit 
cards, new automobile loans, used automobile loans, fixed-rate mortgage 
loans, and variable-rate mortgage loans. As an alternative to making 
this direct comparison, a person may make the determination by using 
one of the following methods:
    (1) Credit score proxy method. (i) In general. A person that sets 
the material terms of credit granted, extended, or otherwise provided 
to a consumer, based in whole or in part on a credit score, may comply 
with the requirements of paragraph (a) of this section by:
    (A) Determining the credit score (hereafter referred to as the 
``cutoff score'') that represents the point at which approximately 40 
percent of the consumers to whom it grants, extends, or provides credit 
have higher credit scores and approximately 60 percent of the consumers 
to whom it grants, extends, or provides credit have lower credit 
scores; and
    (B) Providing a risk-based pricing notice to each consumer to whom 
it grants, extends, or provides credit whose credit score is lower than 
the cutoff score.
    (ii) Alternative to the 40/60 cutoff score determination. In the 
case of credit that has been granted, extended, or provided on the most 
favorable material terms to more than 40 percent of consumers, a person 
may, at its option, set its cutoff score at a point at which the 
approximate percentage of consumers who historically have been granted, 
extended, or provided credit on material terms other than the most 
favorable terms would receive risk-based pricing notices under this 
section.
    (iii) Determining the cutoff score. (A) Sampling approach. A person 
that currently uses risk-based pricing with respect to the credit 
products it offers must calculate the cutoff score by considering the 
credit scores of all or a representative sample of the consumers to 
whom it has granted, extended, or provided credit for a specific type 
of credit product.
    (B) Secondary source approach in limited circumstances. A person 
that is a new entrant into the credit business, introduces new credit 
products, or starts to use risk-based pricing with respect to the 
credit products it currently offers may initially determine the cutoff 
score based on information derived from appropriate market research or 
relevant third-party sources for a specific type of credit product, 
such as research or data from companies that develop credit scores. A 
person that acquires a credit portfolio as a result of a merger or 
acquisition may determine the cutoff score based on information from 
the party which it acquired, with which it merged, or from which it 
acquired the portfolio.
    (C) Recalculation of cutoff scores. A person using the credit score 
proxy method must recalculate its cutoff score(s) no less than every 
two years in the manner described in paragraph (b)(1)(iii)(A) of this 
section. A person using the credit score proxy method using market 
research, third-party data, or information from a party which it 
acquired, with which it merged, or from which it acquired the portfolio 
as permitted by paragraph (b)(1)(iii)(B) of this section generally must 
calculate a cutoff score(s) based on the scores of its own consumers in 
the manner described in paragraph (b)(1)(iii)(A) of this section within 
one year after it begins using a cutoff score derived from market 
research, third-party data, or information from a party which it 
acquired, with which it merged, or from which it acquired the 
portfolio. If such a person does not grant, extend, or provide credit 
to new consumers during that one-year period such that it lacks 
sufficient data with which to recalculate a cutoff score based on the 
credit scores of its own consumers, the person may continue to use a 
cutoff score derived from market research, third-party data, or 
information from a party which it acquired, with which it merged, or 
from which it acquired the portfolio as provided in paragraph 
(b)(1)(iii)(B) until it obtains sufficient data on which to base the 
recalculation. However, the person must recalculate its cutoff score(s) 
in the manner described in paragraph (b)(1)(iii)(A) of this section 
within two years, if it has granted, extended, or provided credit to 
some new consumers during that two-year period.
    (D) Use of two or more credit scores. A person that generally uses 
two or more credit scores in setting the material terms of credit 
granted, extended, or provided to a consumer must determine the cutoff 
score using the same method the person uses to evaluate multiple scores 
when making credit decisions. These evaluation methods may include, but 
are not limited to, selecting the low, median, high, most recent, or 
average credit score of each consumer to whom it grants, extends, or 
provides credit. If a person that uses two or more credit scores does 
not consistently use the same method for evaluating multiple credit 
scores (e.g., if the person sometimes chooses the median score and 
other times calculates the average score), the person must determine 
the cutoff score using a reasonable means. In such cases, use of any 
one of the methods that the person regularly uses or the average credit 
score of each consumer to whom it grants, extends, or provides credit 
is deemed to be a reasonable means of calculating the cutoff score.
    (iv) Credit score not available. For purposes of this section, a 
person using the credit score proxy method who grants, extends, or 
provides credit to a consumer for whom a credit score is not available 
must assume that the consumer receives credit on material terms that 
are materially less favorable than the most favorable credit terms 
offered to a substantial proportion of consumers from or through that 
person and must provide a risk-based pricing notice to the consumer.
    (v) Examples. (A) A credit card issuer engages in risk-based 
pricing and the annual percentage rates it offers to consumers are 
based in whole or in part on a credit score. The credit card issuer 
takes a representative sample of the credit scores of consumers to whom 
it issued credit cards within the preceding three months. The credit 
card issuer determines that approximately 40 percent of the sampled 
consumers have a credit score at or above 720 (on a scale of 350 to 
850) and approximately 60 percent of the sampled consumers have a 
credit score below 720. Thus, the card issuer selects 720 as its cutoff 
score. A consumer applies to the credit card issuer for a credit card. 
The card issuer obtains a credit score for the consumer. The consumer's 
credit score is 700. Since the consumer's 700 credit score falls below 
the 720 cutoff score, the credit card issuer must provide a risk-based 
pricing notice to the consumer.
    (B) A credit card issuer engages in risk-based pricing, and the 
annual percentage rates it offers to consumers are based in whole or in 
part on a credit score. The credit card issuer takes a representative 
sample of the consumers to whom it issued credit cards over the 
preceding six months. The credit card

[[Page 79329]]

issuer determines that approximately 80 percent of the sampled 
consumers received credit at its lowest annual percentage rate, and 20 
percent received credit at a higher annual percentage rate. 
Approximately 80 percent of the sampled consumers have a credit score 
at or above 750 (on a scale of 350 to 850), and 20 percent have a 
credit score below 750. Thus, the card issuer selects 750 as its cutoff 
score. A consumer applies to the credit card issuer for a credit card. 
The card issuer obtains a credit score for the consumer. The consumer's 
credit score is 740. Since the consumer's 740 credit score falls below 
the 750 cutoff score, the credit card issuer must provide a risk-based 
pricing notice to the consumer.
    (C) An auto lender engages in risk-based pricing, obtains credit 
scores from one of the nationwide consumer reporting agencies, and uses 
the credit score proxy method to determine which consumers must receive 
a risk-based pricing notice. A consumer applies to the auto lender for 
credit to finance the purchase of an automobile. A credit score about 
that consumer is not available from the consumer reporting agency from 
which the lender obtains credit scores. The lender nevertheless grants, 
extends, or provides credit to the consumer. The lender must provide a 
risk-based pricing notice to the consumer.
    (2) Tiered pricing method. (i) In general. A person that sets the 
material terms of credit granted, extended, or provided to a consumer 
by placing the consumer within one of a discrete number of pricing 
tiers for a specific type of credit product, based in whole or in part 
on a consumer report, may comply with the requirements of paragraph (a) 
of this section by providing a risk-based pricing notice to each 
consumer who is not placed within the top pricing tier or tiers, as 
described below.
    (ii) Four or fewer pricing tiers. If a person using the tiered 
pricing method has four or fewer pricing tiers, the person complies 
with the requirements of paragraph (a) of this section by providing a 
risk-based pricing notice to each consumer to whom it grants, extends, 
or provides credit who does not qualify for the top tier (that is, the 
lowest-priced tier). For example, a person that uses a tiered pricing 
structure with annual percentage rates of 8, 10, 12, and 14 percent 
would provide the risk-based pricing notice to each consumer to whom it 
grants, extends, or provides credit at annual percentage rates of 10, 
12, and 14 percent.
    (iii) Five or more pricing tiers. If a person using the tiered 
pricing method has five or more pricing tiers, the person complies with 
the requirements of paragraph (a) of this section by providing a risk-
based pricing notice to each consumer to whom it grants, extends, or 
provides credit who does not qualify for the top two tiers (that is, 
the two lowest-priced tiers) and any other tier that, together with the 
top tiers, comprise no less than the top 30 percent but no more than 
the top 40 percent of the total number of tiers. Each consumer placed 
within the remaining tiers must receive a risk-based pricing notice. 
For example, if a person has nine pricing tiers, the top three tiers 
(that is, the three lowest-priced tiers) comprise no less than the top 
30 percent but no more than the top 40 percent of the tiers. Therefore, 
a person using this method would provide a risk-based pricing notice to 
each consumer to whom it grants, extends, or provides credit who is 
placed within the bottom six tiers.
    (c) Application to credit card issuers. (1) In general. A credit 
card issuer subject to the requirements of paragraph (a) of this 
section may use one of the methods set forth in paragraph (b) of this 
section to identify consumers to whom it must provide a risk-based 
pricing notice. Alternatively, a credit card issuer may satisfy its 
obligations under paragraph (a) of this section by providing a risk-
based pricing notice to a consumer when:
    (i) A consumer applies for a credit card either in connection with 
an application program, such as a direct-mail offer or a take-one 
application, or in response to a solicitation under 12 CFR 1026.60, and 
more than a single possible purchase annual percentage rate may apply 
under the program or solicitation; and
    (ii) Based in whole or in part on a consumer report, the credit 
card issuer provides a credit card to the consumer with an annual 
percentage rate referenced in Sec.  1022.71(n)(1)(ii) that is greater 
than the lowest annual percentage rate referenced in Sec.  
1022.71(n)(1)(ii) available in connection with the application or 
solicitation.
    (2) No requirement to compare different offers. A credit card 
issuer is not subject to the requirements of paragraph (a) of this 
section and is not required to provide a risk-based pricing notice to a 
consumer if:
    (i) The consumer applies for a credit card for which the card 
issuer provides a single annual percentage rate referenced in Sec.  
1022.71(n)(1)(ii), excluding a temporary initial rate that is lower 
than the rate that will apply after the temporary rate expires and a 
penalty rate that will apply upon the occurrence of one or more 
specific events, such as a late payment or an extension of credit that 
exceeds the credit limit; or
    (ii) The credit card issuer offers the consumer the lowest annual 
percentage rate referenced in Sec.  1022.71(n)(1)(ii) available under 
the credit card offer for which the consumer applied, even if a lower 
annual percentage rate referenced in Sec.  1022.71(n)(1)(ii) is 
available under a different credit card offer issued by the card 
issuer.
    (3) Examples. (i) A credit card issuer sends a solicitation to the 
consumer that discloses several possible purchase annual percentage 
rates that may apply, such as 10, 12, or 14 percent, or a range of 
purchase annual percentage rates from 10 to 14 percent. The consumer 
applies for a credit card in response to the solicitation. The card 
issuer provides a credit card to the consumer with a purchase annual 
percentage rate of 12 percent based in whole or in part on a consumer 
report. Unless an exception applies under Sec.  1022.74, the card 
issuer may satisfy its obligations under paragraph (a) of this section 
by providing a risk-based pricing notice to the consumer because the 
consumer received credit at a purchase annual percentage rate greater 
than the lowest purchase annual percentage rate available under that 
solicitation.
    (ii) The same facts as in the example in paragraph (c)(3)(i) of 
this section, except that the card issuer provides a credit card to the 
consumer at a purchase annual percentage rate of 10 percent. The card 
issuer is not required to provide a risk-based pricing notice to the 
consumer even if, under a different credit card solicitation, that 
consumer or other consumers might qualify for a purchase annual 
percentage rate of 8 percent.
    (d) Account review. (1) In general. Except as otherwise provided in 
this subpart, a person is subject to the requirements of paragraph (a) 
of this section and must provide a risk-based pricing notice to a 
consumer in the form and manner required by this subpart if the person:
    (i) Uses a consumer report in connection with a review of credit 
that has been extended to the consumer; and
    (ii) Based in whole or in part on the consumer report, increases 
the annual percentage rate (the annual percentage rate referenced in 
Sec.  1022.71(n)(1)(ii) in the case of a credit card).
    (2) Example. A credit card issuer periodically obtains consumer 
reports for the purpose of reviewing the terms of credit it has 
extended to consumers

[[Page 79330]]

in connection with credit cards. As a result of this review, the credit 
card issuer increases the purchase annual percentage rate applicable to 
a consumer's credit card based in whole or in part on information in a 
consumer report. The credit card issuer is subject to the requirements 
of paragraph (a) of this section and must provide a risk-based pricing 
notice to the consumer.


Sec.  1022.73  Content, form, and timing of risk-based pricing notices.

    (a) Content of the notice. (1) In general. The risk-based pricing 
notice required by Sec.  1022.72(a) or (c) must include:
    (i) A statement that a consumer report (or credit report) includes 
information about the consumer's credit history and the type of 
information included in that history;
    (ii) A statement that the terms offered, such as the annual 
percentage rate, have been set based on information from a consumer 
report;
    (iii) A statement that the terms offered may be less favorable than 
the terms offered to consumers with better credit histories;
    (iv) A statement that the consumer is encouraged to verify the 
accuracy of the information contained in the consumer report and has 
the right to dispute any inaccurate information in the report;
    (v) The identity of each consumer reporting agency that furnished a 
consumer report used in the credit decision;
    (vi) A statement that Federal law gives the consumer the right to 
obtain a copy of a consumer report from the consumer reporting agency 
or agencies identified in the notice without charge for 60 days after 
receipt of the notice;
    (vii) A statement informing the consumer how to obtain a consumer 
report from the consumer reporting agency or agencies identified in the 
notice and providing contact information (including a toll-free 
telephone number, where applicable) specified by the consumer reporting 
agency or agencies;
    (viii) A statement directing consumers to the Web site of the 
Bureau to obtain more information about consumer reports; and
    (ix) If a credit score of the consumer to whom a person grants, 
extends, or otherwise provides credit is used in setting the material 
terms of credit:
    (A) A statement that a credit score is a number that takes into 
account information in a consumer report, that the consumer's credit 
score was used to set the terms of credit offered, and that a credit 
score can change over time to reflect changes in the consumer's credit 
history;
    (B) The credit score used by the person in making the credit 
decision;
    (C) The range of possible credit scores under the model used to 
generate the credit score;
    (D) All of the key factors that adversely affected the credit 
score, which shall not exceed four key factors, except that if one of 
the key factors is the number of enquiries made with respect to the 
consumer report, the number of key factors shall not exceed five;
    (E) The date on which the credit score was created; and
    (F) The name of the consumer reporting agency or other person that 
provided the credit score.
    (2) Account review. The risk-based pricing notice required by Sec.  
1022.72(d) must include:
    (i) A statement that a consumer report (or credit report) includes 
information about the consumer's credit history and the type of 
information included in that credit history;
    (ii) A statement that the person has conducted a review of the 
account using information from a consumer report;
    (iii) A statement that as a result of the review, the annual 
percentage rate on the account has been increased based on information 
from a consumer report;
    (iv) A statement that the consumer is encouraged to verify the 
accuracy of the information contained in the consumer report and has 
the right to dispute any inaccurate information in the report;
    (v) The identity of each consumer reporting agency that furnished a 
consumer report used in the account review;
    (vi) A statement that Federal law gives the consumer the right to 
obtain a copy of a consumer report from the consumer reporting agency 
or agencies identified in the notice without charge for 60 days after 
receipt of the notice;
    (vii) A statement informing the consumer how to obtain a consumer 
report from the consumer reporting agency or agencies identified in the 
notice and providing contact information (including a toll-free 
telephone number, where applicable) specified by the consumer reporting 
agency or agencies;
    (viii) A statement directing consumers to the Web site of the 
Bureau to obtain more information about consumer reports; and
    (ix) If a credit score of the consumer whose extension of credit is 
under review is used in increasing the annual percentage rate:
    (A) A statement that a credit score is a number that takes into 
account information in a consumer report, that the consumer's credit 
score was used to set the terms of credit offered, and that a credit 
score can change over time to reflect changes in the consumer's credit 
history;
    (B) The credit score used by the person in making the credit 
decision;
    (C) The range of possible credit scores under the model used to 
generate the credit score;
    (D) All of the key factors that adversely affected the credit 
score, which shall not exceed four key factors, except that if one of 
the key factors is the number of enquires made with respect to the 
consumer report, the number of key factors shall not exceed five;
    (E) The date on which the credit score was created; and
    (F) The name of the consumer reporting agency or other person that 
provided the credit score.
    (b) Form of the notice. (1) In general. The risk-based pricing 
notice required by Sec.  1022.72(a), (c), or (d) must be:
    (i) Clear and conspicuous; and
    (ii) Provided to the consumer in oral, written, or electronic form.
    (2) Model forms. Model forms of the risk-based pricing notice 
required by Sec.  1022.72(a) and (c) are contained in Appendices H-1 
and H-6 of this part. Appropriate use of Model Form H-1 or H-6 is 
deemed to comply with the requirements of Sec.  1022.72(a) and (c). 
Model forms of the risk-based pricing notice required by Sec.  
1022.72(d) are contained in Appendices H-2 and H-7 of this part. 
Appropriate use of Model Form H-2 or H-7 is deemed to comply with the 
requirements of Sec.  1022.72(d). Use of the model forms is optional.
    (c) Timing. (1) General. Except as provided in paragraph (c)(3) of 
this section, a risk-based pricing notice must be provided to the 
consumer:
    (i) In the case of a grant, extension, or other provision of 
closed-end credit, before consummation of the transaction, but not 
earlier than the time the decision to approve an application for, or a 
grant, extension, or other provision of, credit, is communicated to the 
consumer by the person required to provide the notice;
    (ii) In the case of credit granted, extended, or provided under an 
open-end credit plan, before the first transaction is made under the 
plan, but not earlier than the time the decision to approve an 
application for, or a grant, extension, or other provision of, credit 
is communicated to the consumer by the person required to provide the 
notice; or
    (iii) In the case of a review of credit that has been extended to 
the consumer, at the time the decision to increase the

[[Page 79331]]

annual percentage rate (annual percentage rate referenced in Sec.  
1022.71(n)(1)(ii) in the case of a credit card) based on a consumer 
report is communicated to the consumer by the person required to 
provide the notice, or if no notice of the increase in the annual 
percentage rate is provided to the consumer prior to the effective date 
of the change in the annual percentage rate (to the extent permitted by 
law), no later than five days after the effective date of the change in 
the annual percentage rate.
    (2) Application to certain automobile lending transactions. When a 
person to whom a credit obligation is initially payable grants, 
extends, or provides credit to a consumer for the purpose of financing 
the purchase of an automobile from an auto dealer or other party that 
is not affiliated with the person, any requirement to provide a risk-
based pricing notice pursuant to this subpart is satisfied if the 
person:
    (i) Provides a notice described in Sec. Sec.  1022.72(a), 
1022.74(e), or 1022.74(f) to the consumer within the time periods set 
forth in paragraph (c)(1)(i) of this section, Sec.  1022.74(e)(3), or 
Sec.  1022.74(f)(4), as applicable; or
    (ii) Arranges to have the auto dealer or other party provide a 
notice described in Sec. Sec.  1022.72(a), 1022.74(e), or 1022.74(f) to 
the consumer on its behalf within the time periods set forth in 
paragraph (c)(1)(i) of this section, Sec.  1022.74(e)(3), or Sec.  
1022.74(f)(4), as applicable, and maintains reasonable policies and 
procedures to verify that the auto dealer or other party provides such 
notice to the consumer within the applicable time periods. If the 
person arranges to have the auto dealer or other party provide a notice 
described in Sec.  1022.74(e), the person's obligation is satisfied if 
the consumer receives a notice containing a credit score obtained by 
the dealer or other party, even if a different credit score is obtained 
and used by the person on whose behalf the notice is provided.
    (3) Timing requirements for contemporaneous purchase credit. When 
credit under an open-end credit plan is granted, extended, or provided 
to a consumer in person or by telephone for the purpose of financing 
the contemporaneous purchase of goods or services, any risk-based 
pricing notice required to be provided pursuant to this subpart (or the 
disclosures permitted under Sec.  1022.74(e) or (f)) may be provided at 
the earlier of:
    (i) The time of the first mailing by the person to the consumer 
after the decision is made to approve the grant, extension, or other 
provision of open-end credit, such as in a mailing containing the 
account agreement or a credit card; or
    (ii) Within 30 days after the decision to approve the grant, 
extension, or other provision of credit.
    (d) Multiple credit scores. (1) In general. When a person obtains 
or creates two or more credit scores and uses one of those credit 
scores in setting the material terms of credit, for example, by using 
the low, middle, high, or most recent score, the notices described in 
paragraphs (a)(1) and (2) of this section must include that credit 
score and information relating to that credit score required by 
paragraphs (a)(1)(ix) and (a)(2)(ix). When a person obtains or creates 
two or more credit scores and uses multiple credit scores in setting 
the material terms of credit by, for example, computing the average of 
all the credit scores obtained or created, the notices described in 
paragraphs (a)(1) and (2) of this section must include one of those 
credit scores and information relating to credit scores required by 
paragraphs (a)(1)(ix) and (a)(2)(ix). The notice may, at the person's 
option, include more than one credit score, along with the additional 
information specified in paragraphs (a)(1)(ix) and (a)(2)(ix) of this 
section for each credit score disclosed.
    (2) Examples. (i) A person that uses consumer reports to set the 
material terms of credit cards granted, extended, or provided to 
consumers regularly requests credit scores from several consumer 
reporting agencies and uses the low score when determining the material 
terms it will offer to the consumer. That person must disclose the low 
score in the notices described in paragraphs (a)(1) and (2) of this 
section.
    (ii) A person that uses consumer reports to set the material terms 
of automobile loans granted, extended, or provided to consumers 
regularly requests credit scores from several consumer reporting 
agencies, each of which it uses in an underwriting program in order to 
determine the material terms it will offer to the consumer. That person 
may choose one of these scores to include in the notices described in 
paragraph (a)(1) and (2) of this section.


Sec.  1022.74  Exceptions.

    (a) Application for specific terms. (1) In general. A person is not 
required to provide a risk-based pricing notice to the consumer under 
Sec.  1022.72(a) or (c) if the consumer applies for specific material 
terms and is granted those terms, unless those terms were specified by 
the person using a consumer report after the consumer applied for or 
requested credit and after the person obtained the consumer report. For 
purposes of this section, ``specific material terms'' means a single 
material term, or set of material terms, such as an annual percentage 
rate of 10 percent, and not a range of alternatives, such as an annual 
percentage rate that may be 8, 10, or 12 percent, or between 8 and 12 
percent.
    (2) Example. A consumer receives a firm offer of credit from a 
credit card issuer. The terms of the firm offer are based in whole or 
in part on information from a consumer report that the credit card 
issuer obtained under the FCRA's firm offer of credit provisions. The 
solicitation offers the consumer a credit card with a single purchase 
annual percentage rate of 12 percent. The consumer applies for and 
receives a credit card with an annual percentage rate of 12 percent. 
Other customers with the same credit card have a purchase annual 
percentage rate of 10 percent. The exception applies because the 
consumer applied for specific material terms and was granted those 
terms. Although the credit card issuer specified the annual percentage 
rate in the firm offer of credit based in whole or in part on a 
consumer report, the credit card issuer specified that material term 
before, not after, the consumer applied for or requested credit.
    (b) Adverse action notice. A person is not required to provide a 
risk-based pricing notice to the consumer under Sec.  1022.72(a), (c), 
or (d) if the person provides an adverse action notice to the consumer 
under section 615(a) of the FCRA.
    (c) Prescreened solicitations. (1) In general. A person is not 
required to provide a risk-based pricing notice to the consumer under 
Sec.  1022.72(a) or (c) if the person:
    (i) Obtains a consumer report that is a prescreened list as 
described in section 604(c)(2) of the FCRA; and
    (ii) Uses the consumer report for the purpose of making a firm 
offer of credit to the consumer.
    (2) More favorable material terms. This exception applies to any 
firm offer of credit offered by a person to a consumer, even if the 
person makes other firm offers of credit to other consumers on more 
favorable material terms.
    (3) Example. A credit card issuer obtains two prescreened lists 
from a consumer reporting agency. One list includes consumers with high 
credit scores. The other list includes consumers with low credit 
scores. The issuer mails a firm offer of credit to the high credit 
score consumers with a single purchase annual percentage rate of 10 
percent. The issuer also mails a

[[Page 79332]]

firm offer of credit to the low credit score consumers with a single 
purchase annual percentage rate of 14 percent. The credit card issuer 
is not required to provide a risk-based pricing notice to the low 
credit score consumers who receive the 14 percent offer because use of 
a consumer report to make a firm offer of credit does not trigger the 
risk-based pricing notice requirement.
    (d) Loans secured by residential real property--credit score 
disclosure. (1) In general. A person is not required to provide a risk-
based pricing notice to a consumer under Sec.  1022.72(a) or (c) if:
    (i) The consumer requests from the person an extension of credit 
that is or will be secured by one to four units of residential real 
property; and
    (ii) The person provides to each consumer described in paragraph 
(d)(1)(i) of this section a notice that contains the following:
    (A) A statement that a consumer report (or credit report) is a 
record of the consumer's credit history and includes information about 
whether the consumer pays his or her obligations on time and how much 
the consumer owes to creditors;
    (B) A statement that a credit score is a number that takes into 
account information in a consumer report and that a credit score can 
change over time to reflect changes in the consumer's credit history;
    (C) A statement that the consumer's credit score can affect whether 
the consumer can obtain credit and what the cost of that credit will 
be;
    (D) The information required to be disclosed to the consumer 
pursuant to section 609(g) of the FCRA;
    (E) The distribution of credit scores among consumers who are 
scored under the same scoring model that is used to generate the 
consumer's credit score using the same scale as that of the credit 
score that is provided to the consumer, presented in the form of a bar 
graph containing a minimum of six bars that illustrates the percentage 
of consumers with credit scores within the range of scores reflected in 
each bar or by other clear and readily understandable graphical means, 
or a clear and readily understandable statement informing the consumer 
how his or her credit score compares to the scores of other consumers. 
Use of a graph or statement obtained from the person providing the 
credit score that meets the requirements of this paragraph 
(d)(1)(ii)(E) is deemed to comply with this requirement;
    (F) A statement that the consumer is encouraged to verify the 
accuracy of the information contained in the consumer report and has 
the right to dispute any inaccurate information in the report;
    (G) A statement that Federal law gives the consumer the right to 
obtain copies of his or her consumer reports directly from the consumer 
reporting agencies, including a free report from each of the nationwide 
consumer reporting agencies once during any 12-month period;
    (H) Contact information for the centralized source from which 
consumers may obtain their free annual consumer reports; and
    (I) A statement directing consumers to the Web site of the Bureau 
to obtain more information about consumer reports.
    (2) Form of the notice. The notice described in paragraph 
(d)(1)(ii) of this section must be:
    (i) Clear and conspicuous;
    (ii) Provided on or with the notice required by section 609(g) of 
the FCRA;
    (iii) Segregated from other information provided to the consumer, 
except for the notice required by section 609(g) of the FCRA; and
    (iv) Provided to the consumer in writing and in a form that the 
consumer may keep.
    (3) Timing. The notice described in paragraph (d)(1)(ii) of this 
section must be provided to the consumer at the time the disclosure 
required by section 609(g) of the FCRA is provided to the consumer, but 
in any event at or before consummation in the case of closed-end credit 
or before the first transaction is made under an open-end credit plan.
    (4) Multiple credit scores. (i) In general. When a person obtains 
two or more credit scores from consumer reporting agencies and uses one 
of those credit scores in setting the material terms of credit granted, 
extended, or otherwise provided to a consumer, for example, by using 
the low, middle, high, or most recent score, the notice described in 
paragraph (d)(1)(ii) of this section must include that credit score and 
the other information required by that paragraph. When a person obtains 
two or more credit scores from consumer reporting agencies and uses 
multiple credit scores in setting the material terms of credit granted, 
extended, or otherwise provided to a consumer, for example, by 
computing the average of all the credit scores obtained, the notice 
described in paragraph (d)(1)(ii) of this section must include one of 
those credit scores and the other information required by that 
paragraph. The notice may, at the person's option, include more than 
one credit score, along with the additional information specified in 
paragraph (d)(1)(ii) of this section for each credit score disclosed.
    (ii) Examples. (A) A person that uses consumer reports to set the 
material terms of mortgage credit granted, extended, or provided to 
consumers regularly requests credit scores from several consumer 
reporting agencies and uses the low score when determining the material 
terms it will offer to the consumer. That person must disclose the low 
score in the notice described in paragraph (d)(1)(ii) of this section.
    (B) A person that uses consumer reports to set the material terms 
of mortgage credit granted, extended, or provided to consumers 
regularly requests credit scores from several consumer reporting 
agencies, each of which it uses in an underwriting program in order to 
determine the material terms it will offer to the consumer. That person 
may choose one of these scores to include in the notice described in 
paragraph (d)(1)(ii) of this section.
    (5) Model form. A model form of the notice described in paragraph 
(d)(1)(ii) of this section consolidated with the notice required by 
section 609(g) of the FCRA is contained in Appendix H-3 of this part. 
Appropriate use of Model Form H-3 is deemed to comply with the 
requirements of Sec.  1022.74(d). Use of the model form is optional.
    (e) Other extensions of credit--credit score disclosure. (1) In 
general. A person is not required to provide a risk-based pricing 
notice to a consumer under Sec.  1022.72(a) or (c) if:
    (i) The consumer requests from the person an extension of credit 
other than credit that is or will be secured by one to four units of 
residential real property; and
    (ii) The person provides to each consumer described in paragraph 
(e)(1)(i) of this section a notice that contains the following:
    (A) A statement that a consumer report (or credit report) is a 
record of the consumer's credit history and includes information about 
whether the consumer pays his or her obligations on time and how much 
the consumer owes to creditors;
    (B) A statement that a credit score is a number that takes into 
account information in a consumer report and that a credit score can 
change over time to reflect changes in the consumer's credit history;
    (C) A statement that the consumer's credit score can affect whether 
the consumer can obtain credit and what the cost of that credit will 
be;
    (D) The current credit score of the consumer or the most recent 
credit score of the consumer that was previously calculated by the 
consumer reporting agency for a purpose related to the extension of 
credit;

[[Page 79333]]

    (E) The range of possible credit scores under the model used to 
generate the credit score;
    (F) The distribution of credit scores among consumers who are 
scored under the same scoring model that is used to generate the 
consumer's credit score using the same scale as that of the credit 
score that is provided to the consumer, presented in the form of a bar 
graph containing a minimum of six bars that illustrates the percentage 
of consumers with credit scores within the range of scores reflected in 
each bar, or by other clear and readily understandable graphical means, 
or a clear and readily understandable statement informing the consumer 
how his or her credit score compares to the scores of other consumers. 
Use of a graph or statement obtained from the person providing the 
credit score that meets the requirements of this paragraph 
(e)(1)(ii)(F) is deemed to comply with this requirement;
    (G) The date on which the credit score was created;
    (H) The name of the consumer reporting agency or other person that 
provided the credit score;
    (I) A statement that the consumer is encouraged to verify the 
accuracy of the information contained in the consumer report and has 
the right to dispute any inaccurate information in the report;
    (J) A statement that Federal law gives the consumer the right to 
obtain copies of his or her consumer reports directly from the consumer 
reporting agencies, including a free report from each of the nationwide 
consumer reporting agencies once during any 12-month period;
    (K) Contact information for the centralized source from which 
consumers may obtain their free annual consumer reports; and
    (L) A statement directing consumers to the Web site of the Bureau 
to obtain more information about consumer reports.
    (2) Form of the notice. The notice described in paragraph 
(e)(1)(ii) of this section must be:
    (i) Clear and conspicuous;
    (ii) Segregated from other information provided to the consumer; 
and
    (iii) Provided to the consumer in writing and in a form that the 
consumer may keep.
    (3) Timing. The notice described in paragraph (e)(1)(ii) of this 
section must be provided to the consumer as soon as reasonably 
practicable after the credit score has been obtained, but in any event 
at or before consummation in the case of closed-end credit or before 
the first transaction is made under an open-end credit plan.
    (4) Multiple credit scores. (i) In general. When a person obtains 
two or more credit scores from consumer reporting agencies and uses one 
of those credit scores in setting the material terms of credit granted, 
extended, or otherwise provided to a consumer, for example, by using 
the low, middle, high, or most recent score, the notice described in 
paragraph (e)(1)(ii) of this section must include that credit score and 
the other information required by that paragraph. When a person obtains 
two or more credit scores from consumer reporting agencies and uses 
multiple credit scores in setting the material terms of credit granted, 
extended, or otherwise provided to a consumer, for example, by 
computing the average of all the credit scores obtained, the notice 
described in paragraph (e)(1)(ii) of this section must include one of 
those credit scores and the other information required by that 
paragraph. The notice may, at the person's option, include more than 
one credit score, along with the additional information specified in 
paragraph (e)(1)(ii) of this section for each credit score disclosed.
    (ii) Examples. The manner in which multiple credit scores are to be 
disclosed under this section are substantially identical to the manner 
set forth in the examples contained in paragraph (d)(4)(ii) of this 
section.
    (5) Model form. A model form of the notice described in paragraph 
(e)(1)(ii) of this section is contained in Appendix H-4 of this part. 
Appropriate use of Model Form H-4 is deemed to comply with the 
requirements of Sec.  1022.74(e). Use of the model form is optional.
    (f) Credit score not available. (1) In general. A person is not 
required to provide a risk-based pricing notice to a consumer under 
Sec.  1022.72(a) or (c) if the person:
    (i) Regularly obtains credit scores from a consumer reporting 
agency and provides credit score disclosures to consumers in accordance 
with paragraphs (d) or (e) of this section, but a credit score is not 
available from the consumer reporting agency from which the person 
regularly obtains credit scores for a consumer to whom the person 
grants, extends, or provides credit;
    (ii) Does not obtain a credit score from another consumer reporting 
agency in connection with granting, extending, or providing credit to 
the consumer; and
    (iii) Provides to the consumer a notice that contains the 
following:
    (A) A statement that a consumer report (or credit report) includes 
information about the consumer's credit history and the type of 
information included in that history;
    (B) A statement that a credit score is a number that takes into 
account information in a consumer report and that a credit score can 
change over time in response to changes in the consumer's credit 
history;
    (C) A statement that credit scores are important because consumers 
with higher credit scores generally obtain more favorable credit terms;
    (D) A statement that not having a credit score can affect whether 
the consumer can obtain credit and what the cost of that credit will 
be;
    (E) A statement that a credit score about the consumer was not 
available from a consumer reporting agency, which must be identified by 
name, generally due to insufficient information regarding the 
consumer's credit history;
    (F) A statement that the consumer is encouraged to verify the 
accuracy of the information contained in the consumer report and has 
the right to dispute any inaccurate information in the consumer report;
    (G) A statement that Federal law gives the consumer the right to 
obtain copies of his or her consumer reports directly from the consumer 
reporting agencies, including a free consumer report from each of the 
nationwide consumer reporting agencies once during any 12-month period;
    (H) The contact information for the centralized source from which 
consumers may obtain their free annual consumer reports; and
    (I) A statement directing consumers to the Web site of the Bureau 
to obtain more information about consumer reports.
    (2) Example. A person that uses consumer reports to set the 
material terms of non-mortgage credit granted, extended, or provided to 
consumers regularly requests credit scores from a particular consumer 
reporting agency and provides those credit scores and additional 
information to consumers to satisfy the requirements of paragraph (e) 
of this section. That consumer reporting agency provides to the person 
a consumer report on a particular consumer that contains one trade 
line, but does not provide the person with a credit score on that 
consumer. If the person does not obtain a credit score from another 
consumer reporting agency and, based in whole or in part on information 
in a consumer report, grants, extends, or provides credit to the 
consumer, the person may provide the notice described in paragraph 
(f)(1)(iii) of this section. If, however, the person obtains a credit 
score from another consumer reporting agency, the person may not rely 
upon the exception in paragraph (f) of this section, but may

[[Page 79334]]

satisfy the requirements of paragraph (e) of this section.
    (3) Form of the notice. The notice described in paragraph 
(f)(1)(iii) of this section must be:
    (i) Clear and conspicuous;
    (ii) Segregated from other information provided to the consumer; 
and
    (iii) Provided to the consumer in writing and in a form that the 
consumer may keep.
    (4) Timing. The notice described in paragraph (f)(1)(iii) of this 
section must be provided to the consumer as soon as reasonably 
practicable after the person has requested the credit score, but in any 
event not later than consummation of a transaction in the case of 
closed-end credit or when the first transaction is made under an open-
end credit plan.
    (5) Model form. A model form of the notice described in paragraph 
(f)(1)(iii) of this section is contained in Appendix H-5 of this part. 
Appropriate use of Model Form H-5 is deemed to comply with the 
requirements of Sec.  1022.74(f). Use of the model form is optional.


Sec.  1022.75  Rules of construction.

    For purposes of this subpart, the following rules of construction 
apply:
    (a) One notice per credit extension. A consumer is entitled to no 
more than one risk-based pricing notice under Sec.  1022.72(a) or (c), 
or one notice under Sec.  1022.74(d), (e), or (f), for each grant, 
extension, or other provision of credit. Notwithstanding the foregoing, 
even if a consumer has previously received a risk-based pricing notice 
in connection with a grant, extension, or other provision of credit, 
another risk-based pricing notice is required if the conditions set 
forth in Sec.  1022.72(d) have been met.
    (b) Multi-party transactions. (1) Initial creditor. The person to 
whom a credit obligation is initially payable must provide the risk-
based pricing notice described in Sec.  1022.72(a) or (c), or satisfy 
the requirements for and provide the notice required under one of the 
exceptions in Sec.  1022.74(d), (e), or (f), even if that person 
immediately assigns the credit agreement to a third party and is not 
the source of funding for the credit.
    (2) Purchasers or assignees. A purchaser or assignee of a credit 
contract with a consumer is not subject to the requirements of this 
subpart and is not required to provide the risk-based pricing notice 
described in Sec.  1022.72(a) or (c), or satisfy the requirements for 
and provide the notice required under one of the exceptions in Sec.  
1022.74(d), (e), or (f).
    (3) Example. A consumer obtains credit to finance the purchase of 
an automobile. If a bank or finance company is the person to whom the 
loan obligation is initially payable, the bank or finance company must 
provide the risk-based pricing notice to the consumer (or satisfy the 
requirements for and provide the notice required under one of the 
exceptions noted above) based on the terms offered by that bank or 
finance company only. The auto dealer has no duty to provide a risk-
based pricing notice to the consumer. However, the bank or finance 
company may comply with this rule if the auto dealer has agreed to 
provide notices to consumers before consummation pursuant to an 
arrangement with the bank or finance company, as permitted under Sec.  
1022.73(c).
    (c) Multiple consumers. (1) Risk-based pricing notices. In a 
transaction involving two or more consumers who are granted, extended, 
or otherwise provided credit, a person must provide a notice to each 
consumer to satisfy the requirements of Sec.  1022.72(a) or (c). 
Whether the consumers have the same address or not, the person must 
provide a separate notice to each consumer if a notice includes a 
credit score(s). Each separate notice that includes a credit score(s) 
must contain only the credit score(s) of the consumer to whom the 
notice is provided, and not the credit score(s) of the other consumer. 
If the consumers have the same address, and the notice does not include 
a credit score(s), a person may satisfy the requirements by providing a 
single notice addressed to both consumers.
    (2) Credit score disclosure notices. In a transaction involving two 
or more consumers who are granted, extended, or otherwise provided 
credit, a person must provide a separate notice to each consumer to 
satisfy the exceptions in Sec.  1022.74(d), (e), or (f). Whether the 
consumers have the same address or not, the person must provide a 
separate notice to each consumer. Each separate notice must contain 
only the credit score(s) of the consumer to whom the notice is 
provided, and not the credit score(s) of the other consumer.
    (3) Examples. (i) Two consumers jointly apply for credit with a 
creditor. The creditor obtains credit scores on both consumers. Based 
in part on the credit scores, the creditor grants credit to the 
consumers on material terms that are materially less favorable than the 
most favorable terms available to other consumers from the creditor. 
The creditor provides risk-based pricing notices to satisfy its 
obligations under this subpart. The creditor must provide a separate 
risk-based pricing notice to each consumer whether the consumers have 
the same address or not. Each risk-based pricing notice must contain 
only the credit score(s) of the consumer to whom the notice is 
provided.
    (ii) Two consumers jointly apply for credit with a creditor. The 
two consumers reside at the same address. The creditor obtains credit 
scores on each of the two consumer applicants. The creditor grants 
credit to the consumers. The creditor provides credit score disclosure 
notices to satisfy its obligations under this subpart. Even though the 
two consumers reside at the same address, the creditor must provide a 
separate credit score disclosure notice to each of the consumers. Each 
notice must contain only the credit score of the consumer to whom the 
notice is provided.

Subpart I--Duties of Users of Consumer Reports Regarding Identity 
Theft


Sec. Sec.  1022.80-1022.81  [Reserved]


Sec.  1022.82  Duties of users regarding address discrepancies.

    (a) Scope. This section applies to a user of consumer reports 
(user) that receives a notice of address discrepancy from a consumer 
reporting agency described in 15 U.S.C. 1681a(p), except for a person 
excluded from coverage of this part by section 1029 of the Consumer 
Financial Protection Act of 2010, Title X of the Dodd-Frank Wall Street 
Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 137.
    (b) Definition. For purposes of this section, a notice of address 
discrepancy means a notice sent to a user by a consumer reporting 
agency described in 15 U.S.C. 1681a(p) pursuant to 15 U.S.C. 
1681c(h)(1), that informs the user of a substantial difference between 
the address for the consumer that the user provided to request the 
consumer report and the address(es) in the agency's file for the 
consumer.
    (c) Reasonable belief. (1) Requirement to form a reasonable belief. 
A user must develop and implement reasonable policies and procedures 
designed to enable the user to form a reasonable belief that a consumer 
report relates to the consumer about whom it has requested the report, 
when the user receives a notice of address discrepancy.
    (2) Examples of reasonable policies and procedures. (i) Comparing 
the information in the consumer report provided by the consumer 
reporting agency with information the user:
    (A) Obtains and uses to verify the consumer's identity in 
accordance with the requirements of the Customer Identification Program 
(CIP) rules

[[Page 79335]]

implementing 31 U.S.C. 5318(l) (31 CFR 1020.220);
    (B) Maintains in its own records, such as applications, change of 
address notifications, other customer account records, or retained CIP 
documentation; or
    (C) Obtains from third-party sources; or
    (ii) Verifying the information in the consumer report provided by 
the consumer reporting agency with the consumer.
    (d) Consumer's address. (1) Requirement to furnish consumer's 
address to a consumer reporting agency. A user must develop and 
implement reasonable policies and procedures for furnishing an address 
for the consumer that the user has reasonably confirmed is accurate to 
the consumer reporting agency described in 15 U.S.C. 1681a(p) from whom 
it received the notice of address discrepancy when the user:
    (i) Can form a reasonable belief that the consumer report relates 
to the consumer about whom the user requested the report;
    (ii) Establishes a continuing relationship with the consumer; and
    (iii) Regularly and in the ordinary course of business furnishes 
information to the consumer reporting agency from which the notice of 
address discrepancy relating to the consumer was obtained.
    (2) Examples of confirmation methods. The user may reasonably 
confirm an address is accurate by:
    (i) Verifying the address with the consumer about whom it has 
requested the report;
    (ii) Reviewing its own records to verify the address of the 
consumer;
    (iii) Verifying the address through third-party sources; or
    (iv) Using other reasonable means.
    (3) Timing. The policies and procedures developed in accordance 
with paragraph (d)(1) of this section must provide that the user will 
furnish the consumer's address that the user has reasonably confirmed 
is accurate to the consumer reporting agency described in 15 U.S.C. 
1681a(p) as part of the information it regularly furnishes for the 
reporting period in which it establishes a relationship with the 
consumer.

Subparts J-L--[Reserved]

Subpart M--Duties of Consumer Reporting Agencies Regarding Identity 
Theft


Sec.  1022.120  [Reserved]


Sec.  1022.121  Active duty alerts.

    (a) Duration. The duration of an active duty alert shall be twelve 
months.


Sec.  1022.122  [Reserved]


Sec.  1022.123  Appropriate proof of identity.

    (a) Consumer reporting agencies shall develop and implement 
reasonable requirements for what information consumers shall provide to 
constitute proof of identity for purposes of sections 605A, 605B, and 
609(a)(1) of the FCRA. In developing these requirements, the consumer 
reporting agencies must:
    (1) Ensure that the information is sufficient to enable the 
consumer reporting agency to match consumers with their files; and
    (2) Adjust the information to be commensurate with an identifiable 
risk of harm arising from misidentifying the consumer.
    (b) Examples of information that might constitute reasonable 
information requirements for proof of identity are provided for 
illustrative purposes only, as follows:
    (1) Consumer file match. The identification information of the 
consumer including his or her full name (first, middle initial, last, 
suffix), any other or previously used names, current and/or recent full 
address (street number and name, apt. no., city, state, and zip code), 
full nine digits of Social Security number, and/or date of birth.
    (2) Additional proof of identity. Copies of government issued 
identification documents, utility bills, and/or other methods of 
authentication of a person's identity which may include, but would not 
be limited to, answering questions to which only the consumer might be 
expected to know the answer.


Sec. Sec.  1022.124-1022.129   [Reserved]

Subpart N--Duties of Consumer Reporting Agencies Regarding 
Disclosures to Consumers


Sec.  1022.130  Definitions

    For purposes of this subpart, the following definitions apply:
    (a) Annual file disclosure means a file disclosure that is provided 
to a consumer, upon consumer request and without charge, once in any 
twelve month period, in compliance with section 612(a) of the FCRA, 15 
U.S.C. 1681j(a).
    (b) Associated consumer reporting agency means a consumer reporting 
agency that owns or maintains consumer files housed within systems 
operated by one or more nationwide consumer reporting agencies.
    (c) Consumer report has the meaning provided in section 603(d) of 
the FCRA, 15 U.S.C. 1681a(d).
    (d) Consumer reporting agency has the meaning provided in section 
603(f) of the FCRA, 15 U.S.C. 1681a(f).
    (e) Extraordinary request volume occurs when the number of 
consumers requesting or attempting to request file disclosures during 
any twenty-four hour period is more than 175 percent of the rolling 
ninety-day daily average of consumers requesting or attempting to 
request file disclosures. For example, if over the previous ninety days 
an average of one hundred consumers per day requested or attempted to 
request file disclosures, then extraordinary request volume would be 
any volume greater than 175 percent of one hundred, i.e., 176 or more 
requests in a single twenty-four hour period.
    (f) File disclosure means a disclosure by a consumer reporting 
agency pursuant to section 609 of the FCRA, 15 U.S.C. 1681g.
    (g) High request volume occurs when the number of consumers 
requesting or attempting to request file disclosures during any twenty-
four hour period is more than 125 percent of the rolling ninety-day 
daily average of consumers requesting or attempting to request file 
disclosures. For example, if over the previous ninety days an average 
of one hundred consumers per day requested or attempted to request file 
disclosures, then high request volume would be any volume greater than 
125 percent of one hundred, i.e., 126 or more requests in a single 
twenty-four hour period.
    (h) Nationwide consumer reporting agency means a consumer reporting 
agency that compiles and maintains files on consumers on a nationwide 
basis as defined in section 603(p) of the FCRA, 15 U.S.C. 1681a(p).
    (i) Nationwide specialty consumer reporting agency has the meaning 
provided in section 603(w) of the FCRA, 15 U.S.C. 1681a(w).
    (j) Request method means the method by which a consumer chooses to 
communicate a request for an annual file disclosure.


Sec. Sec.  1022.131-1022.135   [Reserved]


Sec.  1022.136  Centralized source for requesting annual file 
disclosures from nationwide consumer reporting agencies.

    (a) Purpose. The purpose of the centralized source is to enable 
consumers to make a single request to obtain annual file disclosures 
from all nationwide consumer reporting agencies, as required under 
section 612(a) of the FCRA, 15 U.S.C. 1681j(a).
    (b) Establishment and operation. All nationwide consumer reporting 
agencies shall jointly design, fund, implement, maintain, and operate a 
centralized

[[Page 79336]]

source for the purpose described in Paragraph (a) of this section. The 
centralized source required by this part shall:
    (1) Enable consumers to request annual file disclosures by any of 
the following request methods, at the consumers' option:
    (i) A single, dedicated Web site,
    (ii) A single, dedicated toll-free telephone number; and
    (iii) Mail directed to a single address;
    (2) Be designed, funded, implemented, maintained, and operated in a 
manner that:
    (i) Has adequate capacity to accept requests from the reasonably 
anticipated volume of consumers contacting the centralized source 
through each request method, as determined in accordance with Paragraph 
(c) of this section;
    (ii) Collects only as much personally identifiable information as 
is reasonably necessary to properly identify the consumer as required 
under the FCRA, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other 
applicable laws and regulations, and to process the transaction(s) 
requested by the consumer;
    (iii) Provides information through the centralized source Web site 
and telephone number regarding how to make a request by all request 
methods required under paragraph (b)(1) of this section; and
    (iv) Provides clear and easily understandable information and 
instructions to consumers, including, but not necessarily limited to:
    (A) Providing information on the progress of the consumer's request 
while the consumer is engaged in the process of requesting a file 
disclosure;
    (B) For a Web site request method, providing access to a ``help'' 
or ``frequently asked questions'' screen, which includes specific 
information that consumers might reasonably need to request file 
disclosures, the answers to questions that consumers might reasonably 
ask, and instructions whereby a consumer may file a complaint with the 
centralized source and with the Bureau;
    (C) In the event that a consumer requesting a file disclosure 
through the centralized source cannot be properly identified in 
accordance with the FCRA, section 610(a)(1), 15 U.S.C. 1681h(a)(1), and 
other applicable laws and regulations, providing a statement that the 
consumers' identity cannot be verified; and directions on how to 
complete the request, including what additional information or 
documentation will be required to complete the request, and how to 
submit such information; and
    (D) A statement indicating that the consumer has reached the Web 
site or telephone number for ordering free annual credit reports as 
required by Federal law; and
    (3) Make available to consumers a standardized form established 
jointly by the nationwide consumer reporting agencies, which consumers 
may use to make a request for an annual file disclosure, either by mail 
or on the Web site required under paragraph (b)(1) of this section, 
from the centralized source required by this part. The form provided at 
Appendix L to part 1022, may be used to comply with this section.
    (c) Requirement to anticipate. The nationwide consumer reporting 
agencies shall implement reasonable procedures to anticipate, and to 
respond to, the volume of consumers who will contact the centralized 
source through each request method, to request, or attempt to request, 
a file disclosure, including developing and implementing contingency 
plans to address circumstances that are reasonably likely to occur and 
that may materially and adversely impact the operation of the 
nationwide consumer reporting agency, a centralized source request 
method, or the centralized source.
    (1) The contingency plans required by this section shall include 
reasonable measures to minimize the impact of such circumstances on the 
operation of the centralized source and on consumers contacting, or 
attempting to contact, the centralized source.
    (i) Such reasonable measures to minimize impact shall include, but 
are not necessarily limited to:
    (A) The extent reasonably practicable under the circumstances, 
providing information to consumers on how to use another available 
request method;
    (B) The extent reasonably practicable under the circumstances, 
communicating, to a consumer who attempts but is unable to make a 
request, the fact that a condition exists that has precluded the 
centralized source from accepting all requests, and the period of time 
after which the centralized source is reasonably anticipated to be able 
to accept the consumers' request for an annual file disclosure; and
    (C) Taking all reasonable steps to restore the centralized source 
to normal operating status as quickly as reasonably practicable under 
the circumstances.
    (ii) Reasonable measures to minimize impact may also include, as 
appropriate, collecting request information but declining to accept the 
request for processing until a reasonable later time, provided that the 
consumer is clearly and prominently informed, to the extent reasonably 
practicable under the circumstances, of when the request will be 
accepted for processing.
    (2) A nationwide consumer reporting agency shall not be deemed in 
violation of paragraph (b)(2)(i) of this section if a centralized 
source request method is unavailable to accept requests for a 
reasonable period of time for purposes of conducting maintenance on the 
request method, provided that the other required request methods remain 
available during such time.
    (d) Disclosures required. If a nationwide consumer reporting agency 
has the ability to provide a consumer report to a third party relating 
to a consumer, regardless of whether the consumer report is owned by 
that nationwide consumer reporting agency or by an associated consumer 
reporting agency, that nationwide consumer reporting agency shall, upon 
proper identification in compliance with section 610(a)(1) of the FCRA, 
15 U.S.C. 1681h(a)(1), provide an annual file disclosure to such 
consumer if the consumer makes a request through the centralized 
source.
    (e) High request volume and extraordinary request volume. (1) High 
request volume. Provided that a nationwide consumer reporting agency 
has implemented reasonable procedures developed in accordance with 
Paragraph (c) of this section, entitled ``requirement to anticipate,'' 
the nationwide consumer reporting agency shall not be deemed in 
violation of Paragraph (b)(2)(i) of this section for any period of time 
in which a centralized source request method, the centralized source, 
or the nationwide consumer reporting agency experiences high request 
volume, if the nationwide consumer reporting agency:
    (i) Collects all consumer request information and delays accepting 
the request for processing until a reasonable later time; and
    (ii) Clearly and prominently informs the consumer of when the 
request will be accepted for processing.
    (2) Extraordinary request volume. Provided that the nationwide 
consumer reporting agency has implemented reasonable procedures 
developed in compliance with Paragraph (c) of this section, entitled 
``requirement to anticipate,'' the nationwide consumer reporting agency 
shall not be deemed in violation of Paragraph (b)(2)(i) of this section 
for any period of time during which a particular centralized source 
request method, the centralized source, or the nationwide consumer 
reporting agency experiences extraordinary request volume.

[[Page 79337]]

    (f) Information use and disclosure. Any personally identifiable 
information collected from consumers as a result of a request for 
annual file disclosure, or other disclosure required by the FCRA, made 
through the centralized source, may be used or disclosed by the 
centralized source or a nationwide consumer reporting agency only:
    (1) To provide the annual file disclosure or other disclosure 
required under the FCRA requested by the consumer;
    (2) To process a transaction requested by the consumer at the same 
time as a request for annual file disclosure or other disclosure;
    (3) To comply with applicable legal requirements, including those 
imposed by the FCRA and this part; and
    (4) To update personally identifiable information already 
maintained by the nationwide consumer reporting agency for the purpose 
of providing consumer reports, provided that the nationwide consumer 
reporting agency uses and discloses the updated personally identifiable 
information subject to the same restrictions that would apply, under 
any applicable provision of law or regulation, to the information 
updated or replaced.
    (g) Communications provided through centralized source. (1) Any 
advertising or marketing for products or services, any communications 
or instructions that advertise or market any products or services, or 
any request to establish an account through the centralized source must 
be delayed until after the consumer has obtained his or her annual file 
disclosure.
    (i) In the case of requests made by mail or telephone, the consumer 
``has obtained his or her annual file disclosure'' when the file 
disclosure is mailed, and the nationwide consumer reporting agency may 
include advertising for other products or services with the file 
disclosure.
    (ii) In the case of requests made through the centralized source 
Web site, the consumer ``has obtained his or her annual file 
disclosure'' when the file disclosure is delivered to the consumer 
through the Internet, and the nationwide consumer reporting agency may 
include advertising for other products or services with the file 
disclosure.
    (2) Any communications, instructions, or permitted advertising or 
marketing shall not interfere with, detract from, contradict, or 
otherwise undermine the purpose of the centralized source stated in 
Paragraph (a) of this section.
    (3) Examples of interfering, detracting, inconsistent, and/or 
undermining communications include:
    (i) Centralized source materials that represent, expressly or by 
implication, that a consumer must purchase a paid product or service in 
order to receive or to understand the annual file disclosure;
    (ii) Centralized source materials that represent, expressly or by 
implication, that annual file disclosures are not free, or that 
obtaining an annual file disclosure will have a negative impact on the 
consumers' credit standing; and
    (iii) Centralized source materials that falsely represent, 
expressly or by implication, that a product or service offered 
ancillary to receipt of a file disclosure, such as a credit score or 
credit monitoring service, is free, or fail to clearly and prominently 
disclose that consumers must cancel a service, advertised as free for 
an initial period of time, to avoid being charged, if such is the case.
    (h) Other practices prohibited through the centralized source. The 
centralized source shall not:
    (1) Contain hyperlinks to commercial or proprietary Web sites until 
after the consumer has obtained his or her annual file disclosure, 
except for technical transfers to a Web page on which consumers can 
request their free annual file disclosure; provided, however, that no 
hyperlinks to commercial Web sites shall appear on the initial page of 
the centralized source.
    (2) Require consumers to set up an account in connection with 
obtaining an annual file disclosure; or
    (3) Ask or require consumers to agree to terms or conditions in 
connection with obtaining an annual file disclosure.


Sec.  1022.137  Streamlined process for requesting annual file 
disclosures from nationwide specialty consumer reporting agencies.

    (a) Streamlined process requirements. Any nationwide specialty 
consumer reporting agency shall have a streamlined process for 
accepting and processing consumer requests for annual file disclosures. 
The streamlined process required by this part shall:
    (1) Enable consumers to request annual file disclosures by a toll-
free telephone number that:
    (i) Provides clear and prominent instructions for requesting 
disclosures by any additional available request methods, that do not 
interfere with, detract from, contradict, or otherwise undermine the 
ability of consumers to obtain annual file disclosures through the 
streamlined process required by this part;
    (ii) Is published, in conjunction with all other published numbers 
for the nationwide specialty consumer reporting agency, in any 
telephone directory in which any telephone number for the nationwide 
specialty consumer reporting agency is published; and
    (iii) Is clearly and prominently posted on any Web site owned or 
maintained by the nationwide specialty consumer reporting agency that 
is related to consumer reporting, along with instructions for 
requesting disclosures by any additional available request methods; and
    (2) Be designed, funded, implemented, maintained, and operated in a 
manner that:
    (i) Has adequate capacity to accept requests from the reasonably 
anticipated volume of consumers contacting the nationwide specialty 
consumer reporting agency through the streamlined process, as 
determined in compliance with Paragraph (b) of this section;
    (ii) Collects only as much personal information as is reasonably 
necessary to properly identify the consumer as required under the FCRA, 
section 610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and 
regulations; and
    (iii) Provides clear and easily understandable information and 
instructions to consumers, including but not necessarily limited to:
    (A) Providing information on the status of the consumers request 
while the consumer is in the process of making a request;
    (B) For a Web site request method, providing access to a ``help'' 
or ``frequently asked questions'' screen, which includes more specific 
information that consumers might reasonably need to order their file 
disclosure, the answers to questions that consumers might reasonably 
ask, and instructions whereby a consumer may file a complaint with the 
nationwide specialty consumer reporting agency and with the Bureau; and
    (C) In the event that a consumer requesting a file disclosure 
cannot be properly identified in accordance with the FCRA, section 
610(a)(1), 15 U.S.C. 1681h(a)(1), and other applicable laws and 
regulations, providing a statement that the consumers identity cannot 
be verified; and directions on how to complete the request, including 
what additional information or documentation will be required to 
complete the request, and how to submit such information.
    (b) Requirement to anticipate. A nationwide specialty consumer

[[Page 79338]]

reporting agency shall implement reasonable procedures to anticipate, 
and respond to, the volume of consumers who will contact the nationwide 
specialty consumer reporting agency through the streamlined process to 
request, or attempt to request, file disclosures, including developing 
and implementing contingency plans to address circumstances that are 
reasonably likely to occur and that may materially and adversely impact 
the operation of the nationwide specialty consumer reporting agency, a 
request method, or the streamlined process.
    (1) The contingency plans required by this section shall include 
reasonable measures to minimize the impact of such circumstances on the 
operation of the streamlined process and on consumers contacting, or 
attempting to contact, the nationwide specialty consumer reporting 
agency through the streamlined process.
    (i) Such reasonable measures to minimize impact shall include, but 
are not necessarily limited to:
    (A) To the extent reasonably practicable under the circumstances, 
providing information to consumers on how to use another available 
request method;
    (B) To the extent reasonably practicable under the circumstances, 
communicating, to a consumer who attempts but is unable to make a 
request, the fact that a condition exists that has precluded the 
nationwide specialty consumer reporting agency from accepting all 
requests, and the period of time after which the agency is reasonably 
anticipated to be able to accept the consumers request for an annual 
file disclosure; and
    (C) Taking all reasonable steps to restore the streamlined process 
to normal operating status as quickly as reasonably practicable under 
the circumstances.
    (ii) Measures to minimize impact may also include, as appropriate, 
collecting request information but declining to accept the request for 
processing until a reasonable later time, provided that the consumer is 
clearly and prominently informed, to the extent reasonably practicable 
under the circumstances, of when the request will be accepted for 
processing.
    (2) A nationwide specialty consumer reporting agency shall not be 
deemed in violation of paragraph (a)(2)(i) of this section if the toll-
free telephone number required by this part is unavailable to accept 
requests for a reasonable period of time for purposes of conducting 
maintenance on the request method, provided that the nationwide 
specialty consumer reporting agency makes other request methods 
available to consumers during such time.
    (c) High request volume and extraordinary request volume. (1) High 
request volume. Provided that the nationwide specialty consumer 
reporting agency has implemented reasonable procedures developed in 
accordance with Paragraph (b) of this section, entitled ``requirement 
to anticipate,'' a nationwide specialty consumer reporting agency shall 
not be deemed in violation of Paragraph (a)(2)(i) of this section for 
any period of time during which a streamlined process request method or 
the nationwide specialty consumer reporting agency experiences high 
request volume, if the nationwide specialty consumer reporting agency:
    (i) Collects all consumer request information and delays accepting 
the request for processing until a reasonable later time; and
    (ii) Clearly and prominently informs the consumer of when the 
request will be accepted for processing.
    (2) Extraordinary request volume. Provided that the nationwide 
specialty consumer reporting agency has implemented reasonable 
procedures developed in accordance with Paragraph (b) of this section, 
entitled ``requirement to anticipate,'' a nationwide specialty consumer 
reporting agency shall not be deemed in violation of Paragraph 
(a)(2)(i) of this section for any period of time during which a 
streamlined process request method or the nationwide specialty consumer 
reporting agency experiences extraordinary request volume.
    (d) Information use and disclosure. Any personally identifiable 
information collected from consumers as a result of a request for 
annual file disclosure, or other disclosure required by the FCRA, made 
through the streamlined process, may be used or disclosed by the 
nationwide specialty consumer reporting agency only:
    (1) To provide the annual file disclosure or other disclosure 
required under the FCRA requested by the consumer;
    (2) To process a transaction requested by the consumer at the same 
time as a request for annual file disclosure or other disclosure;
    (3) To comply with applicable legal requirements, including those 
imposed by the FCRA and this part; and
    (4) To update personally identifiable information already 
maintained by the nationwide specialty consumer reporting agency for 
the purpose of providing consumer reports, provided that the nationwide 
specialty consumer reporting agency uses and discloses the updated 
personally identifiable information subject to the same restrictions 
that would apply, under any applicable provision of law or regulation, 
to the information updated or replaced.
    (e) Requirement to accept or redirect requests. If a consumer 
requests an annual file disclosure through a method other than the 
streamlined process established by the nationwide specialty consumer 
reporting agency in compliance with this part, a nationwide specialty 
consumer reporting agency shall:
    (1) Accept the consumers request; or
    (2) Instruct the consumer how to make the request using the 
streamlined process required by this part.


Sec.  1022.138  Prevention of deceptive marketing of free credit 
reports.

    (a) For purposes of this section:
    (1) AnnualCreditReport.com and (877) 322-8228 means the Uniform 
Resource Locator address ``AnnualCreditReport.com'' and toll-free 
telephone number, (877) 322-8228. These are the locator address and 
toll-free telephone number currently used by the centralized source. If 
the locator address or toll-free telephone number changes in the 
future, the new address or telephone number shall be substituted within 
a reasonable time.
    (2) Free credit report means a file disclosure prepared by or 
obtained from, directly or indirectly, a nationwide consumer reporting 
agency (as defined in section 603(p) of the FCRA), that is represented, 
either expressly or impliedly, to be available to the consumer at no 
cost if the consumer purchases a product or service, or agrees to 
purchase a product or service subject to cancellation.
    (3) General requirements for disclosures. The disclosures covered 
by Paragraph (b) of this section shall contain only the prescribed 
content and comply with the following requirements:
    (i) All disclosures shall be prominent;
    (ii) All disclosures shall be made in the same language as that 
principally used in the advertisement;
    (iii) Visual disclosures shall be easily readable; in a high degree 
of contrast from the immediate background on which it appears; in a 
format so that the disclosure is distinct from other text, such as 
inside a border; in a distinct type style, such as bold; and parallel 
to the base of the advertisement or screen;
    (iv) Audio disclosures shall be delivered in a slow and deliberate 
manner and in a reasonably understandable volume and pitch;
    (v) Program-length television, radio, or Internet-hosted multimedia

[[Page 79339]]

advertisement disclosures shall be made at the beginning, near the 
middle, and at the end of the advertisement; and
    (vi) Nothing contrary to, inconsistent with, or that undermines the 
required disclosures shall be used in any advertisement in any medium, 
nor shall any audio, visual, or print technique be used that is likely 
to detract significantly from the communication of any disclosure.
    (b) Medium-specific disclosures. All offers of free credit reports 
shall prominently include the disclosures required by this section.
    (1) Television advertisements. (i) All advertisements for free 
credit reports broadcast on television shall include the following 
disclosure in close proximity to the first mention of a free credit 
report: ``This is not the free credit report provided for by Federal 
law.''
    (ii) The disclosure shall appear at the same time in the audio and 
visual part of the advertisement. The visual disclosure shall be at 
least four percent of the vertical picture height and appear for a 
minimum of four seconds.
    (2) Radio advertisements. All advertisements for free credit 
reports broadcast on radio shall include the following disclosure in 
close proximity to the first mention of a free credit report: ``This is 
not the free credit report provided for by Federal law.''
    (3) Print advertisements. All advertisements for free credit 
reports in print shall include the following disclosure in the form 
specified below and in close proximity to the first mention of a free 
credit report. The first line of the disclosure shall be centered and 
contain only the following language: ``THIS NOTICE IS REQUIRED BY 
LAW.'' Immediately below the first line of the disclosure the following 
language shall appear: ``You have the right to a free credit report 
from AnnualCreditReport.com or (877) 322-8228, the ONLY authorized 
source under Federal law.'' Each letter of the disclosure text shall 
be, at minimum, one-half the size of the largest character used in the 
advertisement.
    (4) Web sites. Any Web site offering free credit reports must 
display the disclosure set forth in paragraphs (b)(4)(i), (ii), and (v) 
of this section on each page that mentions a free credit report and on 
each page of the ordering process. This disclosure shall be visible 
across the top of each page where the disclosure is required to appear; 
shall appear inside a box; and shall appear in the form specified 
below:
    (i) The first element of the disclosure shall be a header that is 
centered and shall consist of the following text: ``THIS NOTICE IS 
REQUIRED BY LAW. Read more at consumerfinance.gov/learnmore.'' Each 
letter of the header shall be one-half the size of the largest 
character of the disclosure text required by paragraph (b)(4)(ii) of 
this section. The reference to consumerfinance.gov/learnmore shall be 
an operational hyperlink, underlined, and in a color that is a high 
degree of contrast from the color of the other disclosure text and 
background color of the box. Until January 1, 2013, ``www.ftc.gov'' and 
the corresponding hyperlink may be substituted for 
``consumerfinance.gov/learmore'' and the corresponding hyperlink;
    (ii) The second element of the disclosure shall appear below the 
header required by paragraph (b)(4)(i) and shall consist of the 
following text: ``You have the right to a free credit report from 
AnnualCreditReport.com or (877) 322-8228, the ONLY authorized source 
under Federal law.'' The reference to AnnualCreditReport.com shall be 
an operational hyperlink to the centralized source, underlined, and in 
the same color as the hyperlink to consumerfinance.gov/learnmore 
required in Sec.  1022.138(b)(4)(i);
    (iii) The color of the text required by Sec.  1022.138(b)(4)(i) and 
(ii) shall be in a high degree of contrast with the background color of 
the box;
    (iv) The background of the box shall be a solid color in a high 
degree of contrast from the background of the page and the color shall 
not appear elsewhere on the page;
    (v) The third element of the disclosure shall appear below the text 
required by paragraph (b)(4)(ii) and shall be an operational hyperlink 
to AnnualCreditReport.com that appears as a centered button containing 
the following language: ``Take me to the authorized source.'' The 
background of this button shall be the same color as the hyperlinks 
required by Sec.  1022.138(b)(4)(i) and (ii) and the text shall be in a 
high degree of contrast to the background of the button;
    (vi) Each character of the text required in paragraph (b)(4)(ii) 
and (v) of this section shall be, at minimum, the same size as the 
largest character on the page, including characters in an image or 
graphic banner;
    (vii) Each character of the disclosure shall be displayed as plain 
text and in a sans serif font, such as Arial; and
    (viii) The space between each element of the disclosure required in 
paragraph (b)(i), (ii), and (v) of this section shall be, at minimum, 
the same size as the largest character on the page, including 
characters in an image or graphic banner. The space between the 
boundaries of the box and the text or button required in Sec.  
1022.138(b)(i), (ii), and (v) shall be, at minimum, twice the size of 
the vertical height of the largest character on the page, including 
characters in an image or graphic banner.
    (5) Internet-hosted multimedia advertising. All advertisements for 
free credit reports disseminated through Internet-hosted multimedia in 
both audio and visual formats shall include the following disclosure in 
the form specified below and in close proximity to the first mention of 
a free credit report. The first line of the disclosure shall be 
centered and contain only the following language: ``THIS NOTICE IS 
REQUIRED BY LAW.'' Immediately below the first line of the disclosure 
the following language shall appear: ``You have the right to a free 
credit report from AnnualCreditReport.com or (877) 322-8228, the ONLY 
authorized source under Federal law.'' The disclosure shall appear at 
the same time in the audio and visual part of the advertisement. If the 
advertisement contains characters, the visual disclosure shall be, at 
minimum, the same size as the largest character on the advertisement.
    (6) Telephone requests. When consumers call any telephone number, 
other than the number of the centralized source, appearing in an 
advertisement that represents free credit reports are available at the 
number, consumers must receive the following audio disclosure at the 
first mention of a free credit report: ``The following notice is 
required by law. You have the right to a free credit report from 
AnnualCreditReport.com or (877) 322-8228, the only authorized source 
under Federal law.''
    (7) Telemarketing solicitations. When telemarketing sales calls are 
made that include offers of free credit reports, the call must include 
at the first mention of a free credit report the following disclosure: 
``The following notice is required by law. You have the right to a free 
credit report from AnnualCreditReport.com or (877) 322-8228, the only 
authorized source under Federal law.''


Sec.  1022.139  [Reserved]

Subpart O--Miscellaneous Duties of Consumer Reporting Agencies


Sec.  1022.140  Prohibition against circumventing or evading treatment 
as a consumer reporting agency

    (a) A consumer reporting agency shall not circumvent or evade 
treatment as a ``consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis,'' as

[[Page 79340]]

defined under section 603(p) of the FCRA, 15 U.S.C. 1681a(p), by any 
means, including, but not limited to:
    (1) Corporate organization, reorganization, structure, or 
restructuring, including merger, acquisition, dissolution, divestiture, 
or asset sale of a consumer reporting agency; or
    (2) Maintaining or merging public record and credit account 
information in a manner that is substantially equivalent to that 
described in Paragraphs (1) and (2) of section 603(p) of the FCRA, 15 
U.S.C. 1681a(p).
    (b) Examples:
    (1) Circumvention through reorganization by data type. XYZ Inc. is 
a consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis. It restructures its operations so that 
public record information is assembled and maintained only by its 
corporate affiliate, ABC Inc. XYZ continues operating as a consumer 
reporting agency but ceases to comply with the FCRA obligations of a 
consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis, asserting that it no longer meets the 
definition found in FCRA section 603(p), because it no longer maintains 
public record information. XYZ's conduct is a circumvention or evasion 
of treatment as a consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis, and thus violates this 
section.
    (2) Circumvention through reorganization by regional operations. 
PDQ Inc. is a consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis. It restructures its 
operations so that corporate affiliates separately assemble and 
maintain all information on consumers residing in each state. PDQ 
continues to operate as a consumer reporting agency but ceases to 
comply with the FCRA obligations of a consumer reporting agency that 
compiles and maintains files on consumers on a nationwide basis, 
asserting that it no longer meets the definition found in FCRA section 
603(p), because it no longer operates on a nationwide basis. PDQ's 
conduct is a circumvention or evasion of treatment as a consumer 
reporting agency that compiles and maintains files on consumers on a 
nationwide basis, and thus violates this section.
    (3) Circumvention by a newly formed entity. Smith Co. is a new 
entrant in the marketplace for consumer reports that bear on a 
consumer's credit worthiness, standing and capacity. Smith Co. 
organizes itself into two affiliated companies: Smith Credit Co. and 
Smith Public Records Co. Smith Credit Co. assembles and maintains 
credit account information from persons who furnish that information 
regularly and in the ordinary course of business on consumers residing 
nationwide. Smith Public Records Co. assembles and maintains public 
record information on consumers nationwide. Neither Smith Co. nor its 
affiliated organizations comply with FCRA obligations of consumer 
reporting agencies that compile and maintain files on consumers on a 
nationwide basis. Smith Co.'s conduct is a circumvention or evasion of 
treatment as a consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis, and thus violates this 
section.
    (4) Bona fide, arm's length transaction with unaffiliated party. 
Foster Ltd. is a consumer reporting agency that compiles and maintains 
files on consumers on a nationwide basis. Foster Ltd. sells its public 
record information business to an unaffiliated company in a bona fide, 
arm's length transaction. Foster Ltd. ceases to assemble, evaluate and 
maintain public record information on consumers residing nationwide, 
and ceases to offer reports containing public record information. 
Foster Ltd.'s conduct is not a circumvention or evasion of treatment as 
a consumer reporting agency that compiles and maintains files on 
consumers on a nationwide basis. Foster Ltd.'s conduct does not violate 
this part.
    (c) Limitation on applicability. Any person who is otherwise in 
violation of paragraph (a) of this section shall be deemed to be in 
compliance with this part if such person is in compliance with all 
obligations imposed upon consumer reporting agencies that compile and 
maintain files on consumers on a nationwide basis under the FCRA, 15 
U.S.C. 1681 et seq.

Appendix A to Part 1022 [Reserved]

Appendix B to Part 1022--Model Notices of Furnishing Negative 
Information

    a. Although use of the model notices is not required, a 
financial institution that is subject to section 623(a)(7) of the 
FCRA shall be deemed to be in compliance with the notice requirement 
in section 623(a)(7) of the FCRA if the institution properly uses 
the model notices in this appendix (as applicable).
    b. A financial institution may use Model Notice B-1 if the 
institution provides the notice prior to furnishing negative 
information to a nationwide consumer reporting agency.
    c. A financial institution may use Model Notice B-2 if the 
institution provides the notice after furnishing negative 
information to a nationwide consumer reporting agency.
    d. Financial institutions may make certain changes to the 
language or format of the model notices without losing the safe 
harbor from liability provided by the model notices. The changes to 
the model notices may not be so extensive as to affect the 
substance, clarity, or meaningful sequence of the language in the 
model notices. Financial institutions making such extensive 
revisions will lose the safe harbor from liability that this 
appendix provides. Acceptable changes include, for example,
    1. Rearranging the order of the references to ``late 
payment(s),'' or ``missed payment(s).''
    2. Pluralizing the terms ``credit bureau,'' ``credit report,'' 
and ``account.''
    3. Specifying the particular type of account on which 
information may be furnished, such as ``credit card account.''
    4. Rearranging in Model Notice B-1 the phrases ``information 
about your account'' and ``to credit bureaus'' such that it would 
read ``We may report to credit bureaus information about your 
account.''

Model Notice B-1

    We may report information about your account to credit bureaus. 
Late payments, missed payments, or other defaults on your account 
may be reflected in your credit report.

Model Notice B-2

    We have told a credit bureau about a late payment, missed 
payment or other default on your account. This information may be 
reflected in your credit report.

Appendix C to Part 1022--Model Forms for Opt-Out Notices

    a. Although use of the model forms is not required, use of the 
model forms in this appendix (as applicable) complies with the 
requirement in section 624 of the Act for clear, conspicuous, and 
concise notices.
    b. Certain changes may be made to the language or format of the 
model forms without losing the protection from liability afforded by 
use of the model forms. These changes may not be so extensive as to 
affect the substance, clarity, or meaningful sequence of the 
language in the model forms. Persons making such extensive revisions 
will lose the safe harbor that this appendix provides. Acceptable 
changes include, for example:
    1. Rearranging the order of the references to ``your income,'' 
``your account history,'' and ``your credit score.''
    2. Substituting other types of information for ``income,'' 
``account history,'' or ``credit score'' for accuracy, such as 
``payment history,'' ``credit history,'' ``payoff status,'' or 
``claims history.''
    3. Substituting a clearer and more accurate description of the 
affiliates providing or covered by the notice for phrases such as 
``the [ABC] group of companies,'' including without limitation a 
statement that the entity providing the notice recently purchased 
the consumer's account.
    4. Substituting other types of affiliates covered by the notice 
for ``credit card,'' ``insurance,'' or ``securities'' affiliates.

[[Page 79341]]

    5. Omitting items that are not accurate or applicable. For 
example, if a person does not limit the duration of the opt-out 
period, the notice may omit information about the renewal notice.
    6. Adding a statement informing consumers how much time they 
have to opt out before shared eligibility information may be used to 
make solicitations to them.
    7. Adding a statement that the consumer may exercise the right 
to opt out at any time.
    8. Adding the following statement, if accurate: ``If you 
previously opted out, you do not need to do so again.''
    9. Providing a place on the form for the consumer to fill in 
identifying information, such as his or her name and address.
    10. Adding disclosures regarding the treatment of opt-outs by 
joint consumers to comply with Sec.  1022.23(a)(2) of this part.

C-1 Model Form for Initial Opt-out Notice (Single-Affiliate Notice)
C-2 Model Form for Initial Opt-out Notice (Joint Notice)
C-3 Model Form for Renewal Notice (Single-Affiliate Notice)
C-4 Model Form for Renewal Notice (Joint Notice)
C-5 Model Form for Voluntary ``No Marketing'' Notice

C-1--Model Form for Initial Opt-Out Notice (Single-Affiliate Notice)--
[Your Choice To Limit Marketing]/[Marketing Opt-Out]

     [Name of Affiliate] is providing this notice.
     [Optional: Federal law gives you the right to limit 
some but not all marketing from our affiliates. Federal law also 
requires us to give you this notice to tell you about your choice to 
limit marketing from our affiliates.]
     You may limit our affiliates in the [ABC] group of 
companies, such as our [credit card, insurance, and securities] 
affiliates, from marketing their products or services to you based 
on your personal information that we collect and share with them. 
This information includes your [income], your [account history with 
us], and your [credit score].
     Your choice to limit marketing offers from our 
affiliates will apply [until you tell us to change your choice]/[for 
x years from when you tell us your choice]/[for at least 5 years 
from when you tell us your choice]. [Include if the opt-out period 
expires.] Once that period expires, you will receive a renewal 
notice that will allow you to continue to limit marketing offers 
from our affiliates for [another x years]/[at least another 5 
years].
     [Include, if applicable, in a subsequent notice, 
including an annual notice, for consumers who may have previously 
opted out.] If you have already made a choice to limit marketing 
offers from our affiliates, you do not need to act again until you 
receive the renewal notice.
    To limit marketing offers, contact us [include all that apply]:

 By telephone: 1-(877) -

 On the Web: www._.com
 By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]

    --Do not allow your affiliates to use my personal information to 
market to me.

C-2--Model Form for Initial Opt-Out Notice (Joint Notice)--[Your Choice 
To Limit Marketing]/[Marketing Opt-Out]

     The [ABC group of companies] is providing this notice.
     [Optional: Federal law gives you the right to limit 
some but not all marketing from the [ABC] companies. Federal law 
also requires us to give you this notice to tell you about your 
choice to limit marketing from the [ABC] companies.]
     You may limit the [ABC] companies, such as the [ABC 
credit card, insurance, and securities] affiliates, from marketing 
their products or services to you based on your personal information 
that they receive from other [ABC] companies. This information 
includes your [income], your [account history], and your [credit 
score].
     Your choice to limit marketing offers from the [ABC] 
companies will apply [until you tell us to change your choice]/[for 
x years from when you tell us your choice]/[for at least 5 years 
from when you tell us your choice]. [Include if the opt-out period 
expires.] Once that period expires, you will receive a renewal 
notice that will allow you to continue to limit marketing offers 
from the [ABC] companies for [another x years]/[at least another 5 
years].
     [Include, if applicable, in a subsequent notice, 
including an annual notice, for consumers who may have previously 
opted out.] If you have already made a choice to limit marketing 
offers from the [ABC] companies, you do not need to act again until 
you receive the renewal notice.
    To limit marketing offers, contact us [include all that apply]:

 By telephone: 1-(877) -

 On the Web: www._.com
 By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]

    --Do not allow any company [in the ABC group of companies] to 
use my personal information to market to me.

C-3--Model Form for Renewal Notice (Single-Affiliate Notice)--[Renewing 
Your Choice To Limit Marketing]/[Renewing Your Marketing Opt-Out]

     [Name of Affiliate] is providing this notice.
     [Optional: Federal law gives you the right to limit 
some but not all marketing from our affiliates. Federal law also 
requires us to give you this notice to tell you about your choice to 
limit marketing from our affiliates.]
     You previously chose to limit our affiliates in the 
[ABC] group of companies, such as our [credit card, insurance, and 
securities] affiliates, from marketing their products or services to 
you based on your personal information that we share with them. This 
information includes your [income], your [account history with us], 
and your [credit score].
     Your choice has expired or is about to expire.
    To renew your choice to limit marketing for [x] more years, 
contact us [include all that apply]:

 By telephone: 1-(877) -

 On the Web: www._.com
 By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]

    --Renew my choice to limit marketing for [x] more years.

C-4--Model Form for Renewal Notice (Joint Notice)--[Renewing Your 
Choice To Limit Marketing]/[Renewing Your Marketing Opt-Out]

     The [ABC group of companies] is providing this notice.
     [Optional: Federal law gives you the right to limit 
some but not all marketing from the [ABC] companies. Federal law 
also requires us to give you this notice to tell you about your 
choice to limit marketing from the [ABC] companies.]
     You previously chose to limit the [ABC] companies, such 
as the [ABC credit card, insurance, and securities] affiliates, from 
marketing their products or services to you based on your personal 
information that they receive from other ABC companies. This 
information includes your [income], your [account history], and your 
[credit score].
     Your choice has expired or is about to expire.
    To renew your choice to limit marketing for [x] more years, 
contact us [include all that apply]:

 By telephone: 1-(877) -

 On the Web: www._.com
 By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]

--Renew my choice to limit marketing for [x] more years.

C-5--Model Form for Voluntary ``No Marketing'' Notice--[Your Choice To 
Stop Marketing]

     [Name of Affiliate] is providing this notice.
     You may choose to stop all marketing from us and our 
affiliates.
     [Your choice to stop marketing from us and our 
affiliates will apply until you tell us to change your choice.]
    To stop all marketing, contact us [include all that apply]:

 By telephone: 1 (877) -

 On the Web: www._.com
 By mail: Check the box and complete the form below, and 
send the form to:
    [Company name]
    [Company address]

--Do not market to me.

Appendix D to Part 1022--Model Forms for Firm Offers of Credit or 
Insurance

    In order to comply with Sec.  1022.54, the following model 
notices may be used:
    (a) English language model notice. (1) Short notice.
BILLING CODE 4810-AM-P

[[Page 79342]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.000

    (2) Long notice.

[[Page 79343]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.001

    (b) Spanish language model notice. (1) Short notice.

[[Page 79344]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.002

    (2) Long notice.

[[Page 79345]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.003


[[Page 79346]]


BILLING CODE 4810-AM-C

Appendix E to Part 1022--Interagency Guidelines Concerning the Accuracy 
and Integrity of Information Furnished to Consumer Reporting Agencies

    The Bureau encourages voluntary furnishing of information to 
consumer reporting agencies. Section 1022.42 of this part requires 
each furnisher to establish and implement reasonable written 
policies and procedures concerning the accuracy and integrity of the 
information it furnishes to consumer reporting agencies. Under Sec.  
1022.42(b) of this part, a furnisher must consider the guidelines 
set forth below in developing its policies and procedures. In 
establishing these policies and procedures, a furnisher may include 
any of its existing policies and procedures that are relevant and 
appropriate. Section 1022.42(c) requires each furnisher to review 
its policies and procedures periodically and update them as 
necessary to ensure their continued effectiveness.

I. Nature, Scope, and Objectives of Policies and Procedures

    (a) Nature and Scope. Section 1022.42(a) of this part requires 
that a furnisher's policies and procedures be appropriate to the 
nature, size, complexity, and scope of the furnisher's activities. 
In developing its policies and procedures, a furnisher should 
consider, for example:
    (1) The types of business activities in which the furnisher 
engages;
    (2) The nature and frequency of the information the furnisher 
provides to consumer reporting agencies; and
    (3) The technology used by the furnisher to furnish information 
to consumer reporting agencies.
    (b) Objectives. A furnisher's policies and procedures should be 
reasonably designed to promote the following objectives:
    (1) To furnish information about accounts or other relationships 
with a consumer that is accurate, such that the furnished 
information:
    (i) Identifies the appropriate consumer;
    (ii) Reflects the terms of and liability for those accounts or 
other relationships; and
    (iii) Reflects the consumer's performance and other conduct with 
respect to the account or other relationship;
    (2) To furnish information about accounts or other relationships 
with a consumer that has integrity, such that the furnished 
information:
    (i) Is substantiated by the furnisher's records at the time it 
is furnished;
    (ii) Is furnished in a form and manner that is designed to 
minimize the likelihood that the information may be incorrectly 
reflected in a consumer report; thus, the furnished information 
should:
    (A) Include appropriate identifying information about the 
consumer to whom it pertains; and
    (B) Be furnished in a standardized and clearly understandable 
form and manner and with a date specifying the time period to which 
the information pertains; and
    (iii) Includes the credit limit, if applicable and in the 
furnisher's possession;
    (3) To conduct reasonable investigations of consumer disputes 
and take appropriate actions based on the outcome of such 
investigations; and
    (4) To update the information it furnishes as necessary to 
reflect the current status of the consumer's account or other 
relationship, including, for example:
    (i) Any transfer of an account (e.g., by sale or assignment for 
collection) to a third party; and
    (ii) Any cure of the consumer's failure to abide by the terms of 
the account or other relationship.

II. Establishing and Implementing Policies and Procedures

    In establishing and implementing its policies and procedures, a 
furnisher should:
    (a) Identify practices or activities of the furnisher that can 
compromise the accuracy or integrity of information furnished to 
consumer reporting agencies, such as by:
    (1) Reviewing its existing practices and activities, including 
the technological means and other methods it uses to furnish 
information to consumer reporting agencies and the frequency and 
timing of its furnishing of information;
    (2) Reviewing its historical records relating to accuracy or 
integrity or to disputes; reviewing other information relating to 
the accuracy or integrity of information provided by the furnisher 
to consumer reporting agencies; and considering the types of errors, 
omissions, or other problems that may have affected the accuracy or 
integrity of information it has furnished about consumers to 
consumer reporting agencies;
    (3) Considering any feedback received from consumer reporting 
agencies, consumers, or other appropriate parties;
    (4) Obtaining feedback from the furnisher's staff; and
    (5) Considering the potential impact of the furnisher's policies 
and procedures on consumers.
    (b) Evaluate the effectiveness of existing policies and 
procedures of the furnisher regarding the accuracy and integrity of 
information furnished to consumer reporting agencies; consider 
whether new, additional, or different policies and procedures are 
necessary; and consider whether implementation of existing policies 
and procedures should be modified to enhance the accuracy and 
integrity of information about consumers furnished to consumer 
reporting agencies.
    (c) Evaluate the effectiveness of specific methods (including 
technological means) the furnisher uses to provide information to 
consumer reporting agencies; how those methods may affect the 
accuracy and integrity of the information it provides to consumer 
reporting agencies; and whether new, additional, or different 
methods (including technological means) should be used to provide 
information to consumer reporting agencies to enhance the accuracy 
and integrity of that information.

III. Specific Components of Policies and Procedures

    In developing its policies and procedures, a furnisher should 
address the following, as appropriate:
    (a) Establishing and implementing a system for furnishing 
information about consumers to consumer reporting agencies that is 
appropriate to the nature, size, complexity, and scope of the 
furnisher's business operations.
    (b) Using standard data reporting formats and standard 
procedures for compiling and furnishing data, where feasible, such 
as the electronic transmission of information about consumers to 
consumer reporting agencies.
    (c) Maintaining records for a reasonable period of time, not 
less than any applicable recordkeeping requirement, in order to 
substantiate the accuracy of any information about consumers it 
furnishes that is subject to a direct dispute.
    (d) Establishing and implementing appropriate internal controls 
regarding the accuracy and integrity of information about consumers 
furnished to consumer reporting agencies, such as by implementing 
standard procedures and verifying random samples of information 
provided to consumer reporting agencies.
    (e) Training staff that participates in activities related to 
the furnishing of information about consumers to consumer reporting 
agencies to implement the policies and procedures.
    (f) Providing for appropriate and effective oversight of 
relevant service providers whose activities may affect the accuracy 
or integrity of information about consumers furnished to consumer 
reporting agencies to ensure compliance with the policies and 
procedures.
    (g) Furnishing information about consumers to consumer reporting 
agencies following mergers, portfolio acquisitions or sales, or 
other acquisitions or transfers of accounts or other obligations in 
a manner that prevents re-aging of information, duplicative 
reporting, or other problems that may similarly affect the accuracy 
or integrity of the information furnished.
    (h) Deleting, updating, and correcting information in the 
furnisher's records, as appropriate, to avoid furnishing inaccurate 
information.
    (i) Conducting reasonable investigations of disputes.
    (j) Designing technological and other means of communication 
with consumer reporting agencies to prevent duplicative reporting of 
accounts, erroneous association of information with the wrong 
consumer(s), and other occurrences that may compromise the accuracy 
or integrity of information provided to consumer reporting agencies.
    (k) Providing consumer reporting agencies with sufficient 
identifying information in the furnisher's possession about each 
consumer about whom information is furnished to enable the consumer 
reporting agency properly to identify the consumer.
    (l) Conducting a periodic evaluation of its own practices, 
consumer reporting agency practices of which the furnisher is aware, 
investigations of disputed information, corrections of inaccurate 
information, means of communication, and other factors that may 
affect the accuracy or integrity of information furnished to 
consumer reporting agencies.
    (m) Complying with applicable requirements under the FCRA and 
its implementing regulations.

[[Page 79347]]

Appendices F-G to Part 1022 [Reserved]

Appendix H to Part 1022--Appendix H--Model Forms for Risk-Based Pricing 
and Credit Score Disclosure Exception Notices

    1. This appendix contains four model forms for risk-based 
pricing notices and three model forms for use in connection with the 
credit score disclosure exceptions. Each of the model forms is 
designated for use in a particular set of circumstances as indicated 
by the title of that model form.
    2. Model form H-1 is for use in complying with the general risk-
based pricing notice requirements in Sec. 1022.72 if a credit score 
is not used in setting the material terms of credit. Model form H-2 
is for risk-based pricing notices given in connection with account 
review if a credit score is not used in increasing the annual 
percentage rate. Model form H-3 is for use in connection with the 
credit score disclosure exception for loans secured by residential 
real property. Model form H-4 is for use in connection with the 
credit score disclosure exception for loans that are not secured by 
residential real property. Model form H-5 is for use in connection 
with the credit score disclosure exception when no credit score is 
available for a consumer. Model form H-6 is for use in complying 
with the general risk-based pricing notice requirements in Sec. 
1022.72 if a credit score is used in setting the material terms of 
credit. Model form H-7 is for risk-based pricing notices given in 
connection with account review if a credit score is used in 
increasing the annual percentage rate. All forms contained in this 
appendix are models; their use is optional.
    3. A person may change the forms by rearranging the format or by 
making technical modifications to the language of the forms, in each 
case without modifying the substance of the disclosures. Any such 
rearrangement or modification of the language of the model forms may 
not be so extensive as to materially affect the substance, clarity, 
comprehensibility, or meaningful sequence of the forms. Persons 
making revisions with that effect will lose the benefit of the safe 
harbor for appropriate use of Appendix H model forms. A person is 
not required to conduct consumer testing when rearranging the format 
of the model forms.
    a. Acceptable changes include, for example:
    i. Corrections or updates to telephone numbers, mailing 
addresses, or Web site addresses that may change over time.
    ii. The addition of graphics or icons, such as the person's 
corporate logo.
    iii. Alteration of the shading or color contained in the model 
forms.
    iv. Use of a different form of graphical presentation to depict 
the distribution of credit scores.
    v. Substitution of the words ``credit'' and ``creditor'' or 
``finance'' and ``finance company'' for the terms ``loan'' and 
``lender.''
    vi. Including pre-printed lists of the sources of consumer 
reports or consumer reporting agencies in a ``check-the-box'' 
format.
    vii. Including the name of the consumer, transaction 
identification numbers, a date, and other information that will 
assist in identifying the transaction to which the form pertains.
    viii. Including the name of an agent, such as an auto dealer or 
other party, when providing the ``Name of the Entity Providing the 
Notice.''
    ix. Until January 1, 2013, substituting ``For more information 
about credit reports and your rights under Federal law, visit the 
Federal Reserve Board's Web site at www.federalreserve.gov, or the 
Federal Trade Commission's Web site at www.ftc.gov.'' for ``For more 
information about credit reports and your rights under Federal law, 
visit the Consumer Financial Protection Bureau's Web site at 
www.consumerfinance.gov/learnmore.''
    b. Unacceptable changes include, for example:
    i. Providing model forms on register receipts or interspersed 
with other disclosures.
    ii. Eliminating empty lines and extra spaces between sentences 
within the same section.
    4. If a person uses an appropriate Appendix H model form, or 
modifies a form in accordance with the above instructions, that 
person shall be deemed to be acting in compliance with the 
provisions of Sec.  1022.73 or Sec.  1022.74, as applicable, of this 
part. It is intended that appropriate use of Model Form H-3 also 
will comply with the disclosure that may be required under section 
609(g) of the FCRA. Optional language in model forms H-6 and H-7 may 
be used to direct the consumer to the entity (which may be a 
consumer reporting agency or the creditor itself, for a proprietary 
score that meets the definition of a credit score) that provided the 
credit score for any questions about the credit score, along with 
the entity's contact information. Creditors may use or not use the 
additional language without losing the safe harbor, since the 
language is optional.
    H-1 Model form for risk-based pricing notice.
    H-2 Model form for account review risk-based pricing notice.
    H-3 Model form for credit score disclosure exception for credit 
secured by one to four units of residential real property.
    H-4 Model form for credit score disclosure exception for loans 
not secured by residential real property.
    H-5 Model form for credit score disclosure exception for loans 
where credit score is not available.
    H-6 Model form for risk-based pricing notice with credit score 
information.
    H-7 Model form for account review risk-based pricing notice with 
credit score information.
BILLING CODE 4810-AM-P

[[Page 79348]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.004


[[Page 79349]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.005


[[Page 79350]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.006


[[Page 79351]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.007


[[Page 79352]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.008


[[Page 79353]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.009


[[Page 79354]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.010


[[Page 79355]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.011


[[Page 79356]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.012


[[Page 79357]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.013


[[Page 79358]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.014


[[Page 79359]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.015


[[Page 79360]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.016

Appendix I to Part 1022--Summary of Consumer Identity Theft Rights

    The prescribed form for this summary is a disclosure that is 
substantially similar to the Bureau's model summary with all 
information clearly and prominently displayed. A summary should 
accurately reflect changes to those items that may change over time 
(such as telephone numbers) to remain in compliance. Translations of 
this summary will be in compliance with the Bureau's prescribed 
model, provided that the translation is accurate and that it is 
provided in a language used by the recipient consumer.

[[Page 79361]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.017


[[Page 79362]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.018


[[Page 79363]]



Appendix J to Part 1022 [Reserved]

Appendix K to Part 1022--Summary of Consumer Rights

    The prescribed form for this summary is a disclosure that is 
substantially similar to the Bureau's model summary with all 
information clearly and prominently displayed. The list of Federal 
regulators that is included in the Bureau's prescribed summary may 
be provided separately so long as this is done in a clear and 
conspicuous way. A summary should accurately reflect changes to 
those items that may change over time (e.g., dollar amounts, or 
telephone numbers and addresses of Federal agencies) to remain in 
compliance. Translations of this summary will be in compliance with 
the Bureau's prescribed model, provided that the translation is 
accurate and that it is provided in a language used by the recipient 
consumer.
[GRAPHIC] [TIFF OMITTED] TR21DE11.019


[[Page 79364]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.020


[[Page 79365]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.021

Appendix L to Part 1022--Standardized Form for Requesting Annual File 
Disclosures

[[Page 79366]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.022


[[Page 79367]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.023

Appendix M to Part 1022--Notice of Furnisher Responsibilities

    The prescribed form for this disclosure is a separate document 
that is substantially similar to the Bureau's model notice with all 
information clearly and prominently displayed. Consumer reporting 
agencies may limit the disclosure to only those items that they know 
are relevant to the furnisher that will receive the notice.

[[Page 79368]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.024


[[Page 79369]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.025


[[Page 79370]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.026

Appendix N to Part 1022--Notice of User Responsibilities

    The prescribed form for this disclosure is a separate document 
that is substantially similar to the Bureau's notice with all 
information clearly and prominently displayed. Consumer reporting 
agencies may limit the disclosure to only those items that they know 
are relevant to the user that will receive the notice.

[[Page 79371]]

[GRAPHIC] [TIFF OMITTED] TR21DE11.027


[[Page 79372]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.028


[[Page 79373]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.029


[[Page 79374]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.030


[[Page 79375]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.031


[[Page 79376]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.032


[[Page 79377]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.033


[[Page 79378]]


[GRAPHIC] [TIFF OMITTED] TR21DE11.034


    Dated: November 29, 2011.
Alastair M. Fitzpayne,
Deputy Chief of Staff and Executive Secretary, Department of the 
Treasury.
[FR Doc. 2011-31728 Filed 12-20-11; 8:45 am]
BILLING CODE 4810-AM-C