[Federal Register Volume 89, Number 87 (Friday, May 3, 2024)]
[Notices]
[Pages 36775-36779]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-09712]


=======================================================================
-----------------------------------------------------------------------

CONSUMER FINANCIAL PROTECTION BUREAU


Supervisory Highlights, Issue 32, Spring 2024

AGENCY: Consumer Financial Protection Bureau.

ACTION: Supervisory Highlights.

-----------------------------------------------------------------------

SUMMARY: The Consumer Financial Protection Bureau (CFPB or Bureau) is 
issuing its thirty-second edition of Supervisory Highlights.

DATES: The findings in this report cover select examinations in 
connection with credit reporting and furnishing that were completed 
from April 1, 2023, through December 31, 2023.

FOR FURTHER INFORMATION CONTACT: Jaclyn Sellers, Senior Counsel, at 
(202) 435-7449. If you require this document in an alternative 
electronic format, please contact [email protected].

SUPPLEMENTARY INFORMATION:

1. Introduction

    Credit reporting is critical to consumers' ability to access credit 
and other products and services and often is used as a factor in rental 
and employment determinations. Accuracy in consumer reports is of vital 
importance to the credit reporting system and to consumers. Inaccurate 
information on a consumer report can have significant consequences for 
consumers and may, among other things, lead them to receive products or 
services on less favorable terms or impede their ability to access 
credit or open a bank account.
    Inaccuracy in the credit reporting system is a long-standing issue 
that remains a problem today. Accordingly, the CFPB continues to 
prioritize examinations of consumer reporting companies (CRCs) and 
furnishers. CRCs are companies that regularly engage in whole or in 
part in the practice of assembling or evaluating information about 
consumers for the purpose of providing consumer reports to third 
parties.\1\ Furnishers are entities, such as banks, loan servicers, and 
others, that furnish information to the CRCs for inclusion in consumer 
reports.
---------------------------------------------------------------------------

    \1\ The term ``consumer reporting company'' as used in this 
publication means the same as ``consumer reporting agency,'' as 
defined in the Fair Credit Reporting Act, 15 U.S.C. 1681a(f), 
including nationwide consumer reporting agencies as defined in 15 
U.S.C. 1681a(p) and nationwide specialty consumer reporting agencies 
as defined in 15 U.S.C. 1681a(x).
---------------------------------------------------------------------------

    CRCs and furnishers play a crucial role in ensuring the accuracy 
and integrity of information contained in consumer reports. They also 
have an important role in the investigation of consumer disputes 
relating to the accuracy of information in consumer reports. The Fair 
Credit Reporting Act (FCRA) \2\ and its implementing regulation, 
Regulation V,\3\ subject CRCs and furnishers to requirements relating 
to their roles in the credit reporting system, including the 
requirement to reasonably investigate disputes and certain accuracy-
related requirements. The FCRA and Regulation V also impose obligations 
in connection with, among other things, consumer-alleged identity theft 
and--most recently--adverse information resulting from human 
trafficking including on consumer reports of human-trafficking victims.
---------------------------------------------------------------------------

    \2\ 15 U.S.C. 1681 et seq.
    \3\ 12 CFR part 1022.
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners have continued to find 
deficiencies in CRCs' compliance with the accuracy and identity theft 
requirements of the FCRA and Regulation V.\4\ For example, examiners 
found some CRCs were engaged in the practice of automatically declining 
to implement identity theft blocks upon receipt of the requisite 
documentation based on overbroad disqualifying criteria and without an 
individualized determination that there is a statutory basis to decline 
the block, in violation of the FCRA. Examiners also found some CRCs 
violated Regulation V's human trafficking requirements, effective as of 
July 25, 2022, by failing to timely block, or in some cases failing to 
block all, adverse items of information identified by the consumer as 
resulting from human trafficking.
---------------------------------------------------------------------------

    \4\ If a supervisory matter is referred to the Office of 
Enforcement, Enforcement may cite additional violations based on 
these facts or uncover additional information that could impact the 
conclusion as to what violations may exist.
---------------------------------------------------------------------------

    In recent reviews of furnishers, examiners have continued to find 
deficiencies in furnishers' compliance with the accuracy and dispute 
investigation requirements of the FCRA and Regulation V. Examiners 
found several furnishers violated the FCRA duty to promptly update or 
correct information determined to be incomplete or inaccurate, 
including, for example, by continuing to report fraudulent accounts to 
CRCs as valid (i.e., non-fraudulent) accounts for several years after 
determining the accounts were fraudulent. Examiners also found that 
some furnishers violated the FCRA, after receiving an identity theft 
report from a consumer at the appropriate address, by continuing to 
furnish information identified in the report as resulting from identity 
theft without the furnishers knowing or being informed by the consumer 
that the information was, in fact, correct. The findings in this report 
cover select examinations in connection with credit reporting and 
furnishing that were completed from April 1, 2023, through December 31, 
2023. To maintain the anonymity of the supervised institutions 
discussed in Supervisory Highlights, references to institutions 
generally are in the plural and related findings may pertain to one or 
more institutions.

2. Supervisory Observations

2.1 Consumer Reporting Companies

    In recent reviews of CRCs, examiners found deficiencies in CRCs' 
compliance with FCRA and Regulation V identity theft block, human 
trafficking submission and accuracy requirements.

2.1.1 CRC Duty To Block the Reporting of Information Resulting From an 
Alleged Identity Theft

    The FCRA requires CRCs to block the reporting of any information in 
a consumer's file that the consumer identifies as information that 
resulted from an alleged identity theft not later than four business 
days after the CRC receives certain documentation relating to the 
alleged identity theft. Such documentation includes appropriate proof 
of the consumer's identity, a copy of an identity theft report, 
identification of the information that resulted from the alleged 
identity theft, and a statement by the consumer that such information

[[Page 36776]]

does not relate to any transaction by the consumer.\5\ A CRC may 
decline to block, or rescind any block of, information if the CRC 
reasonably determines that: the information was blocked in error or a 
block was requested by the consumer in error; the information was 
blocked, or the block was requested, on the basis of a material 
misrepresentation of fact by the consumer relevant to the request to 
block; or the consumer obtained possession of goods, services or money 
as a result of the blocked transaction(s).\6\
---------------------------------------------------------------------------

    \5\ 15 U.S.C. 1681c-2(a); see 15 U.S.C. 1681a(q)(4) and 12 CFR 
1022.3(i)(1) (defining ``identity theft report'').
    \6\ 15 U.S.C. 1681c-2(c).
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners found that CRCs failed to 
timely implement blocks of information after receiving the requisite 
documentation relating to an alleged identity theft, without otherwise 
making a reasonable determination with respect to one of the statutory 
bases for declining to block such information. Examiners found that the 
CRCs instead maintained policies pursuant to which the CRCs 
automatically declined to block information if the associated 
account(s) of the consumer met any one of a set of overbroad 
disqualifying criteria that were not sufficiently tailored to support a 
reasonable determination regarding any of the statutory declination 
bases.
    In response to these findings, CRCs were directed to cease the 
practice of automatically declining to implement blocks based on 
overbroad disqualifying criteria without an individualized 
determination that there is a statutory basis to decline. CRCs also 
were directed to implement revisions to the CRCs' policies to ensure 
compliance with FCRA identity theft block obligations, including any 
circumstances in which the CRCs may reasonably request additional 
information or documentation to determine the validity of an alleged 
identity theft and any circumstances in which there is a valid basis to 
decline to block.

2.1.2 CRC Duty To Promptly Notify Consumers After Declining To 
Implement, or Rescind, an Identity Block

    The FCRA requires CRCs to promptly notify the affected consumer if 
the CRC declines to block, or rescinds a block of, information that the 
consumer identifies as information resulting from an alleged identity 
theft.\7\ CRCs must notify the consumer in the same manner as CRCs are 
required to notify consumers of a reinsertion of information into a 
consumer's file--i.e., in writing within five business days and by 
providing certain information, including the name and address of the 
furnisher of the identified information if reasonably available and a 
notice that the consumer has the right to add a statement to the 
consumer's file disputing the accuracy or completeness of such 
information.\8\
---------------------------------------------------------------------------

    \7\ 15 U.S.C. 1681c-2(c)(2).
    \8\ Id. (referencing the notice requirements of 15 U.S.C. 
1681i(a)(5)(B)).
---------------------------------------------------------------------------

    In recent reviews of CRCs, examiners found that CRCs failed to 
provide the requisite notice within five business days of declining to 
block information--in some instances due to system issues and in others 
due to human error. Examiners also found that CRCs systematically 
failed to timely provide consumers with the relevant furnisher's 
contact information and/or notice regarding the consumer's right to add 
a statement to the consumer's file disputing the accuracy or 
completeness of the furnished information.
    In response to these findings, CRCs were directed to revise their 
policies to ensure compliance with FCRA identity theft block notice 
obligations and update notice templates to include the requisite 
information for consumers.

2.1.3 CRC Duty To Provide Victims of Identity Theft With Summaries of 
Rights

    The FCRA requires CRCs, upon a consumer contacting the CRC and 
expressing a belief that they are a victim of fraud or identity theft, 
to provide the consumer with a summary of rights containing all of the 
information required by the CFPB in its model summary of rights,\9\ 
along with information about how to request more detailed information 
from the CFPB.\10\ In recent reviews of CRCs, examiners found that CRCs 
failed to comply with this provision, either by failing to include 
required information in summaries of rights or by failing to provide 
the summary of rights to eligible consumers entirely.
---------------------------------------------------------------------------

    \9\ Consumer Fin. Prot. Bureau, Appendix I to part 1022--Summary 
of Consumer Identity Theft Rights, https://www.consumerfinance.gov/rules-policy/regulations/1022/i.
    \10\ 15 U.S.C. 1681g(d)(2).
---------------------------------------------------------------------------

    In response to these findings, CRCs are updating their systems to 
ensure that they provide the required summary of rights.

2.1.4 CRC Duty To Block Adverse Information Resulting From Human 
Trafficking

    Regulation V requires CRCs to block adverse items of information 
identified by a consumer or their representative as resulting from a 
severe form of trafficking in persons or sex trafficking, as defined in 
the regulation.\11\ CRCs must block such items within four business 
days of receiving a consumer's submission, except in limited 
circumstances where additional information is necessary to complete the 
submission.\12\ In recent reviews of CRCs, examiners found that CRCs 
failed to timely block identified adverse items of information within 
the applicable four business days. CRCs blocked some but not all items 
identified in a qualifying consumer submission and in other instances 
failed to implement a block entirely.
---------------------------------------------------------------------------

    \11\ 12 CFR 1022.142(c).
    \12\ 12 CFR 1022.142(e)(1).
---------------------------------------------------------------------------

    In response to these findings, CRCs were directed to revise their 
compliance processes to ensure that they process all human trafficking 
block requests in accordance with the requirements of Regulation V.

2.1.5 CRC Duty To Follow Reasonable Procedures To Assure Maximum 
Possible Accuracy

    The FCRA requires that, wherever a CRC ``prepares a consumer report 
it shall follow reasonable procedures to assure maximum possible 
accuracy of the information concerning the individual about whom the 
report relates.'' \13\ In recent reviews of CRCs, examiners found that 
CRCs' accuracy procedures failed to comply with this obligation because 
the CRCs (1) failed to adequately monitor dispute metrics that would 
suggest a furnisher may no longer be a source of reliable, verifiable 
information about consumers, and (2) continued to include information 
in consumer reports that was provided by unreliable furnishers without 
implementing procedures to assure the accuracy of information provided 
by unreliable furnishers. Specifically, the CRCs did not monitor 
metrics and thresholds tied to objective measures of inaccuracy or 
unreliability. Moreover, the CRCs maintained data from furnishers that 
responded to disputes in ways that suggested that the furnishers were 
no longer sources of reliable, verifiable information about consumers. 
For example, CRCs received furnisher dispute response data indicating 
that, for several months, furnishers failed to respond to all or nearly 
all disputes, or responded to all disputes in the same manner. Despite 
observing this dispute response behavior by these furnishers, CRCs 
continued to include information from these furnishers in consumer 
reports.
---------------------------------------------------------------------------

    \13\ 15 U.S.C. 1681e(b).
---------------------------------------------------------------------------

    In response to these findings, CRCs were directed to revise their 
accuracy

[[Page 36777]]

procedures to identify and monitor furnishers and take corrective 
action regarding data from furnishers whose dispute response behavior 
indicates the furnisher is not a source of reliable, verifiable 
information about consumers.

2.2 Furnishers

    In recent reviews of furnishers, examiners found deficiencies in 
furnishers' compliance with FCRA and Regulation V accuracy, dispute 
investigation and identity theft requirements.

2.2.1 Furnisher Duty to Promptly Correct and Update Information 
Determined To Be Incomplete or Inaccurate

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to promptly correct and update furnished information after 
determining that such information is incomplete or inaccurate.\14\ 
Specifically, in recent reviews of auto loan furnishers, examiners 
found that furnishers continued to furnish incomplete or inaccurate 
information for several months, and in some cases years, after the 
furnishers determined, through either dispute handling or 
identification of systemic issues, the information was furnished 
incompletely or inaccurately. For example, examiners found that 
furnishers continued to report dates of first delinquency inaccurately 
for several months after determining that they were reporting 
inaccurately due to various system coding issues. Examiners also found 
that after determining accounts were in a bankruptcy status and 
therefore should have been reported as current with dates of first 
delinquency that reflect the bankruptcy filing dates, furnishers failed 
to update the dates of first delinquency for the accounts to the 
bankruptcy filing dates. By failing to update the dates of first 
delinquency for the accounts in bankruptcy when they determined the 
accounts were in bankruptcy, the furnishers failed to promptly update 
or correct information they had determined to be incomplete or 
inaccurate. In response to these findings, furnishers are updating 
their internal controls related to promptly correcting or updating 
furnished information after determining it is incomplete or inaccurate 
and engaging in lookbacks to remediate the furnishing of the previously 
impacted accounts.
---------------------------------------------------------------------------

    \14\ 15 U.S.C. 1681s-2(a)(2).
---------------------------------------------------------------------------

    Examiners also found that auto loan furnishers did not promptly 
send corrections or updates to CRCs after determining that accounts 
with lease returns were paid-in-full. When leased cars were returned to 
dealerships, furnishers updated their systems of record to reflect that 
the accounts had been paid-in-full. However, examiners found that the 
furnishers failed to update the information furnished to CRCs to 
reflect that the accounts were paid-in-full. In response to these 
findings, furnishers are conducting lookbacks to ensure that 
corrections or updates are furnished for impacted accounts and are 
implementing internal controls to ensure they promptly correct or 
update furnished information after determining it is incomplete or 
inaccurate.
    In addition, in reviews of deposit furnishers, examiners found that 
furnishers continued to report fraudulent accounts to CRCs for several 
years after determining the accounts were fraudulent. While, in some 
instances, furnishers closed the accounts determined to be fraudulent, 
they continued to furnish the accounts as valid (i.e., non-fraudulent) 
accounts and failed to notify CRCs that the accounts should be deleted 
because they were fraudulent. By not instructing CRCs to delete the 
accounts promptly after determining they were fraudulent, the 
furnishers failed to promptly correct or update furnished information 
determined to be inaccurate or incomplete.
    In response to these findings, furnishers conducted lookbacks to 
ensure they deleted all accounts they determined to be opened 
fraudulently and updated their policies and procedures related to 
notifying CRCs when accounts are determined to be fraudulent to ensure 
the accounts are deleted.

2.2.2 Furnisher Duty To Notify CRCs of Direct Disputes

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to notify CRCs that the accuracy or completeness of items 
being furnished by them are subject to dispute.\15\ Specifically, in 
recent reviews of deposit furnishers, examiners found that furnishers 
who received direct disputes from consumers were continuing to furnish 
the disputed information to CRCs without notifying the CRCs that the 
information was subject to dispute.
---------------------------------------------------------------------------

    \15\ 15 U.S.C. 1681s-2(a)(3).
---------------------------------------------------------------------------

    In response to these findings, furnishers are updating their 
policies to make clear that they will provide notices of direct 
disputes to CRCs.

2.2.3 Furnisher Duty To Conduct Reasonable Investigations of Direct 
Disputes

    Examiners are continuing to find that furnishers are violating the 
Regulation V duty to conduct a reasonable investigation of direct 
disputes.\16\ Specifically, in recent reviews of auto loan furnishers, 
examiners found evidence that furnishers failed to investigate direct 
disputes that did not satisfy those furnishers' extraneous identity 
verification requirements. Regulation V specifically defines what a 
consumer must include in a dispute notice to trigger a furnisher's duty 
to investigate. Although these disputes met the Regulation V 
requirements for a direct dispute, examiners found evidence that the 
furnishers did not investigate the disputes because the consumer had 
not satisfied additional identity verification requirements of the 
furnisher. However, Regulation V does not permit a furnisher to 
establish additional requirements beyond what the regulation requires 
in order to initiate a direct dispute investigation by the furnisher.
---------------------------------------------------------------------------

    \16\ 12 CFR 1022.43(e)(1).
---------------------------------------------------------------------------

    Also, in recent reviews of debt collection furnishers, examiners 
found that when the furnishers received a direct dispute, they simply 
deleted the tradeline, rather than conducting an investigation. As the 
Bureau has previously explained, simply deleting tradelines in response 
to a direct dispute does not satisfy furnishers' responsibility to 
conduct a reasonable investigation with respect to the disputed 
information.\17\ After identification of these issues, furnishers were 
directed to update their policies and procedures to ensure they conduct 
reasonable investigations of direct disputes.
---------------------------------------------------------------------------

    \17\ CFPB Bulletin 2014-01 (Feb. 27, 2014).
---------------------------------------------------------------------------

2.2.4 Furnisher Duty To Provide Notice of Delinquency of Accounts

    Examiners are continuing to find that furnishers are violating the 
FCRA duty to notify CRCs of the dates of first delinquency on 
applicable accounts.\18\ Specifically, in recent reviews of auto loan 
furnishers, examiners found that furnishers inaccurately reported dates 
of first delinquency to CRCs due to various coding issues. For example, 
examiners found that coding errors resulted in furnishers inaccurately 
reporting dates of first delinquency as the first day of the statement 
cycle following the consumer's missed payment, rather than 30 days 
after the missed payment due date. Examiners also found that auto

[[Page 36778]]

loan furnishers reported inaccurate dates of first delinquency for 
accounts by reporting the dates of first delinquency as more recent 
than they should have been, including by changing the dates of first 
delinquency for accounts that remained delinquent month after month 
(i.e., accounts for which the dates of first delinquency should not 
have been changed).
---------------------------------------------------------------------------

    \18\ 15 U.S.C. 1681s-2(a)(5).
---------------------------------------------------------------------------

    In response to these findings, furnishers are conducting lookbacks 
to identify and remediate impacted accounts and updating their policies 
and procedures to ensure that they report dates of first delinquency 
accurately.

2.2.5 Furnisher Duty Not To Furnish Information That Purports To Relate 
to a Consumer Upon Receipt of an Identity Theft Report

    Examiners are continuing to find that furnishers are violating the 
FCRA's requirement that if a consumer submits an identity theft report 
at the address specified by the furnisher for receiving such reports 
stating that information maintained by that furnisher that purports to 
relate to the consumer resulted from identity theft, the furnisher may 
not furnish such information to any CRC, unless the furnisher 
subsequently knows or is informed by the consumer that the information 
is correct.\19\ Specifically, in recent reviews of auto loan 
furnishers, examiners found that furnishers who received identity theft 
reports at a qualifying address continued to furnish information 
identified in the report before knowing or being informed by the 
consumer that the information was correct.
---------------------------------------------------------------------------

    \19\ 15 U.S.C. 1681s-2(a)(6)(B).
---------------------------------------------------------------------------

    In response to these findings, furnishers are updating their 
policies and procedures to ensure that information subject to this 
requirement is not furnished prior to the completion of an 
investigation and determination of validity.

3. Supervisory Program Developments

3.1 Recent CFPB Supervisory Program Developments

    Set forth below are select supervision program developments 
including advisory opinions, that have been issued regarding credit 
reporting since our last regular edition of Supervisory Highlights.

3.1.1 CFPB Issued Advisory Opinion on Fair Credit Reporting: Background 
Screening

    On January 11, 2024, the CFPB issued an advisory opinion to affirm 
that, when preparing consumer reports, a CRC that reports public record 
information is not using reasonable procedures to assure maximum 
possible accuracy under the FCRA if it does not have procedures in 
place that: (1) prevent reporting information that is duplicative or 
that has been expunged, sealed, or otherwise legally restricted from 
public access; and (2) include any existing disposition information if 
it reports arrests, criminal charges, eviction proceedings, or other 
court filings.\20\ The advisory opinion also highlights that, when CRCs 
include adverse information in consumer reports: (1) the occurrence of 
the adverse event starts the running of the reporting period for 
adverse items under FCRA section 605(a)(5); (2) that period is not 
restarted or reopened by the occurrence of subsequent events; and (3) a 
non-conviction disposition of a criminal charge cannot be reported 
beyond the seven-year period that begins to run at the time of the 
charge. CRCs thus must ensure that they do not report adverse 
information beyond the reporting period in FCRA section 605(a)(5) and 
must at all times have reasonable procedures in place to prevent 
reporting of information that is duplicative or legally restricted from 
public access and to ensure that any existing disposition information 
is included if court filings are reported.
---------------------------------------------------------------------------

    \20\ The advisory opinion is available at: cfpb_fair-credi-
reporting-background-screening_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

3.1.2 CFPB Issues Advisory Opinion on File Disclosures

    On January 11, 2024, the CFPB issued an advisory opinion to address 
certain obligations that CRCs have under section 609(a) of the 
FCRA.\21\ The advisory opinion underscores that, to trigger a CRC's 
file disclosure requirement under FCRA section 609(a), a consumer does 
not need to use specific language, such as ``complete file'' or 
``file.'' The advisory opinion also highlights the requirements 
regarding the information that must be disclosed to a consumer under 
FCRA section 609(a). In addition, the advisory opinion affirms that 
CRCs must disclose to a consumer both the original source and any 
intermediary or vendor source (or sources) that provide the item of 
information to the CRC under FCRA section 609(a).
---------------------------------------------------------------------------

    \21\ The advisory opinion is available at: cfpb_fair-credit-
reporting-file-disclosure_2024-01.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

4. Remedial Actions

4.1 Public Enforcement Actions

    The CFPB's supervisory actions resulted in and supported the below 
enforcement actions related to credit reporting or furnishing.

4.1.1 Toyota Motor Credit Corporation

    On November 20, 2023, the CFPB issued an order against Toyota Motor 
Credit Corporation (Toyota Motor Credit), which is the United States-
based auto-financing arm of Toyota Motor Corporation and one of the 
largest indirect auto lenders in the country. Toyota Motor Credit 
provides financing for vehicles and optional ``add-on'' products and 
services sold with the vehicles. These add-ons include Guaranteed Asset 
Protection, which can waive some of a consumer's remaining loan balance 
if their car is totaled, stolen or damaged when they still owe money on 
the loan even with car insurance, and Credit Life and Accidental 
Health, which is designed to pay a remaining balance if the consumer 
dies or becomes disabled. The CFPB found that Toyota Motor Credit 
violated the Consumer Financial Protection Act of 2010 by: (1) unfairly 
and abusively making it unreasonably difficult for consumers to cancel 
unwanted add-ons, including when consumers complained that dealers had 
forced add-ons on consumers without their consent; (2) unfairly failing 
to ensure consumers received refunds of unearned Guaranteed Asset 
Protection and Credit Life and Accidental Health premiums when they 
paid off their loans early or ended lease agreements early, making the 
products no longer of any value to consumers; and (3) unfairly failing 
to provide accurate refunds to consumers who canceled their vehicle 
service agreements as a result of flawed system logic. The CFPB also 
found that Toyota Motor Credit violated the FCRA and its implementing 
Regulation V by (1) failing to promptly correct negative information it 
had sent to CRCs, where the negative information was falsely reporting 
customer accounts as delinquent even though customers had already 
returned their vehicles; and (2) failing to maintain reasonable 
policies and procedures to ensure related payment information it sent 
to CRCs was accurate. The order requires Toyota Motor Credit to pay $48 
million in consumer redress and a $12 million civil money penalty.\22\ 
The order also requires Toyota Motor Credit to stop its

[[Page 36779]]

unlawful practices and come into compliance with the law and prohibits 
incentive-based employee compensation or performance measurements in 
relation to add-on products.
---------------------------------------------------------------------------

    \22\ The Order is available at: cfpb_toyota-motor-credit-
corporation-consent-order_2023-11.pdf (consumerfinance.gov).
---------------------------------------------------------------------------

4.1.2 TransUnion, Trans Union LLC, and TransUnion Interactive, Inc.

    On October 12, 2023, the CFPB issued an order against TransUnion, 
parent company of one of the three nationwide CRCs, and two of its 
subsidiaries, Trans Union LLC, and TransUnion Interactive, Inc. 
(collectively, TransUnion), which are headquartered in Chicago, 
Illinois. Security freezes and locks block certain third parties, such 
as lenders, from accessing consumers' credit reports to prevent a 
potential identity thief from obtaining new credit in those consumers' 
names. Starting in September 2018, Federal law has required nationwide 
CRCs to provide security freezes as a free service, whereas locks are a 
feature of certain paid products. The CFPB found that TransUnion, from 
as early as 2003, failed to timely place or remove security freezes and 
locks on the credit reports of tens of thousands of consumers who 
requested them, including certain vulnerable consumers; in some cases, 
those requests were left unmet for months or years. The CFPB found 
TransUnion's failure to place or remove security freezes in a timely 
manner occurred as a result of problems, including systems issues, that 
TransUnion knew about but failed to address for years. The CFPB found 
that TransUnion's failure to place or remove security freezes in a 
timely manner violated the FCRA, and TransUnion's failure to place or 
remove both security freezes and locks in a timely manner was unfair in 
violation of the Consumer Financial Protection Act of 2010. Further, 
the CFPB found that TransUnion engaged in deceptive acts and practices 
by falsely telling certain consumers that their requests had been 
successful when they had not. In addition, the CFPB found that from 
about 2016 to 2020, TransUnion failed to exclude certain consumers, 
including active-duty military and other potential victims of identity 
theft, from pre-screened solicitation lists in violation of FCRA. The 
CFPB's order requires TransUnion to pay $3 million to consumers in 
redress and $5 million in civil penalties.\23\ TransUnion must also 
take steps to address and prevent unlawful conduct, including convening 
a committee to identify and address technology problems that can affect 
consumers.
---------------------------------------------------------------------------

    \23\ A copy of the Consent Order is available at:https://www.consumerfinance.gov/enforcement/actions/transunion-trans-union-llc-and-transunion-interactive-inc/.

Rohit Chopra,
Director, Consumer Financial Protection Bureau.
[FR Doc. 2024-09712 Filed 5-2-24; 8:45 am]
BILLING CODE 4810-AM-P