FCRA and FACTA: Credit Reports on the SAFE Exam

Every mortgage file starts with a credit report, so it makes sense that the NMLS test asks about the law that controls them. The Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA) show up in Federal Mortgage-Related Laws, which is 24% of the national test. Expect questions on when you can pull a report, what you must tell a home loan applicant about their credit score, what goes in an adverse action notice, how long negative items can stay on a report, and how fraud alerts work.

This guide covers the parts the exam tests most, in plain English, with the numbers you need to memorize.

What FCRA and FACTA are

The Fair Credit Reporting Act became law in 1970 and is codified at 15 U.S.C. 1681. It regulates three groups: consumer reporting agencies (the credit bureaus), the users of consumer reports (lenders, landlords, employers, insurers), and the furnishers who send account data to the bureaus. Its goals are accuracy, fairness, and privacy of the information in consumer files.

FACTA, signed December 4, 2003, is not a separate law you look up on its own. It amended the FCRA and added most of the identity theft tools: free annual credit reports, fraud alerts, the Red Flags Rule, credit score disclosures, and card number truncation on receipts.

The CFPB writes most FCRA rules in Regulation V (12 CFR 1022). The CFPB and the FTC share enforcement, along with the banking regulators for the institutions they supervise.

Permissible purpose: when you can pull credit

A credit bureau may furnish a consumer report only for a permissible purpose listed in the law. The ones that matter for an MLO:

A credit transaction involving the consumer, such as a mortgage application the consumer started.
The written instructions of the consumer.
A legitimate business need in connection with a transaction the consumer initiated, or reviewing an existing account.
Others the exam may list as distractors: employment (with the applicant's written authorization), insurance underwriting, a court order or grand jury subpoena, and government licensing decisions.

Curiosity is not a permissible purpose. Pulling a report on a neighbor, an ex, or a celebrity is a violation, and a person who gets a report under false pretenses or knowingly without a permissible purpose is liable for actual damages or $1,000, whichever is greater.

How long negative items can stay on a report

This is the most tested FCRA table. A credit bureau may not report these items once they are older than the limit:

Item	Limit
Bankruptcy	10 years from the order for relief or adjudication
Civil suits, civil judgments, arrest records	7 years, or the statute of limitations if longer
Paid tax liens	7 years from payment
Collection accounts and charge-offs	7 years
Any other adverse item	7 years
Criminal convictions	No time limit

For collections and charge-offs, the 7-year clock does not start on the date the account went to collection. It starts 180 days after the delinquency began, so re-selling an old debt to a new collector does not restart it.

The trap: these limits do not apply to a report used for a credit transaction with a principal amount of $150,000 or more, life insurance with a face amount of $150,000 or more, or a job paying $75,000 or more a year. A question that asks whether a 12-year-old judgment can appear on a report pulled for a $300,000 mortgage is testing this exception.

Credit score disclosure to home loan applicants

Anyone who makes or arranges loans and uses a credit score for a consumer-purpose loan secured by 1 to 4 units of residential real property must give the applicant, as soon as reasonably practicable:

The credit score used and the range of possible scores under that model.
Up to 4 key factors that hurt the score (plus the number of inquiries if that was also a key factor).
The date the score was created and who provided it.
The Notice to the Home Loan Applicant, with the name, address, and phone number of each bureau that provided a score.

"Makes or arranges" means mortgage brokers are covered too, not just lenders. Only one disclosure is required per loan, so if the lender already gave it, the broker does not have to repeat it. A contract clause that forbids a lender from sharing the score with the borrower is void.

Risk-based pricing notices

FACTA added a risk-based pricing notice: when a creditor uses a consumer report to offer credit on terms materially less favorable than its best terms, it has to tell the consumer. Regulation V gives mortgage lenders a simple way to comply. For credit secured by 1 to 4 units of residential real property, a lender that gives every applicant a credit score disclosure notice (the score information above plus a chart showing how the score compares to other consumers) does not have to send a separate risk-based pricing notice. A lender that sends an adverse action notice also does not need one.

Adverse action notices under the FCRA

When a lender denies credit or takes other adverse action based in whole or in part on a consumer report, the FCRA requires a notice that includes:

The numerical credit score used, with its range, key factors, date, and source.
The name, address, and phone number of the credit bureau (toll-free if it is a nationwide bureau).
A statement that the bureau did not make the decision and cannot explain why it was made.
The consumer's right to a free copy of the report within 60 days and the right to dispute inaccurate information with the bureau.

The exam often pairs this with ECOA, which sets the 30-day deadline to notify an applicant after a completed application is denied. Lenders usually combine both into one letter. See the ECOA and Regulation B guide for the ECOA side.

Free reports and disputes

Free annual report: each nationwide credit bureau must give a consumer a free copy of their file once every 12 months, requested through the centralized source (AnnualCreditReport.com).
Disputes: when a consumer disputes an item, the bureau must reinvestigate free of charge within 30 days. That can stretch by up to 15 more days if the consumer sends relevant information during the 30 days. The bureau must notify the furnisher within 5 business days.
Information that is inaccurate or cannot be verified must be deleted or corrected.

FACTA identity theft protections

Know the three alert types and how long each lasts:

Initial fraud alert: at least 1 year. Any consumer who suspects in good faith they are or may become a fraud victim can request one. (It was 90 days before a 2018 change, so older study material may be wrong.)
Extended fraud alert: 7 years. Requires an identity theft report. The consumer is also removed from prescreened offer lists for 5 years.
Active duty alert: at least 12 months for active duty military.

A request to one nationwide bureau is passed on to the others. A lender that sees an initial or active duty alert must take reasonable steps to verify the applicant's identity before extending new credit, including calling the phone number the consumer listed. With an extended alert, the lender must contact the consumer in person or by the contact method the consumer designated.

A security freeze is free. A bureau must place it within 1 business day of a phone or online request (3 business days by mail) and lift it within 1 hour of a phone or online request.

Other FACTA rules the exam may name:

Red Flags Rule: financial institutions and creditors with covered accounts must have a written Identity Theft Prevention Program that identifies, detects, and responds to red flags of identity theft and is updated periodically.
Address discrepancy: when a bureau tells a lender that the address on the request differs substantially from the file, the lender must have procedures to confirm it has the right person.
Receipt truncation: electronically printed card receipts may show no more than the last 5 digits of the card number and may not show the expiration date.

Opting out of prescreened offers

Bureaus may sell prescreened lists to creditors who make firm offers of credit or insurance. A consumer can opt out of those lists. An opt-out by phone or online lasts 5 years. Returning a signed opt-out form makes it permanent.

Liability and deadlines to sue

Willful violation: actual damages or statutory damages of $100 to $1,000, plus punitive damages and attorney's fees.
Negligent violation: actual damages plus attorney's fees. No statutory or punitive damages.
Statute of limitations: the earlier of 2 years after the consumer discovers the violation or 5 years after it occurred.

Three practice questions

1. A borrower applies for a $320,000 purchase loan. The credit report shows a civil judgment entered 11 years ago, and the statute of limitations has expired. Was the credit bureau allowed to include it?

Answer: Yes. The 7-year limit does not apply to a report used for a credit transaction of $150,000 or more. On a smaller loan, the judgment would have to be left off.

2. A consumer who believes her wallet was stolen calls one nationwide credit bureau and asks for a fraud alert. She has not filed an identity theft report. What does she get, and for how long?

Answer: An initial fraud alert lasting at least 1 year. The bureau passes it to the other nationwide bureaus. The 7-year extended alert requires an identity theft report.

3. A mortgage broker pulls credit, uses the score to place a loan on a 2-unit owner-occupied home, and the lender has not given the borrower any credit score disclosure. Does the broker have to provide one?

Answer: Yes. The rule covers anyone who makes or arranges loans secured by 1 to 4 units of residential real property. The broker must give the score, range, key factors, date, source, and the Notice to the Home Loan Applicant. Only if another party already made the disclosure for that loan can the broker skip it.

Practice this on MLO Pass

FCRA questions are mostly numbers and notice contents, which makes them easy points once you have drilled them. A one-time $99 unlock of MLO Pass gives you about 1,154 questions across all five domains: Mortgage Loan Origination Activities 27%, Federal Mortgage-Related Laws 24%, General Mortgage Knowledge 20%, Ethics 18%, and Uniform State Content 11%. Pay once and keep it for life, with no subscription. Sign up to pass your test

Related study guides

Studying with other people taking the SAFE exam? Join the NMLS Test Prep community.