CFPB Fines National Bank for FCRA Violations

The CFPB recently took action against a national bank (Bank) for violating the Fair Credit Reporting Act (FCRA) by, among other things, failing to maintain and implement policies and procedures to ensure that customer information provided to consumer reporting companies was current and accurate.  A consent order signed by the Bank levies a $4.6 million penalty and requires the Bank to establish new policies and procedures to ensure FCRA compliance in the future.

In screening potential customers, banks rely on records maintained by consumer reporting companies regarding consumers’ past checking account behavior.  Under FCRA, banks are required to establish and implement policies and procedures to ensure the accuracy and integrity of consumer information furnished to consumer reporting agencies.  As set forth in the consent order, the CFPB found that the Bank failed to maintain or implement reasonable policies and procedures in connection with the Bank’s provision of information to consumer reporting companies regarding consumer deposit accounts.

FCRA also requires banks to investigate within 30 days any direct disputes from consumers regarding information reported to consumer reporting companies, and to communicate investigation results to complainants.  Per the consent order, the CFPB found that, between July 2010 and December 2014, thousands of consumers sent direct disputes to the Bank concerning information it had furnished to consumer reporting companies.  During that time, the CFPB concluded, the Bank failed to adequately inform consumers of the results of its investigations.

Separately, FCRA requires financial institutions to provide consumers with the name and contact information of any consumer reporting company that supplied information used by the financial institution in deciding to deny a consumer’s checking account application.  The CFPB concluded that, between October 2014 and February 2015, the Bank failed to identify consumer reporting companies that supplied information on which the Bank based its denial decisions in connection with as many as 17,500 checking account applicants.

In addition to paying a $4.6 million penalty, the Bank must adopt reasonable policies and procedures to ensure that the customer information the Bank distributes to consumer reporting companies is accurate.  The Bank must also report investigation results to customers who file direct disputes, and provide consumers with the contact information of any consumer reporting company that supplied information relied on by the Bank to deny any deposit account application.

The action is In the Matter of JPMorgan Chase Bank, N.A., No. 2017-CFPB-0015, and a copy of the consent order may be found here.