RegV_20151119_omb

Supporting Statement for the
Recordkeeping and Disclosure Requirements Associated with
Regulation V (Fair Credit Reporting)
(Reg V; OMB No. 7100-0308)
Summary
The Board of Governors of the Federal Reserve System, under delegated authority from
the Office of Management and Budget (OMB), proposes to extend for three years, without
revision, the mandatory Recordkeeping and Disclosure Requirements Associated with
Regulation V (Fair Credit Reporting) (Reg V; OMB No. 7100-0308).1
Since 2011, the CFPB has been responsible for issuing most FCRA regulations. The
Federal Reserve retained rule-writing authority for certain provisions of the FCRA applicable to
motor vehicle dealers and provisions of the FCRA that require identity theft prevention
programs, regulate the disposal of consumer information, and require card issuers to validate
consumers’ notifications of changes of address.2 However, under the Paperwork Reduction Act
(PRA), the Federal Reserve continues to be responsible for renewing every three years the
information collections required by the financial institutions the Federal Reserve supervises,
regardless of whether the Federal Reserve or CFPB issues the rules mandating the collections.
The PRA classifies reporting, recordkeeping, or disclosure requirements of a regulation as an
information collection.3
The Federal Reserve accounts for the paperwork burden associated with the FCRA
regulations only for Federal Reserve-supervised institutions. The total annual burden for Federal
Reserve-supervised entities is estimated to be 506,124 hours. Other federal agencies account for
the paperwork burden that the FCRA regulations impose on the institutions for which they have
supervisory authority.
Background and Justification
The Fair Credit Reporting Act (FCRA) was enacted in 1970 based on a Congressional
finding that the banking system is dependent on fair and accurate credit reporting.4 The FCRA
was enacted to ensure consumer reporting agencies exercise their responsibilities with fairness,
impartiality, and a respect for the consumer’s right to privacy. The FCRA requires consumer
reporting agencies to adopt reasonable procedures that are fair and equitable to the consumer

1

The Consumer Financial Protection Bureau (CFPB) and the Federal Reserve implementing the Fair Credit
Reporting Act (FCRA). The CFPB’s Regulation V is located at 12 C.F.R. Part 1022. The Federal Reserve’s
Regulation V is located at 12 C.F.R. Part 222. To avoid confusion regarding references to the CFPB’s Regulation V
and the Federal Reserve’s Regulation V, this memorandum generally references “FCRA regulations,” whether such
regulations are issued by the CFPB or the Federal Reserve.
2
See Dodd-Frank Act sections 1029 and 1088(a)(10)(E), 12 U.S.C. § 5519 and 15 U.S.C. 1681s(e).
3
See 44 U.S.C. § 3501 et seq.
4
The FCRA is one part of the Consumer Credit Protection Act which also includes the Truth in Lending Act, Equal
Credit Opportunity Act, and Fair Debt Collection Practices Act. See 15 U.S.C. § 1601 et seq.

with regard to the confidentiality, accuracy, relevancy, and proper utilization of consumer
information.5
Congress substantially amended the FCRA upon the passage of the Fair and Accurate
Credit Transactions Act of 2003 (FACT Act).6 The FACT Act created many new
responsibilities for consumer reporting agencies and users of consumer reports. It contained
many new consumer disclosure requirements, as well as provisions to address identity theft. In
addition, the FACT Act provided consumers with the right to obtain a copy of their consumer
report annually without cost. Improving consumers’ access to their credit report is intended to
help increase the accuracy of data in the consumer reporting system.
The Dodd-Frank Wall Street Reform and Consumer Protection Act, enacted in 2010,
transferred most, but not all, FCRA rulemaking authority to the CFPB. However, rulemaking
responsibility for provisions regarding the disposal of consumer information, identity theft
prevention programs (“red flags”), and the duties of card issuers regarding changes of address
were not transferred CFPB and responsibility for these provisions remained with the Federal
Reserve and other federal agencies.7 On December 21, 2011, the CFPB published an interim
final rule establishing a new Regulation V.8 The Federal Reserve’s FCRA regulations are
contained in the Federal Reserve’s Regulation V.9
Since the last extension of information collection requirements, FCRA regulations
applicable to Federal Reserve-supervised institutions have been amended twice, but these
revisions did not affect the Federal Reserve’s information collection, and the revisions had no
PRA implications.10
Description of Information Collection
The paperwork requirements of the FCRA regulations are described below.

5

See 15 U.S.C. § 1681.
See Pub. L. No. 108-159, 117 Stat. 1952.
7
See Dodd-Frank Act section 1088(a)(10)(E), 15 U.S.C. 1681s(e). In addition, provisions of the FCRA that are
applicable to certain motor vehicle dealers are not within the CFPB’s jurisdiction and must be implemented in
regulations issued by the Federal Reserve or the Federal Trade Commission (FTC).
8
See 76 FR 79308 (Dec. 21, 2011), implementing 12 C.F.R. Part 1022.
9
See 12 C.F.R. Part 222.
10
Prior to the transfer of rule-writing authority to the CFPB in July 2011, the Federal Reserve and FTC jointly
revised their regulations to include the disclosure of credit scores and related information in risk-based pricing
model notices. These changes reflect requirements added by the Dodd-Frank Act, which apply when a consumer’s
credit score is used in setting the material terms of credit. See section 1100F of the Dodd-Frank Act, which
amended FCRA section 615(h), 15 U.S.C. § 1681m. In 2014, the Federal Reserve amended Regulation V to narrow
the definition of “creditor” in the identify theft red flags provisions to correspond to the Red Flag Program
Clarification Act of 2010, which excluded certain professionals, such as doctors or lawyers, who sell a product or
service for which the consumer can pay later. See Public Law 111–319, 124 Stat. 3457 (Dec. 18, 2010), which
amended FCRA section 615(e), 15 U.S.C. § 1681m(e).
6

2

Negative Information Notice (Appendix B to Part 1022)
A financial institution that extends credit and, regularly and in the ordinary course of
business, furnishes information to a consumer reporting agency generally must provide written
notice to a consumer if it furnishes negative information to a consumer reporting agency. After
providing such notice, the financial institution may submit additional negative information with
respect to the same transaction, extension of credit, account, or customer without providing
additional notice to the customer. The notice must be provided to the customer prior to, or no
later than 30 days after, furnishing the negative information to a consumer reporting agency. (15
U.S.C. § 1681s–2(a)(7)).
A financial institution is deemed to be in compliance with the notice requirement if it
properly uses the model forms in Appendix B to 12 C.F.R. Part 1022.
Affiliate Marketing Notice Requirements (Sections 1022.20 - .27)
The affiliate marketing notice requirements generally prohibit a person from using
information received from an affiliate to make a solicitation for marketing purposes to a
consumer, unless the consumer is given a notice; provided a reasonable opportunity and
reasonable and simple method to opt out of the use of the information; and the consumer does
not opt out. The notice must be provided either 1) by an affiliate that has or has previously had a
pre-existing business relationship with the consumer, or 2) as part of a joint notice from two or
more members of an affiliated group of companies, provided that at least one of the affiliates on
the joint notice has or has previously had a pre-existing business relationship with the consumer.
The election of a consumer to opt out must be effective for at least five years beginning
when the consumer’s opt-out election is received and implemented, unless the consumer
subsequently revokes the opt-out in writing or, if the consumer agrees, electronically. An optout period of more than five years may be established, including an opt-out period that does not
expire unless revoked by the consumer. A consumer may opt out at any time.
Identity Theft Red Flags Provisions (Sections 222.90 - .91)
The identity theft red flags provisions require each financial institution or creditor that
offers or maintains one or more covered accounts to (1) create, and periodically update, a written
Identity Theft Prevention Program, which is approved by either its board of directors or an
appropriate committee of the board of directors; (2) involve the board of directors, an appropriate
committee thereof, or senior management in the oversight, development, implementation and
administration of the program; (3) train staff, as necessary, to effectively implement the
program; and (4) exercise appropriate and effective oversight of service provider arrangements.
In addition, the provisions require each credit and debit card issuer to establish policies
and procedures to assess the validity of a change of address notification before honoring a
request for an additional or replacement card received during at least the first 30 days after it
receives the notification. The issuer must also either notify the cardholder of the request in
writing, electronically, or orally, and provide a method of promptly reporting incorrect address

3

changes, or use another means of assessing the validity of the change of address. Alternatively,
the issuer may validate an address when it receives an address change notification, but before it
receives a request for an additional or replacement card.
Address Discrepancies Provisions (Section 1022.82)
The address discrepancies provisions require a user of consumer reports to develop
reasonable policies and procedures it employs when it receives a notice of address discrepancy
from a consumer reporting agency. The policies and procedures must be designed to enable the
user to form a reasonable belief that a consumer report relates to the consumer about whom it has
requested the report.
A user of consumer reports also must develop and implement reasonable policies and
procedures for furnishing an address for the consumer that the user has reasonably confirmed is
accurate to the consumer reporting agency from which it received the notice of address
discrepancy when the user (1) can form a reasonable belief that the consumer report relates to the
consumer about whom the user requested the report; (2) establishes a continuing relationship
with the consumer; and (3) regularly and in the ordinary course of business furnishes information
to the consumer reporting agency from which the notice of address discrepancy relating to the
consumer was obtained. These policies and procedures must provide that the user will furnish
the consumer’s address that the user has reasonably confirmed is accurate to the consumer
reporting agency as part of the information it regularly furnishes for the reporting period in
which it establishes a relationship with the consumer.
Risk-Based Pricing Notices and Credit Score Disclosures (Sections 1022.70 - .75)
The risk-based pricing rule generally requires a creditor to provide a risk-based pricing
notice to a consumer if that creditor (1) uses a consumer report in connection with an application
for, or a grant, extension, or other provision of, credit to that consumer that is primarily for
personal, family, or household purposes; and (2) based in whole or in part on the consumer
report, grants, extends, or otherwise provides credit to that consumer on material terms that are
materially less favorable than the most favorable terms available to a substantial proportion of
consumers from or through that creditor. The rule applies to use of a consumer report in an
account review that results in an increase in the annual percentage rate, unless the consumer is
given an adverse action notice. The risk-based pricing rule provides several alternative methods
that creditors may use to determine which consumers must be given a notice. In 2011, the riskbased pricing notice requirements were amended pursuant to the Dodd-Frank Act to require
creditors to disclose credit scores and related information to consumers if a credit score is used in
setting material terms of credit.
In the alternative, creditors may provide a credit score disclosure to consumers who apply
for credit, whether or not those consumers receive materially less favorable credit terms. To ease
creditors’ burden and cost of complying with the notice and disclosure requirements, model
forms are available in Appendix H of the regulation.

4

Duties of Furnishers of Information (Sections 1022.40 - .43)
Accuracy and integrity policies and procedures. Each person that furnishes information
to a consumer reporting agency (furnisher) must establish and implement reasonable written
policies and procedures regarding the accuracy and integrity of the information relating to
consumers that it furnishes to a consumer reporting agency. A furnisher must also review these
policies and procedures periodically and update them, as necessary. The policies and procedures
must be appropriate to the nature, size, complexity, and scope of each furnisher’s activities. A
furnisher must incorporate into its policies and procedures, as appropriate, guidelines from
Appendix E of 12 C.F.R. Part 1022.
Direct disputes. With some exceptions, if a consumer disputes the accuracy of certain
information in a consumer report directly with the furnisher, the furnisher must (1) conduct a
reasonable investigation with respect to the disputed information; (2) review all relevant
information provided by the consumer with the dispute notice; (3) complete its investigation of
the dispute and report the results of the investigation to the consumer before the expiration of the
period within which a consumer reporting agency would be required to complete its action if the
consumer had elected to dispute the information under that section; and (4) if the investigation
finds that the information reported was inaccurate, promptly notify each consumer reporting
agency to which the furnisher provided inaccurate information of that determination and provide
to the consumer reporting agency any correction to that information that is necessary to make the
information provided by the furnisher accurate.
A furnisher need not investigate a direct dispute if it has reasonably determined that the
dispute is frivolous or irrelevant. If the furnisher makes this determination, it must notify the
consumer of the determination not later than five business days after making the determination,
by mail or, if authorized by the consumer for that purpose, by any other means available to the
furnisher. A notice of determination that a dispute is frivolous or irrelevant must include the
reasons for such determination and identify any information required to investigate the disputed
information, which notice may consist of a standardized form describing the general nature of
such information.
Time Schedule for Information Collection
The recordkeeping and disclosure requirements associated with the FCRA regulations are
mandatory and are triggered by certain events. Disclosures must be provided within prescribed
times.
Legal Status
The Board’s Legal Division has determined that the Dodd-Frank Wall Street Reform and
Consumer Protection Act (12 U.S.C. § 5519) authorizes the Board to prescribe regulations
regarding motor vehicle dealers. The FCRA (15 U.S.C. §§ 1681m, 1681w, and 1681s)
authorizes the Board to prescribe regulations regarding identity theft red flags programs, disposal
of consumer information, and validation of changes of address by card issuers. Additionally, 15
U.S.C. § 1681s(b) and (e) together provide that the Board shall have enforcement powers with

5

regard to Board-regulated entities for CFPB-prescribed regulations under the FCRA. The
obligation to comply with the foregoing notice and disclosure requirements of Regulation V is
mandatory. Because the notices and disclosures required are not provided to the Federal
Reserve, and all records thereof are maintained at state member banks, no issue of confidentiality
arises under the Freedom of Information Act.
Consultation Outside the Agency
On August 11, 2015, the Federal Reserve published a notice in the Federal Register (80
FR 48104) requesting public comment for 60 days on the Reg V information collection. The
comment period for this notice expired on October 13, 2015. The Federal Reserve did not
receive any comments. On November 12, 2015, the Federal Reserve published a final notice in
the Federal Register (80 FR 69968).
Estimates of Respondent Burden
The total annual burden is estimated to be 506,124 hours for institutions supervised by
the Federal Reserve that are deemed respondents for purposes of the PRA. The estimated burden
arises exclusively from the recordkeeping and disclosures required under the regulation and is
shown in the table below. The total recordkeeping and disclosure requirements for the FCRA
regulations represent 3.85 percent of total Federal Reserve System paperwork burden.

6

Number of
respondents11

Reg V
Negative information notice
(12 C.F.R. Part 1022,
Appendix B)

Annual
frequency

Estimated
average time
per response

Estimated
annual burden
hours

1,500

1

15 minutes

375

1,402
1,282,000

1
1

18 hours
5 minutes

25,236
106,833

Identity theft red flags
(12 C.F.R. §§ 222.90-.91)

2,024

1

37 hours

74,888

Address discrepancies
(12 C.F.R. § 1022.82)

1,500

1

4 hours

6,000

Risk-based pricing
(12 C.F.R. §§ 1022.70-.75)
Notice to consumers

1,500

12

5 hours12

90,000

1,500

1

40 hours

60,000

611,966

1

14 minutes

142,792

Affiliate marketing
(12 C.F.R. §§ 1022.20-.27)
Notices to consumers
Consumer response

Furnisher duties
(12 C.F.R. §§ 1022.40-.43)
Policies and procedures
Notices of frivolous disputes to
consumers
Total

506,124

The current estimated cost to the public for this information collection is $23,227,301.13
11

Of these respondents, 773 are considered small entities as defined by the Small Business Administration (i.e.,
entities with less than $550 million in total assets) – 638 state member banks, 70 branches & agencies of foreign
banks, 25 Edge and agreement corporations, and 40 operating subsidiaries.
Of the 1,402 affiliate marketing - notice to consumers respondents, 665 are considered small entities as defined by
the Small Business Administration (i.e., entities with less than $550 million in total assets) – 533 state member
banks, 70 branches & agencies of foreign banks, 225 Edge and agreement corporations, and 40 operating
subsidiaries. www.sba.gov/content/table-small-business-size-standards.
12
The Federal Reserve believes that most respondents are providing credit score disclosures rather than risk-based
pricing notices, so amendments to risk-based pricing notices do not create additional burden.
13
Total cost to the public was estimated using the following formula: percent of staff time, multiplied by annual
burden hours, multiplied by hourly rates (30% Office & Administrative Support at $17, 45% Financial Managers at
$63, 15% Lawyers at $64, and 10% Chief Executives at $87). Hourly rates for each occupational group are the
(rounded) mean hourly wages from the Bureau of Labor and Statistics (BLS), Occupational Employment and Wages
May 2014, published March 25, 2015, www.bls.gov/news.release/ocwage.t01.htm. Occupations are defined using
the BLS Occupational Classification System, www.bls.gov/soc/ and the average consumer cost of $24 is estimated
using data from the BLS Economic News Release (USDL-14-0433) www.bls.gov/news.release/cewqtr.nr0.htm.

7

Sensitive Questions
This collection of information contains no questions of a sensitive nature, as defined by
OMB guidelines.
Estimated Cost to the Federal Reserve System
Since the Federal Reserve does not collect any information, the cost to the Federal
Reserve System is negligible.

8