FRV_20190628_omb

Supporting Statement for the
Recordkeeping and Disclosure Requirements Associated with Regulation V
(FR V; OMB No. 7100-0308)
Summary
The Board of Governors of the Federal Reserve System (Board), under authority
delegated by the Office of Management and Budget (OMB), has extended for three years,
without revision, the Recordkeeping and Disclosure Requirements Associated with Regulation V
(FR V1; OMB No. 7100-0308). The Dodd-Frank Wall Street Reform and Consumer Protection
Act (Dodd-Frank Act), enacted in 2010, transferred to the Bureau of Consumer Financial
Protection (Bureau) most, but not all, of the rulemaking authority for issuing regulations under
the Fair Credit Reporting Act (FCRA).2 The Board and other federal agencies retained
rulemaking responsibility for the FCRA provisions regarding identity theft prevention programs
and the duties of card issuers to validate consumers’ changes of address (hereinafter, “identity
theft red flags”), as well as the disposal of consumer information, with respect to the entities that
are subject to each agency’s respective enforcement authority.3 The Board and Federal Trade
Commission (FTC) also retained rulemaking authority for certain provisions of the FCRA
applicable to motor vehicle dealers.4
The Paperwork Reduction Act (PRA) classifies reporting, recordkeeping, or disclosure
requirements of a regulation as an information collection.5 The Board continues to be responsible
for renewing every three years the information collection requirements contained in the Bureau’s
FCRA regulations for institutions with $10 billion or less in assets6 that are identified in 15
1

The internal Agency Tracking Number previously assigned by the Board to this information collection was
“Reg V.” The Board is changing the internal agency tracking number for the purpose of consistency.
2
The Bureau and the Board have issued regulations implementing the FCRA. The Bureau’s FCRA regulations are
located at 12 CFR Part 1022. The information collection provisions of the Bureau’s FCRA regulations are contained
in Appendix B to 12 CFR Part 1022; and in 12 CFR 1022.20 - .27, 1022.40 - .43, 1022.70 - .75, and 1022.82. The
Board’s FCRA regulations are located at 12 CFR Part 222. The information collection provisions of the Board’s
FCRA regulations applicable to institutions for which the Board has primary enforcement authority are contained in
12 CFR 222.90 - .91.
3
See section 1088(a)(10) of the Dodd-Frank Act (15 U.S.C. §§ 1681s(b) and (e)); see also 15 U.S.C. §§ 1681m and
1681w.
4
See section 1029 of the Dodd-Frank Act (12 U.S.C. § 5519(a) and (c)), which provides generally that rulemaking
authority for provisions of the federal consumer financial laws, including the FCRA, applicable to certain motor
vehicle dealers are not within the Bureau’s jurisdiction and must be implemented in regulations issued by the Board
or the FTC. The FTC accounts for the PRA burden for motor vehicle dealers’ compliance with the FCRA
regulations. See, e.g., 78 FR 16265, 16266 n. 11 (March 14, 2013).
5
See 44 U.S.C. § 3501 et seq.
6
Pursuant to the Dodd-Frank Act, for certain federal consumer financial laws, the Bureau has primary enforcement
authority over the FCRA and its implementing regulations with respect to, among other entities, insured depository
institutions with over $10 billion in assets and any affiliates thereof. See 12 U.S.C. § 5515. Accordingly, the
Bureau’s 2013 OMB Supporting Statement for its FCRA regulations provided that the Bureau is responsible for the
burden estimate “for 155 depository institutions (comprising depository institutions with total assets of more than
$10 billion and their depository affiliates), which is the approximate number of such depository entities that the
[Bureau] now has primary enforcement authority for with respect to [the FCRA] Regulation[s].” See
www.reginfo.gov/public/do/DownloadDocument?objectID=39326801. The Board retained primary enforcement
authority over the Bureau’s FCRA regulations with respect to depository institutions identified in 15 U.S.C. §

U.S.C. § 1681s(b)(1)(A)(ii) and for consumers of these institutions, as well as for prescribing and
enforcing the identity theft red flags provisions in the Board’s FCRA regulations for institutions
of any size that are identified in 15 U.S.C. § 1681s(b)(1)(A)(ii).
The current estimated total annual burden for the entities the Board retained primary
enforcement authority is 523,422 hours. Other federal agencies account for the paperwork
burden that the FCRA regulations impose on the entities for which they have primary
enforcement authority under the Dodd-Frank Act.
Background and Justification
The FCRA was enacted in 1970 based on a Congressional finding that the banking
system is dependent on fair and accurate credit reporting.7 The FCRA was enacted to ensure
consumer reporting agencies exercise their responsibilities with fairness, impartiality, and a
respect for the consumer’s right to privacy. The FCRA requires consumer reporting agencies to
adopt reasonable procedures that are fair and equitable to the consumer with regard to the
confidentiality, accuracy, relevancy, and proper utilization of consumer information.8
Congress substantially amended the FCRA upon the passage of the Fair and Accurate
Credit Transactions Act of 2003 (FACT Act).9 The FACT Act created many new responsibilities
for consumer reporting agencies and users of consumer reports. It contained many new consumer
disclosure requirements, as well as provisions to address identity theft. In addition, the FACT
Act provided consumers with the right to obtain a copy of their consumer report annually
without cost. Improving consumers’ access to their credit reports is intended to help increase the
accuracy of data in the consumer reporting system.
On December 21, 2011, the Bureau published an interim final rule establishing a new
Regulation V.10 The Board’s FCRA regulations are contained in the Board’s Regulation V.11
Since the last extension of information collection requirements, the FCRA regulations
applicable to institutions for which the Board retained primary enforcement authority under the
Dodd-Frank Act have not been amended in a way that imposes any new or revises any existing
recordkeeping, reporting, or disclosure requirements that would be collections of information
requiring approval.

1681s(b)(1)(A)(ii) with $10 billion or less in assets and any affiliates thereof. See 12 U.S.C. § 5515. The Board also
retained enforcement authority for all depository institutions identified in 15 U.S.C. § 1681s(b)(1)(A)(ii):
(1) regardless of size, with respect to the identity theft red flags provisions of the Board’s FCRA regulations and
(2) with $10 billion or less in assets and any affiliates thereof, and consumers of such institutions, with respect to
enforcing the Bureau’s FCRA regulations. See 15 U.S.C. § 1681m(e), and §§ 1681s(b) and (e).
7
The FCRA is one part of the Consumer Credit Protection Act, which also includes the Truth in Lending Act, Equal
Credit Opportunity Act, and Fair Debt Collection Practices Act. See 15 U.S.C. § 1601 et seq.
8
See 15 U.S.C. § 1681.
9
See Pub. L. No. 108-159, 117 Stat. 1952.
10
See 76 FR 79308 (December 21, 2011) implementing 12 CFR Part 1022.
11
See 12 CFR Part 222.

2

Description of Information Collection
The paperwork requirements of the Board’s and the Bureau’s FCRA regulations that
apply to institutions for which the Board retained primary enforcement authority under the
Dodd-Frank Act are described below.
Negative Information Notice (Appendix B to 12 CFR Part 1022)
A financial institution that extends credit and, regularly and in the ordinary course of
business, furnishes information to a consumer reporting agency generally must provide written
notice to a consumer if it furnishes negative information to a consumer reporting agency. After
providing such notice, the financial institution may submit additional negative information with
respect to the same transaction, extension of credit, account, or customer without providing
additional notice to the customer. The notice must be provided to the customer prior to, or no
later than 30 days after, furnishing the negative information to a consumer reporting agency.12
A financial institution is deemed to be in compliance with the notice requirement if it
properly uses the model forms in Appendix B to 12 CFR Part 1022.
Affiliate Marketing Notice Requirements (12 CFR 1022.20 - .27)
The affiliate marketing notice requirements generally prohibit a person from using
information received from an affiliate to make a solicitation for marketing purposes to a
consumer, unless the consumer is given a notice; provided a reasonable opportunity and
reasonable and simple method to opt out of the use of the information; and the consumer does
not opt out. The notice must be provided either (1) by an affiliate that has or has previously had a
pre-existing business relationship with the consumer or (2) as part of a joint notice from two or
more members of an affiliated group of companies, provided that at least one of the affiliates on
the joint notice has or has previously had a pre-existing business relationship with the consumer.
Identity Theft Red Flags Provisions (12 CFR 222.90 - .91)
The identity theft red flags provisions require each financial institution or creditor that
offers or maintains one or more covered accounts to (1) create, and periodically update, a written
Identity Theft Prevention Program, which is approved by either its board of directors or an
appropriate committee of the board of directors, (2) involve the board of directors, an appropriate
committee thereof, or senior management in the oversight, development, implementation and
administration of the program, (3) train staff, as necessary, to effectively implement the program,
and (4) exercise appropriate and effective oversight of service provider arrangements.
In addition, the provisions require each credit and debit card issuer to establish policies
and procedures to assess the validity of a change of address notification before honoring a
request for an additional or replacement card received during at least the first 30 days after it
receives the notification. The issuer must also either notify the cardholder of the request in
writing, electronically, or orally, and provide a method of promptly reporting incorrect address
12

15 U.S.C. § 1681s-2(a)(7).

3

changes, or use another means of assessing the validity of the change of address.
Address Discrepancies Provisions (12 CFR 1022.82)
The address discrepancies provisions require a user of consumer reports to develop
reasonable policies and procedures it employs when it receives a notice of address discrepancy
from a consumer reporting agency. The policies and procedures must be designed to enable the
user to form a reasonable belief that a consumer report relates to the consumer about whom it has
requested the report.
A user of consumer reports also must develop and implement reasonable policies and
procedures for furnishing an address for the consumer that the user has reasonably confirmed is
accurate to the consumer reporting agency from which it received the notice of address
discrepancy when the user (1) can form a reasonable belief that the consumer report relates to the
consumer about whom the user requested the report, (2) establishes a continuing relationship
with the consumer, and (3) regularly and in the ordinary course of business furnishes information
to the consumer reporting agency from which the notice of address discrepancy relating to the
consumer was obtained. These policies and procedures must provide that the user will furnish the
consumer’s address that the user has reasonably confirmed is accurate to the consumer reporting
agency as part of the information it regularly furnishes for the reporting period in which it
establishes a relationship with the consumer.
Risk-Based Pricing Notices and Credit Score Disclosures (12 CFR 1022.70 - .75)
The risk-based pricing rule generally requires a creditor to provide a risk-based pricing
notice to a consumer if that creditor (1) uses a consumer report in connection with an application
for, or a grant, extension, or other provision of, credit to that consumer that is primarily for
personal, family, or household purposes and (2) based in whole or in part on the consumer
report, grants, extends, or otherwise provides credit to that consumer on material terms that are
materially less favorable than the most favorable terms available to a substantial proportion of
consumers from or through that creditor. The rule applies to use of a consumer report in an
account review that results in an increase in the annual percentage rate, unless the consumer is
given an adverse action notice. The risk-based pricing rule provides several alternative methods
that creditors may use to determine which consumers must be given a notice. In 2011, the riskbased pricing notice requirements were amended pursuant to the Dodd-Frank Act to require
creditors to disclose credit scores and related information to consumers if a credit score is used in
setting material terms of credit.
In the alternative, creditors may provide a credit score disclosure to consumers who apply
for credit, whether or not those consumers receive materially less favorable credit terms. To ease
creditors’ burden and cost of complying with the notice and disclosure requirements, model
forms are available in Appendix H of the regulation.
Duties of Furnishers of Information (12 CFR 1022.40 - .43)
Accuracy and integrity policies and procedures. Each entity that furnishes information to

4

a consumer reporting agency (furnisher) must establish and implement reasonable written
policies and procedures regarding the accuracy and integrity of the information relating to
consumers that it furnishes to a consumer reporting agency. A furnisher must also review these
policies and procedures periodically and update them, as necessary. The policies and procedures
must be appropriate to the nature, size, complexity, and scope of each furnisher’s activities. In
developing its policies and procedures, each furnisher must consider the guidelines in
Appendix E of 12 CFR Part 1022, and incorporate those guidelines, as appropriate.
Direct disputes. With some exceptions, if a consumer disputes the accuracy of certain
information in a consumer report directly with the furnisher, the furnisher must (1) conduct a
reasonable investigation with respect to the disputed information, (2) review all relevant
information provided by the consumer with the dispute notice, (3) complete its investigation of
the dispute and report the results of the investigation to the consumer before the expiration of the
period within which a consumer reporting agency would be required to complete its action if the
consumer had elected to dispute the information under that section, and (4) if the investigation
finds that the information reported was inaccurate, promptly notify each consumer reporting
agency to which the furnisher provided inaccurate information of that determination and provide
to the consumer reporting agency any correction to that information that is necessary to make the
information provided by the furnisher accurate.
A furnisher need not investigate a direct dispute if it has reasonably determined that the
dispute is frivolous or irrelevant. If the furnisher makes this determination, it must notify the
consumer of the determination not later than five business days after making the determination,
by mail or, if authorized by the consumer for that purpose, by any other means available to the
furnisher. A notice of determination that a dispute is frivolous or irrelevant must include the
reasons for such determination and identify any information required to investigate the disputed
information, which notice may consist of a standardized form describing the general nature of
such information.
Time Schedule for Information Collection
The recordkeeping and disclosure requirements associated with the FCRA regulations are
mandatory and are triggered by certain events. Disclosures must be provided within prescribed
times stated in the regulations.
Legal Status
As amended by sections 1025 and 1088(a)(10) of the Dodd-Frank Act, the Board is
authorized to enforce compliance with the information collection requirements contained in the
Bureau’s FCRA regulations (Appendix B to 12 CFR Part 1022; and 12 CFR 1022.20 - .27,
1022.40 - .43, 1022.70 - .75, and 1022.82) applicable to institutions identified in 15 U.S.C. §
1681s(b)(1)(A)(ii) with $10 billion or less in assets, and applicable to consumers of these
institutions (15 U.S.C. § 1681s(b); 12 U.S.C. § 5515). Additionally, pursuant to section
1088(a)(2) and (10) of the Dodd-Frank Act, the Board retained authority under the FCRA to
prescribe and enforce the information collection requirements in the Board’s FCRA regulations
relating to identity theft red flags (12 CFR 222.90 - .91) for institutions of any size, which are

5

identified in 15 U.S.C. 1681s(b)(1)(A)(ii) (See 15 U.S.C. § 1681m(e), and §§ 1681s(b) and (e)).
The obligation to comply with the foregoing recordkeeping and disclosure requirements
contained in the FCRA regulations prescribed by the Board and the FCRA regulations prescribed
by the Bureau is mandatory, except for the consumer opt-out responses, which consumers are
required to submit to affiliates of an institution in order to obtain a benefit (i.e., to stop receiving
solicitations for marketing purposes).
Because the records and disclosures required under the Board’s FCRA regulations and
the Bureau’s FCRA regulations are not provided to the Board, and because all records are
maintained at Board-supervised institutions, no issue of confidentiality generally arises under the
Freedom of Information Act (FOIA). In the event such records or disclosures are obtained by the
Board as part of an examination or supervision of a financial institution, this information is
considered confidential pursuant to exemption 8 of the FOIA, which protects information
contained in “examination, operating, or condition reports” obtained in the bank supervisory
process (5 U.S.C. § 552(b)(8)). In addition, certain information (such as records generated during
the investigation of a direct dispute notice submitted by a consumer) may also be withheld under
exemption 6 of the FOIA, which protects from disclosure information that “would constitute a
clearly unwarranted invasion of personal privacy” (5 U.S.C. § 552(b)(6)).
Consultation Outside the Agency
There has been no consultation outside the agency.
Public Comments
On March 19, 2019, the Board published an initial notice in the Federal Register
(84 FR 10070) requesting public comment for 60 days on the extension, without revision, of the
FR V. The comment period for this notice expired on May 20, 2019. The Board did not receive
any comments. On June 17, 2019, the Board published a final notice in the Federal Register
(84 FR 28052).
Estimates of Respondent Burden
The Board accounts for the paperwork burden associated with the FCRA regulations
prescribed by the Bureau for the institutions set forth in 15 U.S.C. § 1681s(b)(1)(A)(ii) with
assets of $10 billion or less, as well as the paperwork burden associated with the identity theft
red flags provisions for the FCRA regulations prescribed by the Board for the institutions (of any
size) set forth in 15 U.S.C. § 1681s(b)(1)(A)(ii), and the paperwork burden associated with
Bureau’s FCRA regulations regarding consumer opt-out provisions under 12 CFR 1022.20 - .27.
The total annual burden is estimated to be 523,422 hours for these respondents for purposes of
the PRA. The estimated burden arises exclusively from the information collections required
under the regulation and is shown in the table below. These recordkeeping and disclosure
requirements represent 4.7 percent of the Board’s total paperwork burden.

6

Estimated
Estimated
Annual
number of
average hours
frequency
respondents13
per response

FR V
Disclosure
Section 1022 Appendix B
Negative information notice
Disclosure
Sections 1022.20-.27
Notices to consumers
Disclosure
Sections 1022.20-.27
Consumer opt-out response
Recordkeeping
Sections 222.90 - .91
Identity theft red flags
Recordkeeping
Section 1022.82
Address discrepancies
Disclosure
Sections 1022.70-.75
Risk-based pricing Notice to
consumers
Recordkeeping
Sections 1022.40-.43
Policies and procedures
Disclosure
Sections 1022.40-.43
Notices of frivolous disputes to
consumers15

1,450

1

1,381

1

1,562,835

1

2,206

1

37

81,622

1,450

1

4

5,800

1,450

12

514

1,450

1

1,450

422

Total

0.25

Estimated
annual burden
hours

18

0.08

40

0.23

363

24,858

125,027

87,000

58,000

140,737

523,407

13

Of these respondents, 654 are considered small entities as defined by the Small Business Administration (i.e.,
entities with less than $550 million in total assets) – 547 state member banks, 44 branches and agencies of foreign
banks, 21 Edge and agreement corporations, and 42 operating subsidiaries.
Of the 1,381 affiliate marketing notice to consumers respondents, 590 are considered small entities as defined by the
Small Business Administration (i.e., entities with less than $550 million in total assets) – 486 state member banks,
44 branches & agencies of foreign banks, 18 Edge and agreement corporations, and 42 operating subsidiaries,
www.sba.gov/document/support--table-size-standards.
14
The Board believes that most respondents are providing credit score disclosures rather than risk-based pricing
notices, so amendments to risk-based pricing notices do not create additional burden.
15
The Board calculated the annual frequency based on the assumption that its current estimate of the total number of
frivolous dispute notices to consumers (611,966) is equally distributed among the respondents (rounded to the
nearest whole number).

7

The current estimated cost to financial institutions for this information collection is $22,946,688
while the cost to consumers is $3,250,702. Accordingly, the total cost to the public is estimated
to be $26,197,390.16
Sensitive Questions
This collection of information contains no questions of a sensitive nature, as defined by
OMB guidelines.
Estimated Cost to the Federal Reserve System
Since the Board does not collect any information, the cost to the Federal Reserve System
is negligible.

16

Total cost to the public was estimated using the following formula: percent of staff time, multiplied by annual
burden hours, multiplied by hourly rates (30% Office & Administrative Support at $19, 45% Financial Managers at
$71, 15% Lawyers at $69, and 10% Chief Executives at $96). Hourly rates for each occupational group are the
(rounded) mean hourly wages from the Bureau of Labor and Statistics (BLS), Occupational Employment and Wages
May 2018, published March 29, 2019, www.bls.gov/news.release/ocwage.t01.htm. Occupations are defined using
the BLS Occupational Classification System, www.bls.gov/soc/. The average consumer cost of $26 is estimated
using data from the BLS Economic News Release (USDL-19-0307), www.bls.gov/news.release/cewqtr.nr0.htm.

8