The Consumer Financial Protection Bureau (CFPB) has issued an interim final rule updating two model disclosures to reflect changes made to the Fair Credit Reporting Act (FCRA) by recent legislation.

fcra-disclosure-notices-updatedBeginning Friday, Sept. 21, employers and background check agencies must use the new forms or use the forms from 2012 with a sheet attached explaining the information about security freezes detailed in the following paragraphs. The revised forms can be obtained through the link at the end of this post.

In May 2018, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act, which requires nationwide consumer reporting agencies to provide “national security freezes” free of charge to consumers. The “national security freeze” restricts prospective lenders from obtaining access to a consumer’s credit report, which makes it harder for identity thieves to open accounts in the consumer’s name.

The Economic Growth, Regulatory Relief, and Consumer Protection Act mandates that whenever the FCRA requires a consumer to receive either the Summary of Consumer Rights or the Summary of Consumer Identity Theft Rights, a notice regarding the new security freeze right also must be included. The Summary of Consumer Rights is a summary of rights to obtain and dispute information in consumer reports and to obtain credit scores. The Summary of Consumer Identity Theft Rights is a summary of rights of identity theft victims. The FCRA requires the bureau to write model forms of these documents. Consumer reporting agencies and other entities can use the bureau’s model forms or their own substantially similar forms.

The May 2018 legislation also extends from 90 days to one year the minimum time that nationwide consumer reporting agencies must include an initial fraud alert in a consumer’s file. A fraud alert informs a prospective lender that a consumer may have been a victim of identity theft and requires that the lender take steps to verify the identity of anyone seeking credit in the consumer’s name. Congress set an effective date of Sept. 21, 2018 for the security freeze right, the notice requirement, and the change in duration for initial fraud alerts.

To assist businesses in coming into compliance with the new law, the interim final rule issued Sept. 12 updates the bureau’s model forms, incorporating the new required notice and the change to the minimum duration of initial fraud alerts. The interim final rule also takes steps to mitigate the impact of these changes on users of the model forms published by the bureau in November 2012 by permitting various compliance alternatives.

The interim final rule invites comment on these and any other aspects of the Bureau’s model forms to inform any possible further rulemaking. The interim final rule is available at: