Section 10: Fair Credit Reporting Act (FCRA) Policy Summary of Regulation The Fair Credit Reporting Act (FCRA) regulates Consumer Reporting Agencies (CRAs), users of consumer reports, and furnishers of consumer-related information to CRAs. This policy includes requirements based on amendments to the FCRA by the Consumer Credit Reporting Reform act of 1996 and the Fair & Accurate Credit Transactions (FACT) Act of 2003. The FCRA imposes requirements on SecurityNational Mortgage Company (SNMC) regarding: When SNMC can request a consumer report (permissible purpose); Prescreened firm offers of credit; Notice and disclosure requirements; Reporting accurate information to CRAs; Investigating disputes of information in consumer reports; Identity theft detection; and Proper information disposal. Definitions A Consumer Report is any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. A Consumer Reporting Agency ( CRA or agency ) is any person or entity that regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. Permissible Purposes A consumer report may only be obtained under the following circumstances: In accordance with the written instructions of the consumer In connection with a credit transaction involving the consumer For employment purposes In connection with a review of an existing account Other legitimate business need When a consumer report is used for employment purposes, the applicant must be provided with a notice of SNMC s intent to obtain a consumer report. The notice must be a separate disclosure which the applicant must sign. SNMC may face liability for misuse of a credit report in two ways: (1) indirectly, through an indemnity clause in a contract with a consumer reporting agency, or (2) directly, under section 604(f) of FCRA. Consumer report information is considered non-public personal information (NPI) under the Gramm-Leach-Bliley Act of 2002 and will be treated as such. REVISION NUMBER: 10.0.2.1 PAGE 1 OF 5 REVISED DATE: 05/16/2014
Affiliate Information Sharing SNMC does not routinely share information among its affiliates. However, it is SNMC s policy only to share or use consumer information in compliance with the FCRA. The FCRA excepts from the definition of a consumer report certain information shared among affiliates, such as transactions and experiences information, or other FCRA information. However, before sharing other FCRA information with its affiliates, SNMC must provide the consumer with notice and an opportunity to opt out of such sharing. Further, before using transactions and experiences information, or other FCRA information, from an affiliate for solicitation and marketing purposes, SNMC must provide the consumer with a notice and an opportunity to opt out of such use of the consumer s information for affiliate marketing purposes, and not share such information if the consumer opts out. SNMC will honor a consumer s request to opt out for a minimum of five years and will not solicit that consumer unless the consumer receives a subsequent notice and opportunity to extend the opt-out. Affiliate marketing opt-out is not required when the affiliated business has a pre-existing business relationship with a consumer. A pre-existing business relationship includes an ongoing financial relationship, a financial transaction during the preceding 18-month period, and an inquiry or application during the preceding 3-month period. For an inquiry, the marketing may only be for a product(s) that is responsive to the consumer s inquiry. Affiliate marketing opt-out is also not required for communications directed to the general public or when SNMC is using the consumer s information to perform services on behalf of the affiliate, unless the affiliate would not be permitted to use the information itself. Using Medical Information The FCRA limits the use of medical information regarding a consumer in the review or granting of credit. The FCRA also prohibits sharing medical information regarding consumers with affiliates. It is SNMC s policy to use consumers medical information (including collection items and judgments) only in compliance with the FCRA. Pre-Screened Offers If SNMC uses information obtained from a consumer reporting agency to offer credit to a consumer that is not initiated by the consumer, the written solicitation must include a statement that: 1. Information contained in the consumer s consumer report was used in connection with the offer. 2. The consumer received the offer because he/she satisfied the criteria for creditworthiness. 3. The credit may not be extended if, after the consumer responds to the offer, the consumer does not meet the specific underwriting criteria or does not furnish the required collateral. 4. The consumer has a right to prohibit information contained in the report from being used in connection with any credit transaction that is not initiated by the consumer. 5. The consumer may exercise that right by notification to the consumer reporting agency. This must include address and telephone number. Any pre-screened offer will include the required notices allowing the consumer to opt out of future pre-screened solicitations. REVISION NUMBER: 10.0.2.1 PAGE 2 OF 5 REVISED DATE: 05/16/2014
Notice and Disclosure Requirements Adverse Action Notice The FCRA requires that a user of a consumer report notify a consumer of adverse action taken in connection with a credit application if that adverse action was based on information in the consumer s credit report, information received from an affiliate of SNMC, or information from a source other than a consumer report or information from an affiliate of SNMC. It is SNMC s policy to approve or deny a credit application within 30 days of receipt. If the application is not complete, our policy is to follow up with the consumer applicant diligently to complete the application as quickly as possible. SNMC provides adverse action notices to consumers who are denied for credit. SNMC combines the FCRA adverse action notice with the ECOA adverse action notice and utilizes the model forms in Appendix C to Regulation B. Credit Score Notice When SNMC uses a credit score in a consumer purpose home loan transaction, regardless of the final action taken, it will provide a disclosure to the consumer as soon as reasonably practicable that includes: The credit score used The range of possible scores The date the score was created The key factors that adversely affected the score Contact information for each CRA that provided a score used Credit Score Disclosure Exception Notice The Credit Score Disclosure Exception Notice will be provided to every consumer credit applicant as soon as reasonably possible, but no later than at or before consummation. The notice shall include: The information required in the Credit Score Notice The distribution of credit scores presented in the form of a bar graph that illustrates the percentage of consumers with credit scores within a particular range or a clear statement informing the consumer how his or her credit score compares to the scores of other consumers That the consumer is encouraged to verify the accuracy of his/her consumer report and has the right to dispute any inaccurate information Contact information for the CRA where the consumer can obtain his/her consumer report A statement directing the consumer to the web site of the CFPB to obtain more information about consumer reports Risk-Based Pricing Notice Mortgage lenders are not required to provide a Risk-Based Pricing Notice if the lender provides the Credit Score Disclosure Exception Notice to every consumer credit applicant, even if some such applicants would not otherwise be entitled to a Risk-Based Pricing Notice. It is SNMC s policy to provide the Credit Score Disclosure Exception Notice to every consumer credit applicant instead of using the Risk-Based Pricing Notice. Reporting of Negative Credit Information Disclosure Financial institutions that regularly extend credit and in the ordinary course of business provide negative information to national CRAs must provide a Negative Information Notice to its consumers. The notice is only required once, but must be provided prior to or no later than 30 days after furnishing the negative information. REVISION NUMBER: 10.0.2.1 PAGE 3 OF 5 REVISED DATE: 05/16/2014
Responsibilities of Furnishers of Information If SNMC regularly furnishes information to CRAs, it must ensure that: 1. The information is accurate and up-to-date. 2. Corrections and/or additional information is promptly reported to the CRAs. 3. If a consumer is disputing the completeness or accuracy of information, SNMC may not furnish the information to the CRAs without notice that the information is in dispute. 4. Notice is provided to the CRAs regarding the voluntary closure of accounts by consumers. 5. When providing information regarding delinquent accounts being placed in collection, charged to losses, or similar action, SNMC shall ensure that it has also notified the CRAs of the month and year of the commencement of the delinquency that immediately preceded the action, within 90 days of furnishing the information. Responsibilities Regarding Disputes Consumers may dispute information furnished by SNMC to a CRA directly with SNMC if the information relates to: The consumer s liability for a loan or other debt with SNMC; The terms of a loan with SNMC; The consumer s performance or other conduct on a loan; or Other information in a consumer report regarding an account with SNMC that bears on the consumer s creditworthiness. SNMC shall develop a process and procedure for consumers to dispute information that SNMC has reported to a CRA and inform consumers of the dispute notification process. Upon notification from the consumer of a valid dispute, through SNMC s process, SNMC must promptly investigate the disputed information, and correct the reported information with the CRA where necessary, before the expiration of 30 days. Upon notification from a CRA of a dispute regarding information provided to the agency, SNMC must promptly investigate the disputed information and report the results, and corrected information where necessary, to the consumer reporting agency before the expiration of 30 days. Identity Theft Program SNMC will maintain a comprehensive Identity Theft Program to detect, prevent, and mitigate identity theft in connection with the opening of all covered accounts or any existing covered accounts. This policy and implementing procedures are designed to control reasonably foreseeable risks to SNMCs customers. SNMC s senior management has elected the Chief Compliance Officer to supervise the overall management of the company s Identity Theft Program. This individual shall report directly to Senior Management and the Board of Directors. On at least an annual basis, the Chief Compliance Officer is to make a written report to the executive staff regarding the status of the company s compliance activities with respect to the Identity Theft Program. Specifically, the Compliance Officer is responsible for: 1. Performing all required risk assessments and provide a report to Senior Management and Board of Directors 2. Developing, implementing, and maintaining detailed identity theft recordkeeping procedures 3. Reviewing any related policies and procedures to ensure compliance with the company s Identity Theft Program 4. Training personnel on Identity Theft Program directives 5. Exercising appropriate and effective oversight of service provider arrangements 6. Supporting an independent Identity Theft Program audit program This program includes policies and procedures to: REVISION NUMBER: 10.0.2.1 PAGE 4 OF 5 REVISED DATE: 05/16/2014
Identify relevant red flags for the covered accounts that the company offers or maintains, and incorporate those red flags into the program; Detect red flags that have been incorporated into the program; Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and Ensure the program is updated periodically to reflect changes in risks to customers and the business models of the company Security Freezes and Security Breach Notification Requirements SNMC is required to safeguard the information of consumers with which it conducts business. Many states statutes impose security breach notification requirements, and these requirements generally apply when certain customer information of mortgage originators or servicers has been compromised. It is SNMC s policy to follow state security breach notification requirements in any affected or applicable states in the event of a security breach involving SNMC s customers. Record Retention and Information Disposal All adverse action notices issued in connection with a credit transaction will be retained in accordance with the Equal Credit Opportunity Act. Solicitations for credit or insurance - the criteria used in making the initial section of consumers to receive the offer, as well as the criteria bearing on creditworthiness or insurability, and any requirement for the furnishing of collateral as a condition of the extension of credit, must be retained for a period of 3 years from the date of the offer. Consumer reports obtained in connection with employment: The signed notification to applicant regarding intent to obtain consumer report will be retained in the employee s file, if hired; otherwise, Signed notifications and adverse action notices, as applicable, will be retained with the application in accordance with the retention schedule of rejected applications. SNMC shall take reasonable measures to dispose of consumer information in a manner designed to protect against unauthorized access to or use of the information and to reduce the risk of consumer fraud and harm, such as identity theft. REVISION NUMBER: 10.0.2.1 PAGE 5 OF 5 REVISED DATE: 05/16/2014