For CRAs

Credentialing establishes that the client is a legitimate business with a permissible purpose for obtaining reports. It typically includes verifying business registration, confirming a physical location, obtaining the written permissible purpose certification, and periodically re-evaluating client access.

Name alone is not a reliable basis for matching a record. A CRA should use sufficient identifiers, such as full name and at least one additional identifier like date of birth, to reasonably establish that the record belongs to the consumer. Additional identifiers may be needed to resolve common name matches. Conflicting or insufficient identifiers should be resolved before the record is reported.

The FCRA generally limits reporting arrests to seven years, subject to its $75,000 salary exception. An arrest does not establish that the alleged conduct occurred, and state laws may impose stricter limits or prohibit reporting certain non-conviction records. When applicable state law is more restrictive, the CRA must follow the stricter rule.

A pending case should be reported as pending, with the current charge and filing information, never as a conviction. State law may restrict whether pending cases can be reported. Because a case may resolve while a report is being prepared, the CRA should verify its current status before reporting it.

A national database result is a pointer, not a verified record. Because database sources update on different schedules, results may be incomplete or outdated. Before reporting a potentially adverse record, the CRA should verify it at the source jurisdiction and report the current, reportable disposition.

Public availability of registry information does not automatically make it reportable or usable for employment. Registry entries must be reliably matched to the consumer, and state law may restrict reporting or employment use of registry information. The applicable restriction depends on the particular state law and source of the information.

A dispute from the consumer about the completeness or accuracy of an item triggers it. The reinvestigation is generally completed within 30 days. Information found to be inaccurate, incomplete, or unverifiable is corrected or deleted as required. The consumer receives written results.

The FCRA does not establish a general retention period for CRA files and employer certifications. Retention policies should account for applicable state law, contractual requirements, litigation and audit needs, and the limitations periods for potential claims. Dispute and compliance records should be retained long enough to document that required procedures were followed.

Credentialing performed once at onboarding goes stale. Businesses close, change hands, and change purpose. Furnishing reports without a valid permissible purpose can expose the CRA to FCRA liability.

Shared logins make it difficult to identify who ordered a report, confirm that the user was authorized, and remove access when someone leaves. Individual credentials and role-based access provide better accountability and help protect consumer information.

Matching on name and a partial identifier produces records that belong to someone else, particularly with common names. Applying a documented identifier standard uniformly, rather than case by case, makes the outcome defensible.

The FCRA establishes federal reporting limits, but some states impose shorter lookback periods, prohibit certain records, or apply restrictions regardless of salary. CRAs must identify and apply any more restrictive state law that governs the report.

A record that has been sealed, expunged, or otherwise made legally non-reportable should not appear in the consumer report. This is different from a matching error because the record may belong to the consumer but still be prohibited from reporting.

National databases may contain incomplete or outdated information. A case reported without confirmation at the source jurisdiction may include a charge that was later dismissed, sealed, amended, or otherwise updated.

When a CRA reports public record information for employment that is likely to have an adverse effect, it must either notify the consumer when the information is reported or maintain strict procedures designed to ensure the information is complete and up to date. The employer’s adverse action process does not replace this CRA obligation.

A CRA should document each reinvestigation, including what was reviewed, who was contacted, and what was concluded. Without adequate records, it may be difficult to demonstrate that reasonable reinvestigation procedures were followed.