Client Management

Before providing access to consumer reports, a CRA should verify that the prospective client is a legitimate business with a permissible purpose for obtaining them.

Under FCRA § 1681e(a), a CRA must maintain reasonable procedures to limit the furnishing of consumer reports to the purposes permitted under FCRA § 1681b. Those procedures must require prospective users to identify themselves, certify the purposes for which reports will be obtained, and certify that reports will be used for no other purpose. The CRA must also make a reasonable effort to verify the identity of a new prospective user and the uses certified before furnishing the first report.

• Verify the business. Confirm the legal business name, address, registration status, and other identifying information through independent sources.
• Understand what the business does. Review the company’s website, business address, telephone number, industry, and other available information. The stated reason for obtaining consumer reports should make sense for the type of business and positions being screened.
• Identify authorized contacts. Determine who is responsible for the account and who will be permitted to order or access reports. Business email addresses should generally be used rather than personal email accounts.
• Complete a site inspection when required. Some data providers, services, or accreditation standards may require an onsite or virtual inspection before access is granted.
• Resolve discrepancies before approval. Unverified information, unusual business activity, inconsistent addresses, or questions about the intended use of reports should be resolved before the account is activated.

A consumer report may only be furnished for a permissible purpose under FCRA § 1681b. For employment screening, that purpose is employment purposes under FCRA § 1681b(a)(3)(B).

FCRA § 1681b(a) permits a CRA to furnish a consumer report under the circumstances listed in that section “and no other.” Employment screening relies on one entry in that list, but a CRA credentialing clients evaluates certified purposes against all of them.

FCRA § 1681a(h) defines employment purposes as evaluating a consumer for employment, promotion, reassignment, or retention as an employee. Employment purposes therefore may include reports obtained in connection with current employees, not only applicants.

• Document the permissible purpose. Record the specific purpose for which the client is authorized to obtain reports.
• Obtain the required certification. Under FCRA § 1681b(b)(1)(A), the client must certify that it has made the required disclosure and obtained the consumer’s written authorization, that it will comply with the adverse action requirements if they become applicable, and that it will not use the information in violation of applicable equal employment opportunity law.
• Provide the Summary of Rights. Under FCRA § 1681b(b)(1)(B), the CRA must provide the Summary of Your Rights Under the Fair Credit Reporting Act with the report, unless it has previously provided the summary to that client.
• Do not assume one purpose covers another. Employment screening, tenant screening, volunteer screening, and other uses may involve different permissible purposes and requirements.
• Address resale before it occurs. Under FCRA § 1681e(e), a client that obtains reports for resale must disclose to the CRA the identity of the end user and each permissible purpose for which the report will be used. The reseller must also maintain procedures ensuring reports are resold only for a permissible purpose and verify those certifications before reselling.
• Review unusual requests. A request involving someone who does not appear to have a reasonable connection to the client’s certified purpose should be questioned before a report is furnished.

A permissible purpose should be established before access is granted and reconsidered whenever the client’s intended use of consumer reports changes.

The service agreement establishes the responsibilities of the CRA and the client and provides the framework for how consumer reports may be ordered and used.

A CRA’s agreement should address, as applicable:

• Services provided and ordering procedures
• Permissible purposes for obtaining reports
• Required client certifications
• Disclosure and authorization responsibilities
• Pre-adverse and adverse action responsibilities
• Restrictions on use and redisclosure of reports
• Data security and confidentiality
• Authorized users and account access
• Audit and compliance review rights
• Suspension and termination
• Indemnification and limitation of liability

The client’s permissible purpose and required FCRA certifications may be included in the service agreement or maintained as separate certifications.

Separate certifications can make it easier to document additional or changed permissible purposes without replacing the entire service agreement.

Access to consumer reports should be limited to individuals who are authorized to order or review them.

• Use individual accounts. Each authorized user should have a unique login rather than sharing credentials with other employees.
• Limit access appropriately. Users should have access only to the information and functions necessary for their responsibilities.
• Designate an account administrator. The client should identify someone authorized to request user additions, removals, and account changes.
• Maintain user activity records. Orders and other significant account activity should be attributable to the individual user who performed them.
• Remove outdated access. User access should be removed when an individual leaves the organization or no longer requires access.
• Suspend questionable access when necessary. Activity suggesting unauthorized use or a purpose outside the client’s certification should be investigated promptly, with access restricted when appropriate.

Access controls protect both consumer information and the CRA’s ability to determine who ordered a report and why.

Credentialing should not end when an account is opened. Businesses change ownership, locations, personnel, and sometimes the purposes for which they use consumer reports.

CRAs should establish a reasonable process for periodically reviewing client accounts.

• Review account activity. Look for ordering volume, search types, or other activity that appears inconsistent with the client’s business or expected use. Significant changes in volume or unexpected types of searches may warrant additional review.
• Reverify client information periodically. Confirm that the business remains active and that important information such as ownership, address, and business operations remains current.
• Review authorized users. Periodically confirm that individuals with account access still require it.
• Obtain new certifications when necessary. If the client begins obtaining reports for an additional purpose, determine whether another permissible purpose and certification must be established.
• Document completed reviews. Maintain a record of when the account was reviewed, what was examined, and whether any action was required.

Client files should document both the original credentialing decision and the CRA’s ongoing management of the account.

Maintain, as applicable:

• Completed client application
• Business verification and credentialing documentation
• Permissible purpose certifications
• Executed service agreement and amendments
• Site inspection documentation
• Authorized users and account administrators
• Dates access was granted, changed, or removed
• Relevant account and ordering activity
• Periodic account reviews and their results
• Updated certifications or recredentialing documentation
• Account suspensions or terminations and the reasons for them
• Approval documentation identifying who approved the account and when

Documentation should be sufficient to show how the client was credentialed, the purpose for which access was granted, and how the account has been managed since approval.

Prospective clients that do not pass credentialing should also be documented. Maintaining declined applications helps demonstrate that credentialing standards are being applied.