CONSUMER 

REPORTS:

WHAT INFORMATION FURNISHERS 

NEED TO KNOW

Federal Trade Commission | business.ftc.gov

1

The Fair Credit Reporting Act (FCRA) is designed to protect 

the privacy of consumer report information — sometimes 

informally called “credit reports” — and to guarantee that 

information supplied by consumer reporting agencies (CRAs) 

is as accurate as possible.

If you report information about consumers to a CRA — like a 

credit bureau, tenant screening company, check verification 

service, or a medical information service — you have 

legal obligations under the FCRA’s Furnisher Rule. Your 

responsibilities include:

● furnishing information that is accurate and complete, 

and

● investigating consumer disputes about the accuracy of 

information you provide.

The Federal Trade Commission, the Consumer Financial 

Protection Bureau, and the federal banking agencies have 

each published a Furnisher Rule. The rules are identical in 

substance. The FTC’s Rule is summarized here. If you are not 

subject to the FTC’s jurisdiction, contact your regulator about 

your obligations.

Accuracy

When you provide information to a CRA, you have obligations 

under the FCRA to ensure the accuracy of the information 

you furnish. As a rule, it’s illegal to report information that 

you know or believe is inaccurate. You have “reasonable 

cause to believe” that information is inaccurate if you have 

knowledge, other than allegations from the consumer, that 

would lead a reasonable person to doubt the accuracy of the 

information. FCRA Section 623(a)(1)(A) You may be exempt 

from this requirement if you give an address for consumers 
2

to report inaccurate information, but you cannot, under any 

circumstances, report information the consumer has told you 

is inaccurate if it is, in fact, inaccurate.

FCRA Section 623(a)(1)(C)

Guidelines for Policies and Procedures

You must establish and implement written policies

and procedures regarding the accuracy and integrity

of information you furnish to a CRA. Guidelines are in

Appendix A to Furnisher Rule Part 660. Read the Appendix;

the information here is just a sample.

Your policies and procedures:

● must be appropriate to the nature, size, complexity, and 

scope of your activities;

● must be reviewed periodically and updated, as 

necessary;

● should ensure that information provided to a CRA is for 

the right person, and reflects the terms of the account 

and the consumer’s performance on the account;

● require maintenance of records for a reasonable amount 

of time;

● establish internal controls for the accuracy and integrity 

of information, such as through random sampling;

● prevent re-aging (inaccurately changing the date of first 

delinquency on a consumer’s account to a later date) 

and duplicative reporting, particularly following portfolio 

acquisitions or sales, mergers, and other transfers; and

● require updating of furnished information where 

necessary.
3

Information should:

● be substantiated by your records when it is furnished;

● include consumer identifiers, like name(s), date of 

birth, Social Security number, telephone number(s), or 

address(es); and

● be furnished in a standardized form and specify the time 

period it pertains to.

Correct and Update Information

If you furnish information to a CRA on a regular basis and 

determine that any information you provided is inaccurate or 

incomplete, you must promptly notify the CRA and provide 

corrections or additions. Going forward, you must furnish only 

the correct information to the CRA. FCRA 623(a)(2)(B)

Furnishing Specific Items

The FCRA requires that if you furnish any information to a 

CRA, you must include any of the following items that are 

applicable to you.

Credit Limits — Usually, you must include a consumer’s credit 

limit among the information you furnish to a CRA. Appendix A(I)

Disputed Information — Once a consumer disputes 

information, you may not report that information to a CRA 

without telling the CRA that the information is in dispute.

FCRA 623(a)(3)

Closed Accounts — If you furnish information to a CRA on 

a regular basis, you must notify the CRA that a consumer 

has voluntarily closed an account the next time you send 

information that would normally include that account. This is 

important because some users of information may interpret 
4

a closed account as an indicator of bad credit unless you 

clearly disclose that the consumer, not the creditor, closed 

the account. FCRA 623(a)(4)

Delinquent Accounts — When you refer an account for 

collection and notify a CRA that you have done so, you 

also must report the date of delinquency to the CRA within 

90 days. The date of delinquency is the month and year 

the consumer’s delinquency resulting in the referral began. 

See the examples below. FCRA 623(a)(5)(A)

If you are a debt collector furnishing information to a CRA 

about the accounts of a creditor, you must report the date of 

delinquency given to you by the creditor. FCRA 623(a)(5)(A) 

This “date of delinquency” determines how long the debt can 

be reported on a consumer’s credit report. Generally, a CRA 

may report a delinquent debt for seven years from the date 

of delinquency. If the debt was discharged in bankruptcy, 

however, a CRA may report it for 10 years.

If the creditor didn’t report the date of delinquency, you have 

two options:

1. You may establish and follow reasonable procedures 

to determine the date from the original creditor or 

another reliable source, or

2. If you can’t determine the date, you may establish 

and follow reasonable procedures to ensure that the 

reported date of delinquency is a date before the 

account was referred to collection or charged off.

FCRA 623(a)(5)(B)
5

These examples illustrate how to calculate the date of 

delinquency:

John Smith’s account becomes delinquent in March 2017. The 

creditor places the account for collection on October 1, 2017.

In this case, the date of delinquency is March 2017. The date 

that the creditor places the account for collection is not the 

basis for calculating the delinquency date. The collection date 

is calculated based on the consumer’s delinquency, not the 

creditor’s later actions.

Mary Myers’s credit card account becomes delinquent in

April 2016. Mary makes partial payments for the next five 

months, but never brings the account current. The creditor 

places the account for collection in January 2017.

Because the account was never brought current during the 

period partial payments were made, the delinquency that 

immediately preceded the collection began in April 2016, 

when Mary first became delinquent. The correct delinquency 

date is April 2016.

Alan Clark’s account becomes delinquent in December 2015. 

The account is placed for collection with Collector A on 

April 1, 2016. Collection is not successful. The creditor places 

the account with Collector B in February 2017.

The date of the delinquency for reporting purposes is 

December 2015. Repeatedly placing an account for 

collection or using different collectors does not change the 

delinquency date.

Lisa Long’s account becomes delinquent in November 2017. 

The creditor has never reported the date of the delinquent 

account to the CRAs, but has records indicating the date of 

delinquency as November 2017. A debt collector acquires the 

debt and attempts collection.
6

If the debt collector establishes and follows reasonable 

procedures to learn the date of delinquency from the creditor 

— and finds that November 2017 is the delinquency date — 

the debt collector may report that date to the CRAs as the 

delinquency date. FCRA 623(a)(5)(B)(ii)

Craig Coleman’s account becomes delinquent, but the

creditor never reports the delinquency date to a CRA. In 

addition, the delinquency date can’t be reasonably obtained 

from the creditor or another reliable source. The account is 

placed for collection in November 2017.

If the debt collector establishes and follows reasonable 

procedures to ensure that the delinquency date reported 

precedes the date the account is placed for collection, 

charged to profit or loss, or subjected to any similar action 

by the original creditor, the debt collector may report that 

alternate delinquency date to a CRA. In this case, the 

alternate delinquency date must be before November 2017. 

This method should be used only when the original date of 

delinquency can’t be determined from the creditor or another 

source. FCRA 623(a)(5)(B)(iii)

Negative Information from Financial Institutions — If you are 

a financial institution (as defined in the Gramm-Leach-Bliley 

Act) that extends credit and regularly reports negative 

information about your customers to a nationwide CRA (for 

example, Equifax, Experian, or TransUnion), you must notify 

your customers that you report such negative information. 

Examples of negative information include a customer’s 

delinquencies, late payments, insolvency, or any form of 

default. FCRA 623(a)(7)(G)(i)
7

You must provide the notice either before you furnish the 

negative information or within 30 days of furnishing it. You 

may include the notice with a notice of default, a billing 

statement, or another item sent to the consumer, but you 

cannot send it with a Truth In Lending Act notification. The 

notices must be clear and conspicuous.

The Consumer Financial Protection Bureau has model 

disclosures at 12 CFR Part 1022, Appendix B, FCRA 623(a)(7).

Medical Information — If your primary business is providing 

medical services, products, or devices, and you, your agent, 

or your assignee reports information about consumers to 

CRAs, you must notify each CRA that you are a medical 

provider. FCRA 623(a)(9) This notice helps the CRAs comply 

with their FCRA duties with regard to the reporting of medical 

information. FCRA 604(g) For example, if the name, address, 

and telephone number of a medical information furnisher 

appears on a consumer report, the information must be 

encoded so it doesn’t identify the specific provider or the 

nature of the services, products, or devices. FCRA 605(a)(6)

(A)

The federal banking agencies have issued rules to implement 

these requirements.

DISPUTES

Consumers may dispute information that you furnished in 

two ways:

1. They may submit a dispute to the CRA.

2. They may submit a dispute directly to you.
8

Disputes to CRAs

If a CRA notifies you that a consumer disputes information 

you provided, you must:

● investigate the dispute and review all relevant 

information provided by the CRA about the dispute;

● report your findings to the CRA;

● provide corrected information to every CRA that 

received the information if your investigation shows the 

information is incomplete or inaccurate; and

● modify the information, delete it, or permanently block 

its reporting if the information turns out to be inaccurate 

or incomplete or can’t be verified. FCRA 623(b)(1)

You must complete these steps within the same time 

allowed under the FCRA for the CRA to resolve the dispute. 

Normally, this is 30 days after the CRA gets the dispute 

from the consumer. If the consumer provides additional 

relevant information during the 30-day period, the CRA has 

15 more days to resolve the dispute. The CRA must give 

you all the relevant information it gets within five business 

days of receipt, and must promptly give you additional 

relevant information provided by the consumer. If you don’t 

investigate and respond to the notification of the dispute 

within the specified times, the CRA must delete the disputed 

information from its files. FCRA 623(b)(2) and 611(a)(1)

Disputes to Furnishers

You must investigate a consumer’s dispute if it relates to:

● the consumer’s liability for a credit account or other 

debt with you. For example, disputes relating to whether 

there is or has been identity theft or fraud against the 
9

consumer, whether there is individual or joint liability on 

an account, or whether the consumer is an authorized 

user of a credit account;

● the terms of a credit account or other debt with you. 

For example, disputes relating to the type of account, 

principal balance, scheduled payment amount on an 

account, or the amount of the credit limit on an openend account;

● the consumer’s performance or other conduct 

concerning an account or other relationship with you. 

For example, disputes relating to the current payment 

status, high balance, date a payment was made, 

amount of a payment made, or date an account was 

opened or closed; or

● any other information in a consumer report about 

an account or relationship with you that affects the 

consumer’s creditworthiness, credit standing, credit 

capacity, character, general reputation, personal 

characteristics, or lifestyle. Furnisher Rule 660.4(a)

You must:

● conduct a reasonable investigation

● review all relevant information provided by the consumer

● report results to the consumer, generally within 30 days

● notify each CRA to which you provided inaccurate 

information if the investigation finds the information was 

inaccurate. Furnisher Rule 660.4(e)

You are not required to investigate the dispute if it relates to:

● the consumer’s identifying information on a consumer 

report, including name, date of birth, Social Security 

number, phone number, or address;
10

● the names of previous or current employers;

● inquiries or requests for consumer reports;

● information from public records, including judgments, 

bankruptcies, and liens;

● information related to fraud alerts or active duty alerts;

● information provided to a CRA by another furnisher; or

● when you believe that the dispute is submitted by, 

prepared on behalf of the consumer by, or submitted 

on a form supplied to the consumer by a credit repair 

organization. Furnisher Rule 660.4(b)

You also are not required to investigate disputes that are 

frivolous or irrelevant, as defined by the Rule:

● the consumer didn’t provide enough information

● the dispute is substantially the same as a dispute 

previously submitted

● you already fulfilled your obligation, and there is no new 

information

● you are not required to investigate the dispute, as 

described in the list above from 660.4(b).

Furnisher Rule 660.4(f)

If a dispute is found to be frivolous or irrelevant, you must 

notify the consumer within five business days of receiving 

the dispute. This notice can be a form letter. Include the 

reason for the determination and, if relevant, any information 

the consumer needs to submit so you can investigate the 

disputed information.
11

ADDITIONAL RESPONSIBILITIES

Victims of Identity Theft

When you are notified by a CRA that a consumer’s identity 

has been stolen, you have specific duties under the FCRA. 

FCRA 605B

● If a CRA notifies you that information you furnished is 

being blocked on a consumer’s credit report because of 

identity theft, you must have procedures to prevent the 

re-reporting of the information. FCRA 623(a)(6)(A)

● If a CRA notifies you that a debt has resulted from 

identity theft, you may not sell, transfer, or place that 

debt for collection. FCRA 615(f)(1)

● If a consumer notifies you that he is a victim of identity 

theft, and gives you an identity theft report, you may not 

furnish information to a CRA regarding the fraudulent 

account or debt. FCRA 623(a)(6)(B)

● If you find that you furnished inaccurate information due 

to identity theft, you must promptly notify each CRA of 

the correct information. Going forward, you must report 

only complete and accurate information. FCRA 623(a)(2)

● If you provide credit, goods, or services to consumers, 

you may be required to supply application or other 

transaction records to an identity theft victim or law 

enforcement officer, if they ask. FCRA 605B(f) 615(g)

● If you establish or extend credit plans or accounts, 

you may be required to follow certain steps to verify a 

consumer’s identity when you see a fraud or active duty 

alert on his credit report. FCRA 605A(h)(B)(ii)
12

Disposing of Consumer Report 

Information

When you are finished using a consumer report, you must 

securely dispose of the report and any information you 

gathered from it. That can include burning, pulverizing, or 

shredding paper documents, and disposing of electronic 

information so that it can’t be read or reconstructed. For more 

information, see Disposing of Consumer Report Information? 

Rule Tells How at business.ftc.gov.

Address Discrepancies

If you are a user of consumer reports and a CRA notifies 

you that the consumer address you provided is substantially 

different from the address it has, you must have policies and 

procedures to investigate and furnish the consumer’s correct 

address to the CRA. For more information, see Duties of 

Users Regarding Address Discrepancies.

NON-COMPLIANCE

If you don’t comply with the FCRA, you may be sued by the 

FTC, Consumer Financial Protection Bureau (CFPB), state 

governments, or in some cases, consumers. The FCRA 

provides for maximum penalties of $4,857 per violation in the 

case of lawsuits brought by the FTC. FCRA 616, 617, 621

Your Opportunity to Comment

The National Small Business Ombudsman and 10 Regional 

Fairness Boards collect comments from small businesses 

about federal compliance and enforcement activities. 

Each year, the Ombudsman evaluates the conduct of 

these activities and rates each agency’s responsiveness 
13

to small businesses. Small businesses can comment to 

the Ombudsman without fear of reprisal. To comment, call 

toll-free 1-888-REGFAIR (1-888-734-3247) or go to 

sba.gov/ombudsman.

The FTC works for the consumer to prevent 

fraudulent, deceptive, and unfair business practices 

in the marketplace and to provide information to help 

consumers spot, stop, and avoid them. To file a complaint 

or to get free information on consumer issues, visit 

consumer.ftc.gov or call toll-free, 1-877-FTC-HELP 

(1-877-382-4357); TTY: 1-866-653-4261. The FTC enters 

consumer complaints into the Consumer Sentinel Network, 

a secure online database and investigative tool used by 

hundreds of civil and criminal law enforcement agencies in 

the U.S. and abroad.

[Note: Edited January 2024 to reflect Inflation-Adjusted Civil Penalty Maximums.]
Federal Trade Commission

BCP Business Center

business.ftc.gov

November 2016