Manage FCRA and FACTA obligations with clear, evidenced controls

The FCRA, or Fair Credit Reporting Act, is a US federal law passed in 1970 that governs consumer reports, such as credit reports and background checks. It sets rules on who may obtain a report and why, how accurate the information must be, how consumers can see and dispute their files, and what notices users must give when they take adverse action based on a report.

FACTA, the Fair and Accurate Credit Transactions Act of 2003, is an amendment to the FCRA rather than a separate regime. It added identity theft protections, including fraud alerts, free annual credit reports, truncation of card numbers on receipts, the Red Flags requirements for identity theft programmes and a duty to dispose of consumer report information securely.

Three groups must comply: consumer reporting agencies such as credit bureaus and background screening companies, businesses that furnish information to those agencies, and users of consumer reports. Users include lenders, insurers, landlords and employers. Any business that holds consumer report information must also follow the FACTA disposal requirements when it destroys that data.

Consumers can sue. For negligent breaches they can recover actual damages and legal costs. For wilful breaches they can recover actual damages or statutory damages of $100 to $1,000 per consumer, plus punitive damages and legal fees, which is why class actions are common. Regulators such as the CFPB and FTC can also bring enforcement actions and seek civil penalties.

The Red Flags Rule implements FCRA section 615(e), added by FACTA. It requires financial institutions and creditors with covered accounts to run a written identity theft prevention programme that identifies warning signs of identity theft, detects them, responds to them and is updated over time. The FTC version is in 16 CFR Part 681, with equivalent rules from the banking regulators.

They overlap but are not interchangeable. GLBA governs financial privacy and safeguards, while SOC 2 and ISO 27001 are security frameworks that help evidence the access control, vendor management and secure disposal the FCRA expects. Neither replaces FCRA duties such as permissible purpose, adverse action notices or dispute handling, which need their own procedures.

Start by identifying your role: agency, furnisher or user. Then put in place written procedures for permissible purpose, required notices, accuracy and dispute handling, an identity theft programme where the Red Flags Rule applies, and secure disposal of consumer report information. Train staff, oversee vendors that handle the data and keep evidence that the procedures work.

FCRA and FACTA are mapped in OneClickComply's control library and available on request, rather than offered as a ready-made framework today. We can map your existing controls to the relevant sections, generate supporting policies and collect evidence automatically. OneClickComply does not certify FCRA compliance, as no certification exists, but our auditors can advise through Ask an Auditor.