[BankComplianceGuy]

If a broker brings them a file with a third party report and they tell the broker they won't proceed based upon any of the data in said report, that is a credit determination and subsequently a violation of FCRA. Funding the loan or making an affirmative credit decision isn't what makes them subject to FCRA, making a credit determination based on report data does.

There's a little more to this. There are two general types of violations for users of credit reports. The first one is doing a hard pull without the consumer's permission or a permissible purpose as defined in the rule. The other violation is failing to provide an adverse action notice when credit is denied based in whole or in part on a consumer credit report.

Permissible purpose to do a hard pull applies to consumer or business credit equally. Permission to pull a consumer report needs to be in writing. Even if its for an MCA. This part of the rule is strictly about protecting access to the consumer's report, since hard pulls affect consumer credit.

FCRA Adverse action notices only applies to consumer credit. Not needed for MCA's because you are not denying credit. For business loans, also not needed because it is a business suffering the adverse action, the consumer is a potential guarantor, and guarantors cannot suffer adverse action. Still need to deliver a Reg B adverse action to the business. One caveat, is if a consumer (sole prop/unincorporated individual) wants a business loan and gets denied. Then a consumer suffers and adverse action and if their personal credit report was used, then an FCRA adverse action notice must be given.