[BankComplianceGuy]

If a broker brings them a file with a third party report and they tell the broker they won't proceed based upon any of the data in said report, that is a credit determination and subsequently a violation of FCRA. Funding the loan or making an affirmative credit decision isn't what makes them subject to FCRA, making a credit determination based on report data does.

There's a little more to this. There are two general types of violations for users of credit reports. The first one is doing a hard pull without the consumer's permission or a permissible purpose as defined in the rule. The other violation is failing to provide an adverse action notice when credit is denied based in whole or in part on a consumer credit report.

Permissible purpose to do a hard pull applies to consumer or business credit equally. Permission to pull a consumer report needs to be in writing. Even if its for an MCA. This part of the rule is strictly about protecting access to the consumer's report, since hard pulls affect consumer credit.

FCRA Adverse action notices only applies to consumer credit. Not needed for MCA's because you are not denying credit. For business loans, also not needed because it is a business suffering the adverse action, the consumer is a potential guarantor, and guarantors cannot suffer adverse action. Still need to deliver a Reg B adverse action to the business. One caveat, is if a consumer (sole prop/unincorporated individual) wants a business loan and gets denied. Then a consumer suffers and adverse action and if their personal credit report was used, then an FCRA adverse action notice must be given.

[CreditGuy]

There's a little more to this. There are two general types of violations for users of credit reports. The first one is doing a hard pull without the consumer's permission or a permissible purpose as defined in the rule. The other violation is failing to provide an adverse action notice when credit is denied based in whole or in part on a consumer credit report.

Permissible purpose to do a hard pull applies to consumer or business credit equally. Permission to pull a consumer report needs to be in writing. Even if its for an MCA. This part of the rule is strictly about protecting access to the consumer's report, since hard pulls affect consumer credit.

FCRA Adverse action notices only applies to consumer credit. Not needed for MCA's because you are not denying credit. For business loans, also not needed because it is a business suffering the adverse action, the consumer is a potential guarantor, and guarantors cannot suffer adverse action. Still need to deliver a Reg B adverse action to the business. One caveat, is if a consumer (sole prop/unincorporated individual) wants a business loan and gets denied. Then a consumer suffers and adverse action and if their personal credit report was used, then an FCRA adverse action notice must be given.

§*603. (f) The term “consumer reporting agency” means any person which, for
monetary fees, dues, or on a cooperative nonprofit basis, regularly engages
in whole or in part in the practice of assembling or evaluating consumer
credit information or other information on consumers for the purpose of
furnishing consumer reports to third parties, and which uses any means or
facility of interstate commerce for the purpose of preparing or furnishing
consumer reports

It is still a violation in the sense that they would be considered a consumer reporting agency under the above and we both know that there is no way they are compliant with the requirements that come with that.

[BankComplianceGuy]

§*603. (f) The term “consumer reporting agency” means any person which, for
monetary fees, dues, or on a cooperative nonprofit basis, regularly engages
in whole or in part in the practice of assembling or evaluating consumer
credit information or other information on consumers for the purpose of
furnishing consumer reports to third parties, and which uses any means or
facility of interstate commerce for the purpose of preparing or furnishing
consumer reports

It is still a violation in the sense that they would be considered a consumer reporting agency under the above and we both know that there is no way they are compliant with the requirements that come with that.

An ISO be considered a "consumer reporting agency"? That would be a huge stretch based on the definition. In your example they bring a file with a "third party report". They didn't collect information about the consumer and prepare the report themselves. They got it from a CRA (Experian, TransUnion). They didn't get a fee for just delivering the report to underwriting. As long as they got permission to pull that consumer report, they are ok.