FACT Act Rulemaking: What’s Ahead

Valerie Moss, CUNA Regulatory Affairs
March 28, 2005

President Bush signed the Fair and Accurate Credit Transaction (FACT) Act into law Dec. 4, 2003. Among other things, this act permanently reauthorized the Fair Credit Reporting Act’s (FCRA) existing pre-emption provisions and extended pre-emption to certain areas related to identity theft (ID) prevention and mitigation. Credit unions are still waiting for regulations on some key FACT Act provisions, including final rules on:

Sec. 214(b): Affiliate marketing. The National Credit Union Administration (NCUA), Federal Trade Commission (FTC), Securities and ExchangeCommission, and the federal banking agencies must issue regulations to implement provisions related to sharing information with affiliates for marketing purposes. NCUA and the banking agencies published a joint proposed rule in the Federal Register July 15, 2004. FTC published a substantially similar rule June 15, 2004 (the agency’s rule will cover state charters and credit union service organizations). The FACT Act required the agencies to issue final regulations by Sept. 4, 2004 (which, obviously, didn’t happen), with an effective date of March 4, 2005.

Sec. 411(a): Medical information. The FACT Act establishes limitations on the use and sharing of medical information. NCUA and the federal banking regulators are required to issue regulations to create exceptions to the general prohibition on obtaining or using medical information. This is necessary to protect legitimate operational, transactional, risk, consumer, and other needs, as well as exceptions to the restrictions on sharing information with affiliates.

Regulators published a proposed rule on April 28, 2004. It will take effect 90 days after regulations are finalized, or as specified in the rule.

There are a number of exceptions to the rule’s restrictions that will only be available to federal credit unions covered by NCUA’s rule. As things stand right now, state-chartered credit unions won’t be able to take advantage of these exceptions because Congress failed to give FTC rulemaking authority for this section of the FACT Act. CUNA, however, is working with Congress and the government agencies to rectify this situation.

Sec. 213(b): Prescreened offers. FTC, in consultation with NCUA and the federal banking agencies, was required to issue regulations to simplify procedures for consumers to opt out of prescreened credit or insurance offers. FTC finalized the prescreened marketing rule on January 24, 2005 with an effective date of August 1, 2005.

The final rule requires credit unions engaged in prescreened solicitations to provide “layered” notices to consumers consisting of an initial, prominent statement that provides the basic opt-out information, followed by a separate, longer explanation that provides additional details. The short notice must be a simple and easy to understand statement that the consumer has a right to opt-out of receiving prescreened solicitations, and it must include a toll-free telephone number of the credit bureaus that the consumer may call to opt-out.

Credit unions are still awaiting proposals on the following FACT Act provisions:

Sec. 311(a): Risk-based pricing notice. Creditors engaged in risk-based pricing using credit reports will be required to provide a special notice if a person receives credit on terms “materially less favorable” than terms offered to most members. The Federal Reserve Board and FTC are required to jointly prescribe rules implementing the risk-based pricing notice requirements.

Sec. 114: ID theft “red flag” guidelines and regulations. NCUA, the federal banking agencies, and FTC must jointly prescribe guidelines for financial institutions and other creditors to use in identifying the patterns, practices, and specific activities related to ID theft. The agencies also must jointly prescribe regulations requiring financial institutions and other creditors to establish “reasonable policies and procedures” for implementing the “red flag” guidelines mentioned previously to identify possible risks to account holders or to the institution’s safety and soundness. Red flags include ID theft related to change of address requests and fraudulent activity using previously inactive accounts.

Sec. 312(a): Procedures to enhance the accuracy of consumer report information. NCUA, FTC, and the federal banking agencies must establish guidelines for the accuracy and integrity of information furnished to a consumer reporting agency, and issue regulations requiring furnishers to establish policies for implementing these guidelines.

Sec. 312(c): Ability to dispute information directly with the furnisher. NCUA, FTC, and the federal banking agencies must jointly issue regulations that will identify the circumstances under which a furnisher will be required to reinvestigate the accuracy of information in consumer reports based on a consumer’s direct request.

Sec. 315: Reconciling address discrepancies. NCUA, FTC, and the federal banking agencies are required to prescribe regulations regarding policies and procedures credit unions and others must use when an address on an application or account substantially differs from the one that appears in the consumer’s credit report.

Stay tuned.

Valerie Moss is director of compliance information for the Credit Union National Association. Send compliance questions to cucomply@cuna.com. This story first appeared in Credit Union Magazine at www.creditunionmagazine.com and is reprinted with permission.