FCRA Requirements for Reporting Agencies, Furnishers, and Users

This article is provided for educational and informational purposes only. It does not constitute legal, financial, or tax advice, and no attorney-client relationship is formed by reading it. Laws, regulations, official guidance, and related information vary by jurisdiction, change frequently, and may have changed or become outdated since publication. Always verify current information with authoritative sources and consult a qualified professional about your specific circumstances. The author and publisher assume no liability for actions taken based on this information.

The Fair Credit Reporting Act is not simply a law about the three nationwide credit bureaus. Its requirements follow information through a system: a business supplies data, a consumer reporting agency assembles or evaluates it, and another business uses the resulting report to make a decision. Understanding which role an organization occupies is the starting point for understanding its duties.

This article focuses on the principal federal requirements rather than every specialized rule or exception. For a broader introduction to the law and consumer rights, see the Fair Credit Reporting Act overview.

Who must comply with FCRA requirements?

A consumer reporting agency, often shortened to CRA, is a person or business that regularly assembles or evaluates consumer information for the purpose of furnishing consumer reports to third parties for a fee or on a cooperative nonprofit basis. The category includes more than the largest credit bureaus and can reach specialty reporting companies that prepare employment, tenant, insurance, check-writing, or other eligibility reports.

A furnisher is an entity that provides information about consumers to a CRA. Creditors, debt collectors, servicers, and other businesses may occupy this role, but a company does not become a furnisher merely because it keeps internal customer records.

A user is a person or business that obtains or uses a consumer report. Lenders, insurers, employers, and housing providers are common examples, and their duties depend partly on the purpose for which the report is obtained.

One organization can occupy more than one role in different transactions. The legal question therefore concerns the activity being performed, not just the company’s label.

Consumer reporting agencies must control access and promote accuracy

The FCRA does not permit a CRA to sell a report for general curiosity. Section 604 lists permissible purposes, including certain credit, employment, insurance, licensing, account-review, collection, and consumer-initiated business needs, along with uses authorized by the consumer in writing.

A CRA must maintain reasonable procedures for limiting reports to those purposes and generally requires a prospective user to identify and certify the intended use. The agency must have reasonable grounds to believe that the stated purpose is one the statute allows.

Accuracy is a separate requirement. When preparing a consumer report, a CRA must follow reasonable procedures designed to assure the maximum possible accuracy of the information concerning the individual.

The statute also limits how long many adverse items may be reported, although the period varies by information type and statutory exceptions apply. For example, most civil suits, civil judgments, and paid tax liens fall under a seven-year rule, while bankruptcy cases may generally be reported for up to ten years.

Consumers also have disclosure rights. Subject to the statute’s identification and request rules, a CRA must disclose the information in a consumer’s file, the sources of that information, and specified recipients or categories of recipients.

The ecosystem extends beyond ordinary credit files. A separate guide to credit reporting agencies explains how nationwide and specialty reporting companies differ.

Disputes trigger duties for both CRAs and furnishers

When a consumer disputes the completeness or accuracy of an item directly with a CRA and the dispute is not frivolous or irrelevant, the CRA generally must conduct a reasonable reinvestigation without charge. The ordinary statutory period is 30 days after receipt, with a possible 15-day extension when the consumer provides additional relevant information during that period.

The CRA must promptly notify the furnisher and provide all relevant information about the dispute that it received from the consumer. After completing the reinvestigation, the CRA generally must provide written results and a revised report if the dispute produced a change.

Furnishers have their own accuracy-and-integrity duties under Regulation V, including reasonable written policies and procedures appropriate to their activities. They also must investigate certain disputes sent by CRAs under Section 623(b).

Regulation V separately addresses qualifying disputes submitted directly to a furnisher. Its coverage and exceptions matter: not every disagreement sent to every address triggers the direct-dispute rule.

A CRA or furnisher may determine that a direct dispute is frivolous or irrelevant in circumstances allowed by law, but it generally must notify the consumer within five business days and identify what additional information is needed. Federal guidance also rejects imposing extra documentary hurdles that the statute and regulation do not authorize.

The mechanics of a consumer challenge are covered in the related guide on how credit-report disputes work.

Furnishers must handle known inaccuracies carefully

Section 623 prohibits a furnisher from supplying information it knows or has reasonable cause to believe is inaccurate, subject to the statute’s defined standard. A furnisher also may not continue furnishing information after a consumer specifically identifies it as inaccurate when the information is in fact inaccurate.

If a furnisher regularly reports information and later determines that information is incomplete or inaccurate, it must promptly notify the CRA and provide a correction or completion. When appropriate, it must notify every other CRA to which it furnished the same information.

A furnisher that reports a disputed item after receiving a qualifying consumer dispute generally must tell the CRA that the information is disputed. Special rules govern matters such as notice before furnishing certain negative information and the reporting of account closures or voluntary disputes.

Users need a lawful purpose and may owe notices

A report user needs a permissible purpose before obtaining a consumer report. Obtaining a report under false pretenses or knowingly without a permissible purpose can create civil or criminal exposure under the statute.

When a user takes adverse action based in whole or in part on a consumer report, Section 615 generally requires notice to the consumer. The notice identifies the CRA, explains that the CRA did not make the decision, and describes rights to dispute report information and request a free copy within 60 days.

Credit decisions can involve an additional risk-based pricing notice when credit is granted on materially less favorable terms because of report information. Regulation V supplies detailed rules and alternative credit-score disclosure methods for this setting.

Employment reports carry extra steps. Before obtaining a report for employment purposes, an employer generally must make a clear and conspicuous written disclosure in a document consisting solely of the disclosure and obtain the consumer’s written authorization.

Before taking adverse employment action based on the report, the employer must provide a copy of the report and the federal summary of rights. A separate adverse-action notice follows if the employer then makes the unfavorable decision.

Investigative consumer reports, which include information obtained through personal interviews about character, reputation, personal characteristics, or mode of living, carry additional disclosure requirements. Housing providers and insurers also can be report users, but the precise notice rules depend on the transaction.

Regulation V turns broad statutory duties into operational rules

The FCRA appears in 15 U.S.C. Sections 1681 through 1681x, while Regulation V appears in 12 C.F.R. Part 1022. The regulation supplies operational detail on subjects including identity-theft protections, direct disputes, accuracy-and-integrity policies, risk-based pricing, medical information, affiliate marketing, and model forms.

Model forms can help standardize required disclosures, but using a form does not replace the need to determine whether the underlying transaction and timing satisfy the law. The CFPB maintains current model notices for consumer rights, identity-theft rights, furnisher duties, user duties, and risk-based pricing.

Currentness matters because rules and official interpretations can change. The FTC’s compiled FCRA text was revised in March 2026, and the CFPB’s compliance page notes that a federal court vacated the agency’s 2025 medical-debt rule.

Federal requirements are only one layer

The FCRA contains provisions addressing its relationship with state law, including targeted preemption rules and room for some state requirements. As a result, the federal statute should not be read as a complete statement of every rule governing a background check or credit-report use.

Employment and housing are especially likely to involve additional state or local restrictions. A neutral federal summary can identify that boundary, but a concrete claim about a particular jurisdiction requires that jurisdiction’s authority.

The practical compliance picture is therefore role-specific and event-specific. The duties can change when information is furnished, a report is requested, a dispute arrives, an adverse decision is contemplated, or identity theft is reported.

Sources

• Federal Trade Commission, Fair Credit Reporting Act, revised March 2026
• Federal Trade Commission, Fair Credit Reporting Act legal library
• Consumer Financial Protection Bureau, FCRA compliance resources
• Electronic Code of Federal Regulations, Regulation V
• Consumer Financial Protection Bureau, reasonable investigation of consumer reporting disputes
• Federal Trade Commission, background checks for employers
• Federal Trade Commission, adverse action and risk-based pricing notices
• Consumer Financial Protection Bureau, FCRA model forms and disclosures