BACKGROUND AND PURPOSE

The Fair Credit Reporting Act (FCRA), effective in April 1971, was substantially amended effective September 30, 1997. The FCRA was amended by the Fair and Accurate Credit Transactions Act (“FACT Act”) of 2003, which was enacted on December 4, 2003, and became effective December 1, 2004. Elements of the FCRA and FACT Act have been implemented in Regulation V (12 CFR 1022).

The FACT Act created many new responsibilities for consumer reporting agencies and users of consumer reports. It contained many new consumer disclosure requirements as well as provisions to address identity theft. In addition, it provided free annual consumer report rights for consumers and improved access to consumer report information to help increase the accuracy of data in the consumer reporting system.

The FCRA contains significant responsibilities for business entities that are consumer reporting agencies. Generally, financial institutions are not classified as consumer reporting agencies; however, the classification may change if their information-sharing business practices are similar to a consumer reporting agency.

SCOPE

This Fair Credit Reporting Act Policy applies to all employees, contractors, and third-party vendors of FACEBANK. It ensures the accuracy, fairness, and privacy of information in consumer credit bureau files.

DEFINITIONS

The FCRA and FACT Act use a number of definitions. Key definitions include the following:

Adverse Action

Concerning credit transactions, the term “adverse action” has the same meaning as used in Section 701(d)(6) (15 U.S.C. 1691(d)(6)) of the Equal Credit Opportunity Act (ECOA), Regulation B (12 CFR 1002.2(c)), and the official staff commentary. Under the ECOA, it means a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the same amount or on terms substantially similar to those requested. Under the ECOA, the term does not include a refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where such additional credit would exceed a previously established credit limit.

For non-credit transactions, the term has the following additional meanings for purposes of the FCRA (and FACT Act):

1. a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance;

2. a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee;

3. a denial or cancellation of, an increase in any charge for, or any other adverse or unfavorable change in the terms of, any license or benefit described in Section 604(a)(3)(D) (15 U.S.C. 1681b(a)(3)(D)); and

4. an action taken or determination that is:

1. Made in connection with an application made by, or transaction initiated by, any consumer or in connection with a review of an account to determine whether the consumer continues to meet the terms of the account.
2. Adverse to the interests of the consumer.

Consumer. A “consumer” is defined as an individual.

Consumer Report

A “consumer report” is any written, oral, or other communication of any information by a consumer reporting agency that bears on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected, in whole or in part, for the purpose of serving as a factor in establishing the consumer’s eligibility for any of the following:

1. Credit or insurance to be used primarily for personal, family, or household purposes;
2. Employment purposes; or
3. Any other purpose authorized under Section 604 (15 U.S.C. 1681b).

The term “consumer report” does not include any of the following:

1. Any report containing information solely about transactions or experiences between the consumer and the person making the report;
2. Any communication of that transaction or experience information among entities related by common ownership or affiliated by corporate control (for example, different institutions that are members of the same holding company, or subsidiary companies of an insured institution);
3. Communication of other information among persons related by common ownership or affiliated by corporate control if:

1. It is clearly and conspicuously disclosed to the consumer that the information may be communicated among such persons; and

1. The consumer is given the opportunity, before the time that the information is communicated, to direct that the information not be communicated among such persons;

4. Any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device;

5. Any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer, such as a lender who has received a request from a broker, conveys his or her decision with respect to such request, if the third party advises the consumer of the name and address of the person to whom the request was made, and such person makes the disclosures to the consumer required under Section 615 (15 U.S.C. 1681m), Requirements on Users of Consumer Reports; or

6. A communication described in subsection (o) or ( x) of Section 603 (15 U.S.C. 1681a) (which relates to certain investigative reports and certain reports to prospective employers).

Consumer Reporting Agency. The term “consumer reporting agency” means any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and who uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

Credit Score. The term “credit score” means a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict the likelihood of certain credit behaviors, including default (and the numerical value or the categorization derived from such analysis may also be referred to as a “risk predictor” or “risk score”). The term does not include any mortgage score or rating of an automated underwriting system that considers one or more factors in addition to credit information, including the loan-to-value ratio, the amount of down payment, or the financial assets of a consumer; or any other elements of the underwriting process or underwriting decision.

Creditor. Generally, in FCRA, the terms “credit” and “creditor” have the same meanings as in section 702 of ECOA (15 U.S.C. 1691a).

Employment Purposes. The term “employment purposes” when used in connection with a consumer report means a report used for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee.

Investigative Consumer Report. An “investigative consumer report” means a consumer report or portion thereof in which information on a consumer’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer reported on or with others with whom he is acquainted or who may have knowledge concerning any such items of information. However, such information does not include specific factual information on a consumer’s credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when such information was obtained directly from a creditor of the consumer or from the consumer.

Person. A “person” means any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

FACEBANK POLICY

It is the policy of FACEBANK to comply with all the requirements of the Fair Credit Reporting Act (“FCRA”), including those amendments made to it by the Fair and Accurate Credit Transactions Act (“FACT Act”) and, the implementing rules contained in the Federal Reserve’s Regulation V (12 CFR Part 1022).

I. Obtaining Consumer Reports

It shall be the Bank’s policy to obtain a consumer report only under circumstances permitted in FCRA. These include:

• In response to a court order or Federal Grand Jury subpoena.
• In accordance with a consumer’s written instructions.
• In connection with a credit transaction involving the consumer;
• For employment purposes (with the appropriate separate consent);
• As potential investor or servicer, in connection with a valuation of, or assessment of the credit or prepayment risks associated with, an existing credit obligation.
• When the Bank otherwise has a legitimate business need for the report in connection with a business transaction initiated by the consumer;
• In order to review a credit account to determine whether the consumer continues to meet the terms of the account;

No one connected with the Bank shall procure a consumer report on any consumer for any purpose other than the Bank’s business.

It is the policy of the Bank that all handling of credit information about consumers by the Bank’s personnel will be accomplished in compliance with the provisions of the FCRA. The Bank shall take all necessary actions to ensure that it remains only a «user» of such information, and never a «consumer reporting agency» as those terms are defined in that act.

Using Credit Reports for Employment Evaluation Purposes

Before using a consumer report for employment purposes, the Bank will inform the person applying for employment that the Bank will be obtaining a consumer credit report and the Bank will ask for authorization to do so. The Bank will not obtain the credit report until the consumer has responded in writing authorizing the report. FACEBANK’s current process for new hires includes all required disclosures, however, it does not pull credit reports

Prescreened Offers of Credit

The Bank shall make, when applicable, any prescreened offers of credit to consumers only in accordance with the provisions of the FCRA. Specifically, the Bank shall make such offers conditioned only upon the consumer continuing to meet the standards the Bank provided to the consumer reporting agency to generate the pre-screened list. Further, the Bank shall provide the disclosure required in prescreened list solicitations concerning meeting the prescreening criteria and the consumer’s ability to opt out of future prescreened lists. Notwithstanding, the Bank is not conducting pre-screening offers to customers.

II. Obtaining Information and Sharing Among Affiliates

Opt-outs from Affiliate Information Sharing for Marketing

It is the policy of the Bank that whenever intends to share any information about a consumer with an affiliate of the Bank, whenever applicable, for marketing purposes, the Bank shall clearly and conspicuously disclose to the consumer that such information sharing may be done unless the consumer opts out and shall provide the consumer with a simple method to opt out. The opt-out shall be effective for a period of five (5) years unless the consumer revokes the opt-out. The only exceptions to this provision of the policy are:

• marketing to a consumer with whom the affiliate has a pre-existing business relationship;
• using the information to facilitate communications to an employee benefit plan participant or in performing other services for the consumer’s employer related to the employment relationship;
• using the information to perform services on behalf of an affiliate, provided the affiliate would be permitted to send the solicitation itself;
• responding to a communication initiated by the consumer or to a solicitation authorized or requested by the consumer; or
• when required to follow state insurance laws pertaining to unfair discrimination in a state in which the Bank is lawfully doing business.

Use of Medical Information in Credit Decisions

The Bank does not obtain or use medical information on any consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.

III. Disclosures to Consumers and Miscellaneous Requirements

Consumer Reports for Employment Purposes

The FCRA generally requires the written permission of a “consumer” to procure a consumer report for “employment purposes.” Moreover, the Bank, as a potential employer, must provide a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes prior to procuring a report. Matters relating to the Bank’s employment practices are generally contained in the Bank’s Human Resources Policies and Procedures Manual. Procedures relating to FCRA and FACT Act compliance shall be included in both this Policy and HR Policies for consistency purposes.

FACEBANK’s current process for new hires includes all required disclosures, however, it does not obtain credit reports. However, if the bank decides to begin generating credit reports in the future, the following procedure should be followed:

Prior to taking any adverse action related to employment that is based in whole or in part on a consumer report, the Bank will provide to the consumer (employee/applicant):

1. A written notice of the adverse action;
2. Provide to the consumer in writing:

(A) the name, address, and telephone number of the consumer reporting agency (including a toll-free telephone number established by the agency if the agency compiles and maintains files on consumers on a nationwide basis) that furnished the report to the person; and

(B) a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken;

1. A copy of the report; and

1. A description in writing of the rights of the consumer under this title, as the CFPB prescribes under Section 609(c)(1 3).

It is the policy of the Bank that whenever it takes adverse action in an employment application, the Bank will provide to the consumer an adverse action notice as required by Section 615 (15 U.S.C. 1681m). Refer to Appendix A for model notice for adverse action notice covering employment purposes and to the Section titled Adverse Action below.

Truncation of Credit and Debit Card Account Numbers

It is the policy of the Bank whenever it issues an electronic receipt for the transaction of business pertaining to debit or credit cards to only issue electronic receipts that contain truncated account numbers with no more than the last five digits of the card number and that do not show the card expiration date at the point of sale or transaction. As per Section 605(g) (15 U.S.C. 1681c) this requirement applies only to electronically issued receipts and does not apply to hand-written receipts or those developed with an imprint of the card.

Risk-Based Pricing Notice

The Risk-Based Pricing Notice is required when the Bank uses both:

• a consumer report in connection with an application for, or a grant, extension, or other provision of, credit to a consumer; and
• based in whole or in part on the consumer report, grants, extends, or otherwise provides credit to that consumer on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers from or through that person. The risk-based pricing notice requirements apply only in connection with credit that is primarily for personal, household, or family purposes.

‘‘Material terms’’ is the annual percentage rate for credit that has an annual percentage rate, or, in the case of credit that does not have an annual percentage rate, as the financial term that the person varies based on the consumer report and that has the most significant financial impact on consumers, such as an annual membership fee or a deposit. For credit cards, which may have multiple annual percentage rates applicable to different features, ‘‘material terms’’ is defined generally as the annual percentage rate applicable to purchases.

‘‘Materially less favorable,’’ applies to material terms, to mean that the terms granted or extended to a consumer differ from the terms granted or extended to another consumer from or through the same person such that the cost of credit to the first consumer would be significantly greater than the cost of credit to the other consumer.

The Bank has determined that it will use risk-based pricing for all of its credit products. However, the Bank does not use credit scores in determining pricing for consumer credit.

The Risk-Based Pricing form will include the following:

• his/her credit score;
• the range of possible scores under the scoring model;
• all of the key factors, up to a maximum of four, that adversely affected the consumer’s score (and if the number of inquiries is one of the factors, then the maximum becomes five);
• the date the credit score was created;
• the name of the entity that provided the score; and
• the statutorily prescribed “Notice to Home Loan Applicant.”

The Notice to Home Loan Applicant and Risk-Based Pricing Notice will be given to all such applicants regardless of whether the loan is closed as soon as is reasonably practicable after using a credit score. In addition, the Risk-Based Pricing Notice will be given to any person in connection with an application for, or a grant, extension, or other provision of, credit to a consumer for personal, family, or household purposes.

Disclosure of Credit Scores by Certain Mortgage Lenders

Section 609(g) (15 U.S.C. 1681g) requires creditors, such as financial institutions, that make or arrange mortgage loans using credit scores to provide the score with accompanying information to the applicants.

For purposes of this section, the term “credit score” is defined as a numerical value or a categorization derived from a statistical tool or modeling system used by a person who makes or arranges a loan to predict the likelihood of certain credit behaviors, including default (and the numerical value or the categorization derived from such analysis may also be referred to as a “risk predictor” or “risk score”).

The credit score does not include either of the following:

1. Any mortgage score or rating by an automated underwriting system that considers one or more factors in addition to credit information, such as the loan-to-value ratio, the amount of down payment, or the financial assets of a consumer.
2. Any other elements of the underwriting process or underwriting decision.

The disclosure requirement applies to both closed-end and open-end loans that are for consumer purposes and are secured by one-to four-family residential real properties, including purchase and refinance transactions. This requirement will not apply in circumstances that do not involve a consumer purpose, such as when a borrower obtains a loan secured by his or her residence to finance his or her small business.

Notice to Home Loan Applicants (Credit Scores on 1-4 Family Loans) – Whenever the Bank processes an application for a covered transaction from a consumer for a loan secured by a 1-4 family residence, whether open- or closed-end, and whether secured by a first or junior lien, if the Bank obtains or generates a credit score, then the Bank shall provide each consumer whose credit score was obtained the Notice to The Home Loan Applicant as defined under Section 609(g)(1)(D) (15 U.S.C. 1681g)– Appendix B.

This notice will include the name, address, and telephone number of each consumer reporting agency that provided a credit score that was used.

In addition, the Bank will provide a Risk-Based Pricing Notice as described below in conjunction with the “Notice of Home Loan Applicant” as required by Section 615(h) (15 U.S.C. 1681m) as follow:

Adverse Action Notices

The Bank shall provide appropriate notices of adverse action to all consumers who are entitled to them under the FCRA. When our adverse action is based in whole or in part on a consumer report from a consumer reporting agency, the Bank will notify the consumer of the adverse action, and will furnish the name, address and telephone number of the consumer reporting agency(ies) making the report. In addition, the Bank will also notify that the consumer reporting agency did not make the adverse action decision and will be unable to provide the consumer with specific reasons why the adverse action was taken. The Bank will also notify the consumer that a free copy of the consumer report can be obtained from the consumer reporting agency if so requested within 60 days of the receipt of the adverse action notice. The Bank also will notify the consumer of his/her right to dispute the accuracy of the report furnished by the consumer reporting agency.

The Bank shall provide appropriate notices of adverse action to all consumers application when adverse action was taken based on information obtained from third parties other than consumer reporting agencies, bearing upon the consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. The Bank shall, within a reasonable period of time, upon the consumer’s written request for the reasons for such adverse action received within sixty days after learning of such adverse action, disclose the nature of the information to the consumer. The Bank shall clearly and accurately disclose to the consumer his/her right to make such written request at the time such adverse action is communicated to the consumer.

IV. Duties of Users of Consumer Reports and Furnishers of Consumer Report Information

Promoting the Accuracy and Integrity of Information Reported

It is the policy of the Bank to promote the accuracy and integrity of furnished information as defined in Subpart E to Regulation V.

Accuracy and Integrity of Information Reported

The Bank established appropriate procedures for investigating and resolving claims relating to information reported to consumer reporting agencies.

Disputes of Credit Information

In case of receipt of a consumer dispute from a credit reporting agency regarding consumer report information the Bank will, within 30 days:

• review all the information provided to the agency;
• investigate the disputed information;
• report the results to the agency; and
• report the results to any other agencies receiving the information.

The Bank will maintain records of all investigations.

Correction and Updating Credit Information

It is the policy of the Bank that it will correct, and update information contained in consumer reports. If the Bank learns that information previously provided to a consumer credit reporting agency is inaccurate or incomplete, the Bank will:

• promptly notify the agency;
• provide the agency with data that will correct the situation, and
• refrain from furnishing that agency with incomplete or inaccurate information.

Disclosure of Contents of Consumer Report

It is the policy of the Bank that no one connected with the Bank shall disclose anything from a consumer report the Bank has procured or otherwise has in its custody except as permitted or required by law. All information in the possession of the Bank concerning its customers is confidential and proprietary. Such information is to be released to persons or entities outside of the Bank only in accordance with applicable laws and Bank policies.

All requests by persons or entities outside the Bank (other than those by government authorities, which are covered under the Bank’s policy on «Customer Confidentiality») for credit information about consumers, shall be referred to the Processing Department of the Bank, which shall be the sole authorized source of such information for outsiders. All other employees of the Bank who may have or come into possession of such information shall decline to release it to anyone outside the Bank. That Department shall handle such requests in accordance with standard procedures. Any deviations from such procedures must be approved in advance in writing by the Chief Financial Officer (CEO).

Reporting Negative Information

Section 623(a)(7) (15 U.S.C. 1681s-2(a)) requires a financial institution to provide consumers with a notice either before it provides negative information to a nationwide consumer reporting agency, or within 30 days after reporting the negative information.

Disposal of Consumer Information

The Bank will ensure the complete destruction, beyond possibility of recovery by unauthorized persons, of any records containing consumer information that are no longer intended to be retained by the Bank for its business purposes.

While the majority of banks adhere to a high level of professional conduct, banks are reminded that they must take a proactive approach to identifying and stopping any acts or practices that may be seen as unfair or deceptive. There are numerous ways a bank may prevent violations of the unfair or deceptive acts or practices regulations. Banks should draw consumers’ attention to the key terms, limitations, and conditions of each product or service so that the consumer can make informed decisions. Additionally, advertisements should be tailored for a realistic bank audience. Banks should also ensure that third parties who market or promote the bank’s products or services are adequately trained to make clear and accurate statements and representations.

RECORD RETENTION

All regulations require that a creditor maintain records as evidence of their compliance. The Bank will maintain records on all complaints for a minimum of five (5) years in order to maintain compliance with all applicable regulations.

TRAINING

Relevant employees will be trained on at least an annual basis, or more often if deemed necessary, concerning this policy, its implementing procedures, manual and internal controls.

IDENTITY THEFT PROGRAM

The Fair Credit Reporting Act Policy will be updated to ensure FACEBANK compliance with regulatory requirements as regulations evolve.

AMENDMENTS

Please refer to the Bank’s Identity Theft Prevention Program (ITPP) Compliance Policy, for additional policy statements.