FCRA: Penalties for Non-Compliance

QUESTION

I am the General Counsel for a company that is primarily a retail mortgage lender, but we do originate as a mortgage broker for certain loan products. We recently went through a state banking examination and were told in the exit interview that we may have some FCRA violations. It is my understanding that the FCRA’s penalties are tier-based. What are the tier-based penalties for violations of the FCRA?

ANSWER

The Fair Credit Report Act (FCRA) does, indeed, have a sliding scale of penalties for non-compliance, which vary based on the willfulness of the non-compliance.

For willful failure to comply, your company would be liable to an aggrieved consumer in an amount equal to the sum of (1) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000, (2) punitive damages as the court may allow, and (3) the costs of the action together with reasonable attorneys’ fees as determined by the court. [15 USC § 1681n]

For negligent non-compliance, your financial institution would be liable to the consumer in an amount equal to the sum of (1) any actual damages sustained by the consumer as a result of the failure, and (2) the costs of the action together with reasonable attorneys’ fees as determined by the court. [15 USC § 1681o]

An action may be brought in any appropriate United States district court without regard to the amount in controversy, or in any other court of competent jurisdiction, within two years from the date on which the liability arises. [15 USC § 1681p] However, if the defendant has materially and willfully misrepresented any information required by the FCRA to be disclosed to an individual and the misrepresented information is material to the establishment of the defendant’s liability, the action may be brought at any time within two years after discovery by the individual of the misrepresentation. [15 USC § 1681p]

The FCRA also gives the Consumer Financial Protection Bureau (CFPB), Federal Trade Commission (FTC), and other appropriate federal regulatory agencies the power to bring civil enforcement actions. [15 USC § 1681s]

I should mention that court decisions have pointed out that the FCRA penalties are not readily available for each and every FCRA violation. I know this seems odd, but courts have disagreed as to whether the section that requires furnishers of information to conduct investigations and report necessary corrections creates a private action enforceable by consumers. [15 USC § 1681s-2(b)] For instance, Nelson v Chase Manhattan does uphold the private action, whereas Elmore v North Fork Bancorporation hedges a bit, noting that it does, but still recognizes the disagreement. [See Nelson v. Chase Manhattan Mortgage Corporation, 282 F.3d 1057, 1059–60 (9th Cir. 2002); Elmore v. North Fork Bancorporation, Inc., 325 F. Supp2d 336 (SDNY 2004)]

To get a sense of how this issue is adjudicated, consider the section that imposes upon furnishers a duty to provide accurate information [15 USC § 1681s-2(a)], which may only be enforced by federal or state agencies or officials. A 2005 court decision held that a plaintiff had no cause of action to protest a lender’s erroneous report of an unwanted, unfunded (i.e., non-existent) loan to consumer reporting agencies, after the plaintiff asked the lender to correct its reporting and the lender promptly, the following day, did so. [Ornelas v. Fidelity National Title Co. of Washington (W.D. Wash. Dec. 9, 2005)]

The FCRA generally provides penalties as I’ve described above. But the Dodd-Frank Act (DFA) offers the possibility of substantially higher penalties than those specified by the FCRA, the FCRA being a “Federal consumer financial law” within the meaning of the DFA. These penalties (which the CFPB may inflation-adjust from time to time) vary from up to $5,000 per day for any violation, to $25,000 per day for a violation “recklessly engaged in,” and to $1,000,000 per day for a provision “knowingly violated.” 

For instance, in January 2018 the CFPB adjusted the civil monetary penalty amounts, as required by the Federal Civil Penalties Inflation Adjustment Act. The CFPB increased the maximum civil money penalties under the Consumer Protection Act for violating a Federal consumer financial law to $5,639 per day for a Tier 1 penalty, $28,195 for a Tier 2 penalty (“reckless” engagement), and $1,127,799 for a Tier 3 penalty (“knowing violation”).

Even firms that are not subject to the CFPB’s enforcement authority are subject to these penalties, which could be sought by their prudential regulator or an applicable State Attorney General or state regulator, and perhaps by consumers as well.

Jonathan Foxx, PhD, MBA

Managing Director

Lenders Compliance Group