FCRA Applicability Memo for Fintech and AI Scoring

In 2012, a company called Spokeo sold profiles of millions of people to HR departments, recruiters and background screening firms. It marketed them as an employment screening tool, with the pitch “Explore Beyond the Resume.” The profiles were built from online and offline sources, including social networks. The FTC alleged that Spokeo was a consumer reporting agency and that it had not verified its customers’ permissible purposes, had not taken steps to ensure accuracy, and had not told its customers what the Fair Credit Reporting Act required of them. Spokeo paid an $800,000 civil penalty .

The FCRA does not ask what a company thinks it is. It asks what the product does, who buys it and what the buyer uses it for. A fintech, a scoring startup or a data vendor has to answer that before launch, and the written answer is an FCRA applicability memo.

The three questions that decide everything

1. Is the output a “consumer report”?

The statute defines a consumer report as a communication of information by a consumer reporting agency that bears on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living, and that is used or expected to be used, in whole or in part, as a factor in establishing the consumer’s eligibility for credit or insurance for personal, family or household purposes, for employment, or for another purpose authorized under section 1681b (15 U.S.C. § 1681a(d), retrieved 2026-10-20).

Two features catch products by surprise. The list of subjects is broad: it reaches character, general reputation and mode of living, not only payment history, so a score built from non-credit data can fall inside it. And “expected to be used” counts, so a vendor that sells to lenders or employers can be covered even if its marketing never says “credit” or “hiring.”

The statute carves out a report containing information solely as to transactions or experiences between the consumer and the person making the report, and certain affiliate communications (§ 1681a(d)(2)). This is why a lender that scores its own customers from its own data is in a different position from a vendor that sells scores about other companies’ customers.

2. Are you a “consumer reporting agency”?

A consumer reporting agency is any person that, for monetary fees, dues or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses interstate commerce to do it (§ 1681a(f)).

Note the verbs: assembling or evaluating. A company does not need to own a database. An AI model that evaluates information on consumers and delivers a score to third parties for a fee is, on the face of the definition, doing the evaluating. The FTC has told Congress that a credit or predictive score can fall within the definition of a consumer report when it is used or expected to be used for eligibility purposes .

3. Is there a permissible purpose?

An agency can furnish a report only for a permissible purpose: a credit transaction, employment, insurance underwriting, a government license or benefit, an existing credit obligation, or a legitimate business need in a transaction the consumer initiated (§ 1681b(a)(3)). For employment reports, the user must give a stand-alone written disclosure and get written authorization first, and follow a pre-adverse-action process before acting (§ 1681b(b)).

For a data vendor, this is where the business model meets the statute. If you cannot show who your customers are and why each is entitled to the data, you have the Spokeo problem.

How the test plays out for common fintech products

The table shows where the three questions usually point. It does not replace the analysis of a specific product.

Wallet scoring is new, but the statutory test is not. A score that evaluates information about an identifiable person and is furnished to lenders or employers as a factor in their decisions has the structure the statute describes, whatever the data source. A score an exchange builds from its own users’ activity and uses internally sits in the first-party space.

What follows if you are a consumer reporting agency

Being inside the statute changes the product. The main obligations on a consumer reporting agency include:

• Know your customers. Procedures requiring prospective users to identify themselves and certify their purposes, and a good-faith effort to verify them (§ 1681e(a)).
• Accuracy. Reasonable procedures to assure maximum possible accuracy (§ 1681e(b)). For a machine-learning model, that raises questions about training data, entity matching and error correction.
• Notices. A notice of responsibilities to anyone who supplies information or receives reports (§ 1681e(d)).
• Disputes. Consumers can dispute inaccurate or incomplete information, and the agency must handle those disputes (§ 1681i).

Enforcement does not depend on a regulator. A person who willfully violates the Act is liable to the consumer for actual damages or statutory damages of $100 to $1,000, plus punitive damages as the court allows and the costs of the action and reasonable attorney’s fees (15 U.S.C. § 1681n, retrieved 2026-10-20). Per-consumer statutory damages are why FCRA claims are often brought as class actions.

What follows if you only use consumer reports

Many fintechs are users of someone else’s reports, not agencies. They still have duties, and algorithmic decisions are where those duties get tested.

When a person takes adverse action based in whole or in part on a consumer report, it must tell the consumer, provide the name, address and phone number of the agency that furnished the report, state that the agency did not make the decision and cannot give the specific reasons, and explain the consumer’s right to a free copy of the report within 60 days and to dispute its accuracy. Where a credit score was used, the notice must also disclose the score and related information (15 U.S.C. § 1681m(a), retrieved 2026-10-20). A separate risk-based pricing notice is required when a consumer report is used to offer credit on materially less favorable terms than the best terms available to a substantial share of consumers (§ 1681m(h)).

“Adverse action” is defined broadly. Beyond a denial, it includes adverse changes in the terms of credit or insurance and, for employment, any decision that adversely affects a current or prospective employee (§ 1681a(k)).

Where AI models create the real exposure

The model’s inputs. If a lender’s model takes in a third-party score or data feed, the lender is using a consumer report and the notice duties follow. If the lender buys a model from a vendor with its own data feeds, who is the agency and who is the user depends on how the data and score flow.

Specific reasons. The FCRA notices are not the only duty. A creditor taking adverse action must also give specific reasons under the Equal Credit Opportunity Act and Regulation B. In 2022 the CFPB issued Circular 2022-03, stating that a creditor cannot rely on a complex algorithm if it cannot give applicants the specific principal reasons for an adverse action, and that the opacity of the technology is not an excuse (CFPB Circular 2022-03, retrieved 2026-10-20). The CFPB withdrew that circular in May 2025 as part of a group of 67 guidance documents. Treat it as a statement of the Bureau’s former reading, not current guidance. The obligation to give reasons remains, and a model that cannot produce them is a design problem regardless of the circular.

Shifting federal posture. In December 2024 the CFPB proposed a rule that would have treated certain data brokers as consumer reporting agencies. It withdrew the proposal in May 2025, stating that rulemaking was not necessary or appropriate at that time and that it would propose a new rule if it later found one necessary (Federal Register, 90 FR 20568, retrieved 2026-10-20). That changes federal rulemaking, not the statute. The definitions in § 1681a are the same, private plaintiffs can still sue, and the FTC has used the statute against data vendors since at least the Spokeo case. A launch plan that depends on enforcement staying quiet carries a risk the statute does not remove.

What an FCRA applicability memo covers

A good memo is short and written to support a decision. Ours covers:

1. Product facts: what data comes in, from whom, what the model does with it, what the output looks like, who receives it and what they do with it.
2. The three-question analysis (consumer report, consumer reporting agency, permissible purpose), applied to each product, tier and customer segment.
3. A conclusion by scenario: inside the FCRA, outside it, or dependent on a design or contract condition. Where the answer is “it depends,” the memo names the facts that decide it.
4. Design options that move a product in or out of scope: restricting use cases by contract, limiting the data used, changing who the customer is, or building to full agency standards from the start.
5. An obligations map if the product is in scope: customer credentialing, accuracy and dispute procedures, user notices, adverse-action support and the employment disclosure and authorization steps.
6. Customer-facing language. A memo that says “not a consumer report” and a sales deck that says “approve better applicants” cannot both stand, so the contract terms, permitted-use clauses and marketing claims have to match the conclusion.

The memo is also what banks, partners and investors ask for in diligence. It shows that the question was asked and answered in writing before launch.

What we do

We act as lead counsel on the engagement and coordinate any specialist support, so you deal with one team.

• An applicability memo for your product, with a clear conclusion and the facts it depends on.
• Product and contract design that puts the product on the right side of the line, including customer terms, permitted-use clauses and onboarding controls.
• A compliance build if the product is in scope: credentialing procedures, dispute handling, adverse-action notice templates and model-governance documentation.
• Review of AI-driven decisions against the FCRA, ECOA and related state requirements.

To scope the memo we need a description of the product, the data sources, the customers and their use cases, and any existing contracts and marketing materials. Other AI products raise different US regulatory questions. For automated calls and messaging, see our guide to TCPA compliance for AI voice agents.

Frequently asked questions

• Does the FCRA apply to non-credit data?

  It can. The purpose the information serves decides, not the data type. Information on character, general reputation or mode of living is covered when used or expected to be used for credit, insurance, employment or another permitted purpose.

• We only use our own customer data. Are we outside the FCRA?

  Often, for that data. Reports solely about transactions or experiences between the consumer and the person making the report are excluded. Mixing in outside data or sharing with non-affiliates can change the result.

• If we are a data vendor, can a disclaimer solve this?

  Not on its own. A clause barring credit or employment use helps only when backed by customer vetting, technical controls and consistent marketing.

• Does this cover state law?

  The FCRA is the federal baseline. Several states have their own consumer reporting, screening and AI decision laws, and a full review looks at the states where your customers are.

Launching a Scoring or Data Product?