FRV_20221021_omb

Supporting Statement for the
Recordkeeping and Disclosure Requirements Associated with
the CFPB’s and the Board’s Regulations V
(FR V; OMB No. 7100-0308)
Summary
The Board of Governors of the Federal Reserve System (Board), under authority
delegated by the Office of Management and Budget (OMB), has extended for three years,
without revision, the Recordkeeping and Disclosure Requirements Associated with the CFPB’s
and the Board’s Regulations V (FR V; OMB No. 7100-0308). The CFPBs Regulation V1 and the
Board’s Regulation V2 (collectively FR V Regulations) implement in part the Fair Credit
Reporting Act (FCRA), which was enacted in 1970 based on a Congressional finding that the
banking system is dependent on fair and accurate credit reporting. 3 The FCRA was enacted to
ensure consumer reporting agencies exercise their responsibilities with fairness, impartiality, and
a respect for the consumer’s right to privacy. The FCRA requires consumer reporting agencies to
adopt reasonable procedures that are fair and equitable to the consumer with regard to the
confidentiality, accuracy, relevancy, and proper utilization of consumer information. 4
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act),
enacted in 2010, transferred to the Consumer Financial Protection Bureau (CFPB) most, but not
all, of the rulemaking authority for issuing regulations under the FCRA. 5 The Board and other
federal agencies retained rulemaking responsibility for the FCRA provisions regarding identity
theft prevention programs and the duties of card issuers to validate consumers’ changes of
address (hereinafter, identity theft red flags), as well as the disposal of consumer information,
with respect to the entities that are subject to each agency’s respective enforcement authority.6
The Board and Federal Trade Commission (FTC) also retained rulemaking authority for certain
provisions of the FCRA applicable to motor vehicle dealers. 7
The Paperwork Reduction Act (PRA) classifies reporting, recordkeeping, or disclosure
1

12 CFR Part 1022.
12 CFR Part 222.
3
The FCRA is one part of the Consumer Credit Protection Act, which also includes the Truth in Lending Act, Equal
Credit Opportunity Act, and Fair Debt Collection Practices Act. See 15 U.S.C. § 1601 et seq.
4
See 15 U.S.C. § 1681.
5
The CFPB and the Board have issued Regulations V implementing the FCRA. The CFPB’s Regulation V is
located at 12 CFR Part 1022. The information collection provisions of the CFPB’s Regulation V are contained in
Appendix B to 12 CFR Part 1022; and in 12 CFR 1022.20 - 1022.27, 1022.40 - 1022.43, 1022.70 - 1022.75, and
1022.82. The Board’s Regulation V is located at 12 CFR Part 222. The information collection provisions of the
Board’s Regulation V applicable to institutions for which the Board has primary enforcement authority are
contained in 12 CFR 222.90 - 222.91.
6
See section 1088(a)(10) of the Dodd-Frank Act (15 U.S.C. §§ 1681s(b) and (e)); see also 15 U.S.C. §§ 1681m and
1681w. Requirements regarding disposal of consumer information do not impose additional recordkeeping
requirements.
7
See section 1029 of the Dodd-Frank Act (12 U.S.C. § 5519(a) and (c)), which provides generally that rulemaking
authority for provisions of the federal consumer financial laws, including the FCRA, applicable to certain motor
vehicle dealers are not within the CFPB’s jurisdiction and must be implemented in regulations issued by the Board
or the FTC. The FTC accounts for the PRA burden for motor vehicle dealers’ compliance with the FCRA
regulations. See, e.g., 78 FR 16265, 16266 n. 11 (March 14, 2013).
2

requirements of a regulation as an information collection. 8 The Board continues to be responsible
for renewing every three years the information collection requirements contained in the CFPB’s
Regulation V for institutions with $10 billion or less in assets9 that are identified in 15 U.S.C. §
1681s(b)(1)(A)(ii) and for consumers of these institutions, as well as for the identity theft red
flags provisions in the Board’s Regulation V for institutions of any size that are identified in
15 U.S.C. § 1681s(b)(1)(A)(ii).
The estimated total annual burden for the FR V is 411,127 hours. Other federal agencies
account for the paperwork burden that the CFPB’s and their own FCRA implementing
regulations impose on the entities for which they have primary enforcement authority under the
Dodd-Frank Act.
Background and Justification
On December 21, 2011, the CFPB published an interim final rule establishing its own
Regulation V.10 The Board’s FCRA regulations are contained in the Board’s Regulation V.11
Since the last FR V information collection approval, the FR V Regulations applicable to
institutions for which the Board retained primary enforcement authority under the Dodd-Frank
Act have not been amended in a way that imposes any new or revises any existing recordkeeping
or disclosure requirements that would be collections of information requiring approval.
Description of Information Collection
The PRA requirements of the FR V Regulations that apply to institutions for which the
Board retained primary enforcement authority under the Dodd-Frank Act12 are described below.
Negative Information Notice (Section 1022 Appendix B)
A financial institution that extends credit and, regularly and in the ordinary course of
business, furnishes information to a consumer reporting agency generally must provide written
notice to a consumer if it furnishes negative information to a consumer reporting agency. 13 After
providing such notice, the financial institution may submit additional negative information with
respect to the same transaction, extension of credit, account, or customer without providing
additional notice to the customer. The notice must be provided to the customer prior to, or no
8

See 44 U.S.C. § 3501 et seq.
Institutions identified in 15 U.S.C. § 1681s(b)(1)(A)(ii) are “any member bank of the Federal Reserve System
(other than a national bank), a branch or agency of a foreign bank (other than a Federal branch, Federal agency, or
insured State branch of a foreign bank), a commercial lending company owned or controlled by a foreign bank, and
any organization operating under section 25 or 25A of the Federal Reserve Act [12 U.S.C. 601 et seq., 611 et seq.].”
Pursuant to the Dodd-Frank Act, for certain federal consumer financial laws, the CFPB has primary enforcement
authority over the FCRA and its implementing regulations with respect to, among other entities, insured depository
institutions with over $10 billion in assets and any affiliates thereof. See 12 U.S.C. § 5515.
10
See 76 FR 79308 (December 21, 2011) implementing 12 CFR Part 1022.
11
See 12 CFR Part 222.
12
See footnote 7.
13
15 U.S.C. § 1681s–2(a)(7). But see 15 U.S.C. § 1681s–2(a)(7)(F).
9

2

later than 30 days after, furnishing the negative information to a consumer reporting agency. 14 A
financial institution is deemed to be in compliance with the notice requirement if it properly uses
the model forms in Appendix B to 12 CFR Part 1022.
Affiliate Marketing Notices (Sections 1022.20 - 1022.27)
The affiliate marketing notice requirements generally prohibit a person from using
information received from an affiliate to make a solicitation for marketing purposes to a
consumer, unless the consumer is given a notice; provided a reasonable opportunity and
reasonable and simple method to opt out of the use of the information; and the consumer does
not opt out. The notice must be provided either (1) by an affiliate that has or has previously had a
pre-existing business relationship with the consumer or (2) as part of a joint notice from two or
more members of an affiliated group of companies, provided that at least one of the affiliates on
the joint notice has or has previously had a pre-existing business relationship with the consumer.
Identity Theft Red Flags (Sections 222.90 - 222.91)
The identity theft red flags provisions require each financial institution or creditor that
offers or maintains one or more covered accounts to (1) create, and periodically update, a written
Identity Theft Prevention Program, which is approved by either its board of directors or an
appropriate committee of the board of directors, (2) involve the board of directors, an appropriate
committee thereof, or senior management in the oversight, development, implementation and
administration of the program, (3) train staff, as necessary, to effectively implement the program,
and (4) exercise appropriate and effective oversight of service provider arrangements.
In addition, the provisions require each credit and debit card issuer to establish policies
and procedures to assess the validity of a change of address notification before honoring a
request for an additional or replacement card received during at least the first 30 days after it
receives the notification. The issuer must also either notify the cardholder of the request in
writing, electronically, or orally, and provide a method of promptly reporting incorrect address
changes, or use another means of assessing the validity of the change of address.
Address Discrepancies (Section 1022.82)
The address discrepancies provisions require a user of consumer reports to develop
reasonable policies and procedures for when it receives a notice of address discrepancy from a
consumer reporting agency. The policies and procedures must be designed to enable the user to
form a reasonable belief that a consumer report relates to the consumer about whom it has
requested the report.
A user of consumer reports also must develop and implement reasonable policies and
procedures for furnishing an address for the consumer that the user has reasonably confirmed is
accurate to the consumer reporting agency from which it received the notice of address
discrepancy when the user (1) can form a reasonable belief that the consumer report relates to the
consumer about whom the user requested the report, (2) establishes a continuing relationship
14

15 U.S.C. § 1681s-2(a)(7).

3

with the consumer, and (3) regularly and in the ordinary course of business furnishes information
to the consumer reporting agency from which the notice of address discrepancy relating to the
consumer was obtained. These policies and procedures must provide that the user will furnish the
consumer’s address that the user has reasonably confirmed is accurate to the consumer reporting
agency as part of the information it regularly furnishes for the reporting period in which it
establishes a relationship with the consumer.
Risk-Based Pricing Notices to Consumers (Sections 1022.70 - 1022.75)
The risk-based pricing rule generally requires a creditor to provide a risk-based pricing
notice to a consumer if that creditor (1) uses a consumer report in connection with an application
for, or a grant, extension, or other provision of, credit to that consumer that is primarily for
personal, family, or household purposes and (2) based in whole or in part on the consumer
report, grants, extends, or otherwise provides credit to that consumer on material terms that are
materially less favorable than the most favorable terms available to a substantial proportion of
consumers from or through that creditor. The rule applies to use of a consumer report in an
account review that results in an increase in the annual percentage rate, unless the consumer is
given an adverse action notice. The risk-based pricing rule provides several alternative methods
that creditors may use to determine which consumers must be given a notice. In 2011, the risk based pricing notice requirements were amended pursuant to the Dodd-Frank Act to require
creditors to disclose credit scores and related information to consumers if a credit score is used in
setting material terms of credit.
In the alternative, creditors may provide a credit score disclosure to consumers who apply
for credit, whether or not those consumers receive materially less favorable credit terms. To ease
creditors’ burden and cost of complying with the notice and disclosure requirements, model
forms are available in Appendix H of the regulation.
Duties of Furnishers of Information (Sections 1022.40 - 1022.43)
Accuracy and integrity policies and procedures. Each entity that furnishes information to
a consumer reporting agency (furnisher) must establish and implement reasonable written
policies and procedures regarding the accuracy and integrity of the information relating to
consumers that it furnishes to a consumer reporting agency. A furnisher must also review these
policies and procedures periodically and update them, as necessary . The policies and procedures
must be appropriate to the nature, size, complexity, and scope of each furnisher’s activities. In
developing its policies and procedures, each furnisher must consider the guidelines in
Appendix E of 12 CFR Part 1022, and incorporate those guidelines, as appropriate.
Direct disputes. With some exceptions, if a consumer disputes the accuracy of certain
information in a consumer report directly with the furnisher, the furnisher must (1) conduct a
reasonable investigation with respect to the disputed information, (2) review all relevant
information provided by the consumer with the dispute notice, (3) complete its investigation of
the dispute and report the results of the investigation to the consumer before the expiration of the
period within which a consumer reporting agency would be required to complete its action if the
consumer had elected to dispute the information under that section, and (4) if the investigation

4

finds that the information reported was inaccurate, promptly notify each consumer reporting
agency to which the furnisher provided inaccurate information of that determination and provide
to the consumer reporting agency any correction to that information that is necessary to make the
information provided by the furnisher accurate.
A furnisher need not investigate a direct dispute if it has reasonably determined that the
dispute is frivolous or irrelevant. If the furnisher makes this determination, it must notify the
consumer of the determination not later than five business days after making the determination,
by mail or, if authorized by the consumer for that purpose, by any other means available to the
furnisher. A notice of determination that a dispute is frivolous or irrelevant must include th e
reasons for such determination and identify any information required to investigate the disputed
information, which notice may consist of a standardized form describing the general nature of
such information.
Respondent Panel
The FR V panel comprises all depository institutions identified in 15 U.S.C. §
1681s(b)(1)(A)(ii): (1) regardless of size, with respect to the identity theft red flags provisions of
the Board’s Regulation V and (2) with $10 billion or less in assets and any affiliates thereof, for
all other provisions.15
Time Schedule for Information Collection
The recordkeeping and disclosure requirements associated with the FR V are mandatory
and are triggered by certain events. Disclosures must be provided within prescribed times stated
in the regulations.
Public Availability of Data
There is no data related to this information collection available to the public.
Legal Status
The FR V is authorized by sections 1025 and 1088(a)(2) and (10) of the Dodd-Frank
Act. Under the FCRA, as amended by sections 1025 and 1088(a)(10) of the Dodd-Frank Act,
the Board is authorized to enforce compliance with the information collection requirements
contained in the CFPB’s FCRA regulations 16 applicable to institutions identified in 15 U.S.C. §
1681s(b)(1)(A)(ii) with $10 billion or less in assets, and applicable to consumers of these
institutions (15 U.S.C. § 1681s(b) and 12 U.S.C. § 5515). Additionally, pursuant to section
1088(a)(2) and (10) of the Dodd-Frank Act, the Board retained authority under the FCRA to
prescribe and enforce the information collection requirements in the Board’s FCRA regulations
relating to identity theft red flags 17 for institutions identified in 15 U.S.C. § 1681s(b)(1)(A)(ii)
15

See 12 U.S.C. § 5515 and footnote 7.
Appendix B to 12 CFR Part 1022; and 12 CFR §§ 1022.20 - 1022.27, 1022.40 - 1022.43, 1022.70 - 1022.75, and
1022.82.
17
12 CFR §§ 222.90 - 222.91.
16

5

of any size (15 U.S.C. §§ 1681m(e), and 1681s(b) and (e)). The obligation to comply with the
FR V is mandatory, except for the consumer opt-out responses, which consumers are required
to submit in order obtain a benefit.
The notices, records, and disclosures included in the FR V are not provided to the
Federal Reserve, but are maintained at Board-supervised institutions. As such, no issue of
confidentiality generally arises under the Freedom of Information Act (FOIA). In the event such
notices, records, or disclosures are obtained by the Board as part of an examination or
supervision of a financial institution, this information is considered confidential pursuant to
exemption 8 of the FOIA, which protects information contained in “examination, operating, or
condition reports” obtained in the bank supervisory process (5 U.S.C. § 552(b)(8)). In addition,
certain information (such as direct dispute notices regarding a consumer) may also be withheld
under exemption 6 of the FOIA, which protects from disclosure information that “would
constitute a clearly unwarranted invasion of personal privacy” (5 U.S.C. § 552(b)(6)).
Consultation Outside the Agency
There has been no consultation outside the agency.
Public Comments
On February 14, 2022, the Board published an initial notice in the Federal Register (87
FR 8246) requesting public comment for 60 days on the extension, without revision, of the
FR V. The comment period for this notice expired on April 15, 2022. The Board did not receive
any comments. The Board adopted the extension, without revision, of the FR V as originally
proposed. On July 25, 2022, the Board published a final notice in the Federal Register (87 FR
44115).
Estimate of Respondent Burden
As shown in the table below, the estimated total annual burden for the FR V is 411,127
hours. The 1,361 financial institution respondents are based on the Q2 2021 Consolidated
Reports of Condition and Income (Call Reports) (FFIEC 031, FFIEC 041, and FFIEC 051; OMB
No. 7100-0036), Schedule RC. The Consumer Opt-Out responses are based on memoranda items
from the Q2 2021 Call Reports schedule on deposits, assuming that 60 percent of the balance of
the deposit accounts of “individuals, partnerships, and corporations” belonged to individuals.
Using data from the 2019 Survey of Consumer Finances (FR 3059; OMB No. 7100-0287),
estimated average loan or account size by product type was determined, and the balances divided
from the Call Report by these averages to produce an estimated number of accounts for which
consumers may have received an opt‐out notice. It was then assumed that 10 percent of those
with accounts receiving such notices opted out. These recordkeeping and disclosure requirements
represent 5.9 percent of the Board’s total paperwork burden.

6

Estimated Estimated
Estimated
Estimated
number of
annual average hours annual burden
respondents18 frequency per response
hours

FR V
Disclosure
Section 1022 Appendix B
Negative information notice
Disclosure
Sections 1022.20 - 1022.27
Affiliate Marketing Notices:
Notices to consumers
Disclosure
Sections 1022.20 - 1022.27
Affiliate Marketing Notices:
Consumer opt-out response
Recordkeeping
Sections 222.90 - 222.91
Identity theft red flags
Recordkeeping
Section 1022.82
Address discrepancies
Disclosure
Sections 1022.70 - 1022.75
Risk-based pricing
notices to consumers
Recordkeeping
Sections 1022.40 - 1022.43
Duties of Furnishers of Information:
Policies and procedures
Disclosure
Sections 1022.40 - 1022.43
Duties of Furnishers of
Information:
Notices of frivolous disputes to
consumers

1,361

1

1,300

1

267,860

1

2,495

1

37

92,315

1,361

1

4

5,444

1,361

12

5

81,660

1,361

1

40

54,440

1,361

422

Total

0.25

18

0.08

0.23

340

23,400

21,429

132,099
411,127

The estimated total annual cost to financial institutions for the FR V is $23,557,244 while

18

Of the 1,361 financial institution respondents, 617 are considered small entities as defined by the Small Business
Administration (i.e., entities with less than $600 million in total assets), https://www.sba.gov/document/supporttable-size-standards. Of the 1,300 affiliate marketing notice to consumers respondents, 553 are considered small
entities as defined by the SBA. Of the 2,495 identify theft red flags respondents, 617 are considered small entities as
defined by the SBA. There are no special accommodations given to mitigate the burden on small inst itutions.

7

the estimated total annual cost to consumers is $600,012.19
Sensitive Questions
These collections of information contain no questions of a sensitive nature, as defined by
OMB guidelines.
Estimated Cost to the Federal Reserve System
The estimated cost to the Federal Reserve System for collecting and processing this
information collection is negligible.

19

Total cost to the public was estimated using the following formula: percent of staff time, multiplied by annual
burden hours, multiplied by hourly rates (30% Office & Administrative Support at $21, 45% Financial Managers at
$74, 15% Lawyers at $71, and 10% Chief Executives at $102). Hourly rates for each occupational group are the
(rounded) mean hourly wages from the Bureau of Labor Statistics (BLS), Occupational Employment and Wages,
May 2021, published March 31, 2022, https://www.bls.gov/news.release/ocwage.t01.htm. Occupations are defined
using the BLS Standard Occupational Classification System, https://www.bls.gov/soc/. The average consumer cost
of $28 is estimated using data from the BLS, Occupational Employment and Wages, May 2021, published March 31,
2022, https://www.bls.gov/news.release/ocwage.t01.htm.

8