FCRA

The Fair Credit Reporting Act (FCRA) is a US federal law that governs how consumer credit information is collected, used, and shared, and it requires that credit decisions be accurate and explainable to the consumer.

The FCRA sets rules for credit reporting agencies and for the businesses that use their reports, including banks and lenders. It requires that the information used to make a credit decision be as accurate as reasonably possible, gives consumers the right to see what is in their file, and lets them dispute anything that is wrong. When a lender takes an adverse action, such as denying a loan or raising an interest rate based on a credit report, the FCRA requires the lender to send the consumer an adverse action notice explaining the basis for that decision.

These requirements were written for a world of manual underwriting and rule based scoring, but they do not soften when a bank replaces that process with a machine learning model or an AI system. If an algorithm scores a consumer's creditworthiness, the same accuracy and explainability obligations apply to whatever data and logic produced that score. A lender still has to answer the question of why a consumer was denied, and increasingly, where the data behind that decision actually came from.

That second question is where many institutions struggle. A credit model can pull inputs from dozens of internal and external systems, and the path from raw data to a model's output is rarely documented well enough to reconstruct on demand. Lineage back to the original source of every input, along with a record of any transformation applied along the way, gives a compliance team the evidence needed to support an adverse action notice and to demonstrate that the data behind a decision was accurate at the time it was used.

How FCRA relates to fair lending, explainability, and data provenance

FCRA is often discussed alongside fair lending law, but the two address different things. FCRA focuses on the accuracy of the data used in a credit decision and the consumer's right to an explanation. Fair lending focuses on whether the outcome of that decision is discriminatory. AI explainability is the general capability that lets an institution answer the "why" behind a decision, whatever technology produced it. Data provenance is the record keeping that supports both: it documents where a specific input came from and what happened to it before it reached the decision.

What FCRA Compliance Actually Requires

For a compliance leader, an FCRA dispute or a regulatory exam is not the time to discover that nobody can trace a data field back to its source. Reading the actual code, queries, and pipelines that move and transform data, through source code analysis rather than manually maintained documentation, makes it possible to show exactly which systems, tables, and transformations fed a specific credit decision, turning "we believe the data was accurate" into a documented, verifiable answer a compliance team can hand to an examiner or use to resolve a consumer dispute quickly.

Related glossary terms

• Fair Lending / Algorithmic Accountability
• AI Explainability
• Data Provenance
• Model Risk Management

Frequently asked questions

Does FCRA apply if a bank uses an AI model instead of a traditional credit score?

Yes. FCRA applies to the credit decision and the data behind it, not to the specific method used to produce it. If an AI model factors into a decision to deny credit, raise a rate, or take another adverse action, the same requirements apply: the underlying data must be accurate, and the consumer is entitled to an explanation. Institutions that cannot trace a model's inputs back to their source have a harder time meeting that obligation.

What counts as evidence that credit data was accurate under FCRA?

There is no single required format, but documentation showing where a data element originated, how it moved through internal systems, and whether it was transformed before reaching the credit decision is generally strong evidence. Lineage records that connect a specific data point in an adverse action notice back to its source system let a compliance team respond to disputes and exams with a verifiable answer rather than an assumption.

What does FCRA require for tracing a credit decision back to its data?

FCRA does not prescribe a specific technology, but it does require a business to be able to explain and correct the data behind a credit decision within statutory timeframes. In practice that means an organization needs documented visibility into which systems, tables, and transformations produced a given data point, not just a final score, so a dispute or exam request can be answered with a verifiable record rather than a best effort reconstruction.