Specifications

End-User Credentialing

Before an account can pull a single report, the agency has to know who it is and what it’s for.

What it ensures

The FCRA pushes permissible-purpose discipline upstream to the agency: it must maintain procedures to limit furnishing to lawful purposes and to vet the users it credentials. This control holds an account inactive until the user is identified and certifies its permissible purposes.

It ensures access to consumer reports is granted deliberately, not by default at signup.

Watch it run

A prospective end-user asks to open an account that can pull consumer reports.

Illustrative run — one case moving through the End-User Credentialing specification.

Pending activation Credentialed Active Rejected
Permitted transition Forbidden move Start Terminal state
Before an end-user can pull reports, the agency must verify who they are and bind them to permissible purposes by certification. Activating the account before that is in red.
✕ refused 1 ✓ Request 2 ✓ Certified 3 ✓ Activated
Ready

A prospective end-user asks to open an account that can pull consumer reports.

  1. Ready

    The request

    A new client wants access. Access to consumer reports is access to people’s lives.

  2. Blocked

    The shortcut

    Turning the account on quickly is good for sales and bad for the law. Activation is held until the user is identified and certifies its permissible purposes.

    Where it comes from

    The FCRA pushes permissible-purpose discipline upstream to the agency: it must maintain procedures to limit furnishing to lawful purposes and to vet who it lets in.

    What it satisfies

    Holding activation until the user identifies itself and certifies its purposes — and the agency verifies both — is exactly what §1681e(a) requires.

    FCRA §1681e(a) Statute 15 U.S.C. § 1681e(a) Every consumer reporting agency shall maintain reasonable procedures designed to avoid violations of section 1681c of this title and to limit the furnishing of consumer reports to the purposes listed under section 1681b of this title. These procedures shall require that prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose. … Every consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report. U.S. Code · Cornell LII ↗
  3. Permitted

    Certified

    The client states its permissible purposes, attests it will use reports for no other, and the agency verifies it.

  4. Permitted

    Activated

    Now the account can pull, within the purposes it certified.

  5. On the record

    The proof

    The file shows who was let in, and on what certified basis.

Why it holds

Why the whole holds

No single login makes access lawful. It holds because an account cannot pull until its purposes are certified and its identity verified. Reliability isn’t trust in the client; it’s that an uncredentialed account has no path to a report.

Why it matters

An agency that furnishes reports to inadequately vetted users is exposed under §1681e(a); credentialing is the gate that keeps impermissible use from starting at the source.