The Fair Credit Reporting Act (FCRA), codified at 15 U.S.C. § 1681 et seq., governs how consumer reporting agencies (CRAs) collect, use, and share credit information — giving consumers the right to access, dispute, and correct their credit files, and imposing requirements on lenders who use credit reports to make decisions.
Enacted in 1970 and significantly amended by the Consumer Credit Protection Act, the Fair and Accurate Credit Transactions Act (FACTA, 2003), and the Dodd-Frank Act (2010), the FCRA (15 U.S.C. §§ 1681–1681x; full text at ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act) is jointly enforced by the Consumer Financial Protection Bureau (CFPB, cfpb.gov) and the Federal Trade Commission (FTC, ftc.gov/credit). Key FCRA rights and obligations: (1) Free annual credit reports — consumers are entitled to one free report per year from each major CRA (Equifax, Experian, TransUnion) through AnnualCreditReport.com (the only FTC-authorized source). (2) Right to dispute — consumers may dispute inaccurate or incomplete information; CRAs must investigate within 30 days (15 U.S.C. § 1681i). (3) Adverse action notices — when a lender denies credit, increases cost, or takes other adverse action based on a credit report, it must provide the consumer with a notice identifying the CRA used and the consumer's right to a free report (15 U.S.C. § 1681m). (4) Permissible purpose — credit reports may only be pulled for specific permissible purposes: credit applications, employment screening (with written consent), insurance underwriting, account review, and a few others (15 U.S.C. § 1681b). Unauthorized pulls are FCRA violations. (5) Retention limits — most negative information must be removed after 7 years; Chapter 7 bankruptcy after 10 years (15 U.S.C. § 1681c). For business borrowers: personal credit is often pulled for small business applications (especially for loans under $250K), making FCRA directly relevant. When a lender pulls your personal credit and declines your application, FCRA requires an adverse action notice. The CFPB's FCRA model forms and consumer guidance are available at cfpb.gov/consumer-tools/credit-reports-and-scores/. Business credit reports (Dun & Bradstreet, Experian Business, Equifax Business) are not covered by FCRA — that is governed by commercial credit agreements and contract law.
For a business loan application, a lender generally has 'permissible purpose' under FCRA (15 U.S.C. § 1681b) to pull the personal credit of business owners, particularly as guarantors. However, for pre-qualification or marketing purposes, lenders typically use soft pulls that don't require formal written consent and don't affect your score. You should always be told what type of pull is being run. If you receive an adverse action notice, the CFPB's guide at cfpb.gov/consumer-tools/credit-reports-and-scores/ explains your rights.
Under 15 U.S.C. § 1681c: most negative items (late payments, collections, charge-offs, repossessions, Chapter 13 bankruptcy) must be removed after 7 years. Chapter 7 bankruptcy remains for 10 years. Tax liens filed after April 2018 no longer appear on consumer credit reports (major CRAs voluntarily removed them). Accurate negative information cannot be removed before its legal expiration — services that claim otherwise are engaging in credit repair fraud. See annualcreditreport.com to check your reports.
No. FCRA applies to consumer credit reports — reports on natural persons. Business credit reports (Dun & Bradstreet PAYDEX, Experian Intelliscore, Equifax Business Credit) are not governed by FCRA. They are subject to contract law and commercial credit agreement terms. This means businesses have no statutory right to dispute business credit report entries under FCRA — though each bureau has its own dispute process. The CFPB has taken the position that FCRA applies when a consumer's personal data appears in what is nominally a business report (cfpb.gov/compliance/).