HMDA, FCRA & FACTA
~12 min read · Cover LAR reporting purposes, adverse-action duties, and red-flag identity rules.
Three transparency statutes ride together: HMDA makes lending patterns public, FCRA governs the credit report that decides the file, and FACTA bolts on identity-theft defenses. The exam tests each law's core mechanism — the LAR, permissible purpose and adverse-action duties, and the Red Flags Rule.
HMDA and the LAR
The Home Mortgage Disclosure Act (Regulation C) requires covered lenders to collect and report application-level data on a Loan Application Register: application outcome, loan type and amount, property location, and applicant demographics (collected under the government-monitoring rules — the applicant may decline, and for in-person applications the MLO then records observations). Purpose: expose redlining and disparate lending patterns to regulators and the public. HMDA creates no underwriting rules — it is a reporting statute whose data fuels fair-lending enforcement.
- Reg C; data reported on the LAR, published annually
- Demographic data collected for monitoring — never for decisions
- The anti-redlining searchlight, not a decision rule
FCRA: the credit-report rulebook
The Fair Credit Reporting Act allows pulling a consumer report only with a permissible purpose (a credit application the consumer initiated is the MLO's). Users taking adverse action based even in part on a report must give a notice naming the consumer reporting agency, its contact information, and the consumer's rights to a free report copy and to dispute. Risk-based pricing rules add notices when report-driven terms are materially worse. Consumers get free annual reports from the bureaus and dispute-reinvestigation rights (generally 30 days).
- Permissible purpose required for every pull
- Adverse action from report data → FCRA notice naming the bureau
- Free annual reports; dispute + reinvestigation rights
FACTA's additions
FACTA amended FCRA with identity-theft armor: fraud alerts and credit freezes honored by users, truncation of card numbers on receipts, proper disposal of consumer information, and the Red Flags Rule — creditors run written identity-theft prevention programs that detect, respond to, and mitigate red flags (mismatched SSNs, altered documents, alerts on the report). An MLO seeing an active-duty or fraud alert must take reasonable steps to verify identity before proceeding.
Worked example
An applicant declines to state ethnicity on a face-to-face application. Her credit report shows a fraud alert and a 588 score; the lender declines the file citing the score. Walk the three statutes' demands.
HMDA: the MLO notes the declination and records ethnicity/race/sex by visual observation and surname as Reg C requires for in-person applications — the data goes to the LAR either way, and using it in the decision is forbidden. FCRA/FACTA: the fraud alert triggers the Red Flags program — verify identity through reasonable means (documents, callback numbers on the alert) before any further action. The decline: adverse action based on the report requires the FCRA notice — bureau name and contacts, free-copy right, dispute right — layered with ECOA's specific-reasons notice (insufficient credit score, with the score disclosure where required). Three statutes, three separate duties, one file.
Common exam pitfalls
Skipping monitoring data when the applicant declines.
In-person applications: the MLO records observed demographics anyway — that IS the Reg C rule.
Sending only an ECOA notice on a credit-driven decline.
Report-based adverse action needs the FCRA notice too: bureau identity, free report, dispute rights.
Treating a fraud alert as background noise.
Alerts trigger the Red Flags program — verify before proceeding, document the steps.
HMDA watches the lender, FCRA guards the report, FACTA hunts the thief.
Recap
- HMDA/Reg C: LAR reporting exposes lending patterns; data never drives decisions
- Demographics recorded by observation when declined in person
- FCRA: permissible purpose to pull; adverse-action notice names the bureau
- Free annual reports, disputes, ~30-day reinvestigations
- FACTA: fraud alerts, freezes, disposal, truncation, Red Flags programs
- Alerts demand identity verification before the file moves
VIDEO LESSON
Watch this lesson on video — free
Prove it: 10 questions on this topic
Every lesson ends with a ten-question check in the free course — your progress syncs between the web and the EstatePass app.
Studying for the NMLS SAFE MLO exam? Track every lesson free — progress syncs with the app.
Start freeMore in Federal Laws & Regulations
Study smarter in the free dashboard
- Every lesson tracked, synced with the iOS app
- Ten-question checks after each lesson
- Lesson videos, flashcards and mock exams
No credit card required.