[.green-span]What Is Permissible Purpose Under FCRA? A Guide for Lenders[.green-span]
Permissible purpose under FCRA is the federal rule that a consumer report may be furnished or obtained only for a reason listed in Section 604 (15 U.S.C. § 1681b). The list is closed, so pulling a report for any unlisted reason violates federal law. Users must also certify their purpose to the consumer reporting agency (CRA) that supplies the report.
This guide covers the full Section 604(a) list, the user-side rules, and how prescreening, employment checks, guarantors, soft pulls, and account reviews fit in. It also lays out a five-step framework that risk and compliance teams can use to document permissible purpose for every pull. Everything here describes federal law as of November 2026, and state laws can add limits, so consult counsel before you change your credit-pull policies.
What Permissible Purpose Under FCRA Means for Lenders and Platforms
Section 604 sets rules on both sides of every credit pull. The CRA may furnish a report only for a listed purpose, and the requester may obtain and use it only for a listed purpose.
The CRA Rule and the User Rule Work Together
Section 604(a) lets a CRA furnish a report "under the following circumstances and no other," which makes the list exhaustive (15 U.S.C. § 1681b). Section 604(f) places the matching duty on users. A person may not use or obtain a consumer report unless the purpose is permitted and certified by the prospective user.
That certification runs through Section 607 (15 U.S.C. § 1681e). CRAs must require prospective users to identify themselves, certify their purposes, and certify that they will use the information for no other purpose. Section 607(e) also requires resellers to disclose each end user and permissible purpose to the originating CRA. Platforms that pass credit data between parties should confirm their role with counsel.
The Full List of Permissible Purposes in Section 604(a)
The statute allows a CRA to furnish a consumer report only in these circumstances (15 U.S.C. § 1681b(a)):
- In response to a court order, a federal grand jury subpoena, or a subpoena issued under 31 U.S.C. 5318 or 18 U.S.C. 3486.
- In accordance with the written instructions of the consumer to whom the report relates.
- For a credit transaction involving the consumer, including extending credit to that consumer or reviewing or collecting their account.
- For employment purposes, subject to the added steps in Section 604(b).
- For underwriting insurance involving the consumer.
- For eligibility for a government license or benefit that by law must consider financial responsibility or status.
- For a potential investor, servicer, or current insurer assessing the credit or prepayment risk of an existing credit obligation.
- For a legitimate business need tied to a business transaction initiated by the consumer.
- For a legitimate business need to review whether the consumer still meets the terms of an account.
- For certain government travel charge card programs.
- For specified child support enforcement purposes.
- For the FDIC or NCUA acting as conservator, receiver, or liquidating agent.
Only the subpoenas named in the statute qualify, so a generic subpoena does not create a permissible purpose. The "legitimate business need" purpose is also narrow, because it requires either a consumer-initiated transaction or a review of an existing account.
Each Permissible Purpose Applies to One Specific Consumer
The credit-transaction purpose covers the consumer "on whom the information is to be furnished," so the purpose attaches to a specific person. In July 2022, the CFPB issued an advisory opinion (87 FR 41243) stating that these purposes were "consumer specific." That opinion cited a 2018 CFPB consent order against State Farm Bank, where agents obtained reports on consumers who were not seeking credit. In some instances, agents initiated applications for the wrong consumer.
The CFPB withdrew that opinion on May 12, 2025, along with a separate November 10, 2021 opinion on name-only matching (90 FR 20084). The Bureau said it would not enforce or rely on either opinion during its review. Its withdrawn guidance page still listed both as withdrawn as of July 2026, but withdrawing guidance does not change the statute or private liability.
Applying the statute's consumer-specific wording, the credit-transaction purpose covers "the consumer on whom the information is to be furnished" (15 U.S.C. § 1681b). A spouse or co-applicant who applies jointly is covered.
For a non-applicant spouse, FTC staff have said a permissible purpose can exist in limited cases (FTC 2011 staff report, comment 604(a)(3)(A)-2). These include cases where the spouse will use or be liable on the account, or where the applicant relies on the spouse's income. They also include state community property or necessaries rules, and an applicant acting as the spouse's agent.
Where Regulation B bars the creditor from requesting information on the spouse, no permissible purpose exists. This is informal, non-binding staff guidance, so consult counsel.
Prescreening Requires a Firm Offer of Credit
Section 604(c) lets a CRA furnish reports for credit or insurance transactions that the consumer did not initiate (15 U.S.C. § 1681b(c)). Without the consumer's authorization, the transaction must be a firm offer of credit or insurance. The CRA must also have run the subsection (e) opt-out process. No opt-out can be in effect for the consumer, and added limits apply to consumers under 21.
The prescreen user receives only limited data. It covers name and address, a non-unique identifier used solely to verify identity, and information that does not reveal the consumer's history with a particular creditor.
Since March 2026, a new Section 604(c)(4) has limited "trigger leads" tied to residential mortgage requests. The law became Public Law 119-36 on September 5, 2025 (Congress.gov, H.R. 2808), and it took effect in March 2026. The amendment notes show the provision took effect 180 days after enactment (15 U.S.C. § 1681b).
Under that limit, a CRA may furnish a prescreened report based on a mortgage-related request only for a firm offer. The recipient must also have the consumer's authorization, originate or service their current mortgage, or be a depository institution or credit union holding their account. This limit applies to residential mortgage transactions and does not extend to other prescreening.
Employment Checks Require Disclosure and Authorization
Employment is a listed purpose, but Section 604(b) adds steps that credit transactions do not require (15 U.S.C. § 1681b(b)). The employer must give a clear and conspicuous written disclosure in a stand-alone document. The consumer must then authorize the report in writing.
Before taking adverse action based on the report, the employer must give the consumer a copy of it and a written summary of their rights. Separate rules cover certain transportation workers, national security investigations, and medical information.
Commercial Credit and Personal Guarantors
Reports on businesses as such are generally outside FCRA. A July 2000 FTC staff letter said reports from commercial services such as Dun & Bradstreet "are not covered by the FCRA."
A report on an individual can still be a consumer report when the loan is for a business. The 2000 letter found no permissible purpose for a business loan guarantor without written consent, according to the FDIC. A June 22, 2001 FTC staff letter, also noted by the FDIC, then treated personal liability for a business debt as a transaction "involving the consumer."
FTC staff later adopted both letters in its 2011 staff report, and these informal staff opinions are not binding on the Commission. For SMB lenders, a permissible purpose can exist for sole proprietors, co-signers, and guarantors where the individual is personally liable.
The federal banking agencies generally agreed with FTC staff that a lender has no permissible purpose for a principal not personally liable for the business debt (FDIC). This position is also informal and non-binding, so consult counsel. Separately, a consumer's written instructions are a listed purpose under Section 604(a)(2) (15 U.S.C. § 1681b).
Soft Pulls and Hard Pulls Follow the Same Rule
FCRA does not distinguish between hard and soft inquiries, as Shipkevich PLLC notes. Section 604(f) bars obtaining "a consumer report for any purpose" without a permissible purpose, so the duty follows the report rather than the inquiry label. Whether a soft-pull product delivers a consumer report depends on the data it returns.
Account Review and Ongoing Monitoring
Account review appears twice in Section 604. Section 604(a)(3)(A) covers the "review or collection of an account," and Section 604(a)(3)(F)(ii) covers checking whether the consumer still meets the account terms. Lenders can rely on these purposes for existing accounts, and they should record which account each review relates to.
FTC staff limit the review purpose to an existing account relationship where the report is used solely to decide whether to modify the account terms (FTC 2011 staff report). Staff said it does not cover marketing, and it ends once an account is paid off and closed.
Penalties for Pulling Without a Permissible Purpose
FCRA sets civil and criminal exposure at different thresholds, and each one depends on intent:
- Willful violations (Section 616). Consumers may recover actual damages or $100 to $1,000 in statutory damages, plus punitive damages and, in a successful action, costs and attorney's fees (15 U.S.C. § 1681n).
- Knowing pulls by individuals (Section 616). A natural person who knowingly pulls without a permissible purpose owes actual damages or $1,000, whichever is greater.
- Liability to the CRA (Section 616(b)). False-pretenses or knowing pulls also create liability to the CRA for actual damages or $1,000, whichever is greater.
- Negligent violations (Section 617). Consumers can recover actual damages plus, in a successful action, costs and reasonable attorney's fees (15 U.S.C. § 1681o).
- Criminal liability (Section 619). Knowingly and willfully obtaining information under false pretenses carries a fine, up to 2 years in prison, or both (15 U.S.C. § 1681q).
Ordinary negligent errors do not meet the criminal standard. Section 619 requires knowing and willful conduct as well as false pretenses.
Build Consent Into the Embedded Lending Flow
In embedded lending, the borrower applies inside a SaaS product or marketplace. That means consent capture and pull logging need to live in the application flow itself. Lendflow Connect links brands to 75+ specialty and bank lenders through widgets, landing pages, and APIs. Its consent flows are configurable, so teams can match them to their regulatory and UX requirements.
Your compliance team and counsel still own the policy, and the platform gives you a place to apply it at the point of application. For more on how embedded financing launches work, see Lendflow's guide to embedding finance for SaaS and brokers.
A Five-Step Framework to Document Permissible Purpose for Every Pull
The steps below turn the statute into controls that hold up in an audit. Each step produces a record, so you can show the purpose behind any single pull on request.
Step 1: Tie Every Pull Type to a Section 604 Purpose
Inventory every point where your systems request a consumer report, including applications, prescreen campaigns, account reviews, and guarantor checks. Assign each pull type its Section 604 subsection, such as 604(a)(3)(A) for credit applications or 604(a)(3)(F)(ii) for account reviews.
Pause any pull type you cannot map to a listed purpose until counsel reviews it. The mapping also shows which pulls need extra steps, such as employment disclosures or prescreen opt-out checks.
Step 2: Capture Consent and Instructions in the Application Flow
When a pull relies on the consumer's written instructions or a consumer-initiated transaction, record that evidence when the borrower acts. Store the consent language shown, the timestamp, the applicant's identity, and the version of the flow they completed.
For SMB financing, capture each guarantor's or co-applicant's consent and personal liability separately. One owner's consent covers that owner, so a second principal needs their own record.
Step 3: Match the Report to the Right Consumer
The 2018 State Farm Bank order in the CFPB's 2022 opinion involved pulls on people not seeking credit, in some instances the wrong consumer (CFPB advisory opinion). Require enough identifying fields before you submit a request, and stop staff from picking a consumer from a search list without verification.
Flag any request where the identity data on the application and the pull request do not match. Review those cases before anyone uses the report in a decision.
Step 4: Log the Purpose, Certification, and Evidence for Each Pull
Each pull record should show the Section 604 purpose, the Section 607 certification, the requesting user, and the application or account ID. Link the record to the consent evidence. If you pass data to lenders or partners, log which end user received the report and why. Section 607(e) requires resellers to disclose both.
Keep these logs in a system your compliance team can search by consumer, user, and date. That way you can answer a consumer dispute or examiner request with one record instead of a manual search.
Step 5: Restrict Access and Audit Pulls on a Schedule
Limit report access to the roles that need it for the certified purpose, and block reuse for other purposes such as marketing. Run periodic audits that sample pulls and confirm each one has a mapped purpose and supporting evidence.
Trace every exception to its root cause, such as a flow that skipped consent or a pull made without an application. Fix the control, retrain the team, and confirm in the next audit that the exception rate has dropped.
Best Practices to Keep Every Credit Pull Defensible
Strong permissible purpose programs pair clear policy with system-level enforcement. These practices close the gaps that most often cause problems.
- Write policy at the subsection level. Name the exact Section 604 subsection for each pull type, since vague labels like "business need" invite misuse.
- Treat soft pulls like any other consumer report. Apply the same purpose mapping and logging, because FCRA does not carve out soft inquiries.
- Separate business reports from consumer reports. Commercial bureau reports on an entity are generally outside FCRA, while reports on guarantors can be consumer reports.
- Confirm personal liability before pulling on principals. Document the guarantee first, and get written instructions from principals who are not personally liable.
- Recheck mortgage prescreen programs. Confirm that mortgage-related prescreen data you receive meets the Section 604(c)(4) conditions in effect since March 2026.
- Cite the statute instead of withdrawn guidance. Describe the CFPB's 2022 opinion as withdrawn guidance in your policies, and anchor each rule in Section 604.
- Add state law to your review. This article covers federal law only, and state rules can add further limits.
A common pitfall is reusing a report pulled for one purpose, such as an application, for another purpose, such as cross-selling. The Section 607 certification promises the information will be used for no other purpose, so any reuse needs its own permissible purpose.
Conclusion: Treat Permissible Purpose as a Control on Every Pull
Permissible purpose under FCRA limits consumer reports to the closed list in Section 604, and it applies to each consumer on each pull. Teams that map every pull type, capture consent in the flow, and log purpose and certification can defend any single report.
The statute still governs after the CFPB withdrew its 2022 opinion in May 2025. This article reflects federal law as of November 2026, and informal FTC staff opinions are not binding. Consult counsel before you set or change your credit-pull policies.
Frequently Asked Questions About FCRA Permissible Purpose
Is a Soft Pull Exempt From Permissible Purpose Requirements?
The statute does not create a soft-pull exemption. Section 604(f) bars obtaining a consumer report without a permissible purpose, so the real question is whether the soft-pull product returns a consumer report.
Can a Lender Pull a Personal Report on a Business Loan Guarantor?
A June 2001 FTC staff letter said a permissible purpose can exist under Section 604(a)(3)(A) when the individual accepted personal liability for the business debt. FTC staff letters are informal and not binding, so confirm your approach with counsel.
Can a Lender Check a Spouse's Credit on a Joint Application?
A spouse who applies jointly fits the credit-transaction purpose in 15 U.S.C. § 1681b. For a non-applicant spouse, FTC staff have said a permissible purpose can exist in limited cases (FTC 2011 staff report).
Those cases include a spouse who will use or be liable on the account, an applicant who relies on the spouse's income, or applicable community property or necessaries law. They also include an applicant acting as the spouse's agent, while no permissible purpose exists where Regulation B bars the request. This staff guidance is informal and non-binding, so consult counsel.
Is the CFPB's 2022 Permissible Purpose Advisory Opinion Still in Effect?
The CFPB withdrew the July 2022 opinion on May 12, 2025, and said it would not enforce or rely on it during its review (90 FR 20084). The Bureau noted the withdrawal is not necessarily final, and the underlying statute did not change.
What Are the Penalties for Pulling Credit Without a Permissible Purpose?
Willful violations allow actual damages or $100 to $1,000 in statutory damages, plus punitive damages and, in a successful action, costs and attorney's fees. Negligent violations allow actual damages plus, in a successful action, costs and reasonable attorney's fees (15 U.S.C. § 1681o). Knowing and willful access under false pretenses is a crime that carries a fine, up to 2 years in prison, or both.
