Bank statement analysis is usually not a consumer report when a lender reviews statements the applicant handed over, because the FCRA definition covers communications made by a consumer reporting agency. It can become one when an outside company assembles or evaluates account data about a person and furnishes the result to lenders deciding on consumer credit.
When is bank statement analysis a consumer report under the FCRA?
Bank statement analysis is a consumer report only when three things line up: a consumer reporting agency makes the communication, the information bears on a person's credit standing or character, and it is used or expected to be used to decide eligibility for consumer credit, insurance, employment or another permitted purpose. Miss one, and the definition fails.
The wording sits in the FCRA definition of "consumer report" at 15 U.S.C. 1681a(d). It reaches any written, oral or other communication "by a consumer reporting agency" that bears on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living. The eligibility purposes listed are credit or insurance used mainly for personal, family or household purposes, employment, and the other purposes allowed under section 1681b.
A bank statement analysis easily meets the second part. Average deposits, overdraft counts, recurring payroll and debt payments all bear on credit capacity. That is the whole point of reading them. So the question almost always turns on the first part and the third: who produced the analysis, and what kind of credit it feeds.
Lenders tend to ask the question backwards. They look at the report and ask whether it looks like a credit report. The statute does not care how a document looks. A plain spreadsheet can be a consumer report if a consumer reporting agency sent it, and a polished twenty-page underwriting report is not one if the lender built it from its own file.
The consumer reporting agency test behind every consumer report
A consumer report exists only if a consumer reporting agency communicates it. Under the FCRA, that is a person who, for fees or on a cooperative nonprofit basis, regularly assembles or evaluates consumer credit information or other information on consumers in order to furnish consumer reports to third parties.
Read the agency definition in 15 U.S.C. 1681a(f) slowly, because each phrase does work:
- "For monetary fees, dues, or on a cooperative nonprofit basis." Someone is paid, or shares costs, to do the assembling.
- "Regularly engages." A one-off favor between two loan officers is not a business of reporting.
- "Assembling or evaluating." Collecting data counts. So does scoring or summarizing it.
- "For the purpose of furnishing consumer reports to third parties." The output goes to someone other than the company that made it.
That last element separates two kinds of software. A tool that a lender runs on its own files, where the lender sees the output and makes the call, keeps the information inside the lender. A service that gathers data about consumers and sells its conclusions to many lenders furnishes information to third parties, and that is the activity the definition was written for.
The FTC staff summarized decades of interpretation in its 40 Years of Experience with the Fair Credit Reporting Act staff report. One point from it matters here: where a company reports on people for both covered purposes and uncovered ones, such as purely commercial uses, the staff treats the report as a consumer report. The phrase "in whole or in part" in the definition stretches that far.
Why a lender's own statement review falls outside the consumer report definition
A lender's own review of bank statements the applicant supplied is not a consumer report, because no consumer reporting agency is involved. The lender received documents from the applicant, read them and decided. Information moved from the borrower to the creditor, not from a reporting agency to a user.
The statute also carves out reports "containing information solely as to transactions or experiences between the consumer and the person making the report." The FTC staff report gives examples: a creditor calling an account "slow pay" based on its own history with the customer is outside the definition. A bank describing how its own depositor has run an account is reporting its own experience.
That exclusion has a limit that catches lenders out. The staff report says a creditor's report of application information, such as an applicant's list of assets and liabilities, is not the creditor's own transaction or experience information, because it describes the customer's dealings with other companies. A borrower's statements from another bank are exactly that kind of material. Reading them for your own decision is fine. Passing your analysis of them to an unrelated lender is a different act, and the exclusion may not cover it.
This matters for brokers. A broker who analyzes a borrower's statements and sends the summary to the lender it is placing the loan with is part of one transaction the borrower started. A broker who builds a habit of selling statement summaries to many lenders for a fee starts to look like the business the agency definition describes.
Data handling duties still apply when the FCRA does not. A lender holding months of a borrower's statements is holding nonpublic personal information, and the FTC Safeguards Rule duties for lenders and brokers cover how it must be stored, accessed and disposed of. The FCRA question and the security question are separate.
When does a vendor's bank statement report become a consumer report?
A vendor's bank statement report becomes a consumer report when the vendor itself works as a consumer reporting agency: it assembles or evaluates information about individuals, regularly, for a fee, to give to lenders who use it for consumer credit decisions. A vendor that only supplies a tool the lender operates usually does not.
The facts that push a vendor toward agency status are practical ones:
- The vendor holds the data across clients. If information gathered for one lender is kept and reused to answer another lender's request about the same person, the vendor is assembling information on consumers for third parties.
- The vendor supplies data the lender did not have. Pulling account records from a source other than the applicant's own upload, then evaluating them, looks like gathering rather than processing.
- The vendor issues a judgment. A score, a pass or fail, or a risk grade that the vendor designs and the lender relies on is "evaluating" consumer information.
- The vendor markets the output as a report on the person. Selling a product as a view of an applicant's creditworthiness invites the reading that it is one.
The opposite facts point the other way. The lender uploads the statements. The software organizes them into totals and flags. The lender's underwriter applies the lender's own criteria. The vendor does not keep the analysis for anyone else.
TrueBankFlow is built on that second pattern. Its homepage FAQ says the analysis "is not a credit decision, a consumer report or lending advice," and that it organizes and summarizes what is in the statements so the underwriter can review it. Whether a given vendor arrangement falls inside the FCRA still depends on its facts, so lenders should put the question to counsel when they sign a vendor contract.
A vendor's privacy terms are part of the same review. Lenders that share statement data with a service provider should check that their GLBA privacy notice describes that sharing accurately.
Business loans, guarantors and the consumer report question
For business credit, the consumer report question splits in two. A report about a company is not a consumer report, because a company is not a consumer. A report from a consumer reporting agency about an individual owner can still be a consumer report, even when the lender uses it to decide on a business loan.
The FTC staff report sets out both halves. Reports about corporations and other collective entities are not reports about a consumer. A report on a person's business history, collected by a commercial reporting service solely for business transactions, is not a consumer report either. But a consumer reporting agency's report on an individual's personal credit stays a consumer report "regardless of the purpose for which the information may in fact be used."
Permissible purpose follows the same line. Under 15 U.S.C. 1681b(a)(3)(A), an agency may furnish a report to someone who intends to use it in connection with a credit transaction "involving the consumer." The FTC staff reads that to cover an owner who will be personally liable as a co-signer or guarantor. It does not cover an owner, shareholder or officer who will not be personally liable.
For a business lender reading company account statements, this means:
- Statements of the business account, reviewed by the lender, are about the entity. That review is not an FCRA event.
- Personal statements of a guarantor, uploaded by the guarantor, are still the lender's own review of applicant-supplied documents.
- A consumer reporting agency's product about the guarantor is a consumer report, so the lender needs a permissible purpose and must follow the user duties.
The guide to bank statements for a business loan application covers which accounts and months a lender usually asks for. That choice decides whose data the lender ends up holding.
Consumer report missteps in bank statement workflows
Most consumer report problems in statement review come from treating the FCRA as a label instead of a test. A lender assumes software output can never be a consumer report, or that any third-party output always is, and builds a process on the wrong assumption.
The table below sorts six common situations. They are examples to show how the definition works, not legal conclusions for any specific file.
| Situation (example) | Likely consumer report? | Main reason |
|---|---|---|
| Underwriter reads uploaded statements by hand | No | No consumer reporting agency involved |
| Lender runs analysis software on its own uploads; vendor keeps nothing for others | Usually no | The lender evaluates; the vendor does not furnish reports to third parties |
| Vendor scores applicants from account data and sells the score to many lenders | Likely yes | Regular evaluation of consumer information for third parties, for a fee |
| Broker sends its statement summary to the lender funding that loan | Usually no | One transaction the borrower started, no reporting business |
| Lender sells its statement summaries about applicants to other lenders | May be yes | Goes beyond the lender's own transactions with the consumer |
| Business lender reviews only the company's account | No | Reports about entities are not about a consumer |
A few habits cause trouble often enough to name:
- Reusing an analysis across lenders. A broker or vendor that answers a second lender's request with a file built for the first is assembling information for third parties.
- Letting the vendor decide. If the vendor's pass or fail drives the decision, the lender may be using a consumer report without the notices that come with one.
- Writing the decline as if no report was used. If a consumer report did shape a consumer credit decision, the notice carries extra FCRA content, which the guide to adverse action notices for cash flow declines walks through.
- Assuming business credit means no FCRA. A personal report on a guarantor is still a consumer report.
Lenders that want a summary they control can review statements in TrueBankFlow, where every total links back to the statement lines behind it, so the underwriter makes the call from the lender's own file.