What Is a Consumer Reporting Agency? A Comprehensive Analytical Treatment

Introduction

The Fair Credit Reporting Act (FCRA) locates most of its consumer protections at the intersection of two concepts: 

• the consumer report and 
• the consumer reporting agency. 

These terms do not operate independently. A consumer report is defined by whether it is furnished by a consumer reporting agency, and a consumer reporting agency is defined by whether it furnishes consumer reports. This circularity is structurally significant: it ensures the analysis focuses on how information actually flows through the marketplace rather than on labels chosen by the industry. Because each term relies on the other, an entity cannot escape the Act simply by declaring that it is “not a consumer reporting agency.” Such a declaration is analytically meaningless without examining how the entity handles information and how that information is used. A definition that incorporates use and function necessarily prevents self-exemption.

The Statutory Framework

A consumer reporting agency is defined in 15 U.S.C. §1681a(f) as any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages—whether wholly or partially—in assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and uses interstate commerce to do so.

Congress drafted this definition with a wide aperture. “Person” encompasses individuals, corporations, partnerships, nonprofit cooperatives, and even government bodies. Early legislative proposals would have excluded nonprofit loan cooperatives, but Congress rejected those attempts to ensure the Act could not be circumvented through corporate form.

Regular Engagement in Consumer Information Activities

Regular engagement under the FCRA refers to activity that forms part of an entity’s ordinary and recurring operations rather than something incidental or sporadic. The FTC has indicated that a single or isolated instance of furnishing consumer information is insufficient, and courts interpreting analogous consumer statutes offer further clarity. Under the FDCPA, conduct is deemed “regular” when it reflects a customary and sustained pattern rather than occasional behavior. The Truth in Lending Act provides an even clearer benchmark: a business “regularly” extends credit if it does so more than twenty-five times per year. While the FCRA contains no numeric threshold of its own, this TILA standard offers a meaningful analogue, illustrating that activity crossing from isolated to recurrent—and occurring more than a minimal number of times annually—qualifies as regular engagement. 

Assembling and Evaluating Information

• Assembling

The 2011 FTC Staff Summary defines assembling as gathering, collecting, or bringing together consumer information, regardless of its source. Some CRAs seeking to avoid the FCRA have argued that assembling requires combining multiple pieces of data. The statutory language provides no support for this. “Bringing together” is a functional description of preparing information—whether one item or several—for communication. Extracting a single record from a broader dataset and preparing it for delivery is assembling. The inquiry concerns transformation, not volume.

• Evaluating

Evaluating information means appraising, assessing, determining, or exercising judgment. When a vendor searches public records using identifiers supplied by a CRA and decides which record belongs to the consumer, evaluation is occurring. Attempts to characterize such matching as “purely mechanical” ignore the reality that every act of selecting a record associated with a particular name, date of birth, or other identifier reflects a judgment about identity.

This remains true even when the vendor relies on the court clerk to perform the initial match. If the vendor provides identifiers to a clerk, receives purportedly corresponding records, and then conveys those records to a CRA or background screening company, the vendor is implicitly adopting the clerk’s determination as correct. By transmitting the information as responsive to the inquiry, the vendor is representing that the record matches the consumer. That assumption is itself evaluative: it affirms that the clerk's match is valid, that the record pertains to the subject of the inquiry, and that the information can properly be included in a consumer report. The vendor is not acting as a neutral courier; it is exercising judgment by crediting the clerk’s assessment and converting it into a determination for downstream reporting. Evaluation often exists beneath the surface of business models that portray themselves as passive or automated, but matching—even through reliance on another actor’s selection—remains a form of evaluative processing under the FCRA.

Together, assembling and evaluating expose the ambiguities surrounding the “mere conduit” doctrine.

The “Mere Conduit” Problem

Few areas of CRA jurisprudence reveal more conceptual strain than the so-called “mere conduit” problem. Courts have split on when an entity ceases to be a courier and becomes an assembler of information.

Several courts have held that mere reception and retransmission of information does not constitute assembling. These cases involve entities that do nothing more than pass along information exactly as received—without opening, reviewing, sorting, formatting, selecting, or interpreting it. Classic examples include individuals who physically carry sealed medical records or entities that place laboratory reports into an envelope and send them onward without any engagement with their content. In such circumstances, the entity is truly acting as a courier, not a data processor.

Other courts have taken a more realistic view of how information is handled. These courts have held that entities collecting public records from sheriff’s departments, police agencies, or courthouses—and then formatting those records into an output document or report—are engaged in assembling. Choosing which records to extract, identifying which belong to the subject, organizing the information, or placing it into a structured format all constitute assembling under the FCRA. Even the simplest act of structuring raw data into a report involves decisions about what to include and how to present it.

These outcomes appear inconsistent but can be harmonized. 

This distinction captures the essential principle: Transmission is not assembly. Transformation, Formulation, or Organization is.

Under this framework, many vendors supplying public records to CRAs do far more than passively relay information. They collect, interpret, and structure data—precisely the activities Congress intended to regulate.

Vendors, Disclaimers, and Actual Purpose

Vendors frequently add disclaimers asserting their information is “not for FCRA purposes.” Because of the circular structure of the definitions, such disclaimers have no legal effect. Whether information is a consumer report depends on its use, and whether an entity is a CRA depends on whether it furnishes consumer reports. No entity can exempt itself by proclamation. The inquiry requires determining how the information will be used and whether it enters an eligibility-based decision making stream governed by §1681b.

The FTC has repeatedly made clear that disclaimers are irrelevant when data is used—or reasonably expected to be used—for employment, housing, credit, insurance, or similar decisions. Vendors providing criminal records, eviction filings, licensing information, or comparable data to CRAs understand that their data enters the consumer-reporting pipeline. A lack of meaningful procedures to prevent this use reinforces CRA status.

The Purpose Requirement and Its Structural Implications

The definition of a CRA requires assembling or evaluating to occur “for the purpose of furnishing consumer reports to third parties.” Some courts have read this phrase to require a subjective, articulated intent to furnish information as a “consumer report.” Under that approach, an entity could attempt to avoid FCRA regulation by insisting it did not subjectively intend its information to be used for an eligibility decision—even when it knew or expected that outcome.

But the internal logic of the FCRA defeats that interpretation. A consumer report is defined by how it is used. A CRA is defined by whether it furnishes consumer reports. Each definition incorporates the other. Because of this interdependence, the definitional inquiry cannot turn on whether an entity labels its output a “consumer report” or states it lacks intent. Once the information is assembled or evaluated and enters the chain of FCRA-governed decision making, it is a consumer report and the assembler is a CRA.

Resellers demonstrate why this must be true. A reseller obtains data from a primary CRA, merges or reformats it, and furnishes a new report to an employer or landlord. Both the primary CRA and the reseller are CRAs. If purpose required direct transmission to the decisionmaker, the primary CRA could argue that it did not intend eligibility use because it furnished only to a reseller. Yet the statute explicitly treats both actors as CRAs. Congress knows how to impose a directness requirement, as §1681i’s “direct dispute” language shows. Its absence in §1681a(f) is decisive.

Furnishing to Third Parties

CRA status also requires furnishing information to a third party. Internal transfers do not meet this requirement, nor do involuntary disclosures such as data theft. Independent contractors, however, can satisfy the third-party requirement because they are separate legal actors. Cooperative loan exchanges that assemble loan-application data and share it with participating finance companies qualify because they furnish information for eligibility determinations. Intermediaries in multi-step data flows also qualify when they transmit assembled or evaluated information used downstream for FCRA purposes.

Contexts That Do Not Give Rise to CRA Status

Certain activities fall outside the CRA definition when the information is not assembled or evaluated for eligibility decisions. Furnishing information solely to service existing accounts, comply with compulsory legal process, assist law enforcement, complete a mutually dependent loan transaction, or convey information to successors during securitization does not transform an entity into a CRA. The FCRA focuses on eligibility-related uses; where that context is absent, CRA status does not attach.

Conclusion

A consumer reporting agency is any entity that collects fees or operates cooperatively, regularly assembles or evaluates consumer information, reasonably expects that the information will be used—directly or indirectly—for 

• employment, 
• housing, 
• credit, 
• insurance, or 
• similar eligibility decisions, 

and furnishes the information to a third party. Because of the definitional circularity between “consumer report” and “consumer reporting agency,” an entity cannot remove itself from the Act by declaring that it is not a CRA. The analysis turns entirely on the functional reality of how information is gathered, transformed, furnished, and used.

When viewed through this lens, vendors and intermediaries supplying public records or structured data to CRAs, resellers, or other decisionmakers routinely meet the statutory definition of a consumer reporting agency, and the information they provide constitutes consumer reports within the meaning of the FCRA.