OmniaIQ
LoginGet Started
Compliance

FCRA Compliance Checklist for Lead Pre-Qualification

The consent, permissible purpose, and audit trail you need on every pull.

  • Permissible purpose

    Documented for every pull, no exceptions.

  • Consent + timestamp

    IP, language shown, and time captured.

  • Audit trail

    Decision + consent linked and retrievable.

  • Adverse action

    Handled by the lender of record, not the pre-qual layer.

The Checklist

  1. Permissible purpose declared. Written instructions from the consumer is the standard purpose for consumer-initiated pre-qualification.
  2. Consent language displayed at intake. Clear, plain-English, above the submit button — not buried in a linked policy.
  3. Consent artifact stored. Timestamp, IP address, exact language shown, form field values.
  4. Soft inquiry only. No hard pulls at pre-qualification stage — hard pulls are for underwriting decisions.
  5. Decision linked to consent. Every stored verdict references the consent record.
  6. Retention policy documented. How long consent and pull artifacts are kept, and how they're destroyed.
  7. Adverse action pathway. When a lender downstream denies based on the report, the lender issues the adverse action notice — not the pre-qualification layer.
  8. Vendor certification. Your pre-qualification vendor certifies FCRA-compliant data access.

Who Owns What

FCRA responsibility allocation
Obligation Owner
Permissible purpose declaration Pre-qualification customer (lender / agency)
Consent capture at intake Form owner
Bureau data access Pre-qualification vendor
Adverse action notice Lender of record after hard-pull decision
Consumer dispute handling Bureau + furnisher

Frequently Asked Questions

  • No. A DNQ verdict at pre-qualification is not a credit decision; it's a routing signal. Adverse action is owned by the lender after a formal hard-pull decision.

  • Industry standard is a minimum of 5 years post-inquiry, though state laws vary. Consult counsel for your specific footprint.

  • Yes. Modern bureau APIs establish permissible purpose with name, phone, email, and address. SSN is not required for a soft inquiry.

See it on your pipeline

Schedule a 30-minute demo and we'll map the pre-qualification layer to your current stack.