source:
  type: regulation
  id: reg-v-1022.3
  authority: 12 CFR §1022.3 — Definitions (Regulation V)
  description: 12 CFR §1022.3 — Definitions.
  coverage_tier: context
obligations:
- id: reg-v-1022.3-full
  canonical_id: reg-v-1022.3-full
  section: 12 CFR §1022.3 — Definitions
  type: reference
  tags:
  - regulator-direct
  - fcra
  - corpus-expansion
  - tier-context
  primary_source:
    tier: 1
    authority: 12 CFR §1022.3 — Definitions (Regulation V)
    source_class: cfpb-regulation
    source_url: https://www.law.cornell.edu/cfr/text/12/1022.3
    snapshot_id: f10d15e90feaf6d1
    fetched_at: '2026-06-17T20:38:43Z'
    content_hash: sha256:90aadceb1ec5137c7d55bef71618c2f30f7586686f9abe4fda63c4c77f0b0389
    paragraph_quote: '§ 1022.3 Definitions. For purposes of this part, unless explicitly
      stated otherwise: (a) Act means the FCRA ( 15 U.S.C. 1681 et seq. ). (b) Affiliate
      means any company that is related by common ownership or common corporate control
      with another company . For example, an affiliate of a Federal credit union is
      a credit union service corporation, as provided in 12 CFR part 712 , that is
      controlled by the Federal credit union. (c) [Reserved] (d) Common ownership
      or common corporate control means a relationship between two companies under
      which: (1) One company has, with respect to the other company: (i) Ownership,
      control , or power to vote 25 percent or more of the outstanding shares of any
      class of voting security of a company , directly or indirectly, or acting through
      one or more other persons; (ii) Control in any manner over the election of a
      majority of the directors, trustees, or general partners (or individuals exercising
      similar functions) of a company ; or (iii) The power to exercise, directly or
      indirectly, a controlling influence over the management or policies of a company
      , as determined by the applicable prudential regulator (as defined in 12 U.S.C.
      5481(24) ) (a credit union is presumed to have a controlling influence over
      the management or policies of a credit union service corporation if the credit
      union service corporation is 67% owned by credit unions) or, where there is
      no prudential regulator, by the Bureau; or (2) Any other person has, with respect
      to both companies, a relationship described in paragraphs (d)(1)(i) through
      (d)(1)(ii). (e) Company means any corporation, limited liability company , business
      trust, general or limited partnership, association, or similar organization
      . (f) Consumer means an individual. (g) Identifying information means any name
      or number that may be used, alone or in conjunction with any other information,
      to identify a specific person , including any: (1) Name, social security number,
      date of birth, official state or government issued driver''s license or identification
      number, alien registration number, government passport number, employer or taxpayer
      identification number; (2) Unique biometric data, such as fingerprint, voice
      print, retina or iris image, or other unique physical representation; (3) Unique
      electronic identification number, address, or routing code; or (4) Telecommunication
      identifying information or access device (as defined in 18 U.S.C. 1029(e) ).
      (h) Identity theft means a fraud committed or attempted using the identifying
      information of another person without authority. (i) (1) Identity theft report
      means a report: (i) That alleges identity theft with as much specificity as
      the consumer can provide; (ii) That is a copy of an official, valid report filed
      by the consumer with a Federal, state , or local law enforcement agency , including
      the United States Postal Inspection Service, the filing of which subjects the
      person filing the report to criminal penalties relating to the filing of false
      information, if, in fact, the information in the report is false; and (iii)
      That may include additional information or documentation that an information
      furnisher or consumer reporting agency reasonably requests for the purpose of
      determining the validity of the alleged identity theft , provided that the information
      furnisher or consumer reporting agency: (A) Makes such request not later than
      fifteen days after the date of receipt of the copy of the report form identified
      in Paragraph (i)(1)(ii) of this section or the request by the consumer for the
      particular service, whichever shall be the later; (B) Makes any supplemental
      requests for information or documentation and final determination on the acceptance
      of the identity theft report within another fifteen days after its initial request
      for information or documentation; and (C) Shall have five days to make a final
      determination on the acceptance of the identity theft report, in the event that
      the consumer reporting agency or information furnisher receives any such additional
      information or documentation on the eleventh day or later within the fifteen
      day period set forth in Paragraph (i)(1)(iii)(B) of this section. (2) Examples
      of the specificity referenced in Paragraph (i)(1)(i) of this section are provided
      for illustrative purposes only, as follows: (i) Specific dates relating to the
      identity theft such as when the loss or theft of personal information occurred
      or when the fraud(s) using the personal information occurred, and how the consumer
      discovered or otherwise learned of the theft. (ii) Identification information
      or any other information about the perpetrator, if known. (iii) Name(s) of information
      furnisher(s), account numbers, or other relevant account information related
      to the identity theft . (iv) Any other information known to the consumer about
      the identity theft . (3) Examples of when it would or would not be reasonable
      to request additional information or documentation referenced in Paragraph (i)(1)(iii)
      of this section are provided for illustrative purposes only, as follows: (i)
      A law enforcement report containing detailed information about the identity
      theft and the signature, badge number or other identification information of
      the individual law enforcement official taking the report should be sufficient
      on its face to support a victim''s request. In this case, without an identifiable
      concern, such as an indication that the report was fraudulent, it would not
      be reasonable for an information furnisher or consumer reporting agency to request
      additional information or documentation. (ii) A consumer might provide a law
      enforcement report similar to the report in Paragraph (i)(1) of this section
      but certain important information such as the consumer ''s date of birth or
      Social Security number may be missing because the consumer chose not to provide
      it. The information furnisher or consumer reporting agency could accept this
      report, but it would be reasonable to require that the consumer provide the
      missing information. The Bureau''s Identity Theft Affidavit is available on
      the Bureau''s Web site ( consumerfinance.gov/learnmore ). The version of this
      form developed by the Federal Trade Commission , available on the FTC''s Web
      site ( ftc.gov/idtheft ), remains valid and sufficient for this purpose. (iii)
      A consumer might provide a law enforcement report generated by an automated
      system with a simple allegation that an identity theft occurred to support a
      request for a tradeline block or cessation of information furnishing. In such
      a case, it would be reasonable for an information furnisher or consumer reporting
      agency to ask that the consumer fill out and have notarized the Bureau''s Identity
      Theft Affidavit or a similar form and provide some form of identification documentation.
      (iv) A consumer might provide a law enforcement report generated by an automated
      system with a simple allegation that an identity theft occurred to support a
      request for an extended fraud alert. In this case, it would not be reasonable
      for a consumer reporting agency to require additional documentation or information,
      such as a notarized affidavit. (j) Medical debt information means medical information
      that pertains to a debt owed by a consumer to a person whose primary business
      is providing medical services, products, or devices, or to such person ''s agent
      or assignee, for the provision of such medical services, products, or devices.
      Medical debt information includes but is not limited to medical bills that are
      not past due or that have been paid. (k) Medical information means: (1) Information
      or data, whether oral or recorded, in any form or medium, created by or derived
      from a health care provider or the consumer , that relates to: (i) The past,
      present, or future physical, mental, or behavioral health or condition of an
      individual; (ii) The provision of health care to an individual; or (iii) The
      payment for the provision of health care to an individual. (2) The term does
      not include: (i) The age or gender of a consumer ; (ii) Demographic information
      about the consumer , including a consumer ''s residence address or email address;
      (iii) Any other information about a consumer that does not relate to the physical,
      mental, or behavioral health or condition of a consumer , including the existence
      or value of any insurance policy; or (iv) Information that does not identify
      a specific consumer . (l) Person means any individual, partnership, corporation,
      trust, estate cooperative, association, government or governmental subdivision
      or agency , or other entity . [ 76 FR 79312 , Dec. 21, 2011, as amended at 90
      FR 3372 , Jan.14, 2025]'
  judgment: false
