CFPB's New Rule Bars Creditors From Using Medical Debt

The Consumer Financial Protection Bureau has finalized the rule Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information, which amends Regulation V, the regulation that implements the Fair Credit Reporting Act. Published as 90 FR 3276 on January 14, 2025, the rule is effective March 17, 2025. The Fair Credit Reporting Act already prohibits creditors from considering medical information when they decide whether a consumer qualifies for credit, or on what terms — this rule removes the regulatory exception that had let creditors obtain and use medical debt information notwithstanding that prohibition, and it separately restricts what a consumer reporting agency may furnish to a creditor. For financial firms that extend consumer credit, or that supply or receive consumer reports, this is a direct change to underwriting inputs, not a peripheral update.

This guide explains, in plain English, what the rule does, who it touches, what financial firms should check before the effective date, and how a compliance team keeps the resulting data restriction consistent across underwriting systems and vendor relationships. It leads with the obligation and the date, not with any product. The aim is to give compliance and risk teams a clear, sourced picture they can act on without re-reading the full Federal Register entry themselves.

Key Takeaways

• A CFPB final rule, cited as 90 FR 3276, removes the regulatory exception that had allowed creditors to obtain and use medical debt information in credit eligibility determinations; the rule is effective March 17, 2025.

• The same rule generally prohibits a consumer reporting agency from furnishing a creditor a consumer report that contains medical debt information the creditor is prohibited from using, per 90 FR 3276.

• The rule amends 12 CFR Part 1022 — Regulation V — and carries RIN 3170-AA54; it was published in the Federal Register on January 14, 2025.

• The FCRA's general prohibition on considering medical information in credit decisions is not new; this rule closes an exception to it under 90 FR 3276, rather than creating the prohibition itself.

• This post is informational only and is not legal or tax advice; consult a qualified attorney or compliance professional before acting on any specific situation.

What this rule actually does

The Fair Credit Reporting Act has long prohibited creditors from considering medical information in determining a consumer's eligibility for credit, or the terms of that credit. Regulation V, the CFPB regulation that implements the FCRA, historically included an exception that allowed creditors to obtain and use certain medical debt information notwithstanding that statutory prohibition. The final rule at 90 FR 3276 removes that regulatory exception. Read carefully, this is a narrowing rule: it does not create a new prohibition on using medical information in credit decisions — the FCRA's general prohibition already existed — it eliminates the carve-out that had permitted one category of medical-debt use to continue.

The rule does not stop at creditors. It also provides, per 90 FR 3276, that a consumer reporting agency generally may not furnish to a creditor a consumer report containing information on medical debt that the creditor is prohibited from using. In practice, the restriction reaches both ends of the data flow: the creditor that would use medical debt information in an eligibility determination, and the consumer reporting agency that would otherwise include that information in a report supplied to the creditor. A firm that reviews only its own underwriting policy, without also checking what its consumer-report vendors are furnishing, has addressed half of what the rule requires.

The table below summarizes the change using only the language of the rule itself, as published at 90 FR 3276.

The rule is effective March 17, 2025, per 90 FR 3276. It amends the regulations at 12 CFR Part 1022 — Regulation V — and the rulemaking carries RIN 3170-AA54. Financial firms should treat the effective date as the point at which the exception is gone, not as the start of a phase-in; the rule is not written as a multi-year runway in the way some CFPB and prudential rules are.

Who is affected

The rule reaches two distinct populations. First, creditors — banks, credit unions, and other lenders that extend consumer credit and make eligibility or pricing determinations — lose the ability to rely on the removed exception once the rule takes effect on March 17, 2025, per 90 FR 3276. Second, consumer reporting agencies that compile and furnish consumer reports to those creditors take on a parallel restriction on what they may include. A financial firm can sit on either side of this relationship, or both, depending on whether it also operates or contracts with a reporting function.

The table below breaks out why each stakeholder group is affected, per 90 FR 3276.

Covered firms should read this rule together with the underlying FCRA prohibition whose exception it narrows, since the removed exception only makes sense in light of the prohibition it had been carving space out of. The rule amends 12 CFR Part 1022, and the rulemaking carries RIN 3170-AA54. Reading the rule in isolation tells a compliance team what changed; reading it against Regulation V's existing structure tells them why it matters for a specific underwriting workflow.

What financial firms should do before the effective date

The most important framing for this rule is the opposite of an extension: it takes something away that some creditors had been relying on. A firm that has not touched its exception-based medical-debt practices since this rule's effective date of March 17, 2025, per 90 FR 3276, is the firm most exposed to a mismatch between its policy and the current text of Regulation V. The rule requires creditors to stop relying on the removed exception, and it requires consumer reporting agencies to stop furnishing the now-restricted information; it does not describe a transition period beyond the single effective date.

A sourced preparation path looks like this. First, confirm whether the organization is a creditor that extends consumer credit, operates as a consumer reporting agency, or both, since the rule's two restrictions attach differently to each role. Second, review underwriting criteria, credit policy manuals, and any automated decision logic for a reference to the exception the rule at 90 FR 3276 removes, and update that language to reflect the current text of 12 CFR Part 1022. Third, if the firm receives consumer reports from a reporting agency, confirm with that vendor, in writing, that its furnishing practices already reflect the medical-debt restriction; if the firm is itself a reporting agency, confirm the same on the furnishing side. Fourth, keep a current copy of the rule on hand, since RIN 3170-AA54 is the reference a compliance team should use to track any related CFPB guidance.

Throughout, the operative framing is that the rule requires creditors and consumer reporting agencies to conform to the narrowed exception as of the effective date; this is a description of the law as published in the Federal Register, not a personalized legal command to any reader, and it is not a substitute for advice from your own counsel.

Operationalizing the exception review at volume

The hard part for most financial firms is not the first read of this rule — it is confirming, across every underwriting system and every consumer-report vendor relationship, that the removed exception has actually stopped being used. That is a cross-system verification problem, and verification at volume is where US Tech Automations fits. Configured against a firm's underwriting rules and vendor data feeds, the platform can flag any reference to medical debt information that survives in a credit eligibility determination or an inbound consumer report, and route the flag to a named compliance reviewer instead of leaving it to a periodic manual audit. You can see how that kind of workflow is structured on the US Tech Automations agentic workflows page. The goal is not to replace a compliance officer's judgment on any single file; it is to make sure the removed exception does not quietly survive in a legacy rule or a vendor's default configuration after the March 17, 2025 effective date set by 90 FR 3276.

How this fits the broader regulatory window

This rule does not exist in a vacuum. It is one of 259 U.S. federal rules published July 1, 2024 – July 5, 2026 by 10 agencies governing our covered industries, sealed in our point-in-time index of that period. A single exception-removal like this one is easy to read in isolation; the harder problem is that financial firms carry many CFPB, prudential, and state-level obligations at once, each attached to its own CFR part, its own RIN, and its own effective date. A firm that tracks only the rules already on its radar risks missing one that quietly narrows a practice it had assumed was still permitted.

The takeaway for leadership is straightforward: the FCRA's prohibition on considering medical information in credit decisions has not changed, but the exception some creditors relied on is gone as of the March 17, 2025 effective date under 90 FR 3276, and a parallel restriction now applies to consumer reporting agencies. Building a durable way to confirm that removed exceptions like this one are actually reflected in underwriting systems and vendor contracts — not just in a policy binder — is what keeps a firm from re-discovering an old exception the hard way, in an exam or a dispute. Firms that want to see how that kind of ongoing verification and documentation workflow is put together can review US Tech Automations pricing to compare plans.

Frequently asked questions

What is the effective date of this CFPB medical-debt rule?

The rule is effective March 17, 2025, as stated in 90 FR 3276. It was published in the Federal Register on January 14, 2025.

What does the rule change for creditors?

The rule removes the regulatory exception under Regulation V that had allowed creditors to obtain and use medical debt information in credit eligibility determinations, per 90 FR 3276. The FCRA's underlying prohibition on considering medical information in credit decisions is not new; the exception to it is what the rule removes.

Does this rule also restrict consumer reporting agencies?

Yes. The rule at 90 FR 3276 generally prohibits a consumer reporting agency from furnishing a creditor a consumer report that contains medical debt information the creditor is prohibited from using.

Which part of the Code of Federal Regulations does this rule amend?

The rule amends 12 CFR Part 1022, which is Regulation V, the CFPB's regulation implementing the Fair Credit Reporting Act. The rulemaking carries RIN 3170-AA54.

Does removing the exception eliminate the FCRA's medical-information prohibition entirely?

No. The FCRA's general prohibition on considering medical information in credit eligibility determinations already existed; this rule at 90 FR 3276 removes a regulatory exception that had permitted one category of medical debt information to be used notwithstanding that prohibition.

How should a financial firm prepare before the effective date?

A financial firm should confirm whether it is a creditor, a consumer reporting agency, or both, then review underwriting criteria, decision logic, and vendor consumer-report feeds for any reliance on the exception removed by 90 FR 3276, updating that language to reflect the current text of 12 CFR Part 1022.

Related guidance

For related financial-services compliance coverage, see our notes on the CFPB's Regulation B amendments under the Equal Credit Opportunity Act, the small business lending revisions to Regulation B, and Regulation S-P's privacy and safeguarding duties for financial firms.

Disclaimer

This article is provided for informational purposes only and does not constitute legal or tax advice. Reading it does not create an attorney-client relationship. Regulatory requirements are fact-specific, and you should consult a qualified attorney or tax advisor before acting on any matter discussed here. Every date, citation, RIN, CFR reference, and figure in these posts is copied verbatim from the Federal Register and eCFR as of the snapshot date. Nothing is estimated, modeled, or extrapolated. This is not legal or tax advice.

Last reviewed: July 5, 2026.

Source: U.S. Federal Register (90 FR 3276); current text via eCFR, 12 CFR Part 1022.