The purpose of the iSoftpull Credentialing Policy is to result in the screening of prospective End Users and the verification of both the End Users’ identities and the certifications made by such End Users including, but not limited to, permissible purpose to receive Consumer Reports in accordance with Section 604 of the FCRA, 15 U.S.C. § 1681b, as required by Section 607(a) of the FCRA, 15 U.S.C. §1681e(a), and permitted use to receive nonpublic personal information, including CRD Reference Services, as encompassed by Section (6802)(e) of the Gramm-Leach-Bliley Act, Title V, Subtitle A, Financial Privacy (15 U.S.C. § 6801-6809) (“GLBA”).

The Program should result in the verification

1.  The business identity of the End User;
   
2.  The End User is a legitimate business engaged in the business certified and has a permissible purpose for obtaining Consumer Reports and/or a permitted use to receive nonpublic personal information;
   
3. The End User is both based in the United States and has its principal place of business in the United States; and (4)
   
4. The Data and Services shall be delivered by iSoftpull only to United States locations of such End Users.

Membership Application.

The Membership Application contains the following information at a minimum:

• Full name and address of End User (including all DBAs)

• Nature of End User’s business

• The specific purpose(s) for which Data will be used

• Information regarding the classification of the End User’s business (sole proprietor, partnership, corporation)

• Identification of the owner(s) (if sole proprietor or partnership) including home address(es), social security number(s) and the End User Federal tax identification number(s)

• End User website address(es)/URLs

Verification of Permissible Purpose

Permissible Purpose for access to Data should be consistent with the type of business and request for access noted on the application for service. iSoftpull verifies permissible purpose by collecting the ENd Users loan application where applicable, reviewing End Users Websites, and conduction telephone conference investigations. If prospective End Users fails to adequately verify and substantiate their permissible purpose, iSoftpull shall not onboard client.

Sole Proprietor or Partnership- Credit Report Requirement

In addition to the foregoing, if the End User is a sole proprietor or partnership, iSoftpull must obtain written consent to secure a copy of the owner’s or partners’ personal credit report(s). ISoftpull must also obtain a copy of the owner’s or partners’ government issued photo identification, and confirm that the name, address and date of birth on the identification card match the information supplied on the written consent form, prior to requesting a credit report. ISoftpull must then obtain a credit report on such owner or partner, including a fraud risk evaluation tool. ISoftpull must review these reports to determine whether the individual credit report is consistent with the individual’s age and business experience, whether the social security number provided is associated with any other individual or whether any other indicia of identity fraud are apparent. If the sole proprietor or partners refuse to consent to having their personal credit reports accessed for this purpose, iSoftpull denies the application.

Business Type/Industry Verification

ISoftpull confirms, via a business telephone directory such as the Yellow Pages (printed or electronic) whether the End User is listed under any Unauthorized Business Type, as defined within this Bureau Policies. If the phone listing for the End User cannot be verified using online tools (all VOIP lines, Google phone etc.) the End User needs to provide a physical copy of their most recent bill reflecting the same legal name/address that applicant listed on their application. If End User is listed under an Unauthorized Business Type, iSoftpull may not provide the End User any Data unless otherwise first expressly approved (see Unauthorized Business Types Policy).

Business Banking and Credit Verifications 

iSoftpull obtains a copy of the End Users business bank statement to verify to verify business banking status. Bank statement must include End User's name as written on membership application, type of account, and statement date. All verifications are documented and maintained by iSoftpull. Any financial institution not listed with a reputable directory or phone listing may not be used for purposes of business banking or credit verifications.

As an alternative to business banking and credit verification, iSoftpull obtains one of the following:

• A listing with a reputable industry listing or rating, such as A.M. Best’s, Moody’s, Standard and Poor’s, FDIC or NCUA. A copy of such listing must be retained in the membership file

• A copy of the prospective End User’s Annual Report published within the last twelve (12) months, which has been certified by a certified public accounting firm

• A commercial business report containing information reported by a third party, that reflects the same company name and location.

End User Website Verification

Business License

Where no business license is required by the state, county or city, the following validations are acceptable in lieu of a business license:

• Validation of Federal Employer Identification Number (also known as Federal Tax Identification Number). Not: An application applying for a Federal Employer Identification Number is not acceptable

• Proof of a professional license issued by the state

• Proof of regulation and/or insured by:

• Office of the Comptroller of the Currency (OCC)

• Federal Reserve System o Federal Deposit Insurance Corporation (FDIC)

• National Credit Union Administration (NCUA)

• Proof of 501(c) status under the US Internal Revenue Code

• Proof of Articles/Certificate of Incorporation, Organization or Partnership

New Business

If End User has been in business for one (1) year or less, two of the following items are secured:

• Copy of utility or telephone bill in the business name for service at the principal place of business

• Copy of lease or proof of property ownership by the business of the principal place of business of End User

• Copy of bank statement addressed to the End User at its principal place of business

• Proof of commercial insurance under the business name shown on the application

Verification of the Principal

• Verification (via authentication methods and tools) of identity of the authorized signer to include, but not be limited to, the following: name, address, and driver’s license information.

• Verification of the principal’s relationship to the business to ensure that his/her relationship to, and representation of, the business activity conducted is as noted on the application for service. Methods of validating that the principal and business are related may include confirmation that the email address of the principal is within the Subscriber’s domain, confirmation that the principal can be reached via the phone number of business.

• Confirmation that the principal and executive officers of the business/company are not reflected on the Specially Designated Nationals (SDN) list maintained by the U.S. Office of Foreign Asset Control (OFAC).