No, we do not believe you may report your customer’s gambling to a family member, as this would violate Illinois and federal financial privacy protections. The Illinois Banking Act and Regulation P prohibit the disclosure of a customer’s financial records or financial information to a third party, unless an exception applies. Although there are exceptions allowing the disclosure of private financial information when a bank believes a customer is the victim of financial exploitation, this situation does not appear to meet any definition of “financial exploitation” — which generally involves the use of an elderly person’s resources by a third party.

We believe that you may deny a loan application on the basis of the customer’s gambling problem, provided that you send an adverse action notice to the customer. Regulation B allows creditors to “consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis.” Further, the U.S. District Court for the Northern District of Illinois has stated that the Equal Credit Opportunity Act and its regulations “do not prohibit adverse action for any reason that is not discriminatory, . . . do not require that adverse action be based upon reliable information, and do not require reconsideration of an application when it turns out that adverse action has been taken upon unreliable information.”

If you decide to deny a loan application because of your customer’s gambling, you must provide an adverse action notice stating the reason for the rejection or disclosing the applicant’s right to request a statement of your reasons. In addition, the Fair Credit Reporting Act requires that the adverse action notice disclose that you obtained information “from a person other than a consumer reporting agency bearing upon the consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living,” and that the applicant may request the information that you relied on in taking the adverse action within sixty days of receipt of the adverse action notice.

For resources related to our guidance, please see:

• Illinois Banking Act, 205 ILCS 5/48.1(c) (“Except as otherwise provided by this Act, a bank may not disclose to any person, except to the customer or his duly authorized agent, any financial records or financial information obtained from financial records relating to that customer of that bank unless:

(1) the customer has authorized disclosure to the person;

(2) the financial records are disclosed in response to a lawful subpoena, summons, warrant, citation to discover assets, or court order which meets the requirements of subsection (d) of this Section; or

(3) the bank is attempting to collect an obligation owed to the bank and the bank complies with the provisions of Section 2I of the Consumer Fraud and Deceptive Business Practices Act.”)

• Regulation P, 12 CFR 1016.3(p)(1)(i) (“Nonpublic personal information means . . . Personally identifiable financial information . . . .”)

• Regulation P, 12 CFR 1016.3(q)(1) (“Personally identifiable financial information means any information:

(i) A consumer provides to you to obtain a financial product or service from you;

(ii) About a consumer resulting from any transaction involving a financial product or service between you and a consumer; or

(iii) You otherwise obtain about a consumer in connection with providing a financial product or service to that consumer.”)

• Regulation P, 12 CFR 1016.15(a)(2) (Exceptions to the opt-out requirements include the disclosure of nonpublic personal information “(ii) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability; . . .”)

• Illinois Banking Act, 205 ILCS 5/48.1(b) (“This Section does not prohibit: . . . (16) The furnishing of information to law enforcement authorities, the Illinois Department on Aging and its regional administrative and provider agencies, the Department of Human Services Office of Inspector General, or public guardians: (i) upon subpoena by the investigatory entity or the guardian, or (ii) if there is suspicion by the bank that a customer who is an elderly person or person with a disability has been or may become the victim of financial exploitation. . . (iii) ‘financial exploitation’ means tortious or illegal use of the assets or resources of an elderly or disabled person, and includes, without limitation, misappropriation of the elderly or disabled person’s assets or resources by undue influence, breach of fiduciary relationship, intimidation, fraud, deception, extortion, or the use of assets or resources in any manner contrary to law.”)

• Adult Protective Services Act, 320 ILCS 20/4(a-7) (“A person making a report under this Act in the belief that it is in the alleged victim's best interest shall be immune from criminal or civil liability or professional disciplinary action on account of making the report, notwithstanding any requirements concerning the confidentiality of information with respect to such eligible adult which might otherwise be applicable.”)

• Adult Protective Services Act, 320 ILCS 20/2(f-1) (“‘Financial exploitation’ means the use of an eligible adult’s resources by another to the disadvantage of that adult or the profit or advantage of a person other than that adult.”)

• Regulation B, 12 CFR 1002.6(a) (“Except as otherwise provided in the Act and this part, a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis.”)

• Grant v. World Class Mortg. Corp., 1990 U.S. Dist. LEXIS 2207, *4 (N.D. Ill. 1990) (“The statute and regulations do not prohibit adverse action for any reason that is not discriminatory as defined by the statute (see 15 USCA § 1691(a), (b), (c) (1982)), do not require that adverse action be based upon reliable information, and do not require reconsideration of an application when it turns out that adverse action has been taken upon unreliable information. The statute and regulations only required that defendant give plaintiffs a statement of the reasons for the adverse action.”)

• Regulation B, 12 CFR 1002.9(a)(2) (“A notification given to an applicant when adverse action is taken shall be in writing and shall contain . . . either: (i) A statement of specific reasons for the action taken; or (ii) A disclosure of the applicant’s right to a statement of specific reasons within 30 days, if the statement is requested within 60 days of the creditor’s notification. The disclosure shall include the name, address, and telephone number of the person or office from which the statement of reasons can be obtained. If the creditor chooses to provide the reasons orally, the creditor shall also disclose the applicant’s right to have them confirmed in writing within 30 days of receiving the applicant’s written request for confirmation.”)

• Fair Credit Reporting Act, 15 USC 1681m(b)(1) (“Whenever credit for personal, family, or household purposes involving a consumer is denied or the charge for such credit is increased either wholly or partly because of information obtained from a person other than a consumer reporting agency bearing upon the consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, the user of such information shall, within a reasonable period of time, upon the consumer’s written request for the reasons for such adverse action received within sixty days after learning of such adverse action, disclose the nature of the information to the consumer. The user of such information shall clearly and accurately disclose to the consumer his right to make such written request at the time such adverse action is communicated to the consumer.”)