Inaccurate or unverifiable data — Illegal to report data you know or have reason to believe is inaccurate. If investigation can't verify → must delete, not re-report.

Time-barred items — Any negative item beyond its FCRA obsolescence window (7 or 10 years). Check DOFD before every submission cycle.

Identity theft accounts — If a CRA notifies you that a reported account is blocked due to ID theft, you cannot re-report it unless you verify with 100% confidence it is correct. Cannot sell, transfer, or place that debt for collection either.

Re-aged accounts — Cannot reset the DOFD. Selling or re-placing an account does not restart the 7-year clock.

Discriminatory reporting — Cannot treat accounts differently based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance income.

Medical PHI beyond minimum necessary — Diagnoses, procedure codes, treatment notes, or any data that identifies the specific provider or service. Psychotherapy notes: absolute prohibition under any circumstance.

Civil judgments — Removed April 2018. Not accepted. 96% lacked required SSN/DOB PII. Enforcement still available via wage garnishment and bank levy.

Tax liens — Removed July 2017. ~50% lacked PII. State and IRS tax liens no longer on consumer reports from big-3.

Non-contractual debts — Parking tickets, speeding tickets, library fines, court fees, municipal violations. Not arising from a voluntary agreement to pay = not reportable.

Medical collections under $500 — Voluntarily removed by all three bureaus in 2023. Submissions will be rejected or purged.

Paid medical debt — Must be removed immediately upon confirmation of payment. NCAP policy since 2017.

Stale collections (6+ months inactive) — CRAs proactively purge collection tradelines not updated for more than 6 months. Monthly reporting is mandatory to maintain any tradeline.

Pay-for-tradeline schemes — Explicitly prohibited per Equifax's published commercial furnishing requirements. Account terminated on discovery. Experian's furnisher materials contain a general "certain types of data not accepted" disclaimer but do not publish this example by name — treat as prohibited across both as a matter of practice.

Self-reported tradelines — Furnishers reporting tradelines on themselves are explicitly barred per Equifax's published requirements. Not separately confirmed in Experian's public materials, though the same practice risk applies.

Future-services debts — Gym memberships, subscription pre-payments, and other future-services-based data are explicitly named as not accepted in Equifax's own data furnisher FAQ. Experian's furnisher materials only state generically that "certain types of data" are not accepted, without naming examples — do not assume Experian's exclusion list mirrors Equifax's exactly. Note: this exclusion applies to original-creditor furnishing; once assigned to a third-party collector, the debt is furnished as an ordinary collection tradeline and is not subject to this exclusion (see Collections tab).

Submissions missing original creditor name — Per NCAP, original creditor name and Creditor Classification Code are mandatory fields. Missing = rejection.

Medical debt in ban states — CA, CO, CT, DE, IL, ME, MD, MN, NJ, NY, OR, RI, VT, VA, WA. Do not furnish medical accounts where consumer's address is in a ban state. Track consumer address carefully.

Substance use disorder records (42 CFR Part 2) — From federally-assisted SUD programs, require specific patient authorization naming the recipient before any disclosure. General BAA is not sufficient.

Psychotherapy notes — HIPAA absolute prohibition. Accounts where the only validation data involves psychotherapy notes cannot be placed for collection or reported.

Surprise medical bills — The No Surprises Act (eff. Jan 2022) bars surprise billing for certain out-of-network emergency services. If a debt collector reports or tries to collect a debt barred by the No Surprises Act, it may violate FCRA or FDCPA. Verify the underlying debt's validity before reporting.

Active bankruptcy accounts — Once a consumer files and discloses their case number, all collection reporting activity on included accounts pauses under the automatic stay until discharge or dismissal.

Submit full portfolio — every account, every cycle. Missing an account for 6+ months may result in CRA purge.

Update balances, payment status, and account condition codes accurately.

Check for new bankruptcies in portfolio — pause reporting on those accounts.

Review medical accounts against state ban list — flag accounts where consumer moved to a ban state.

Process pending e-OSCAR dispute responses — 30-day investigation deadline applies from CRA receipt date.

Check DOFD age — remove any account within 30 days of hitting its 7-year (or 10-year) obsolescence date.

30 days to complete investigation after CRA forwards dispute. Extendable to 45 days only if consumer provides additional info during the period.

Must conduct thorough investigation — cannot simply verify with your own records. Review all info provided by the CRA alongside the dispute notice.

Report investigation results to CRA. If data is inaccurate or unverifiable — modify, delete, or permanently block. Notify ALL CRAs that received the original information, not just the one that forwarded the dispute.

Do not re-report deleted data in the next reporting cycle without a verified basis. Fix your system of record first.

Keep full audit trail of every dispute: what came in, what was investigated, how you responded. CFPB and state AGs actively audit dispute handling.

Max $4,983 per violation. Active 2025 enforcement focus on FCRA despite workforce cuts. Active lawsuit against Experian for dispute failures.

Retains enforcement authority for non-bank entities. March 2026 FCRA revision published — review for any new provisions.

All 50 states have independent enforcement authority. Medical debt ban state AGs actively enforce. CA, NY especially active.

Consumers: actual damages + statutory damages ($100–$1,000/violation) + punitive damages (willful) + attorney fees. SOL: 2 years from discovery or 5 years from violation. Attorneys take on contingency.