15 U.S.C. §1681g — Disclosures to consumers
CRA-side duties to disclose to a consumer, on request, the information in the consumer's file, sources, recent inquirers, credit scores (key factors), and the FCRA Summary of Rights. Also imposes a duty on business entities (including [LENDER]) to provide application/transaction records to identity-theft victims within 30 days of a verified request.
Verbatim regulatory text
Verbatim provisions from 15 U.S.C. §1681g — Disclosures to consumers — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.
15 U.S.C. §1681g(e)(1) — Identity-theft victim records duty
For the purpose of documenting fraudulent transactions resulting from identity theft , not later than 30 days after the date of receipt of a request from a victim in accordance with paragraph (3), and subject to verification of the identity of the victim and the claim of identity theft in accordance with paragraph (2), a business entity that has provided credit to, provided for consideration products, goods, or services to, accepted payment from, or otherwise entered into a commercial transaction for consideration with, a person who has allegedly made unauthorized use of the means of identification of the victim , shall provide a copy of application and business transaction records in the control of the business entity, whether maintained by the business entity or by another person on behalf of the business entity, evidencing any transaction alleged to be a result of identity theft to—
15 U.S.C. §1681g(e)(4) — No charge to identity-theft victim
(4) No charge to victim