Compliance
FCRA permissible purpose
Why every live report pull needs an FCRA permissible purpose, which purposes CRS certifies accounts for, and what that allows you to run through the API.
Warning
This page is not legal advice. It describes how Cascades applies the Fair Credit Reporting Act to API usage so your integration matches the certification your account holds. Your obligations under the FCRA, state law and the bureaus' terms are yours; consult your counsel.
Why does it matter for an API call?
A consumer report — a credit report, a criminal or eviction search, an identity verification against bureau data — may only be obtained for a permissible purpose listed in FCRA §604 (15 U.S.C. §1681b). Every execution_mode: live run that reaches a product node pulls such a report. The API cannot tell whether the applicant behind payload.applicant really applied for the tenancy, job or credit you certified; that certification is yours, and it is the reason live access is granted per account rather than per key.
Test-mode runs use synthetic data or bureau-published sandbox subjects and are not consumer reports; they need no permissible purpose.
Which purposes does CRS certify?
At activation (/activate) you declare one permissible purpose and one industry, and sign the end-user certification. The purposes Cascades accepts:
| Purpose (as declared) | FCRA basis | Typical use |
|---|---|---|
| Tenant / rental application | §604(a)(3)(F) — legitimate business need in connection with a transaction initiated by the consumer | Residential tenant screening |
| Employment screening | §604(a)(3)(B), with the §604(b) employment conditions | Pre-employment and ongoing employment checks |
| Extension of credit | §604(a)(3)(A) | Consumer lending, auto, commercial-with-guarantor |
| Insurance underwriting | §604(a)(3)(C) | Underwriting of insurance involving the consumer |
| Written instructions of the consumer | §604(a)(2) | Consumer-initiated checks with explicit written authorisation |
| Legitimate business need | §604(a)(3)(F) | Account review and other consumer-initiated business transactions |
Industries: Auto Lending, Bank & Credit Union, Bankruptcy Attorney, Commercial Lending, Consumer Lending, Debt Consolidation, Employment, Housing Counseling, Tenant Screening.
Approval is granted by CRS after review of the activation form. Until then live requests return 403 live_mode_forbidden — see Sandbox vs live.
What does the purpose constrain in practice?
- Run only cascades that fit the certified purpose. An account certified for tenant screening should not run employment cascades live. All products remain available in the sandbox so you can build and test; live activation is reviewed against your certification.
- Employment has extra steps. The §604(b) conditions require a clear, stand-alone disclosure and the applicant's written authorisation before the pull, and the two-step pre-adverse / adverse notice process if you decide against them. Cascades' employment flow implements the notice sequence (see Adverse action); the disclosure and authorisation happen on your side, before you call
trigger. - Keep the consumer's authorisation and the application record.
external_referenceon the trigger is the place to carry your application id so a pull can be tied back to the transaction that justified it. - Limit who can read reports.
executions:read:fullunlocks per-step report data and PDF downloads. Grant it to the systems and people with a need to know, and see Keys, scopes and rate limits. - Do not repurpose a report. A report obtained for a tenancy decision may not be reused for an unrelated purpose. Re-evaluations (
POST /executions/{id}/re_evaluations) replay the original run's input against the original definition; they do not create a new permissible purpose.
What happens when I take adverse action?
If you deny, or take another adverse action against, an applicant based in whole or in part on a consumer report, §615 requires a notice with the source of the report, the applicant's right to a free copy and to dispute, and (for credit) the key factors and score disclosure. Cascades' adverse-action node produces that notice; the requirements and the reason vocabulary are on Adverse action notices.