Credit report authorization

How do we capture the borrower's credit pull authorization on a secure screen, with the consent and the timestamp written to the loan file before the pull runs?

Make the authorization a gate on the pull. Callvu presents the authorization to each borrower on a process-controlled screen with the disclosure the lender uses, records the consent with the timestamp, the device and the borrower, writes it to the loan file in the LOS, and only then allows the credit report request; a request without a recorded authorization for that borrower is blocked.

In scopeSimpleCallvu moves: chase and verify, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The credit was pulled on a verbal yes, and the authorization is signed at closing.

Today, without Callvu

A loan officer takes an application by phone and pulls credit to quote. The borrower said yes on the call. The signed authorization is in the closing package, weeks later. An examiner, a dispute with the borrower, or a consumer reporting agency's audit asks for the authorization before the pull, and the file has a date after it.

FCRA requires a permissible purpose, and the lender's agreements with the reporting agencies and its own policy require the borrower's written or electronic authorization before the pull. The co-borrower needs their own. For a soft pull at prequalification versus a hard pull at application, the authorization's scope matters.

It is one screen, and it has to come first.

How it runs

From the requestto the system of record.

The application (or the preapproval, or a prequalification that needs a pull) reaches the point where a credit report will be requested. Callvu opens the authorization step for each borrower before the request.

Borrower: Reads the disclosure and authorizes the pull on their own screen; each co-borrower does the same.
Loan officer: Sees whether the authorization exists and cannot request the report before it.
Callvu: Presents the authorization, records it, writes it to the loan file and gates the report request.

Present the authorization
Each borrower sees the lender's authorization and disclosure on a process-controlled screen: what will be pulled, from which agencies, the type of inquiry (soft or hard) and its purpose, and the notice the lender's policy includes (for example, that the credit score will be disclosed under FCRA if adverse action is taken).
Chase and verify
The borrower authorizes with a typed name or signature; the consent, the timestamp, the device and the borrower identity are recorded. A co-borrower who has not authorized is reminded, and the loan officer sees who is outstanding.
Write back and gate
The authorization is written to the loan file in the LOS for that borrower, and the credit report request for that borrower is released. A request for a borrower without a recorded authorization is blocked, and the block is in the Audit Trace.
Reuse within scope
The authorization's scope (the purpose and the period the lender's policy allows) is recorded, so a later pull within scope (a refresh before closing) is allowed and one outside it asks again.

Where it ends: Every credit report on the loan was requested after a recorded authorization for that borrower, with the timestamp, the device and the disclosure version in the loan file. The Decision Trace shows the gate on each request; the Audit Trace shows the authorization and any blocked request.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

FCRA permissible purpose (15 USC 1681b(a)(3)(A)) and the reporting agencies' end-user agreements: A consumer report may be obtained in connection with a credit transaction involving the consumer; the lender's agreements with the agencies and its policy require the consumer's authorization on record before the pull, and audits test it. A soft inquiry for prequalification and a hard inquiry at application have different scopes.
FCRA credit score disclosure and risk-based pricing (15 USC 1681g(f) and Reg V 12 CFR part 1022 subpart H): A mortgage applicant receives the credit score disclosure notice with the scores used, and the disclosure's delivery is tied to the pull.
E-SIGN (15 USC 7001): An electronic authorization is valid with the consent to electronic records captured first and the record retained.

Company policies

No credit report request for a borrower without their recorded authorization; the gate cannot be overridden.
Each borrower authorizes separately, on their own screen.
The authorization's scope and period are recorded and applied to later pulls.
The LOS loan file is the system of record.

Controls

Authorization and disclosure on a process-controlled screen.
Per-borrower consent with timestamp, device and identity.
Write to the loan file before release.
Gate on the credit report request with blocked requests logged.
Scope and period applied to later pulls.

Clocks and deadlines

Before the pull: The authorization precedes the report request; the timestamps prove the order.
Authorization period: The policy's period for a refresh pull within the same purpose.

Documents and checks

The authorization and disclosure as shown, with version
The consent record per borrower with timestamp and device
The gate results per report request
The credit score disclosure notice where delivered

In the Decision Trace

The disclosure version shown.
The gate check on each report request and its result.
The scope applied to any later pull.

In the Audit Trace

The authorization event per borrower.
Each report request, released or blocked.
The write to the LOS.

The handoff

Between the front doorand the back office.

The front door

The application or preapproval step, on each borrower's screen.

The back office

The report is requested by the process after the gate; nobody checks a folder for the authorization.

The Decision Desk

There is no Decision Desk step: the authorization is the borrower's. A blocked request is visible to the loan officer with the reason.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

Bank Leumi runs its home lending workflows on Callvu.

MTG-01

Community Bank of Mississippi runs TRID loans on Callvu.

MTG-02

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Callvu enforces every policy while the work runs, whether a person or an AI started it. A step marked required that fails fails the run.

ENF-01 · Self-asserted · verified 2026-11-02

Callvu reads what the CRM, core or EHR already knows and prefills, so the customer only answers what is missing.

HND-03 · Self-asserted · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

Can the loan officer pull credit on a verbal authorization?

Not through this process. The report request is gated on the borrower's recorded authorization, captured on their own screen with a timestamp.

Does the co-borrower authorize separately?

Yes, on their own screen; the gate checks each borrower's authorization before their report is requested.

What about a refresh pull before closing?

It is allowed within the authorization's recorded scope and period; outside it, the borrower is asked again.

Related processes

Preapproval with credit authorization Application intake (URLA / 1003)Application started by an AI agent Try it in the sandbox All home lending processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.