TransUnion Tenant Screening Reseller Compliance Guide

Written by: Luis Teran, Co-founder, CEO, TenantEvaluation

Key Takeaways

• The FTC’s $2.25 million RentGrow settlement shows that FCRA reseller obligations are actively enforced and that procedural gaps create serious financial risk.
• Resellers must run an independent FCRA compliance program that covers permissible purpose certification, written consent, data security, source disclosure, and dispute forwarding.
• Florida CAMs and HOAs must match screening criteria to governing documents, keep records for five years, and align board approval timelines with FCRA adverse action notice windows.
• Annual recredentialing requires updated permissible-purpose documentation, current security evidence, staff training records, and proof of compliant adverse action and dispute workflows.
• TenantEvaluation provides a direct TransUnion and Equifax reseller platform with built-in FCRA workflows, biometric ID verification, and lease tracking, so you can learn more and see how it fits your communities.

Core FCRA Roles and Reseller Responsibilities

The FCRA draws a clear line between resellers and direct-user end-users, and that distinction determines which obligations apply to your organization.

• Reseller (15 U.S.C. § 1681a(u)): An entity that assembles or merges consumer report information from one or more consumer reporting agencies and furnishes the resulting report to a third party. Resellers must maintain their own FCRA compliance program independent of the originating CRA.
• End-User / Direct User: An entity that receives a consumer report from a CRA or reseller and uses it solely for its own permissible purpose. End-users carry narrower obligations but remain subject to adverse action, written consent, and permissible purpose rules.
• Permissible Purpose (15 U.S.C. § 1681b): The statutory basis authorizing a consumer report request, including a legitimate business need in connection with a transaction initiated by the consumer.
• Adverse Action (15 U.S.C. § 1681m): Any denial, conditional approval, or materially worse terms offered to an applicant based in whole or in part on a consumer report.
• Annual Recredentialing: The periodic re-verification process required by TransUnion and other bureaus confirming that a reseller continues to meet permissible purpose, data security, and operational standards.

TenantEvaluation is a direct, legitimate reseller of TransUnion and Equifax data, with FCRA compliance built into the platform foundation, not added later. See how the platform handles every reseller obligation end-to-end in a live walkthrough.

TransUnion Reseller Checklist for Florida Property Managers

Now that the core roles are defined, this checklist translates those definitions into practical TransUnion reseller obligations for Florida property management companies and CAMs.

1. Certify permissible purpose before each report request. Bureau reseller agreements require certification that at least one permissible purpose under 15 U.S.C. § 1681b exists, including a legitimate business need tied to a consumer-initiated transaction. TransUnion may require individual per-report certification in addition to any blanket agreement.
2. Obtain written consent from every applicant before ordering a report. FCRA requires written authorization prior to running a tenant screening report. Florida CAMs must retain signed consent documentation as part of the application record.
3. Restrict report use to the certified permissible purpose only. Consumer reports may not be sold, licensed, or provided to any other party and must be used solely for the one-time purpose certified at the time of request.
4. Implement data security controls meeting bureau standards. Resellers must maintain end-to-end encryption, access controls, and PCI-level data handling to protect consumer report information from unauthorized access or breach.
5. Retain written consumer authorizations for a minimum of five years. Bureau agreements require retention of all written consumer authorizations for at least five years from the date of inquiry, and these records must be available during audits.
6. Disclose all sources of information in consumer files upon request. The RentGrow enforcement action specifically cited failure to disclose third-party databases used for address history and name matching as an FCRA violation. Resellers must maintain a complete source inventory.
7. Apply Florida-specific overlays. Florida community associations must align screening criteria with governing documents, HOA bylaws, and any county-level fair housing ordinances that impose additional restrictions on screening factors.

Annual TransUnion Recredentialing for Florida Resellers

TransUnion and other major bureaus require resellers to complete periodic recredentialing to confirm continued eligibility and current controls.

1. Submit updated permissible purpose certification documentation. Resellers must re-certify the business purposes for which consumer reports are accessed and confirm that no material change in use case has occurred since the prior credentialing cycle.
2. Provide evidence of current data security controls. Bureau recredentialing typically requires documentation of encryption standards, access management policies, and any third-party security audits completed during the prior year.
3. Confirm employee training completion. Staff with access to consumer report data must complete FCRA training annually. Training records must be maintained and available for bureau review.
4. Demonstrate adverse action workflow compliance. Resellers must show that their adverse action notice process meets 15 U.S.C. § 1681m requirements, including pre-adverse action notice, review period, and final notice procedures.
5. Audit and certify dispute-forwarding procedures. The FTC’s RentGrow complaint cited failure to forward consumer disputes to originating CRAs as a core violation. Resellers must document that disputes are forwarded within the required timeframe under 15 U.S.C. § 1681i.
6. Maintain compliance records. Resellers should implement retention policies that allow them to demonstrate FCRA compliance during audits or regulatory reviews.
7. Florida note: Florida management companies that manage multiple associations must ensure recredentialing documentation covers all entities operating under the reseller agreement, not only the parent management company.

TransUnion Adverse Action Workflow for Property Managers

The FCRA two-notice adverse action process is one of the most frequently mishandled obligations in tenant screening, so property managers need a clear sequence.

1. Identify the triggering event. Adverse action in a housing context includes not only outright denial but also requiring a higher security deposit, a guarantor, a rent increase, or denial of a renewal lease when the decision is based in whole or in part on the screening report.
2. Issue the pre-adverse action notice immediately after identifying a potential denial. The pre-adverse action notice must include a copy of the consumer report and the CFPB/FTC Summary of Rights so the applicant can review and dispute inaccuracies before the decision is finalized.
3. Allow a minimum review period of 5–7 business days. Sending both the pre-adverse and final adverse action notices on the same day violates FCRA requirements. The applicant must have a meaningful opportunity to dispute the report.
4. Issue the final adverse action notice after the review period. The final notice must include the CRA’s name, address, and toll-free telephone number, a statement that the CRA did not make the decision, and notice of the applicant’s right to a free copy of the report within 60 days under 15 U.S.C. § 1681j(b).
5. Document every step with timestamps. Audit-ready records of pre-adverse notice delivery, review period, and final notice delivery are essential for demonstrating compliance during bureau audits or FTC inquiries.
6. Forward disputes to the originating CRA within the required timeframe. Under 15 U.S.C. § 1681i, the CRA must conduct a reasonable reinvestigation within 30 days of receiving a written dispute and forward it to the original furnisher.
7. Florida note: Florida HOA and condo boards that participate in the approval decision must be included in the adverse action documentation chain. Board voting records should be timestamped and retained alongside the adverse action file.

TenantEvaluation’s platform includes automated adverse action workflows built to the FCRA standard, with timestamped audit trails for every notice. See the two-notice process automated from pre-adverse through final notice, with IDVerify identity confirmation built in.

Florida HOA and Condo Screening Compliance with TransUnion

Florida community associations operate under a dual compliance framework that combines federal FCRA obligations with Florida-specific governance requirements in HOA and condominium statutes.

1. Align screening criteria with governing documents. Florida HOAs and condominiums must apply screening standards that are consistent with their recorded declarations, bylaws, and rules. Criteria not supported by governing documents create fair housing exposure.
2. Apply uniform screening standards across all applicants. Inconsistent application of screening criteria, including credit thresholds, criminal history lookups, or income requirements, creates disparate impact liability under the Fair Housing Act.
3. Retain all screening records connected to each application. Florida associations subject to audit or litigation must produce complete application files, including consent forms, screening reports, adverse action notices, and board voting records.
4. Manage age-restricted community documentation separately. Florida condos and HOAs operating as 55+ communities must maintain age-verification documentation that is distinct from standard screening records. TenantEvaluation’s 55+ Communities Verification capability standardizes how age-restricted requirements are handled across applications and improves documentation consistency.
5. Coordinate board approval records with screening timelines. Florida condominium and HOA approval processes often involve board votes that must align with FCRA adverse action timelines. Delays in board scheduling cannot extend the FCRA notice window.
6. Florida note: Florida Statute Chapter 718 (Condominium Act) and Chapter 720 (HOA Act) impose specific approval process requirements that interact with FCRA timelines. CAMs should confirm that their screening workflow accounts for both statutory frameworks at the same time.

Permissible Purpose Certification for TransUnion Resellers

Permissible purpose certification functions as the gatekeeper for every consumer report request, and failures at this stage create criminal exposure under the FCRA.

1. Certify permissible purpose at the reseller agreement level. TransUnion reseller agreements require a blanket certification of the permissible purposes under which the reseller will access consumer reports, tied to the specific business use case. This certification establishes the organization’s general authorization to access bureau data.
2. Certify permissible purpose at the individual report level. Because the blanket agreement only establishes general authorization, bureau agreements may require individual per-report certification of permissible purpose that confirms each specific request matches an approved permissible purpose, particularly for high-volume resellers.
3. Confirm consumer-initiated transaction before ordering. The permissible purpose for tenant screening is a legitimate business need in connection with a transaction initiated by the consumer. The applicant must have submitted an application before a report is ordered.
4. Maintain certification records for audit access. As noted in the compliance requirements above, these records must be produced upon request during bureau or regulatory audits.
5. Train staff on criminal liability for false certification. The FCRA provides that any person who knowingly and willfully obtains consumer information under false pretenses may be fined under Title 18 or imprisoned for up to two years, or both.
6. Florida note: Management companies operating across multiple Florida associations must ensure that permissible purpose certification covers each association entity separately, not only the management company umbrella.

Biometric Identity Verification as a Compliance Safeguard

Permissible purpose certification requires that a consumer-initiated transaction exists before a report is ordered, and IDVerify+ strengthens this requirement by confirming that the person submitting the application is the same person whose identity is being certified before the screening report is requested.

IDVerify+ integrates government-issued ID validation, AI-powered liveness detection, and biometric facial matching directly inside the TenantEvaluation workflow. This setup creates a documented, timestamped record that the applicant was physically present and identity-confirmed at the point of consent, which provides a layer of audit defensibility that document-upload-only workflows cannot match.

Florida CAMs that manage high-density communities or portfolios with elevated fraud exposure can move from document-based review to biometric-confirmed identity verification with IDVerify+. The verification result, including ID authenticity confirmation, liveness status, and biometric match result, appears directly in the screening report visible to the CAM and creates a complete audit trail from identity confirmation through final decision.

Comparing Reseller and Direct-User FCRA Obligations

This comparison table highlights how reseller obligations differ from direct-user obligations and where Florida-specific overlays apply.

Obligation	Reseller Requirement	Direct-User Requirement	Florida Note
Permissible Purpose Certification	Blanket certification plus individual per-report certification may be required	Blanket certification at agreement level, with no per-report certification typically required	Must cover each association entity separately in multi-association portfolios
Written Consumer Consent	Required before each report and retained for minimum five years	Required before each report, with retention period set by agreement	Must align with Florida Statute governing document requirements for application records
Adverse Action Notices	Must issue two-notice process under 15 U.S.C. § 1681m and avoid sending both notices on the same day	Same two-notice obligation applies as the decision-maker	Board voting timelines must align with FCRA notice windows under Chapters 718 and 720
Dispute Forwarding	Must forward disputes to originating CRAs, as illustrated by the RentGrow settlement referenced above	Must respond to disputes but does not forward to upstream CRAs	No Florida-specific overlay, so the federal FCRA standard applies
Source Disclosure	Must disclose all data sources including third-party databases upon consumer request	Must disclose the CRA that provided the report	No Florida-specific overlay, so the federal FCRA standard applies
Annual Recredentialing	Required by bureau agreement and includes security audit, training records, and compliance certification	Not typically required, although end-user agreements may include periodic review	Multi-association management companies must recredential at the entity level
Data Security Standards	Bureau-level encryption, access controls, and PCI compliance required	Reasonable security measures required, with bureau-level standards not always mandated	Florida Information Protection Act (FIPA) imposes breach notification obligations

Maintaining Audit-Ready Records with TenantEvaluation Workflows

Audit readiness functions as an ongoing operating posture, not a one-time project, so Florida CAMs need workflows that create compliance documentation automatically.

TenantEvaluation’s Lease Tracking capability connects resident onboarding, unit data, approvals, and lease documentation into one centralized, real-time workflow. Every lease record carries real-time status visibility, including active, pending, expired, or missing, with a searchable digital history of resident activity and document trails. When a bureau audit or regulatory inquiry arrives, the complete application-to-occupancy record is immediately accessible instead of scattered across folders and inboxes.

TEpayments by Zinc adds a connected payment workflow inside the same platform. Application fees and deposits are collected within the onboarding process, with payments going directly from the applicant to the Association’s designated account. TenantEvaluation organizes the workflow but never holds the funds. The result is a traceable payment record that boards and auditors can access alongside the screening and lease documentation, creating one connected audit trail from application submission through occupancy.

TenantEvaluation has processed 100,000+ applications annually across 5,000+ communities, with FCRA compliance as the operational foundation. See how Lease Tracking and TEpayments by Zinc create an audit-ready record across every stage of the resident lifecycle in a live platform walkthrough.

Frequently Asked Questions

Is TenantEvaluation a legitimate TransUnion reseller, and what does that mean for my community association?

TenantEvaluation is a direct, legitimate reseller of TransUnion and Equifax data. Reseller status means TenantEvaluation accesses bureau data under strict bureau rules, maintains regular compliance reviews and audits, and uses no gray-market or offshore data sources. For community associations, the screening reports ordered through TenantEvaluation carry the full chain of FCRA compliance, from permissible purpose certification through adverse action workflows, without the association needing to establish its own bureau relationship. The association remains the decision-maker, and TenantEvaluation serves as the compliant data provider.

Can a Florida HOA or condo association opt out of providing adverse action notices if the board makes the final decision?

No. The FCRA adverse action obligation applies to any entity that takes adverse action based in whole or in part on a consumer report, regardless of whether a board or a manager makes the final decision. Florida HOA and condo boards that participate in the approval vote are part of the decision-making chain. The two-notice process, which includes a pre-adverse action notice with the report and Summary of Rights followed by a final adverse action notice after the review period, must be completed before the denial or conditional approval is communicated to the applicant. Board voting timelines must be structured to accommodate the FCRA notice window, not the other way around.

What information must a Florida property manager include in an adverse action notice when using TransUnion screening data?

The adverse action notice must include a statement that adverse action was taken, the name, address, and toll-free telephone number of the consumer reporting agency that provided the report, a statement that the CRA did not make the decision and cannot provide specific reasons for it, and notice of the applicant’s right to obtain a free copy of the consumer report within 60 days of the notice. The notice may be delivered orally, in writing, or electronically. The pre-adverse action notice must also include a copy of the actual consumer report and the CFPB/FTC Summary of Consumer Rights. Both notices must be timestamped and retained as part of the application audit file.

How does annual recredentialing work for a Florida management company operating as a TransUnion reseller?

Annual recredentialing requires the management company to re-certify its permissible purposes, provide evidence of current data security controls, confirm employee FCRA training completion, and demonstrate that adverse action and dispute-forwarding workflows remain compliant. For Florida management companies that manage multiple associations, recredentialing documentation must cover each entity operating under the reseller agreement. TenantEvaluation’s built-in audit trails, timestamped records, and automated workflows support the documentation requirements that bureau recredentialing reviewers examine.

What is the difference between reseller liability and direct-user liability under the FCRA for property managers?

A reseller assembles or merges consumer report information from one or more CRAs and furnishes the result to a third party. Resellers carry obligations that direct users do not, including forwarding consumer disputes to originating CRAs, disclosing all data sources upon consumer request, and maintaining bureau-level data security standards subject to annual recredentialing. Direct users receive a report and use it for their own permissible purpose, so they must comply with adverse action, written consent, and permissible purpose rules, but they do not carry the upstream dispute-forwarding or source-disclosure obligations that apply to resellers. The RentGrow enforcement action illustrates that reseller-specific obligations are enforced separately from general FCRA end-user requirements.

Conclusion

Florida CAMs, VPs of Operations, and Board Presidents exploring TransUnion reseller status in 2026 face a compliance framework that is specific, enforceable, and actively monitored. The RentGrow settlement demonstrates that reseller obligations, including permissible purpose certification, dispute forwarding, source disclosure, and duplicate-reporting prevention, function as the basis for multi-million-dollar enforcement actions.

TenantEvaluation is the only platform built specifically for Florida community associations with FCRA compliance as the foundation. As a direct TransUnion and Equifax reseller, TenantEvaluation provides built-in adverse action workflows, permissible purpose controls, biometric identity verification through IDVerify, centralized Lease Tracking, and connected payment workflows through TEpayments by Zinc, all inside one audit-ready platform designed for the compliance demands that community associations face. See how TenantEvaluation handles every reseller obligation so your association does not have to by requesting a live platform walkthrough.