A common and costly misconception in fintech lending is that soft pulls are exempt from the Fair Credit Reporting Act's permissible purpose requirement. They are not. Under 15 U.S.C. § 1681b, every consumer report obtained, soft or hard, requires a permissible purpose. The hard-versus-soft distinction affects whether the inquiry shows on the consumer's report and influences their score. It does not change your FCRA obligation to have, and document, a valid purpose for the pull.
Key Takeaways:
- Soft pulls require a permissible purpose under FCRA exactly like hard pulls; the difference is score impact, not compliance obligation
- Genuine prequalification initiated by the consumer can rely on the consumer-initiated transaction purpose
- Prescreening (firm offers of credit) is a separate permissible purpose under § 1681b(c) with its own opt-out and firm-offer requirements
- Pulling a soft inquiry on a consumer who only browsed, without initiating a transaction, can be a pull without permissible purpose
- The documentation standard is the same as for hard pulls: tie each inquiry to a specific consumer action or statutory basis
Soft Pull vs Hard Pull: What Actually Differs
A hard inquiry is recorded on the consumer's credit report, is visible to other lenders, and can affect the consumer's credit score. It is typically used when the consumer applies for credit and the lender will make a decision.
A soft inquiry is not visible to other creditors and does not affect the score. It is used for prequalification, account review, prescreening, and the consumer's own checks of their report.
What does not differ: both require a permissible purpose. The FCRA's permissible purpose rule in § 1681b(a) governs whether a consumer reporting agency may furnish a report to you at all. It does not carve out soft inquiries. If you obtain a consumer report, soft or hard, you must have a statutory purpose and be able to show it. For the full documentation discipline at volume, see our pillar guide on permissible purpose documentation at scale.
Permissible Purpose for Prequalification
Prequalification is where most soft-pull confusion lives, because the word covers two different things.
Consumer-Initiated Prequalification
When a consumer affirmatively asks "what rate would I qualify for?" and provides identifying information to get an answer, the consumer has initiated a credit transaction. That generally supports a permissible purpose under § 1681b(a)(3)(A) (a credit transaction involving the consumer) or, depending on structure, § 1681b(a)(3)(F)(i). The triggering event is the consumer's request, and your documentation should capture it: who requested prequalification, when, and through what action.
The compliance risk appears when the "request" is thin. If a consumer merely lands on a page, or a partner submits a lead the consumer never authorized, and your system fires a soft inquiry, there may be no permissible purpose at all. A pull without a real consumer-initiated transaction is impermissible regardless of whether it was soft.
Prescreening (Firm Offers of Credit)
The other kind of "prequalification" is prescreening, where you, not the consumer, initiate the process to identify consumers for offers. Prescreening has its own permissible purpose under § 1681b(c), and it comes with conditions:
- You must extend a firm offer of credit to consumers who meet your predetermined criteria
- You must include a clear and conspicuous opt-out notice (consumers can opt out through OptOutPrescreen.com)
- You must retain the criteria, offer terms, and lists for the required period
Prescreening is not a license to pull credit for general marketing. If you obtain report information to target consumers but do not make a firm offer, you have exceeded the prescreening permissible purpose.
The Documentation Standard Is the Same
Because soft pulls carry the same permissible purpose requirement, they carry the same documentation requirement. For each soft inquiry, a defensible record captures:
- The consumer identifier the report was pulled on
- The timestamp of the pull
- The statutory basis (consumer-initiated transaction, prescreening under § 1681b(c), account review, etc.)
- The triggering event that justified it (a prequalification request, a prescreen campaign, a scheduled account review)
- The requestor (which system or process initiated the pull)
Examiners do not waive transaction-level documentation for soft pulls. The CFPB Supervision and Examination Manual's FCRA module instructs examiners to verify a permissible purpose for each consumer report obtained. "Each" includes soft inquiries. The mechanics of building this record into an API workflow are covered in our FCRA compliance requirements for fintech lenders.
Where Fintechs Get Into Trouble
Soft-pull permissible purpose failures tend to cluster around a few patterns:
- Partner-originated leads. A marketing partner submits "applications" the consumer never completed, and the system fires soft inquiries with no consumer-initiated transaction behind them.
- Browse-to-pull triggers. A page view or abandoned form triggers a soft pull before the consumer has actually requested anything.
- Prescreen without firm offers. Report data is used to target consumers, but no firm offer of credit follows, exceeding the § 1681b(c) purpose.
- Account review drift. Soft pulls on existing customers are run as "routine monitoring" without a documented business reason tied to a specific account function.
- No retention link. Soft inquiries are logged by the bureau, but nothing in the lender's system ties each one to its triggering consumer action, so it can't be reconstructed for an examiner.
These are the same failure modes that produce hard-pull findings, which is the point: the soft label does not lower the bar.
Soft pulls need the same permissible purpose evidence as hard pulls, captured at the moment of the pull. See how Canarie ties each inquiry to its statutory basis and triggering event →
A Practical Rule of Thumb
If you are deciding whether a given soft pull is safe, ask three questions:
- What statutory purpose applies? Name the specific § 1681b provision, not "general lending."
- What did the consumer actually do? Identify the concrete, consumer-initiated action (or, for prescreening, confirm a firm offer will follow).
- Can I prove both for this exact pull? If you can't reconstruct the link between the inquiry and the triggering event, you have a documentation gap even if the purpose was valid.
When all three have clean answers and the answers are recorded automatically at the time of the pull, soft inquiries are defensible. When any answer depends on after-the-fact reconstruction, you have the exposure examiners look for.
Frequently Asked Questions
Do soft pulls require a permissible purpose under FCRA?
Yes. Every consumer report obtained under FCRA requires a permissible purpose, whether the inquiry is hard or soft. The soft-versus-hard distinction affects score impact and visibility to other lenders, not your obligation to have and document a valid statutory purpose for the pull.
Can I run a soft pull for prequalification without the consumer applying?
Only if the consumer initiated the prequalification, which generally supports a consumer-initiated transaction purpose, or if you are prescreening under § 1681b(c) and will extend a firm offer of credit. A soft pull triggered by a page view or an unauthorized partner lead, with no consumer-initiated action, can lack a permissible purpose.
What is the difference between prequalification and prescreening?
Prequalification is typically consumer-initiated: the consumer asks what they would qualify for. Prescreening is lender-initiated: you identify consumers for firm offers of credit. They rely on different permissible purposes, and prescreening carries firm-offer and opt-out requirements under § 1681b(c).
Do I have to document soft pulls the same way as hard pulls?
Yes. The documentation standard is identical. For each soft inquiry, record the consumer, timestamp, statutory basis, triggering event, and requesting system. Examiners verify a permissible purpose for each consumer report obtained, and that includes soft inquiries.
Does a soft pull hurt a consumer's credit score?
No. A soft inquiry is not visible to other creditors and does not affect the consumer's credit score. That is the practical difference from a hard inquiry. It does not change the FCRA permissible purpose requirement.
Capture Purpose at the Point of the Pull
The soft-pull trap is treating these inquiries as low-risk and skipping the documentation you would never skip for a hard pull. At fintech volume, that gap surfaces the moment an examiner samples your inquiry log and asks you to justify each one.
Canarie maps FCRA permissible purpose to your credit pull workflows, including soft inquiries and prescreening, so every pull is tied to its statutory basis and consumer action and is exportable on demand.