TransUnion won Ramirez, and name-only matching still lost

The week

On June 25, 2021, the Supreme Court decided TransUnion LLC v. Ramirez. TransUnion had offered a product that flagged consumers on credit reports as potential matches to people on the Treasury Department’s list of Specially Designated Nationals, based on a comparison of first and last names. A class of 8,185 people sued under the Fair Credit Reporting Act, alleging among other things that TransUnion failed to use reasonable procedures to ensure accuracy. In a 5-4 opinion by Justice Kavanaugh, the Court held that only the 1,853 class members whose misleading reports had been disseminated to third parties had suffered a concrete injury giving them standing to sue for damages in federal court on that claim. The rest, whose flagged files sat in TransUnion’s database unshared, did not.

Ramirez is taught mainly as a case about constitutional standing, and its effect on class actions is real. But the facts describe a data problem every bank, credit union and fintech will recognize. A system compared names, found superficial matches to a sanctions list, and attached a damaging flag to real people who had nothing to do with sanctioned parties. The lead plaintiff was reportedly refused a car purchase because of such a flag. TransUnion largely won on standing. The practice lost on every other measure. Three things govern a matching process like this, and the ruling changed none of them: the matching logic that creates the error, the moment of disclosure where the Court located the harm, and the enforcement channels that do not depend on private lawsuits.

The matching logic: names are not identities

Name-only matching is cheap and fast, and it produces false positives at scale. Common names, transliteration from other scripts, and naming conventions that order or combine names differently guarantee that a list of sanctioned individuals will appear to match many innocent people. Sanctions screening teams deal with this daily. Standard practice treats a name match as an alert to be resolved with other identifiers, such as date of birth, address, nationality or identification numbers, and never as a conclusion. OFAC’s own published guidance on evaluating a potential hit makes the same point, walking users through comparing full names, dates of birth, addresses and other details before treating a match as valid.

Incentives in screening push toward over-matching, because missing a true match can bring severe penalties while a false positive costs only review time. As an internal posture, that is reasonable. Ramirez shows where it becomes dangerous: when an unresolved potential match leaks into a customer-facing outcome, such as a frozen account, a declined payment, or a notice telling someone they appear on a list.

Any entity resolution process has an error rate, and the design question is what happens to its outputs. A useful practice is to tier them. Matches that only prompt internal review can tolerate low confidence. Matches shown to customers, used in decisions or sent to third parties need high confidence and a human or secondary check. The thresholds, the identifiers required at each tier, and the measured false positive rate should be documented and reviewed, the same way a credit model’s cut-offs are.

The moment of disclosure: where harm becomes concrete

The Court drew its line at dissemination. People whose inaccurate flags were sent to businesses suffered something close to the reputational harm of defamation. People whose flags stayed in a database did not, in the Court’s view, suffer a concrete injury, even though the risk of future disclosure existed.

That line has an operational corollary. Legal and reputational exposure peaks when data leaves the organization or drives a decision about a person. Controls are therefore worth most at those boundaries: before a report is furnished, before an adverse action is taken, before a flag reaches a counterparty or a customer screen. Concentrating quality checks at outbound interfaces gives the most risk reduction per hour of effort.

The ruling also invites complacency that the facts do not support. An inaccurate flag in a database is one query from disclosure. For a lender, that query may be its own underwriting system. For a fintech, it may be an API partner. Data that is wrong and stored is a liability waiting for a trigger, and the cheapest time to fix it is before the trigger arrives.

The enforcement channels: regulators need no standing

Article III standing limits private plaintiffs in federal court. It does not limit the CFPB, the FTC or state attorneys general enforcing the FCRA and state laws, nor bank examiners reviewing practices. State courts may apply different standing rules. A narrower path for federal class actions does not reduce the regulatory exposure of poor matching.

The duties differ by role. Consumer reporting agencies face the FCRA’s accuracy requirement directly. Banks and fintechs that furnish data to bureaus have their own accuracy and dispute obligations. Institutions using screening, fraud and identity verification outputs to make decisions about consumers may face adverse action notice duties. Organizations should check with counsel on which apply.

Disputes are an enforcement channel too, and an early warning system. Consumers who discover a wrong flag complain to the institution, to the bureau and increasingly to regulators’ complaint portals, where patterns are visible to supervisors. An institution that tracks disputes by root cause, and routes matching-related disputes back to the team that tunes the matching rules, learns about false positives from the people they harm before an examiner or journalist assembles the same picture.

Across all three, matching is a judgment encoded in software. The identifiers available, the thresholds chosen and the controls placed on outputs decide its quality. A ruling that narrows who can sue changes none of those engineering choices, and it should not lower the standard they are held to.

With hindsight

From 2026, Ramirez has had a lasting effect on litigation, with courts applying its concrete-injury test across privacy and data cases, including data breach suits. On the substance, regulation swung both ways. In November 2021, the CFPB issued an advisory opinion stating that consumer reporting agencies using name-only matching were not using reasonable procedures to ensure accuracy, and it brought enforcement actions over background screening accuracy. In May 2025, the CFPB withdrew that advisory opinion among 67 guidance documents. State regulators and attorneys general stayed active. The engineering point held regardless of the policy cycle: name-only matching produces false positives at scale, and outputs that reach other parties need stronger identifiers and review.