Anyone Can Pull Your Business Credit. Experian Says So Out Loud.

On the consumer side, someone needs a permissible purpose to pull your credit, and you can see every inquiry for free once a year. Neither of those is true for your business.

The bureaus are unusually candid about it. Experian: "unlike personal credit — which can be viewed only with the permission of the report holder — business credit scores are made available to the public. Anyone can view your business credit score for any reason." Elsewhere on the same site: "anyone, including your competitors and other creditors, can purchase your report without your permission."

D&B says the same: "Unlike personal credit files, anyone can purchase business credit reports."

Why this is legal

One definition does all the work. 15 U.S.C. § 1681a(c): "The term 'consumer' means an individual."

And § 1681a(d)(1) limits a "consumer report" to information used to establish eligibility for "credit or insurance to be used primarily for personal, family, or household purposes," employment, or another purpose authorized under § 1681b.

A report about an entity is neither about a consumer nor about household-purpose credit. So the FCRA machinery — permissible purpose, file disclosure, the free annual report, the reinvestigation timeline — never attaches.

Do business inquiries lower a business score?

This is where careful sourcing matters, because the three bureaus give three different answers and only one of them is on the record.

Experian's published Intelliscore Plus factor categories are credit factors ("Number of trade experiences, balances outstanding, payment habits, credit utilization and trends over time"), public records, and demographics ("Years on file, Standard Industrial Classification code and business size"). Inquiry frequency is separately listed as an influencing element and as an input to Predicted DBT.

What nobody publishes is a weight. There is no points-per-inquiry figure for any business score, from anyone.

What you can actually see

You can see counts and industries. You cannot see names. Nobody sells you the names.

D&B's definition of an inquiry is worth reading in full because it explains what the number means: "the number of individual request(s) for information… by a unique external customer(s) on a Dun & Bradstreet D-U-N-S Number in a rolling one-year (365-day) time period. More than one inquiry can be made by each unique customer, which would indicate that some customers have inquired on such D-U-N-S Number multiple times and may be monitoring the associated business."

Experian goes further on the display side. Its sample business reports carry a dedicated Inquiries section with monthly counts broken out by inquirer industry category — columns like Bank, Bureau, Financial Services, Insurance, Leasing, Transportation. Its glossary defines the window differently from D&B: "Inquiries are the number of companies making inquiries on the subject company in the last 9 months."

Experian also alerts on them: "Each time an entity orders a copy of a credit report for a company you have enrolled in Business Credit Advantage, you will be notified via an automated email alert," processed "weekly by Experian and sent to you every Tuesday."

On D&B's free tier, be precise about the limit: "CreditSignal only shows four of your Dun & Bradstreet scores for 14 days, then provides directional changes to such scores." Note also that CreditSignal is effectively retired branding — the URL redirects and the current free product is D&B Credit Insights Free.

The pull that does follow the rules

Here is the part people conflate. When a lender pulls the owner's personal credit as part of a business application — which is routine — that is a consumer report and the FCRA applies in full.

15 U.S.C. § 1681b(a) opens: "Subject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other." Permissible purposes include your written instructions and credit transactions involving an extension of credit.

The timing, from Experian and confirmed independently by FICO: hard inquiries "stay on your credit report for two years from the inquiry date. However, while lenders can see all inquiries made during that time, the inquiries only directly affect your credit score for one year." Experian adds that "A single hard inquiry will usually take fewer than five points off your FICO Score."

FICO is blunt about why business applications hit personal credit: "Many lenders will still check all the business owners' personal credit," and "There may be minimum consumer FICO Score requirements for all business owners." Related reading: business credit vs personal credit.

What is not published anywhere: which specific business credit products trigger a hard consumer pull versus a soft one. That is lender by lender. Ask before you apply, in writing.

There is no rate-shopping window

On the consumer side, FICO de-duplicates: multiple inquiries for the same credit type are treated "as a single inquiry because you're looking for one new form of credit," across "45 days for the newer versions of the FICO Scores" or 14 days for older versions. It applies only to auto loans, mortgages and student loans.

Nothing comparable is published for business credit. Not by D&B, not by Experian Business, not by Equifax Commercial, not by FICO for SBSS.

Practical consequence: shop lenders deliberately rather than in a shotgun burst, and prefer lenders who will pre-qualify on a soft pull. See how to build business credit fast without wasting inquiries.

What you do get: the right to ask why

The Equal Credit Opportunity Act does cover business applicants, and it gives you the one enforceable right in this whole area.

Per FTC business guidance, a business may request the reasons for a denial within 60 days, and "The creditor must give you the specific reasons - in writing - within 30 days of your request." You also cannot be denied business credit on the basis of race, color, religion, national origin, sex, marital status or age.

Regulation B, 12 CFR 1002.9(a)(3), splits the rules by size. For businesses with gross revenues of $1 million or less in the preceding fiscal year — excluding trade credit and factoring — action may be communicated orally or in writing, and the right-to-reasons disclosure may be given at application time rather than at denial. For businesses over $1 million, and for trade credit and factoring regardless of size, the creditor must provide written reasons if the applicant asks within 60 days.

Record retention differs too: one year after the decision for businesses under $1 million in revenue, but only 60 days for those over — unless you request longer retention or written reasons, which extends it to a year.

What 1071 does and does not do

People hear about the CFPB's small business lending rule and assume it will let them see who pulled their file. It will not — it is lender-side reporting to the CFPB, not a disclosure right for applicants.

Current status: the CFPB published a reconsideration final rule on May 1, 2026, effective June 30, 2026, with the compliance date extended to January 1, 2028. The reconsidered rule excludes merchant cash advances, agricultural lending and small-dollar loans; raises the origination threshold from 100 to 1,000 transactions annually; and lowers the small-business revenue threshold from $5 million to $1 million.

Litigation continues in three jurisdictions, where courts stayed compliance deadlines for some market participants but not for non-plaintiffs. If you find a CFPB page citing July 2025 or January 2026 compliance dates, it is stale — those were superseded.

What to actually do

What monitoring actually costs, side by side

If you want to know when someone pulls you, only one product publishes a per-pull alert. Here is the full published price ladder so you can see what you are choosing between.

Read that table against the fact that no bureau publishes a points-per-inquiry weight, and the spending decision gets simpler. You are buying awareness, not score protection.

Use the ECOA request as a diagnostic, not a formality

Because business credit files carry no FCRA dispute rights, the written statement of reasons you can demand after a denial is frequently the only document in the entire process that tells you what a lender actually saw.

1. Send the request in writing within 60 days of the denial. Reference the Equal Credit Opportunity Act and ask for the specific reasons for the adverse action.
2. Expect a written response within 30 days of your request.
3. If your prior-year gross revenue exceeded $1 million, send it immediately — Regulation B only requires the creditor to retain records for 60 days unless you request reasons or longer retention.
4. Compare the stated reasons against your own pulled reports. A reason that does not match anything on your file is a data error worth disputing at the bureau.

The inquiry is not the problem

People worry about inquiries because it is the one variable that feels controllable. But only one bureau publishes that inquiries influence anything, none publishes a weight, and nobody de-duplicates.

What is actually costing applications is what the puller finds once they are in: a name that does not match across systems, a file too thin to score, an address that flags, a lien nobody released. Those are fixable, and unlike inquiries, they are worth the attention.