We risk rate our vendors as critical, material, and minor. We previously used Equifax to make account opening decisions in addition to requesting credit reports for loans/new hires. We now only use them for the credit reports. We previously had them listed as a critical vendor due to customer information sharing and necessity to opening accounts. Is anyone doing regular due diligence on agencies strictly for the use of credit reports?