A signed authorization from the consumer is not required before pulling a credit report in connection with a legitimate business transaction initiated by the consumer (e.g. application for a loan). However, some financial institutions may choose to have a policy in place that requires written authorization.
See section 604 of the FCRA for a list of permissible purposes for pulling credit reports and what is required.