FCRA Background Check Compliance for Employers

If you run a background check on a job applicant through a screening company, federal law requires you to follow a specific sequence before you can act on what it says. Most small employers do not know the sequence exists. It is one of the most litigated areas of the Fair Credit Reporting Act, and the violations are usually procedural rather than malicious.

The uncomfortable part: you can run a lawful check, find something genuinely disqualifying, make a defensible hiring decision, and still be liable — because of how you papered it.

Whether This Applies to You

The FCRA reaches you if you obtain a consumer report from a consumer reporting agency for employment purposes. In plain terms: if you pay a background screening company to check an applicant, you are covered.

Things that commonly surprise people:

• Company size does not matter. There is no small-employer exemption.
• Volunteers count where the screening is for a position of responsibility. Churches and nonprofits are not outside this.
• Existing employees count. Running a check on a current employee for promotion, retention, or reassignment triggers the same duties as hiring.
• Contractors and gig workers are frequently covered, depending on the arrangement.
• It is not only criminal history. Credit checks, driving records, and employment verification obtained through a screening company are all consumer reports.

What generally falls outside: checks you conduct entirely yourself, such as calling a former employer directly or searching a public court website, without using a third party.

The Five Steps, in Order

Order matters. Doing the right things in the wrong sequence is still a violation.

1. Provide a clear, standalone written disclosure Before obtaining the report, give the applicant a written notice stating that a consumer report may be obtained for employment purposes. It must consist solely of that disclosure.
2. Get written authorization The applicant must authorize the check in writing. This may appear on the same document as the disclosure, but nothing else may.
3. Certify to the screening company You must certify to the agency that you made the disclosure, obtained authorization, will comply with adverse action requirements, and will not use the information in violation of equal opportunity laws.
4. Send a pre-adverse action notice, then wait Before taking adverse action based in whole or in part on the report, provide a copy of the report and the summary of rights document — then allow a reasonable period for the applicant to respond.
5. Send the final adverse action notice After the waiting period, if you proceed, send a notice containing the required elements set out below.

The Standalone Disclosure — Where Most Employers Fail

This single requirement produces more FCRA class actions against employers than anything else, and the reason is that the natural thing to do is the wrong thing.

The disclosure must be in a document that consists solely of the disclosure. Not a section of the application. Not a paragraph in the onboarding packet. Not a page that also contains a liability waiver, an at-will employment acknowledgment, a state-law notice, or a release of claims.

Practical rule: the disclosure document should contain the disclosure, and the authorization, and nothing else. Everything else you want signed goes on a different piece of paper.

A second, related point — the disclosure must be clear and conspicuous. Dense legal paragraphs, small type, and language an ordinary applicant cannot follow have all been challenged.

The Pre-Adverse Action Notice and the Waiting Period

This is the step people skip entirely, usually because it feels redundant. It is not redundant — it is the applicant's only opportunity to correct a report before it costs them the job.

Before you take adverse action, you must provide:

• A copy of the consumer report you relied on.
• The written summary of consumer rights prescribed for this purpose.

Then you wait. The FCRA does not state a number of days; it requires a reasonable opportunity to respond. Many employers work to a defined internal period so the practice is consistent and documentable, and counsel can advise what is appropriate for your situation.

If the applicant does respond and disputes something, do not simply proceed. Consider what they provided, and document that you did.

The Final Adverse Action Notice

If you proceed after the waiting period, the final notice must include:

• Notice that adverse action was taken based in whole or in part on the consumer report.
• The name, address, and telephone number of the consumer reporting agency that supplied the report.
• A statement that the agency did not make the decision and cannot give the specific reasons for it.
• Notice of the applicant's right to obtain a free copy of the report from the agency within the period the statute allows.
• Notice of the right to dispute the accuracy or completeness of the information with the agency.

"Adverse action" is broader than not hiring. It includes denial of promotion, reassignment, termination, and other decisions adverse to the individual.

Seven Mistakes That Produce Lawsuits

• Burying the disclosure in the application. The most common violation, and the easiest for a plaintiff to prove from your own paperwork.
• Including a liability release in the disclosure document. See above.
• Skipping the pre-adverse action notice and going straight to rejection.
• Not sending the report itself with the pre-adverse notice. The applicant cannot dispute what they have not seen.
• Acting immediately after sending the pre-adverse notice. Same-day rejection defeats the purpose and will be treated that way.
• Re-screening existing employees without a fresh disclosure and authorization, on the theory that the original one covers it.
• Assuming the screening company handles compliance. It does not. Its obligations are its own; yours remain yours.

State and Local Law Sits on Top of This

Federal law is the floor, not the ceiling. Many states and a growing number of cities add requirements: restrictions on when criminal history may be asked about, limits on how far back records may be considered, additional notices, and separate state-law disclosure documents.

Two practical consequences. First, the obligations generally follow where the applicant is, so a multi-state employer may have several sets of rules in play. Second, a state-required notice usually cannot be combined with the federal standalone disclosure — that is the standalone problem again, arriving from a different direction.

A Compliance Checklist

• Our disclosure is a separate document containing only the disclosure and authorization.
• It contains no liability release, no waiver, no at-will language, no state-law notices.
• It is written plainly enough for an ordinary applicant to understand.
• We obtain written authorization before requesting any report.
• We provide the required certification to our screening company.
• We send a pre-adverse action notice with a copy of the report and the summary of rights.
• We allow a consistent, documented period for response before acting.
• We actually consider responses we receive, and record that we did.
• Our final adverse action notice contains all five required elements.
• We repeat the process for re-screens of current employees.
• We have checked the requirements of every state and city where we hire.
• We retain the paperwork, and we dispose of report data properly when we no longer need it.

Common Questions

Does the FCRA apply to small employers?

Yes. There is no small-business exemption. If you obtain a consumer report from a screening company for employment purposes, the requirements apply regardless of headcount.

Can the background check disclosure go in the job application?

No. The disclosure must be in a document consisting solely of the disclosure. Including it in an application, or adding a liability release to it, is the most commonly litigated FCRA violation by employers.

How long must I wait after the pre-adverse action notice?

The FCRA requires a reasonable opportunity to respond rather than specifying a number of days. Many employers adopt a consistent internal period so the practice is uniform and documentable. Ask counsel what is appropriate for your situation.

Do these rules apply to volunteers?

Generally yes, where a consumer report is obtained through a screening company for a position of responsibility. Churches and nonprofits are not outside the FCRA.

Does my screening company handle compliance for me?

No. The screening company has its own obligations as a consumer reporting agency. The disclosure, the authorization, the certification, and both adverse action notices are yours. Many screening companies provide template documents, but using a template does not transfer the liability.

Last updated: September 11, 2026 · Published by the FCRA Professional Institute