Fair Credit Reporting Act (FCRA)

When the FCRA applies to hiring

The FCRA (15 U.S.C. 1681 and following) kicks in whenever an employer uses a consumer report for employment purposes. A consumer report is any report from a consumer reporting agency, which in practice means any outside background check vendor. Criminal record searches, motor vehicle records, credit reports, employment and education verifications run by a vendor, and drug test results reported through a screening company can all fall under it.

It covers applicants, current employees (for promotion, reassignment or retention decisions) and, in many cases, independent contractors, depending on the court. It does not cover a search your own HR team runs directly on a county court website, although state law may still apply.

The Consumer Financial Protection Bureau and the Federal Trade Commission share enforcement, but the bigger practical risk is private lawsuits. Willful violations carry statutory damages of $100 to $1,000 per person plus punitive damages and attorney fees, which is why FCRA claims are so often brought as class actions against high-volume employers.

The four steps of an FCRA-compliant background check

1. Certify to the vendor. Before the vendor will run reports, the employer certifies that it will follow the FCRA, will not misuse the information and will comply with equal employment laws.
2. Give a standalone disclosure. Tell the candidate in writing that a consumer report may be obtained for employment purposes. The disclosure must be clear and conspicuous and must be in a document that consists solely of the disclosure. Liability waivers, state notices for other states, at-will language and long legal paragraphs do not belong in it. This one rule drives more FCRA litigation than any other.
3. Get written authorization. The candidate signs to authorize the check. An electronic signature works. The authorization can sit on the same page as the disclosure, but nothing else should.
4. Follow the adverse action process. If anything in the report might lead you to reject or withdraw an offer, send a pre-adverse action notice with a copy of the report and the CFPB's 'A Summary of Your Rights Under the Fair Credit Reporting Act'. Wait a reasonable period before deciding; five business days is the common practice. If you go ahead, send a final adverse action notice naming the screening company, stating that the company did not make the decision, and explaining the right to dispute the report and get a free copy within 60 days.

Investigative consumer reports, the kind that include interviews with references or neighbors, need an extra disclosure within three days of requesting them.

A worked example from a high-volume program

A regional home health agency hires about 60 caregivers a month. Its screening vendor runs criminal, sex offender registry and license checks after a contingent offer.

Rachel, the recruiter, gets a report for a candidate named Darnell showing a theft conviction from nine years ago. Agency policy says theft within seven years disqualifies for in-home roles, but older convictions get an individualized review. Rachel does not reject him on the spot. She sends the pre-adverse action notice with the report and the summary of rights, and invites Darnell to share anything relevant. He replies within two days with proof that the record was expunged and the vendor reported it in error.

The agency asks the vendor to correct the report, clears Darnell and starts him in the next orientation class. Had Rachel skipped the pre-adverse step, the agency would have lost a qualified hire and handed him a strong FCRA claim.

What screening companies can and cannot report

Under the FCRA, a screening company cannot report arrests that did not lead to a conviction, civil judgments, paid tax liens or collection accounts once they are more than seven years old. Convictions themselves have no federal time limit. The seven-year limits do not apply when the job is reasonably expected to pay $75,000 a year or more.

Several states go further. California, New York and others restrict how far back conviction records can be reported or considered, and many cities and states layer on fair chance rules about when you can ask about records at all. Our ban the box entry covers that timing. State rules vary, so confirm the rules for every state where you hire.

The vendor is also required to follow reasonable procedures for maximum possible accuracy. Mismatched records, such as a conviction belonging to someone with the same name and birth year, are a common source of disputes, so choose a vendor that checks multiple identifiers.

FCRA compliance in high-volume hiring

At scale, the risk is not one bad decision. It is a flawed template copied into 40,000 applications. A few practices separate clean programs from litigated ones.

Keep the disclosure screen in your online application genuinely standalone, with no scroll-through release language. Have counsel review the exact screens candidates see, not a PDF version. Log when each candidate viewed the disclosure, signed and received each notice.

Automate the adverse action workflow, but keep a human decision in the middle. The system can send the pre-adverse notice and start the waiting clock; a trained reviewer should apply your written criteria, look at anything the candidate submits, and make the final call. For jobs with many conditional offers, make sure no one starts work, or is told they will not, before the waiting period ends.

Finally, line up the FCRA steps with your contingent offer letters and onboarding dates so a slow check does not quietly push start dates or lose candidates.

Common FCRA mistakes

• Adding a liability release or extra state notices to the disclosure document.
• Burying the disclosure in a long online application or the employment application's fine print.
• Rejecting a candidate the same day the report arrives without sending a pre-adverse action notice.
• Sending the pre-adverse notice without a copy of the report or the summary of rights.
• Using an outdated summary of rights form.
• Treating an in-house check of social media or court records as exempt while also relying on vendor findings.
• Applying a blanket rule that any conviction disqualifies, which raises disparate impact concerns under Title VII alongside the FCRA.