FCRA Compliance for Employers: A Practical Guide

The Fair Credit Reporting Act is a federal law enacted in 1970 and significantly updated in 2003. It governs how consumer reporting agencies (CRAs) — including background check companies — collect, use, and share consumer information.

When you hire a third-party service to run a pre-employment background check, you become a "user" of a consumer report under the FCRA. That triggers a specific set of obligations that apply before, during, and after the screening process.

The FCRA applies any time you use a CRA to obtain criminal history reports, credit reports for employment purposes, driving records, employment or education verifications, or drug test results in some cases. If you're pulling these reports yourself through public records — not through a CRA — the FCRA doesn't apply. But the moment you use a third-party screening service, you're covered.

Before you run a background check on a job applicant or employee, you must provide a written disclosure informing them that you may obtain a consumer report for employment purposes.

This disclosure must be in a standalone document — it cannot be buried in an employment application or combined with other forms. It must be clear and conspicuous, written in plain language rather than legal boilerplate, and provided before you request the report.

This is where many employers trip up. Embedding the disclosure in a multi-page application packet — even if the applicant signs it — doesn't satisfy the FCRA's standalone requirement. Courts have ruled against employers on exactly this point. Your background check provider should supply a compliant disclosure form. Use it.

Along with the disclosure, you must obtain the applicant's written authorization before ordering the report. This can be on the same standalone document as the disclosure, or a separate form — but it must be written and signed.

Electronic signatures are acceptable. A checkbox on an online application is not sufficient on its own unless it's part of a proper e-signature process with a clear audit trail.

Keep signed authorization forms on file. If you're ever challenged on a hiring decision, you'll want proof that consent was obtained before the report was pulled.

The FCRA doesn't just govern how you get the report — it also limits how you use it. Most negative information in a consumer report cannot be reported after seven years. Bankruptcies can be reported for up to 10 years. If the position pays $75,000 or more annually, these time limits don't apply.

An arrest is not a conviction. Using an arrest record that didn't result in a conviction as a basis for not hiring someone is legally risky and, in many states, explicitly prohibited. Focus on convictions — and even then, consider whether the offense is relevant to the job.

You can only use a credit report for employment purposes if the position involves financial responsibility, access to sensitive financial data, or fiduciary duties. Using credit reports for general hiring without a job-related justification is a violation — and several states have additional restrictions on employment credit checks.

This is the step most employers miss — and it's the one that generates the most litigation. If you're considering taking an adverse action (not hiring, not promoting, terminating) based in whole or in part on information in a background check, you must follow a two-step process.

Before you make the final decision, you must send the applicant a pre-adverse action notice — a letter informing them you're considering not hiring them based on the background check. You must include a copy of the background check report and a copy of "A Summary of Your Rights Under the FCRA." The purpose is to give the applicant a reasonable opportunity to dispute inaccurate information before you finalize your decision.

There's no specific number of days mandated by the FCRA, but the FTC and courts have generally indicated that five business days is a reasonable minimum. Once the waiting period has passed and you've made your final decision, you must send a final adverse action notice identifying the CRA, noting that the CRA did not make the hiring decision, and confirming the applicant's right to a free copy of the report within 60 days. This two-step process is non-negotiable.

Not all background check providers are FCRA-compliant. If you use a service that doesn't follow FCRA requirements, you can be held liable alongside them. Always verify that your screening provider is a legitimate CRA operating under the FCRA.

Combining the disclosure with other documents is one of the most common — and most litigated — FCRA violations. The FCRA requires a standalone disclosure, full stop.

Many employers send a rejection letter and move on. If that rejection was based even partly on a background check, skipping the pre-adverse action notice is a violation. The FCRA also sets a federal floor — states and cities can add requirements on top of it. Ban-the-box laws now exist in dozens of states and cities. California, New York, and Illinois have particularly detailed requirements. Always check the laws in your jurisdiction.

A compliant pre-employment background check process doesn't have to be complicated. Before the check: provide a standalone FCRA disclosure, obtain written authorization, and confirm your CRA is FCRA-compliant.

After the check: if considering adverse action, send the pre-adverse action notice with a copy of the report and the FCRA summary of rights. Wait a reasonable period (at least five business days). Send the final adverse action notice if you proceed. Keep records of every step.

Use a reputable, FCRA-compliant background check provider. Establish a written screening policy before you begin accepting applications. Apply your criteria consistently to every applicant to reduce the risk of discrimination claims. When in doubt, get legal advice. The cost of a consultation with an employment attorney is far less than the cost of an FCRA lawsuit.