Employee Background Checks Under the FCRA: Disclosure and Adverse Action

When an employer uses a third-party screening company to check an applicant or employee, the Fair Credit Reporting Act governs the paperwork on both ends of the process. Before the report is ordered, the employer must make a specific disclosure and obtain written authorization. Before acting on it, the employer must run a two-step adverse action sequence.

Neither requirement asks whether the hiring decision was fair. They ask whether the process gave the individual notice and a chance to respond. That is why so much litigation in this area involves employers who made a defensible decision using an indefensible form.

When the statute applies at all

The FCRA is triggered when an employer obtains a consumer report from a consumer reporting agency for employment purposes. All three elements matter. A consumer report is information bearing on creditworthiness, character, general reputation, personal characteristics, or mode of living that is used or expected to be used for an eligibility decision. A consumer reporting agency is a business that regularly assembles or evaluates such information for third parties. Employment purposes include hiring, promotion, reassignment, and retention.

In practice: a criminal-history report, driving record, education verification, or employment verification ordered from a screening vendor is almost always a consumer report. Research an employer performs entirely on its own — a manager running a web search, or an internal reference call — generally is not. Once a vendor is in the chain, the statute applies even if the report contains only public-record data.

Section 604 of the Act, 15 U.S.C. § 1681b, sets the permissible purposes for furnishing a report and, in subsection (b), the specific conditions for employment use.

The standalone disclosure and written authorization

Before procuring a report for employment purposes, the employer must provide a clear and conspicuous disclosure, in writing, that a consumer report may be obtained. The statute requires that the disclosure appear in a document that consists solely of the disclosure. The applicant must then give written authorization, which may appear on the same document.

The word "solely" has generated more litigation than any other requirement in this area. Language that has repeatedly caused problems includes liability releases and waivers, at-will employment acknowledgments, drug-testing consents, certifications about the truth of the application, state-specific notices bundled into the same page, and extraneous descriptions of the vendor's services. The safe construction is a single page containing the disclosure, the authorization signature block, and nothing else.

The employer must also certify to the screening company that it has made the required disclosure, obtained authorization, and will not use the information in violation of any applicable federal or state equal-opportunity law. That certification is normally embedded in the vendor service agreement and should be reviewed rather than assumed.

Verify before relying: Several states require their own notices or authorizations for background checks, and some require a separate check box before a copy of the report is sent to the applicant. Those state forms must be delivered as separate documents, not folded into the federal disclosure page.

The two-step adverse action sequence

If the employer intends to take adverse action based in whole or in part on the report, the process has two distinct stages separated by a real interval. Collapsing them into one letter is the second most common defect after the crowded disclosure form.

1. Step 1 — Decide provisionally, not finally

   The employer identifies information in the report that would disqualify the candidate and reaches a tentative decision. The decision must remain genuinely reversible; the requisition should not be closed and the offer should not be withdrawn yet.

2. Step 2 — Send the pre-adverse-action notice

   The notice must be accompanied by a copy of the consumer report the employer relied on and by the written summary of rights under the FCRA that the Consumer Financial Protection Bureau publishes. Screening vendors normally supply the current version of that summary; confirm it is the current one.

3. Step 3 — Allow a reasonable interval

   The statute does not specify a number of days. A commonly used market practice is five business days, which is a practice and not a legal minimum. The operative test is whether the individual had a real opportunity to dispute the accuracy of the report or explain the entry before the decision became final. Local fair-chance ordinances sometimes set a longer, mandatory window.

4. Step 4 — Consider what comes back

   If the individual disputes an entry or supplies context, someone with authority must actually review it and document the review. A process that logs responses without evaluating them is difficult to defend.

5. Step 5 — Send the final adverse action notice

   Required content under 15 U.S.C. § 1681m includes the name, address, and telephone number of the consumer reporting agency; a statement that the agency did not make the decision and cannot explain it; notice of the right to obtain a free copy of the report from the agency within 60 days; and notice of the right to dispute the accuracy or completeness of the information with the agency.

Adverse action is broader than a rejection. It covers denial of employment, denial of promotion, reassignment, and termination, and any other decision that adversely affects a current or prospective employee. Rescinding a conditional offer after a report comes back is adverse action, and the two-step process applies.

Criminal records, fair-chance rules, and individualized assessment

Federal FCRA procedure runs alongside a separate body of state and local law restricting how criminal history is used. Fair-chance statutes and ordinances commonly delay when criminal history may be requested until after a conditional offer, require an individualized assessment weighing the nature of the offense, the time elapsed, and the relationship to the job, and mandate a longer response window with a written statement of the specific conviction relied on.

Those rules layer on top of the FCRA rather than replacing it. An employer in a covered jurisdiction may need to send a pre-adverse-action notice that satisfies both regimes at once, and to hold the position open for longer than five business days. The consequences a conviction carries for the individual outside employment are a separate subject; our brief on plea agreements and collateral consequences covers how a collateral consequence arises and persists.

The FCRA also limits what agencies may report. Certain adverse items are subject to reporting time limits, and those limits do not apply to reports for positions above defined salary thresholds. Employers should not assume a report is complete or that omissions are errors.

Program controls that prevent claims

• A disclosure document reviewed for extraneous content, versioned, and dated internally, with the retired versions archived.
• An authorization record tied to each individual, retrievable by name and date, showing what was signed and when.
• A vendor agreement containing the required certification and the vendor's obligation to supply the current CFPB summary of rights.
• Templates for both notices, with the report and summary of rights attached automatically rather than manually.
• A tracked interval between notices, with the requisition held open and no system action that signals finality.
• A documented individualized assessment for criminal-history decisions where any covered jurisdiction applies.
• A single owner for the process — decentralized hiring managers issuing their own letters is the most common source of inconsistency.
• A periodic audit sampling completed files against the sequence above.

Because the same records are examined in workforce-reduction and investigation contexts, screening files should be maintained with the same discipline described in workplace investigation scope and records and coordinated with the notice planning in WARN Act and state mini-WARN compliance.

Questions the desk gets

Does the FCRA apply to current employees, or only applicants?

It applies to both. Reports obtained for retention, promotion, or reassignment decisions are for employment purposes, and the same disclosure, authorization, and adverse-action steps apply. Employers running periodic rechecks on existing staff sometimes rely on an authorization signed at hire that covers future reports. Whether an evergreen authorization is sufficient depends on how it was drafted and on state law; a fresh disclosure is the conservative approach.

What if the applicant says the report is wrong?

Direct the person to dispute the entry with the consumer reporting agency, which has statutory reinvestigation duties, and pause the final notice while the dispute is pending if the timeline allows. The employer is not required to investigate the accuracy of the report itself, but it should not proceed to final action while a documented dispute is live if doing so would defeat the purpose of the notice. Where the entry appears to result from identity theft, our brief on identity theft recovery explains what an identity theft report unlocks.

Are investigative consumer reports treated differently?

Yes. An investigative consumer report includes information about character, general reputation, or mode of living obtained through personal interviews with neighbors, friends, or associates. The employer must disclose in writing that such a report may be obtained, within three days of requesting it, explain the nature and scope of the investigation, and inform the consumer of the right to request additional disclosure of that nature and scope. Reference-check products sold by vendors sometimes fall in this category without the employer realizing it.

Who issues the notices when a staffing agency places the worker?

The party that obtains the report and makes the eligibility decision carries the obligations. In many staffing arrangements the agency orders the report and issues the notices, while the client company never sees the underlying data. Problems arise when the client makes the disqualifying decision after seeing report content, because the client has then used a consumer report and taken adverse action. Contracts should state which entity performs each step.

What is the exposure for getting the sequence wrong?

The Act provides for actual damages for negligent noncompliance, and statutory damages within a set range plus punitive damages for willful noncompliance, along with attorney fees. Because the defect is usually in a form used for every applicant, these cases are frequently brought as class actions even where no one suffered concrete harm from the underlying decision. The FTC's employer guidance and the CFPB both publish current materials on user obligations.

Where the risk actually sits

The risk sits in the form and the interval, not in the judgment call. Pull the disclosure document today and read it as a plaintiff's lawyer would: does it contain a single sentence that is not the disclosure? Then pull five completed adverse-action files and check the dates on the two notices. If the gap is zero, or if both letters were generated in the same batch, the program has a defect that applies to every file, not one file.

Fix the document first, because it affects the largest population. Fix the interval second, and give the decision owner explicit instructions that the requisition stays open. Then map the fair-chance jurisdictions where the company hires, since those rules override the default timing. Related pay-practice and workforce obligations are collected on the Employment & Workforce desk, including the deduction limits covered in wage deductions and expense reimbursement.