The Fair Credit Reporting Act governs how US employers can use consumer reports — including background checks, credit reports, and motor vehicle records — in hiring decisions. Violating the FCRA is not a technicality risk; it is the basis for substantial class action litigation that has resulted in multi-million dollar settlements against household-name employers. This guide explains what you must do, in the right order, every time you run a background check on a job candidate.
What the FCRA Covers in Employment
The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) was enacted in 1970 and has been amended several times, most significantly by the Consumer Credit Protection Act and the Fair and Accurate Credit Transactions Act. In the employment context, the FCRA regulates the use of "consumer reports" — information gathered by Consumer Reporting Agencies (CRAs) about individuals.
In hiring, a consumer report includes any report prepared by a CRA that contains information about a person's character, general reputation, personal characteristics, or mode of living. This covers:
- Criminal background checks
- Credit reports used in employment decisions
- Motor vehicle records
- Education and employment verification reports
- Reference checks conducted by a third-party CRA
- "Investigative consumer reports" (in-depth checks involving personal interviews with neighbours, friends, or associates)
The FCRA does not apply to background checks conducted entirely in-house by the employer (e.g., searching public court records directly), only to reports obtained from third-party CRAs. However, most employers use third-party background check providers, making the FCRA relevant to virtually all employment background screening.
Which Employers Must Comply
The FCRA applies to any employer that uses a consumer report — obtained from a CRA — in making employment decisions. There is no minimum employee threshold. A company with 5 employees that uses a background check service must comply with the FCRA's employer obligations. State and local background check laws may impose additional or stricter requirements — ban-the-box laws, credit check restrictions, and longer adverse action timelines vary significantly by jurisdiction.
The Consent Requirement: What Candidates Must Sign
Before obtaining a consumer report, the employer must complete two separate legal steps — disclosure and authorisation. These are distinct requirements that cannot be combined with the employment application or with other documents.
Step 1: Provide a standalone disclosure. The employer must provide the candidate with a clear, written disclosure that a consumer report may be obtained for employment purposes. This disclosure must appear in a document that consists solely of the disclosure — it cannot be buried in an employment application, an offer letter, or an employee handbook. Courts and the FTC have consistently held that a disclosure buried within other material violates the standalone requirement.
Step 2: Obtain written authorisation. The employer must obtain written authorisation from the candidate before obtaining the report. The authorisation may appear on the same document as the disclosure, but both must be present. Electronic signatures are permissible.
For investigative consumer reports only: If you are obtaining an investigative consumer report (one that includes personal interviews), you must provide an additional written notice within three days of requesting the report, advising the candidate of their right to request a description of the nature and scope of the investigation.
Common mistakes employers make in the disclosure/authorisation phase:
- Including the disclosure within the employment application (violates the standalone requirement)
- Adding liability releases, waivers, or other language to the disclosure document (the FTC and courts have found this may violate the standalone requirement)
- Obtaining verbal consent rather than written authorisation
- Using a disclosure form that references the employer's policies rather than focusing solely on the consumer report notice
The Standalone Document Rule in Practice
The standalone disclosure requirement has been the basis for dozens of class action lawsuits. Employers have faced settlements in the $5 million–$30 million range for embedding disclosure language within an employment application. The fix is simple: use a separate, single-purpose document that contains only the FCRA disclosure and authorisation — nothing else. Have employment counsel review your form before deployment.
Adverse Action Process: The Two-Step You Must Follow
If an employer intends to take an adverse action — declining to hire, withdrawing an offer, or rescinding a conditional offer — based in whole or in part on information in a consumer report, the FCRA requires a two-step process before the decision becomes final.
Step 1: Pre-adverse action notice (before the decision is made).
Before taking adverse action, the employer must provide the candidate with:
- A copy of the consumer report
- A copy of the FTC's "A Summary of Your Rights Under the Fair Credit Reporting Act" document
- Contact information for the CRA that prepared the report
The purpose of the pre-adverse action notice is to give the candidate an opportunity to dispute inaccurate or incomplete information in the report before the employer's decision is finalised. The candidate must be given a "reasonable" period — the FTC has suggested at least five business days is reasonable, though some employers use three to seven days.
Step 2: Adverse action notice (after the waiting period).
After the waiting period has elapsed — assuming the candidate has not raised a dispute that changes the outcome — the employer may take the adverse action and must then provide the adverse action notice. This notice must include:
- The name, address, and phone number of the CRA that provided the report
- A statement that the CRA did not make the adverse action decision and cannot explain why the decision was made
- The candidate's right to obtain a free copy of the consumer report from the CRA within 60 days
- The candidate's right to dispute the accuracy or completeness of the report with the CRA
Critical point: the adverse action notice does not need to explain the employer's reasoning. The employer is not required to disclose which specific information in the report influenced the decision. However, the employer must provide all of the above elements — omitting any one of them constitutes a FCRA violation.
What Consumer Reporting Agencies (CRAs) Must Provide
CRAs — the companies that prepare background check reports — have their own FCRA obligations that are separate from the employer's. However, understanding these obligations helps employers design a compliant process.
CRAs must:
- Follow reasonable procedures to ensure the maximum possible accuracy of reported information
- Maintain a process for consumers to dispute inaccurate information
- Provide the candidate with a copy of their report upon request
- Investigate disputed information within 30 days (or 45 days in certain circumstances)
- Delete or correct information found to be inaccurate or unverifiable
Employers should ensure that their background check vendor is a legitimate CRA with documented FCRA compliance procedures, and that the vendor's reports clearly identify the source of each reported item. This documentation becomes important if a candidate disputes a report item during the adverse action waiting period.
Choosing a FCRA-Compliant Background Check Vendor
Not all background check services are created equal. Verify that your vendor is a registered CRA, maintains an FCRA-compliant dispute process, provides current and accurate data, and has a data security programme appropriate for handling personal information. Request a copy of the vendor's FCRA compliance documentation before signing a contract, and confirm that the vendor will provide candidates with dispute information as required by law.
State-Specific FCRA Complications
The FCRA sets the federal floor for background check compliance in employment, but many states and localities have enacted laws that impose stricter requirements. Employers operating in multiple states must navigate a patchwork of overlapping obligations.
Ban-the-box laws: At least 37 states and over 150 cities and counties have enacted "ban the box" laws that restrict when employers can ask about criminal history. Many prohibit asking about criminal records on the initial application. Some require that an offer be made before a background check is initiated. California, New York City, and Philadelphia have particularly detailed requirements.
Credit check restrictions: Many states limit or prohibit employer use of credit reports in hiring decisions. California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Nevada, Oregon, Vermont, and Washington have statutes restricting credit checks in employment to specific job categories (financial roles, positions with fiduciary responsibility) or prohibiting them entirely for most positions.
Criminal history look-back limitations: The FCRA limits CRAs from reporting most criminal records older than seven years (with exceptions for positions paying over $75,000/year). Some states impose shorter look-back periods or categorical restrictions on what criminal records can be reported at all.
Extended adverse action timelines: Some states require a longer waiting period between pre-adverse action notice and finalising the adverse decision — California, for example, requires a minimum of five business days after the pre-adverse action notice before taking final adverse action. New York City's Fair Chance Act imposes even more detailed procedural requirements.
How to Document FCRA Compliance in Your ATS
FCRA compliance depends entirely on documentation. If you cannot demonstrate that you provided the required notices at the right times and in the right sequence, you cannot defend against an FCRA claim. Your ATS should support this documentation process:
- Consent tracking: Record the date and method by which each candidate provided written authorisation for a background check. This should be time-stamped and stored in the candidate's record.
- Notice delivery records: Log when pre-adverse action notices were sent, to which email address or mailing address, and which documents were included (copy of report, FCRA summary of rights).
- Waiting period tracking: Track the date of the pre-adverse action notice and enforce the waiting period before finalising any adverse action. Automated workflows that prevent an adverse action stage from being completed before the waiting period has elapsed reduce the risk of procedural violations.
- Adverse action notice records: Record when the final adverse action notice was sent and confirm all required elements were included.
- Retention: EEOC regulations require that hiring records — including background check records — be retained for at least one year. Some state laws impose longer retention requirements. Your ATS should enforce configurable retention periods.
| FCRA Step | Timing | Required Documents | Treegarden Support |
|---|---|---|---|
| Standalone disclosure | Before obtaining report | FCRA disclosure form only | Document upload + timestamp logging |
| Written authorisation | Before obtaining report | Signed authorisation form | Digital signature capture, timestamped |
| Pre-adverse action notice | Before finalising adverse decision | Report copy + FCRA rights summary | Workflow stage with mandatory waiting period |
| Waiting period | Minimum 5 business days (recommended) | N/A | Configurable delay before adverse action stage unlocks |
| Adverse action notice | After waiting period | CRA contact info + candidate rights | Automated template with required elements |
| Records retention | 1+ years after action | All above documents | Automated retention policy, configurable by state |
Common FCRA Violations That Lead to Class Action Lawsuits
FCRA class action litigation has become a significant area of employment law. The following violations are the most frequently cited in class action complaints and regulatory enforcement actions:
- Defective disclosure forms: The most common class action basis. Disclosure forms that include additional language — authorisations to verify information, liability waivers, at-will employment statements — have been held to violate the standalone requirement. Even well-intentioned additions create liability.
- Failure to provide pre-adverse action notice: Employers who notify candidates of disqualification without first providing the consumer report and FCRA rights summary violate the two-step adverse action process. This is particularly common when HR teams are not aware that a background check influenced a staffing agency's candidate recommendation.
- Insufficient waiting period: Finalising an adverse action the same day as the pre-adverse action notice, or before the candidate has a meaningful opportunity to dispute the report, violates the FCRA's purpose. Courts have found same-day or next-day adverse actions problematic.
- Using consumer reports for current employees without consent: The FCRA applies to employment decisions for current employees, not just hiring. Running a background check on a current employee for a promotion or internal transfer without a new disclosure and authorisation is a violation.
- Incomplete adverse action notices: Adverse action notices that omit required elements — the CRA's contact information, the statement that the CRA did not make the decision, or the candidate's right to a free report — violate the FCRA regardless of whether the underlying adverse decision was justified.
Class Action Settlement Scale
FCRA class action settlements have ranged from $2 million to $30 million+ for major employers. Plaintiffs' firms actively recruit lead plaintiffs for FCRA cases because the statute provides for statutory damages of $100–$1,000 per violation (plus attorneys' fees) even without proof of actual harm. A flawed disclosure form sent to 10,000 applicants creates 10,000 potential statutory damages claims.
Free Calculators for This Topic
Save time with these free HR calculators — no sign-up required:
Frequently Asked Questions
Does the FCRA apply if we run background checks in-house?
The FCRA's employer obligations apply only when you use a Consumer Reporting Agency — a third-party provider — to obtain background check information. If you personally search public court records, verify employment directly with past employers, or check references yourself without a CRA intermediary, the FCRA does not apply to that specific activity. However, most employers use CRA-provided background check services, which triggers full FCRA compliance obligations.
What is the minimum waiting period between pre-adverse action notice and the final adverse decision?
The FCRA does not specify a fixed number of days — it requires a "reasonable" time for the candidate to respond to the pre-adverse action notice. The FTC has indicated that five business days is typically a reasonable minimum. Several states impose longer statutory waiting periods. Best practice is a minimum of five business days, and longer in states with explicit requirements (California, New York City, etc.).
Can we use a background check vendor's form for the FCRA disclosure?
Yes, provided the vendor's form meets the standalone requirement — it contains only the FCRA disclosure and authorisation, nothing else. Review your vendor's form carefully before use. Many vendors provide compliant forms, but it remains the employer's legal responsibility to ensure the form meets FCRA requirements. Have employment counsel review the form, particularly if you operate in multiple states.
What if a candidate disputes information in the background check report during the waiting period?
If a candidate raises a dispute during the waiting period, the employer should pause the adverse action process until the dispute is resolved. The employer should notify the CRA of the dispute; the CRA has 30 days to investigate and correct any inaccurate information. Once the dispute is resolved — either by confirming the original information or correcting it — the employer can resume the adverse action process or reconsider the hiring decision in light of corrected information.
How does Treegarden support FCRA compliance documentation?
Treegarden's background check workflow includes timestamped logging of consent collection, automated waiting period enforcement (configurable by state), template-based pre-adverse action and adverse action notices that include all FCRA-required elements, and records retention policies that comply with EEOC and FCRA retention requirements. All background check-related actions are logged in the candidate's record for audit purposes.
Making FCRA Compliance a Systematic Process, Not an Ad Hoc One
FCRA compliance is not complex in theory — the rules are specific and the sequence is clear. The risk comes from ad hoc execution: HR teams that follow the process correctly most of the time but deviate when they are under pressure to move quickly, when using a new background check vendor, or when the disclosure form was last reviewed three years ago.
The solution is to embed FCRA compliance into your hiring system so that correct process is the path of least resistance. An ATS that enforces disclosure collection, logs consent, enforces waiting periods, and generates compliant notice templates removes the human error risk from a compliance process that has proven expensive for employers that get it wrong.
Treegarden is designed with this compliance-by-design approach. If you want to see how background check compliance is handled within the platform, book a demo with our team.