Running a background check is not a single action, it is a legal process with specific obligations attached to nearly every step. Employers who order consumer reports for employment purposes are considered “users” of those reports under the Fair Credit Reporting Act (FCRA), and the law places clear duties on them before a report is requested, while it is being reviewed, and after a decision is made.
Many employers assume compliance simply means having applicants sign a form. In practice, the FCRA’s requirements run through the entire hiring workflow, and missing a step, even one that seems procedural, is one of the most common sources of employer liability in this area.
Important: FCRA obligations apply to employers directly. Using a background screening company (a Consumer Reporting Agency) does not shift legal responsibility for disclosure, authorization, or adverse action procedures away from the employer.
Before Requesting a Report
Provide a standalone disclosure
Before ordering a background check, employers must provide the applicant with a clear, written disclosure stating that a consumer report may be obtained for employment purposes. This disclosure has to be its own standalone document, it cannot be combined with the job application, a liability waiver, an arbitration agreement, or any other unrelated hiring paperwork. Bundling the disclosure with other language is one of the most frequently litigated FCRA violations, even when the underlying background check itself was accurate.
Obtain written authorization
Employers must also obtain the applicant’s written authorization before a report can be requested. This authorization can be collected on paper or electronically, and many employers now use electronic disclosure and authorization systems as part of their applicant tracking workflow. Regardless of format, the signed authorization should be retained as part of the employer’s compliance records.
Certify compliance to the CRA
Before a screening company will provide reports, it will generally require the employer to certify, usually as part of the client service agreement, that it will use reports only for permissible employment purposes, follow proper adverse action procedures, and avoid discriminatory use of background information. This certification is a real legal representation, not a formality, and employers should understand what they are agreeing to before signing a screening company’s service agreement.
- Standalone written disclosure, separate from other hiring documents
- Signed authorization obtained before the report is requested
- Certification of compliant, permissible use provided to the screening company
While Reviewing Results
A background report does not make a hiring decision on its own, and it should not be applied as an automatic pass/fail filter. Employers should evaluate findings in context, considering the relevance of the information to the specific position, the nature and severity of any offense, how much time has passed, and evidence of rehabilitation where applicable.
Blanket policies that automatically disqualify any applicant with a criminal record, regardless of context, create meaningful legal exposure, not just under the FCRA, but under state fair-chance laws and federal guidance addressing disparate impact in hiring. Evaluating records individually, rather than applying a fixed rule to every applicant, is both a legal safeguard and a better hiring practice.
Before Taking Adverse Action
If a background check plays any role in a decision not to hire, to rescind an offer, or to terminate employment, the employer must follow a two-step adverse action process before that decision becomes final.
Step 1: Pre-adverse action notice
Before finalizing the decision, the employer must send the applicant a pre-adverse action notice. This must include a copy of the actual consumer report the decision is based on, and a copy of the FTC’s standardized “Summary of Your Rights Under the Fair Credit Reporting Act” document.
Step 2: A reasonable waiting period
The FCRA does not specify an exact number of days, but a waiting period of approximately five business days is the widely followed industry standard. This window exists to give the applicant a genuine opportunity to review the report and dispute anything inaccurate before the employer proceeds.
Step 3: Final adverse action notice
If the employer proceeds with the negative decision after the waiting period, a final adverse action notice must be sent. This notice must include the name and contact information of the screening company, a statement that the screening company did not make the hiring decision and cannot explain the reasoning behind it, and notice of the applicant’s right to dispute the report’s accuracy and request a free copy of it within 60 days.
Skipping either notice, or rushing the waiting period between them, is one of the most common and most litigated FCRA compliance failures, and it frequently forms the basis for class action claims, since the same procedural gap tends to affect every applicant screened under the same process.
Recordkeeping Requirements
Employers should retain FCRA-related records, including signed disclosures, authorizations, and copies of any adverse action notices sent, for a minimum of two years. In some cases, longer retention is required under other overlapping employment recordkeeping obligations, such as those imposed by the EEOC. These records are typically the first thing requested in the event of a dispute, an audit, or litigation, so maintaining organized, accessible documentation is a practical safeguard, not just a legal checkbox.
- Signed disclosure and authorization forms, retained for at least two years
- Copies of pre-adverse action and final adverse action notices sent
- Documentation showing consistent application of screening policies across candidates
Layering in State and Local Law
FCRA compliance is the federal floor, not the full picture. State and local laws frequently add requirements on top of the FCRA, and employers operating in multiple states need to comply with all applicable layers simultaneously, not just the federal baseline.
Common state and local additions include:
- Ban the Box and Fair Chance laws restricting when criminal history can be asked about or considered in the hiring timeline
- Shorter lookback periods limiting how far back certain criminal or credit information can be reported
- Salary history bans restricting what compensation information can be requested or relied upon
- Additional state-specific disclosure or notice requirements beyond what the FCRA mandates
Because these rules vary significantly by jurisdiction, employers with a multi-state workforce should confirm the specific requirements in each state and locality where they screen candidates, rather than assuming one national policy covers every location.
Common Employer Mistakes
Combining disclosure with other paperwork. Adding liability waivers, policy acknowledgments, or unrelated legal language to the disclosure form is one of the most common and most easily avoided compliance failures.
Skipping or rushing pre-adverse action. Moving directly to rejection without providing the required notice, report copy, and waiting period removes the applicant’s ability to catch and correct errors before a final decision is made.
Relying only on database searches. National criminal databases are a useful research tool, but they are not a substitute for court-level verification, and coverage varies significantly by source and jurisdiction.
Applying blanket disqualification policies. Automatically rejecting any applicant with a criminal record, without individualized review, increases legal exposure under both the FCRA and state fair-hiring laws.
Using outdated forms. The CFPB periodically updates required model language, including the Summary of Rights document. Employers should confirm they are using current versions rather than relying on forms that haven’t been reviewed in years.
Working With a Screening Partner
Since much of FCRA compliance depends on how a background check is conducted and reported, the screening company an employer works with matters. A strong partner should provide accurate, court-verified research rather than relying solely on database matching, clear adverse action support and documentation, responsive communication when questions come up, and secure handling of applicant data.
Fast turnaround time is valuable, but accuracy and compliance support matter more. A report delivered quickly but based on incomplete or unverified information can create more risk than it resolves. Employers using AI-assisted screening or evaluation tools should also confirm those tools comply with FCRA notice and consent requirements, since automated evaluation of background information can trigger the same obligations as a traditional manual review.
The Cost of Getting It Wrong
FCRA violations do not require proof of actual harm to result in liability. Statutory damages of $100 to $1,000 per violation are available for negligent noncompliance, with uncapped punitive damages possible for willful violations, plus attorney’s fees and court costs if the applicant prevails. Because the same procedural gap, such as a bundled disclosure form, tends to affect every applicant screened under it, these cases are a frequent basis for class action litigation, turning a single overlooked step into liability across an entire applicant pool.
The Bottom Line
FCRA compliance is a process, not a form. Employers who build disclosure, authorization, adverse action, and recordkeeping into a consistent, well-documented workflow, and who layer in the correct state and local requirements for every jurisdiction where they hire, put themselves in a far stronger position than those treating a background check as a single transactional step. Proactive, consistent compliance is significantly less costly than responding to a dispute or a lawsuit after the fact.
