Hiring decisions carry risk. Employers want to protect their workplace, customers, and reputation, while applicants have legal rights that must be respected throughout the background screening process. That is where the Fair Credit Reporting Act, commonly called the FCRA, becomes critical.
The FCRA is the federal law that regulates employment background checks nationwide. It governs how consumer reports, including background checks, are collected, shared, and used in the United States. Passed in 1970 and enforced primarily by the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB), the FCRA was originally written to regulate credit bureaus. Over time, its scope expanded to cover the full range of consumer reporting activity, including the criminal history, employment, and identity checks that make up modern pre-employment screening.
For employers, landlords, and anyone who orders a background check on another person, the FCRA is the rulebook. It sets requirements for how reports can be requested, what must be disclosed to the person being screened, and what steps must happen before an employer can act on negative information. Many employers assume compliance simply means getting a signed authorization form. It does not. The law affects nearly every stage of the screening process, from disclosure and authorization through report accuracy, applicant rights, adverse action, and recordkeeping.
Important: Many FCRA lawsuits are caused by procedural mistakes, not intentional misconduct. Employers can face significant legal exposure for issues such as improper disclosure forms, failing to follow pre-adverse action procedures, or taking adverse action before allowing applicants an opportunity to dispute information. Even technical violations may result in costly litigation and regulatory scrutiny.
What Counts as a Consumer Report
The FCRA’s protections turn on a specific term: consumer report. A consumer report is any communication from a CRA that speaks to a person’s character, general reputation, or personal characteristics, and is used or expected to be used to determine eligibility for employment, housing, credit, or insurance. A criminal history search, an employment verification, or a motor vehicle record pulled for hiring purposes all qualify.
There is also a subcategory that carries extra requirements: the investigative consumer report. This applies when information is gathered through personal interviews, such as reference checks that ask about a person’s character or lifestyle rather than simply confirming dates of employment. If an employer orders this type of report, an additional disclosure is required, telling the applicant that an investigative report may be requested and explaining their right to ask for details about its nature and scope.
Who the FCRA Applies To
The FCRA applies any time a Consumer Reporting Agency (CRA), such as a background check company, compiles information about a person for use in decisions about employment, housing, credit, or insurance. The law applies regardless of company size. A small business hiring one employee and a national company hiring thousands are both expected to comply. Three parties sit inside this framework:
- Consumer Reporting Agencies (CRAs): Companies that assemble consumer reports, such as background screening firms.
- Furnishers: Sources that supply data to CRAs, including courts, employers, and financial institutions.
- Users: Employers, landlords, or lenders who request and use the reports to make decisions.
Each party has distinct obligations under the law, and liability can attach to any of them if the process breaks down.
Core Requirements for Employers
Employers who order background checks are considered users of consumer reports under the FCRA, and the law places specific duties on them before, during, and after the screening process.
Before requesting a report
- Provide a clear, standalone written disclosure to the applicant stating that a background check will be conducted. This disclosure cannot be combined with the job application, a liability waiver, or other hiring paperwork.
- Obtain the applicant’s written authorization before ordering the report.
Before taking adverse action
Before taking adverse action based on a report, such as declining to hire, rescinding an offer, or terminating employment, the employer must send a pre-adverse action notice that includes:
- A copy of the consumer report the decision is based on.
- A copy of “A Summary of Your Rights Under the Fair Credit Reporting Act,” a standardized document published by the FTC.
After sending this notice, the employer must pause before finalizing anything. The FCRA does not name an exact number of days, but a wait of around five business days is the widely followed industry standard for giving the applicant a real opportunity to review the report and dispute inaccuracies.
After the waiting period
If the employer proceeds with the adverse action, a final adverse action notice must be sent. This one must include the CRA’s name and contact information, a statement that the CRA did not make the hiring decision and cannot explain the reason for it, and notice of the applicant’s right to dispute the report’s accuracy and request a free copy of it from the CRA within 60 days.
Skipping or rushing any of these steps is one of the most common sources of FCRA litigation, even when the underlying background check was accurate.
The FCRA Background Check Process, Step by Step
Understanding the full compliance workflow matters. Background screening is not a single transaction, it is a process with specific steps before, during, and after the report is completed.
Step 1: Provide a clear disclosure
Before obtaining a background check, employers must provide a clear disclosure informing the applicant that a consumer report may be obtained for employment purposes. One of the most common employer mistakes is combining this disclosure with unrelated language, such as liability waivers or broad legal releases. The safest approach is to keep the disclosure simple and focused solely on the background check.
Step 2: Obtain written authorization
Employers must obtain written authorization before ordering the report. Authorization may be paper-based or electronic, and many employers now use electronic disclosure and authorization systems for efficiency and recordkeeping. Regardless of format, the authorization should be retained as part of the employer’s compliance records.
Step 3: Certify compliance to the CRA
Before providing reports, the CRA generally requires employers to certify that they will follow FCRA requirements, use reports only for permissible employment purposes, comply with adverse action procedures, and avoid discriminatory use of information. This certification is usually included in the client service agreement.
Step 4: The CRA conducts the background check
The CRA gathers and verifies information from appropriate sources, which may include county criminal courts, federal courts, national databases, sex offender registries, employment records, educational institutions, motor vehicle departments, and professional licensing boards. Many employers mistakenly assume all criminal data comes from one national source. National criminal databases are only one research tool and often contain incomplete or limited information.
Step 5: Review the results carefully
A background report does not automatically determine whether someone should or should not be hired. Employers should evaluate findings for job relevance, the nature of the offense, severity, time passed, rehabilitation, and applicable state and local laws. Automatic
