Home/ Hiring & Onboarding/ Guide № 14

Background Checks: The FCRA Compliance Guide

Running a background check through a screening company triggers the federal FCRA's exact sequence — standalone disclosure, written authorization, pre-adverse notice, waiting period, adverse action notice — and class actions punish every shortcut.

LegalWorkplace.com Staff Reviewed Sep 2026 · 9 min read · 8 steps
Background Checks: The FCRA Compliance Guide
The trigger
The FCRA applies whenever you use a third-party screening company (a consumer reporting agency) — not when you check references yourself.
The formality
The disclosure must be a standalone document — burying it in the application is the most-litigated FCRA mistake.
The sequence
Before rejecting on the report: pre-adverse notice + copy of the report + summary of rights, a reasonable wait, then the adverse action notice.
Run the interactive checklist as you go ↓
0 of 8 steps checked · jump to checklist
Not legal advice. Educational guide to general U.S. employment law. Rules vary by state — consult an employment attorney for specific cases.
01

When the FCRA applies

The Fair Credit Reporting Act covers far more than credit: any background report you buy from a screening company — criminal history, employment verification, driving records, education checks — is a consumer report from a consumer reporting agency, and ordering one for hiring triggers the FCRA's employment provisions, per the FTC's employer guidance. Checks you run yourself (calling references, searching public records directly) sit outside the FCRA, though the EEOC's discrimination rules still apply to how you use what you find.

Write the check into the offer as a contingency — the offer letter guide shows the language — and run the FCRA sequence before acting on anything the report returns.

02

Before the check: disclosure and authorization

Two documents, in this order. First, a clear and conspicuous written disclosure that you may obtain a consumer report — in a document that consists solely of the disclosure. The "standalone" requirement is literal: courts have certified class actions over liability waivers, at-will statements, and even state-law notices packed into the same page. Second, the candidate's written authorization (which may share the page with the disclosure). For "investigative consumer reports" — interviews about character and reputation — an additional notice and a statement of the person's rights apply.

03

Acting on results: the two-letter sequence

1. Pre-adverse action
Before deciding, send the candidate a copy of the report and the CFPB's "Summary of Your Rights Under the FCRA." The point is a real chance to dispute errors — screening databases are wrong often enough to matter.
2. Wait
A reasonable period for the candidate to respond — five business days is the widely used benchmark. Decisions dated the same day as the pre-adverse letter are Exhibit A in FCRA suits.
3. Adverse action
If you proceed, send the final notice: the decision, the screening company's name and contact details, a statement that the company didn't make the decision, and the right to dispute and obtain a free copy within 60 days.
04

State and local overlays

The FCRA is the floor. Many states and cities add ban-the-box timing rules (no criminal history questions until after a conditional offer), individualized-assessment requirements before rejecting for convictions, salary-history bans, and limits on credit checks for most roles. Before finalizing your screening flow, check the state pages in our law library for the jurisdictions where you hire — and never let a vendor's default forms substitute for your own compliance review; the employer, not the screening company, answers for the process.

Your checklist

0 / 8
Tick each step as you complete it — progress saves while you read.
?

Frequently asked questions

Does the FCRA apply if we do the checking ourselves?
No — the FCRA governs consumer reports obtained from consumer reporting agencies (screening companies). Do-it-yourself reference calls and public records searches fall outside it, though discrimination and state-law limits still apply.
What makes a disclosure form non-compliant?
Anything extra. The FCRA requires a clear, conspicuous disclosure in a document that consists solely of the disclosure — liability waivers, state notices, or application text mixed in have driven waves of class actions.
How long must we wait between the pre-adverse and adverse action notices?
The statute says enough time for the candidate to dispute the report — the FTC has suggested five business days is reasonable in common circumstances. The waiting period is the point: skipping it defeats the purpose and the compliance.
Can we reject any candidate with a criminal record?
Blanket exclusions invite EEOC scrutiny — the agency's guidance calls for considering the nature of the offense, time passed, and job-relatedness, and many states and cities add ban-the-box timing rules on when you may ask at all.
§

Official resources