FCRA Compliance for Employers: A Practical Guide
The Fair Credit Reporting Act (FCRA) governs how employers may obtain and use background checks. It’s enforced by the FTC and CFPB, it allows private lawsuits — including class actions over paperwork mistakes — and most claims come down to a handful of process steps that are easy to get right once you build them into your hiring workflow.
This guide covers the core federal requirements. (State and local laws can add more; when in doubt, involve counsel.)
Before you run the check
1. Provide a standalone disclosure
You must tell the candidate, in a clear and conspicuous written disclosure, that you may obtain a background check for employment purposes. Critically, the disclosure must be a standalone document — courts have repeatedly penalized employers for burying it in the job application or stuffing it with liability waivers and extra language.
2. Get written authorization
The candidate must authorize the check in writing before you order it. The authorization may be combined with the disclosure, but nothing else should be.
3. Certify your permissible purpose
Your screening company will ask you to certify that you have a permissible purpose (employment), that you obtained consent, and that you’ll comply with the FCRA and applicable equal-opportunity laws. This is standard — it’s how consumer reporting agencies like us meet our own FCRA obligations.
If the report raises concerns: the two-step adverse action process
You cannot simply reject a candidate based on a background check. The FCRA requires two separate steps:
Step 1 — Pre-adverse action notice
Before making a final decision, send the candidate:
- A pre-adverse action letter stating you’re considering action based on the report
- A copy of the report
- The CFPB’s “Summary of Your Rights Under the Fair Credit Reporting Act”
Step 2 — Wait, then final adverse action notice
Give the candidate a reasonable time to respond — five business days is a widely used benchmark — so they can dispute or explain the record. If you proceed, send a final adverse action notice that includes the screening company’s name and contact information, a statement that the screening company didn’t make the decision, and the candidate’s rights to dispute the report’s accuracy and request an additional free copy within 60 days.
Reports are sometimes wrong through no fault of the candidate — identity mix-ups and outdated court data happen. The two-step process exists so real people get a chance to correct the record.
Skipping the adverse action waiting period is one of the most commonly litigated mistakes in all of employment screening.
Quick compliance checklist
- ☐ Standalone disclosure form (no extra language)
- ☐ Written authorization before ordering
- ☐ Certification on file with your screening provider
- ☐ Individualized assessment of any record against the actual job duties
- ☐ Pre-adverse action letter + report copy + summary of rights
- ☐ Reasonable waiting period (≈5 business days)
- ☐ Final adverse action notice with all required contents
- ☐ Check state/local rules: ban-the-box timing, salary-history bans, credit-check restrictions, and seven-year reporting limits in several states
The FTC’s full FCRA text is the authoritative reference.
Compliance is built into our platform
At 5 Star Background Checks, compliance isn’t an add-on. Our reports are aligned to the latest state and federal laws, legally unreportable records are filtered before you ever see them, and every report is reviewed by our Quality Assurance team. Your dedicated, PBSA-certified account professional can walk your team through the adverse action workflow.
Create your account free — no contracts or minimums — or call 1-800-935-8537. Curious what a compliant report contains? See what shows up on an employment background check.
This article is general information, not legal advice. Consult your employment counsel about your specific obligations.
