Checklist · Consumer Protection

Running Background Checks Under the FCRA: A Practical Checklist

15 U.S.C. §§ 1681

Type
Checklist
Jurisdiction
National
Date
2024-08-04
Topic
Consumer Protection

The Fair Credit Reporting Act governs almost every employment background check run through a third-party screening company, and most employers violate it in the first five minutes — by burying the required disclosure inside a job application. This checklist walks the full compliance workflow phase by phase: confirming that the report is a "consumer report" from a consumer reporting agency, delivering a standalone clear-and-conspicuous disclosure, obtaining written authorization, certifying permissible purpose to the CRA, handling investigative consumer reports, and executing the two-step adverse action sequence of pre-adverse-action notice, waiting period, and final notice. It then layers on the state and local overlay — ban-the-box statutes, fair-chance ordinances, credit-history restrictions — and the EEOC's disparate-impact guidance on arrest and conviction records. Each phase closes with the traps that generate class actions, illustrated through a fictional employer whose application packet does everything wrong. The document ends with a consolidated one-glance checklist, common mistakes, and primary authority.

Running Background Checks Under the FCRA: A Practical Checklist

Consumer Protection > Credit Reporting | Published 4 August 2024 - Updated 26 October 2025 | UpLaw - uplaw.us

The Fair Credit Reporting Act does not ask whether your background check was accurate, fair, or well-intentioned. It asks whether you handed the applicant a piece of paper that contained nothing but the disclosure. Employers lose FCRA cases on paperwork, not on judgment.

Keywords: FCRA background check, consumer report, consumer reporting agency, standalone disclosure, written authorization, permissible purpose, pre-adverse action notice, adverse action notice, Summary of Consumer Rights, investigative consumer report, ban the box, fair chance, individualized assessment, Disposal Rule, willful violation

How to use this checklist

The FCRA, 15 U.S.C. §§ 1681–1681x, is a consumer-protection statute that most employers meet only from the wrong end — as defendants. It regulates three actors: the consumer reporting agency (CRA) that assembles the report, the furnisher that feeds it data, and the user who buys and acts on it. An employer running a background check is a user, and § 1681b(b) imposes a short, mechanical set of duties on users that are easy to satisfy and easy to botch.

The penalties are asymmetric. A negligent violation under § 1681o exposes the employer to actual damages plus fees. A willful violation under § 1681n exposes it to statutory damages of $100 to $1,000 per consumer, punitive damages, and fees — with no proof of actual harm required. Multiply $1,000 by every applicant who received a defective disclosure form over a two-year period and you have the economics of the FCRA class-action bar.

Our running example: Cedarhawk Logistics, a 900-employee regional freight and warehousing company that screens every driver, dock worker, and dispatcher through a national screening vendor. Cedarhawk's twelve-page online application ends with a block of boilerplate that includes an arbitration clause, an at-will acknowledgment, a drug-testing consent, and — in the middle of the fourth paragraph — the sentence "I authorize the Company to obtain consumer reports about me." Cedarhawk has never had a bad-hire lawsuit. It is about to have a very expensive FCRA one.

Phase 1 — Is it a "consumer report" from a CRA? (and when the FCRA does not apply)

  • [ ] Identify who is assembling the information. A third party in the business of assembling consumer information for a fee is a consumer reporting agency, 15 U.S.C. § 1681a(f).
  • [ ] Confirm the report bears on creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living and is used or collected for an eligible purpose — that makes it a consumer report, § 1681a(d).
  • [ ] Confirm your purpose is an employment purpose — evaluation for employment, promotion, reassignment, or retention as an employee, § 1681a(h).
  • [ ] Screen the vendor list: criminal-records searches, motor-vehicle-record pulls through a vendor, credit checks, education and employment verifications, drug-test result reporting through a third-party administrator, tenant-screening-style databases — all of it can be a consumer report.
  • [ ] Identify what is outside the FCRA: purely in-house checks you perform yourself (calling a former employer directly, running a free public-records search yourself), and reports about business entities rather than individuals.
  • [ ] Note the § 1681a(y) carve-out: a report of a third-party investigation into suspected employee misconduct or legal violations is generally not a consumer report for FCRA purposes if the employer does not use it as a communication about creditworthiness and provides a summary of the nature of the investigation before taking adverse action.
  • [ ] Confirm the vendor's contract designates it as a CRA and commits it to FCRA compliance.

Why it matters, and the traps. Employers routinely assume the FCRA is a credit statute and that a criminal-history search is therefore outside it. Wrong. The definition in § 1681a(d) reaches "character, general reputation, personal characteristics, or mode of living" — a criminal-records report is the paradigm case. The trigger is not the content of the report; it is the fact that a third party assembled it for a fee.

The mirror-image trap is over-inclusion. If a hiring manager Googles a candidate, or calls a prior supervisor personally, no CRA is involved and the FCRA does not apply (though discrimination law still does — see Employment Discrimination Law: A Comprehensive Guide). And the § 1681a(y) misconduct-investigation carve-out is genuinely useful: it is what lets you hire outside counsel or an investigator to look into a harassment complaint without triggering the disclosure-and-authorization machinery. Build that carve-out into your process deliberately — see Conducting a Workplace Investigation: A Practical Checklist.

Cedarhawk: its vendor runs county criminal searches, a national database scan, MVR pulls, and employment verifications. All four are consumer reports. Every one of them is inside § 1681b(b).

Phase 2 — The standalone disclosure: clear, conspicuous, and in a document consisting solely of the disclosure

  • [ ] Draft a separate document whose only content is the disclosure that a consumer report may be obtained for employment purposes, § 1681b(b)(2)(A)(i).
  • [ ] Verify the document contains no liability waiver or release of any kind.
  • [ ] Verify it contains no at-will acknowledgment, no arbitration clause, no drug-test consent, no state-law notices bundled in.
  • [ ] Verify it is not part of the employment application — not an appendix, not a scroll-box at the bottom, not a checkbox in a click-through flow shared with other consents.
  • [ ] Verify the language is clear and conspicuous: plain English, readable type, no legalese, no dense block of unbroken text.
  • [ ] Deliver the disclosure before the report is procured.
  • [ ] Keep the disclosure text neutral — do not describe the report as something other than what it is (e.g., do not call it a "background investigation report" if you are also ordering an investigative consumer report; that is a separate disclosure, see Phase 5).

Why it matters, and the traps. This is the single most litigated provision in employment FCRA practice, and it is litigated because employers cannot resist the temptation to make the page do double duty. The statutory text is unusually rigid: the disclosure must be "in a document that consists solely of the disclosure." The Ninth Circuit held in Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017), that including a liability waiver in the disclosure violated the standalone requirement — and that the violation could be willful under § 1681n, because the statutory text is unambiguous and an employer's contrary reading is objectively unreasonable. The same court later held in Gilberg v. California Check Cashing Stores, LLC, 913 F.3d 1169 (9th Cir. 2019), that cramming state-law notices into the same document violates both the standalone requirement and the clear-and-conspicuous requirement.

The willfulness link is what makes this existential. Under Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), willfulness includes reckless disregard — an interpretation of the statute that is objectively unreasonable, where the text is clear and no authoritative guidance excuses the reading. "Consists solely of the disclosure" is about as clear as statutory text gets. That is why defective-disclosure classes settle in the seven figures.

Cedarhawk: its disclosure is a sentence inside a boilerplate paragraph inside a twelve-page application that also contains an arbitration clause and a release. It is not standalone, it is not conspicuous, and under Syed it is not merely negligent. Fixing this is a thirty-minute job that Cedarhawk did not do — and every applicant since the form went live is a potential class member, subject to the § 1681p limitations period (the earlier of two years after discovery or five years after the violation).

Phase 3 — Written authorization from the consumer

  • [ ] Obtain the consumer's written authorization to procure the report, § 1681b(b)(2)(A)(ii).
  • [ ] Confirm the authorization is signed (wet, e-signature, or a compliant click-through under E-SIGN).
  • [ ] Decide whether the authorization may appear on the disclosure document — the statute permits the authorization to be on the disclosure form itself, but nothing else may be.
  • [ ] If you intend to run periodic checks during employment, use an evergreen authorization drafted to cover future reports, and confirm your state permits it (some, including California, do not treat blanket evergreen consents as sufficient).
  • [ ] For applicants applying by mail, telephone, computer, or similar means for a position involving interstate transportation, apply the modified oral/written/electronic procedure in § 1681b(b)(2)(B)–(C).
  • [ ] Preserve the signed authorization in a file separate from the personnel file, consistent with your medical/confidential-records segregation practice.

Why it matters, and the traps. Authorization is the easy half of the requirement, and employers usually get it — that is precisely why they get complacent about the disclosure. Note the asymmetry: the disclosure must be standalone; the authorization may ride along on it. Many compliant forms are a single page with the disclosure on top and a signature line below. What may not ride along is anything else.

The trucking carve-out in § 1681b(b)(2)(B) is narrow and misunderstood. It applies to applicants for positions involving interstate transportation who apply remotely; it permits oral, written, or electronic disclosure and authorization, and it modifies the adverse-action mechanics in § 1681b(b)(3)(B). It does not eliminate the duties. If, like Cedarhawk, you hire both drivers and dock workers through the same portal, the carve-out covers the drivers and not the warehouse staff — so build the compliant process and use it for everyone.

Phase 4 — Certify permissible purpose and compliance to the CRA

  • [ ] Execute the CRA's user certification under § 1681b(b)(1), certifying that (a) you have made the required disclosure and obtained authorization, and (b) the information will not be used in violation of any applicable federal or state equal employment opportunity law or regulation.
  • [ ] Confirm you have a permissible purpose under § 1681b(a)(3)(B) — employment purposes — and that you are not repurposing an employment report for anything else.
  • [ ] Confirm the CRA has verified your identity and the certified purpose, as § 1681e(a) requires it to do.
  • [ ] Restrict internal access to the report to those with a need to know.
  • [ ] Confirm the CRA follows reasonable procedures to assure maximum possible accuracy under § 1681e(b), and that its § 1681k procedures for public-record information reported for employment purposes are in place.

Why it matters, and the traps. The certification is not a formality: it is the hook that ties your EEO obligations to the FCRA. When you certify that you will not use the information in violation of EEO law, you have told a federal regulator, in writing, that your criminal-history screen complies with Title VII. Phase 11 is where you make that certification true.

The permissible-purpose rule also polices repurposing. A report pulled for employment cannot be used to evaluate the person as a tenant, a borrower, or a business counterparty. Obtaining or using a consumer report without a permissible purpose is itself an FCRA violation and, in aggravated cases, a criminal one under § 1681q.

Phase 5 — Investigative consumer reports and the extra disclosure

  • [ ] Determine whether the vendor will conduct personal interviews with neighbors, friends, associates, or others about the applicant's character, general reputation, personal characteristics, or mode of living — if so, it is an investigative consumer report, § 1681a(e).
  • [ ] Provide the additional § 1681d(a)(1) disclosure in writing, mailed or otherwise delivered not later than three days after the report is first requested, clearly and accurately disclosing that an investigative consumer report may be made and that it may include information on character, general reputation, personal characteristics, and mode of living.
  • [ ] Include in that disclosure a statement of the consumer's right to request additional disclosures about the nature and scope of the investigation, together with the written Summary of Consumer Rights.
  • [ ] If the consumer requests it, make a complete and accurate disclosure of the nature and scope of the investigation within five days of the request or of the report's request date, whichever is later, § 1681d(b).
  • [ ] Certify to the CRA that you have complied with § 1681d(a), as § 1681d(a)(2) requires.

Why it matters, and the traps. Most routine database and county-records screens are not investigative consumer reports; the trigger is information obtained through personal interviews. But reference checks conducted by a vendor — the very thing many employers order as an add-on for executive hires — frequently cross the line. If a screening vendor calls three former colleagues to ask what the candidate is like to work with, that is character information obtained through interviews.

The trap is timing. The § 1681d disclosure is a three-day, report-request-triggered obligation, distinct from the § 1681b(b)(2) pre-procurement disclosure. Employers that fold the two together into a single form on day one usually satisfy both; employers that order the reference-interview module as an afterthought, three weeks into the process, usually satisfy neither.

Phase 6 — Review the report and identify disqualifying information

  • [ ] Read the entire report, not the vendor's green/red "adjudication" flag.
  • [ ] Confirm the record actually belongs to this applicant — matching name, date of birth, and identifiers, not a common-name hit.
  • [ ] Check obsolescence limits under § 1681c: arrests, civil suits, and civil judgments generally may not be reported after seven years; bankruptcies after ten years. Note that records of criminal convictions are not subject to the seven-year limit, and that § 1681c(b)(3) lifts those limits for a report to be used in connection with employment at an annual salary that equals or may reasonably be expected to equal $75,000 or more. Treat that exception with care: many CRAs decline to rely on it as a matter of policy, several states impose their own obsolescence limits with no salary carve-out, and reporting a stale record you are merely permitted to see does not make acting on it defensible under Phase 11.
  • [ ] Separate arrests without conviction from convictions — most jurisdictions and the EEOC treat arrest records as legally weak evidence of conduct.
  • [ ] Confirm the criterion you are applying was defined in advance and is job-related, not invented after you saw the record.
  • [ ] Document the specific record and the specific reason it is disqualifying.

Why it matters, and the traps. Vendor adjudication matrices are a convenience, not a defense. The employer — not the CRA — makes the employment decision, and the employer answers for it under Title VII. Automated red flags on stale, mismatched, or expunged records are the raw material of both FCRA inaccuracy claims and disparate-impact claims.

Cedarhawk: the report on dispatcher applicant "M. Reyes" flags a felony conviction. It is an eleven-year-old drug-possession conviction under a nearly identical name, in a county Reyes has never lived in. Cedarhawk's vendor flagged it red; Cedarhawk's recruiter closed the file. Nobody looked at the date of birth. This is exactly the fact pattern the two-step adverse action process exists to catch.

Phase 7 — Step one of adverse action: the pre-adverse-action notice, the report, and the Summary of Rights

  • [ ] Before taking any adverse action based in whole or in part on the report, provide the consumer with:
    • [ ] a copy of the consumer report, § 1681b(b)(3)(A)(i); and
    • [ ] a written description of the consumer's rights — the Summary of Consumer Rights prescribed under § 1681g(c) and published by the CFPB in Regulation V, 12 C.F.R. part 1022.
  • [ ] Include a pre-adverse-action letter identifying the CRA (name, address, telephone number) and stating that the CRA did not make the decision.
  • [ ] Do not describe the decision as final. It is not final; that is the entire point.
  • [ ] Recognize the breadth of "adverse action" for employment purposes: § 1681a(k)(1)(B)(ii) covers a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee — including rescinding a conditional offer, refusing a promotion, and termination.
  • [ ] Send by a method you can prove (email with delivery confirmation, tracked mail, or both) and calendar the send date.

Why it matters, and the traps. The pre-adverse-action notice is the FCRA's central innovation for employment screening: the consumer gets to see the report before the decision bites, and to fix it. Employers defeat the provision in two ways. The first is sequencing: they tell the candidate "we're going a different direction," then mail the pre-adverse-action packet. That is adverse action taken before disclosure, and it violates § 1681b(b)(3) on its face. The second is completeness: they send the letter but not the report, or the report but not the Summary of Rights. All three pieces are required.

Cedarhawk: it emails Reyes a rejection at 9:04 a.m. and a "pre-adverse action notice" at 9:06 a.m. The two-minute gap is not a waiting period. It is Exhibit A.

Phase 8 — The waiting period and the consumer's chance to dispute

  • [ ] Wait a reasonable period after the pre-adverse-action notice before taking final action. The statute prescribes no number; FTC staff have long treated five business days as generally reasonable, and that is the market standard.
  • [ ] Hold the requisition open during the waiting period — do not fill the role and then pretend the candidate had a chance.
  • [ ] Provide a channel for the consumer to respond: a named contact, a phone number, an email address.
  • [ ] If the consumer disputes the report with the CRA, pause. Await the reinvestigation outcome under § 1681i (30 days, extendable to 45 if new information is supplied).
  • [ ] If the consumer offers context rather than a dispute — an explanation, evidence of rehabilitation, an expungement order — route it to the individualized assessment in Phase 11.
  • [ ] Document what you received and what you did with it.

Why it matters, and the traps. A waiting period with no functioning intake channel is theater. Courts and regulators look at whether the consumer had a realistic opportunity to correct the record; a letter directing the applicant to a general HR inbox that nobody monitors will not survive scrutiny. Note also the standing overlay: after TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), and Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), a plaintiff must show concrete harm, and a bare procedural violation with no dissemination and no decision may not clear Article III. That is a real defense — but it is a defense to the federal-court claim, not a compliance strategy. A candidate who was actually rejected on a false record has all the concreteness anyone needs.

Cedarhawk: had it waited five business days, Reyes would have called, pointed at the date of birth, and the vendor would have removed the record within a week. Instead Cedarhawk hired someone else, and Reyes hired a lawyer.

Phase 9 — Step two: the adverse action notice and its required contents

  • [ ] After the waiting period (and after resolving any dispute), send the adverse action notice required by § 1681m(a), containing:
    • [ ] notice of the adverse action;
    • [ ] the name, address, and telephone number of the CRA that furnished the report (a toll-free number if the CRA is a nationwide agency);
    • [ ] a statement that the CRA did not make the decision and cannot explain the reasons for it;
    • [ ] notice of the consumer's right to obtain a free copy of the report from the CRA within 60 days; and
    • [ ] notice of the consumer's right to dispute the accuracy or completeness of any information in the report with the CRA.
  • [ ] Deliver in writing, orally, or electronically — but in practice, always in writing, and always retained.
  • [ ] Layer any state or local adverse-action requirements on top (Phase 10). Several jurisdictions require a written individualized assessment, a copy of the conviction record, and a longer response window.
  • [ ] Close the file with the report, both notices, proof of delivery, the assessment, and the decision rationale.

Why it matters, and the traps. The most common defect here is a notice that never names the CRA or never says the CRA did not make the decision. Both are express statutory line items. The second most common defect is a final notice that says nothing more than "we have decided not to move forward" — omitting the free-copy and dispute rights that give the consumer a post-decision remedy.

Remember the damages architecture. A willful failure exposes Cedarhawk to $100–$1,000 per applicant under § 1681n, plus punitives and fees; negligence exposes it to actual damages and fees under § 1681o. For what those numbers look like once employment claims are stacked on top, see Damages in Employment Litigation: Back Pay, Statutory Caps, and Punitive Awards.

Phase 10 — Ban-the-box, fair-chance laws, and the state/local overlay

  • [ ] Map every jurisdiction where you recruit (not merely where you are headquartered). Fair-chance obligations follow the applicant's location.
  • [ ] Identify ban-the-box timing rules: most fair-chance laws bar any criminal-history inquiry until after a conditional offer, or at least until after an initial interview. Roughly three dozen states and well over a hundred cities and counties have some version; the details differ substantially and change often. Verify your jurisdictions.
  • [ ] For federal contractors and agencies, apply the Fair Chance to Compete for Jobs Act of 2019, 5 U.S.C. § 9202, which bars criminal-history inquiries before a conditional offer in covered federal hiring and contracting.
  • [ ] Layer on state FCRA analogues: California's Investigative Consumer Reporting Agencies Act, Cal. Civ. Code §§ 1786 et seq. (separate disclosure content, a check box to receive a copy of the report, source identification); New York General Business Law § 380 et seq.; and similar statutes elsewhere.
  • [ ] Layer on conviction-consideration statutes: New York Correction Law Article 23-A (§§ 752–753) and the NYC Fair Chance Act; California's Fair Chance Act, Cal. Gov't Code § 12952, with its mandatory written individualized assessment and multi-day response window.
  • [ ] Layer on credit-history restrictions: many jurisdictions sharply limit employer use of credit reports absent a job-related exception (for example, California Labor Code § 1024.5, the Illinois Employee Credit Privacy Act, and New York City's Stop Credit Discrimination in Employment Act).
  • [ ] Check salary-history and biometric overlays where relevant — fingerprint-based screening implicates state biometric-privacy statutes; see Biometric Privacy Law and the AI Systems That Read Faces and Voices.
  • [ ] Confirm the FCRA does not preempt these overlays for employment screening: § 1681t preserves most state regulation of employer conduct, and state notice requirements generally stack on top of federal ones.

Why it matters, and the traps. The FCRA is a floor, and a procedural one. It tells you how to run the check; state and local fair-chance law tells you when you may ask and what you may do with the answer. A perfectly FCRA-compliant rescission of a conditional offer in Los Angeles or New York City can still be flatly unlawful because the employer skipped a mandatory written individualized assessment or gave the applicant three days instead of five business days to respond.

The multistate trap is remote hiring. Cedarhawk's dispatcher role is remote-eligible and it recruits in six states. Its process is built to Kansas law. Two of its applicants live in jurisdictions with fair-chance ordinances that Cedarhawk has never heard of. Build the most protective process and run it everywhere; the cost of the extra letter is trivial next to the cost of a jurisdictional audit. The same principle governs handbook drafting — see Building a Legally Sound Employee Handbook and Drafting an Employee Handbook That Holds Up: A Practical Checklist.

Phase 11 — Individualized assessment and the EEOC's disparate-impact guidance

  • [ ] Abandon any blanket exclusion based on a criminal record. A categorical bar is the classic disparate-impact target under Title VII, 42 U.S.C. § 2000e-2(k).
  • [ ] Apply the Green factors — from Green v. Missouri Pacific Railroad Co., 549 F.2d 1158 (8th Cir. 1977), and adopted in the EEOC's Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII (2012):
    • [ ] the nature and gravity of the offense or conduct;
    • [ ] the time elapsed since the offense, conduct, and/or completion of the sentence; and
    • [ ] the nature of the job held or sought.
  • [ ] Conduct a genuine individualized assessment: notify the individual of the potential exclusion, give them an opportunity to explain, and consider what they provide (rehabilitation, employment history, the accuracy of the record, the circumstances).
  • [ ] Do not treat arrests without conviction as proof of conduct; the EEOC's position is that an arrest record standing alone does not establish that criminal conduct occurred.
  • [ ] Document the assessment in writing — several state fair-chance statutes require it, and it is your best Title VII evidence regardless.
  • [ ] Preserve applicant-flow and screening data so you can test for adverse impact in your own screen before someone else does.

Why it matters, and the traps. Disparate impact under Griggs v. Duke Power Co., 401 U.S. 424 (1971), and codified at § 2000e-2(k), does not require intent. A facially neutral criminal-history screen that disproportionately excludes protected groups must be job related for the position in question and consistent with business necessity. "We don't hire felons" is not a business necessity; "we do not place individuals with recent convictions for theft from an employer into unsupervised roles handling high-value freight" might be.

The FCRA and Title VII are not alternatives — they are cumulative. A candidate can plead FCRA procedural violations and Title VII disparate impact from the same rejection, and the FCRA-mandated file is the discovery goldmine for the Title VII claim. That is why the certification in Phase 4 and the assessment here belong to a single, coherent hiring process — the one mapped in The Employment Law Toolkit: From Hiring to Separation.

Phase 12 — Recordkeeping, secure disposal, and vendor management

Why it matters, and the traps. The Disposal Rule is the FCRA duty employers forget entirely — and it is the one that turns a filing-cabinet cleanout into an enforcement action. Consumer report information dumped in a recycling bin is a textbook violation. The rule reaches any business that uses consumer reports, which includes essentially every employer that has ever run a screen.

The worked example, end to end: what Cedarhawk did and what it should have done

It is worth putting the pieces together, because the individual defects in Cedarhawk Logistics' process look small and the aggregate looks like a bet-the-department claim.

What Cedarhawk did. M. Reyes applies for a remote-eligible dispatcher role through Cedarhawk's twelve-page online portal. On page ten, buried in the fourth paragraph of a boilerplate block that also contains an arbitration clause, an at-will acknowledgment, a drug-testing consent, and a release of liability, is the sentence "I authorize the Company to obtain consumer reports about me." Reyes clicks a single checkbox covering the whole block. Cedarhawk orders a county criminal search, a national database scan, an MVR pull, and employment verifications — all consumer reports. The vendor also calls three former colleagues to ask what Reyes is like to work with, and no § 1681d disclosure ever goes out. The database scan returns a red flag: an eleven-year-old felony drug-possession conviction, under a nearly identical name, in a county Reyes has never lived in. The recruiter closes the file. At 9:04 a.m. Reyes receives a rejection email. At 9:06 a.m. Reyes receives a "pre-adverse action notice" with no copy of the report and no Summary of Consumer Rights. Cedarhawk fills the role that afternoon. Reyes lives in a city with a fair-chance ordinance Cedarhawk has never heard of.

Count the violations. The disclosure was not standalone and not conspicuous, and it carried a release — Syed and Gilberg territory, and under Safeco potentially willful, exposing Cedarhawk to $100–$1,000 per applicant under § 1681n across every applicant who saw that form within the § 1681p limitations window. The vendor's reference interviews made this an investigative consumer report with no § 1681d(a) disclosure and no § 1681d(a)(2) certification. The pre-adverse-action packet omitted both required enclosures and, worse, followed the adverse action rather than preceding it, violating § 1681b(b)(3) on its face. No waiting period ran, so Reyes never got the realistic opportunity to point at the date of birth. No individualized assessment was performed, exposing the blanket "no felonies" screen to disparate-impact attack under Griggs and § 2000e-2(k). And the local fair-chance ordinance supplies an independent violation that the FCRA does not preempt.

What five minutes of process would have bought. A one-page document containing nothing but the disclosure, with the authorization signature line beneath it. A separate page for the arbitration clause, the release, and the state notices. The § 1681d disclosure mailed within three days because the reference-interview module was ordered on day one, not as an afterthought. A pre-adverse-action packet — letter, full report, Summary of Consumer Rights — sent before any decision, followed by five business days with a named human being and a monitored inbox. Reyes calls on day two, points at the date of birth, the vendor removes the mismatched record within a week, and Cedarhawk hires a qualified dispatcher instead of buying a class action. The requisition stays open four extra days. That is the entire cost of compliance.

Common mistakes to avoid

  1. Burying the disclosure in the application. The one violation to eliminate today. "Consists solely of the disclosure" means solely.
  2. Including a liability release in the disclosure. Syed makes this potentially willful, not merely negligent.
  3. Adding state-law notices to the federal disclosure form. Same document, same problem. Use separate pages.
  4. Sending the rejection and the pre-adverse-action notice together. The waiting period must precede the decision, not accompany it.
  5. Omitting the report or the Summary of Rights from the pre-adverse-action packet. All three components are mandatory.
  6. An adverse action notice that never names the CRA or never says the CRA did not make the decision.
  7. Trusting the vendor's red flag. You make the decision; you own the disparate-impact and accuracy risk.
  8. Blanket criminal-record exclusions. Griggs, § 2000e-2(k), and the EEOC's 2012 guidance all point the other way.
  9. Ignoring the applicant's location. Fair-chance law follows the applicant, especially in remote hiring.
  10. Treating an arrest as a conviction.
  11. Running a check on a contractor and assuming the FCRA does not apply. It can — and misclassification carries its own exposure; see Classifying Workers: Employee or Independent Contractor — A Practical Checklist and Worker Classification: A Comprehensive Guide to Employee and Independent Contractor Status.
  12. No disposal protocol. 16 C.F.R. part 682 applies to you.

The consolidated FCRA background-check checklist

  • [ ] Vendor is a CRA; report is a consumer report; purpose is an employment purpose.
  • [ ] Standalone written disclosure — nothing else on the page. No waiver. No arbitration clause. No state notices.
  • [ ] Written authorization obtained before the report is procured.
  • [ ] User certification signed: disclosure made, authorization obtained, no use in violation of EEO law.
  • [ ] If personal interviews are involved: § 1681d investigative-report disclosure within three days, plus the Summary of Rights and the nature-and-scope right.
  • [ ] Report reviewed in full; identity match confirmed; obsolescence limits under § 1681c checked.
  • [ ] Pre-adverse-action packet sent: letter + full copy of the report + Summary of Consumer Rights.
  • [ ] Reasonable waiting period (five business days is the working standard), with a live channel for response.
  • [ ] Dispute or explanation received? Pause, reinvestigate, and reassess.
  • [ ] Individualized assessment documented under the Green factors.
  • [ ] Adverse action notice sent with all five § 1681m(a) elements.
  • [ ] State/local fair-chance, ICRAA/GBL, and credit-history overlays satisfied.
  • [ ] File retained, segregated, and — when its time comes — securely disposed of.

Primary authority

Statutes

  • Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x, including § 1681a (definitions: consumer report, CRA, investigative consumer report, employment purposes, adverse action); § 1681b(a)(3)(B) and § 1681b(b) (employment purposes; certification, disclosure, authorization, and the pre-adverse-action requirement); § 1681c (obsolescence limits and the $75,000 salary exception); § 1681d (investigative consumer reports); § 1681e (CRA compliance procedures and maximum possible accuracy); § 1681g(c) (Summary of Consumer Rights); § 1681i (reinvestigation of disputes); § 1681k (public-record information for employment purposes); § 1681m (adverse action notice requirements); § 1681n (willful noncompliance; statutory damages of $100–$1,000, punitive damages, and fees); § 1681o (negligent noncompliance); § 1681p (limitations period); § 1681q (obtaining information under false pretenses); § 1681t (relation to state laws).
  • Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e-2, including § 2000e-2(k) (disparate impact; job relatedness and business necessity).
  • Fair Chance to Compete for Jobs Act of 2019, 5 U.S.C. § 9202.
  • Representative state analogues (state law — verify your jurisdiction): California Investigative Consumer Reporting Agencies Act, Cal. Civ. Code §§ 1786 et seq.; California Fair Chance Act, Cal. Gov't Code § 12952; California Labor Code § 1024.5 (credit reports); New York General Business Law § 380 et seq.; New York Correction Law Article 23-A.

Regulations and agency guidance

  • FTC Disposal Rule, 16 C.F.R. part 682; CFPB Regulation V, 12 C.F.R. part 1022 (including the model Summary of Consumer Rights and the Notice to Users of Consumer Reports).
  • EEOC, Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII of the Civil Rights Act of 1964 (April 25, 2012).
  • EEOC recordkeeping regulations, 29 C.F.R. part 1602.

Cases

Secondary sources

  • CFPB, A Summary of Your Rights Under the Fair Credit Reporting Act (the model form prescribed under § 1681g(c) and appended to Regulation V) — use the current model form; it has been revised, and a stale version is a defective packet.
  • CFPB, Notice to Users of Consumer Reports: Obligations of Users Under the FCRA (the companion Regulation V appendix summarizing user duties, including the § 1681b(b) employment sequence).
  • FTC staff guidance on employment background screening, including the long-standing staff view that a waiting period of roughly five business days between the pre-adverse-action notice and the final notice is generally reasonable. This is staff guidance, not a statutory deadline; the statute requires only a reasonable period.

A practice note on weight: the FCRA's employment provisions are short and mechanical, and the case law that matters is mostly about the disclosure form. Read § 1681b(b) and § 1681m directly. They are two of the few federal statutory provisions a non-lawyer HR professional can and should read in the original.

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. The FCRA is federal, but background-check compliance also depends on state and local fair-chance, consumer-reporting, and credit-history laws that vary substantially and change often. Verify current requirements in every jurisdiction where you recruit, and consult qualified counsel before acting.