FCRA Compliance Guide for Employers

Are you using our background checks for employment purposes? If so, you are legally required to follow the conditions of the Fair Credit Reporting Act (FCRA), a federal law that protects the privacy and rights of the subjects of consumer reports. Background checks for employment purposes qualify as consumer reports, which means they are subject to the FCRA. 

Note that “employment purposes” includes not only part-time or full-time employees but also contractors, temporary workers, agents, volunteers, and other roles. Whenever you’re using a background check to vet someone for any of these positions, you must follow the FCRA requirements listed below.

What is the Fair Credit Reporting Act (FCRA)?

The Fair Credit Reporting Act, or the FCRA, is a federal law intended to ensure the privacy, accuracy, and fairness of consumer reports. Though the law was initially created to regulate credit checks – and therefore applied mostly to credit reporting agencies – the FCRA today extends to background checks. Employers, landlords, lenders, and other entities that regularly use background checks for professional or official purposes must follow the FCRA regulations to avoid violations of federal law.

History

The FCRA was enacted in 1970 to ensure that consumer reporting agencies always exercised their responsibilities with fairness, impartiality, and respect for the consumer’s right to privacy. The FCRA protects the subject of a check by limiting what a consumer reporting agency can report. Effective nationwide, the law is the key landmark for consumer, employee, and job seeker rights. It was the first law in the United States to regulate how private businesses could access and use someone’s personal information. Many additional laws on the subject have been passed in the years since, particularly since the internet and social media have created new avenues for infringing on citizens’ privacy. However, the FCRA remains arguably the most crucial law regarding the subject of background checks.

When the FCRA was implemented, the growing privacy-related trend in the U.S. wasn’t the expansion of online life but rather the growth of the credit reporting industry. The end of the 19th century birthed Retail Credit Co., the first significant credit reporting agency in American history. Retail Credit grew considerably over the first half of the 20th century, acquiring smaller agencies and expanding its size, reach, and influence.

The growth of Retail Credit and the credit reporting industry inspired controversy and backlash. Consumers were alarmed at how credit reports could deny them key opportunities, from loans to housing—especially since there was no mechanism in place for consumers to review their own credit reports, dispute their accuracy, or explain a lapse in credit to a creditor.

These concerns were well-founded: not only did consumers have no rights in credit reporting but there was also a practice in the industry in which the investigators charged with assembling consumer credit reports had to reach “quotas” for adverse information on their reports. To achieve those quotas, some investigators compiled reports based on incomplete information to cast a negative light on consumers and their credit history.

In other cases, investigators fabricated negative information. Sometimes, they departed from credit history information with what they reported on credit reports, highlighting private information—such as race, national origin, sex, religion, disability, genetic information, marital status or sexual orientation—under the pretense of revealing details about a person’s “character.”

This rampant abuse of power ultimately led Congress to launch an inquiry into the credit reporting industry, which led to implementing the FCRA.

The law took effect on April 25, 1971. While it has been revisited, amended, and improved several times in the years since it remains the primary regulation for the reporting industry. It applies to entities ranging from the three major credit reporting bureaus (Equifax, Experian, and TransUnion) to screening companies such as backgroundchecks.com.

Purpose

The simplest way to describe the purpose of the FCRA is that it exists to protect the rights of consumers. In the past, consumers had no way to protect themselves from unethical, inaccurate, or overly intrusive reports. The FCRA is an in-depth, multi-layered law that defends these rights and lays out mechanisms for their protection.

Even though it mentions “credit reporting” in its title, the FCRA applies to much more than credit reports. The background reports regulated under the FCRA include the consumer’s credit standing. Still, they can extend to matters of character, general reputation, personal characteristics, mode of living, and similar information—all of which can determine a person’s eligibility for credit, insurance, housing, or a job.

By these standards, screening companies qualify as a “consumer reporting agency” under the FCRA, and employee background screenings are considered consumer reports. Both are subject to the regulatory measures in the FCRA.

Within the FCRA, there are rules about what can be reported as part of consumer reporting agencies’ checks. For instance, bankruptcy cases can be no older than ten years, and all other adverse information—except criminal convictions—can be no older than seven years. Reports cannot share medical information unless they are for insurance purposes.

Because other types of legislation can limit or restrict the information that employers can use to make hiring decisions, some employers experience confusion regarding employment background check regulations. The FCRA’s “seven-year rule,” for instance, features in discussions about how far back an employment investigation can go, even though the primary information most employers seek with background searches—criminal history—is not limited in this respect by the law. Some states have established their own laws to extend the seven-year rule to criminal history, but this restriction is not enforced at the federal level.

It is worth noting that, while states often have their own laws to supplement the FCRA, no state can pass a law that precludes or supersedes the FCRA. As a federal law, the FCRA must be obeyed by all reporting agencies and all employers throughout the U.S. and its territories.

In addition to protecting the consumer once the check is initiated, FCRA requirements also demand that an employer disclose specific information and obtain the consumer’s permission before their investigation can legally begin.

FCRA Compliance Requirements for Employers Running Background Checks

Any employer using past information obtained through a reporting agency such as ours for employment purposes must follow the FCRA to the letter. These requirements apply whether you’re hiring for a full-time position or a part-time job. They are also applicable whether you’re vetting contractors or temporary employees, and even when screening volunteers. All these individuals have rights regarding personal information, and employers must respect those rights under federal law.

Within the FCRA, there are several rules about what agencies can report. For instance, bankruptcy cases can be no older than ten years. All other adverse information, except for criminal convictions, can be no older than seven years. No medical information can be shared on consumer reports unless the report is for insurance purposes.

In addition to protecting the consumer once a check is underway, the FCRA requires an employer to disclose their intention to run the check and obtain the subject’s permission beforehand.

If you plan to evaluate a candidate’s past as part of your pre-employment screening process, you need to be aware of the requirements of the FCRA. This federal law dictates how employers can execute any pre-employment check, whether a criminal background search for criminal records, a credit record check, or a verification of past employment.

To learn more about how FCRA compliance works in the context of the pre-employment background screenings that backgroundchecks.com provides, continue reading below.

Before using our services

Before conducting a background check for employment purposes, educate yourself on the requirements of the FCRA. One essential document to read is the Consumer Financial Protection Bureau’s "Notice to Users of Consumer Reports."

Before the check

The first steps of the background screening process are straightforward for both the employer and the applicant. 

First, the employer must provide the applicant with a disclosure form. This form informs the candidate that you intend to check their background for employment purposes. This disclosure must be separate from any other documents—for instance; you cannot couple the disclosure form with your organization’s employment application or a release of liability.

Second, the applicant must sign an authorization that permits the employer to run a background check. Similar to the disclosure form, the consent authorization form must be presented separately from most other application documents or job information. 

The FCRA permits the combination of the disclosure and authorization forms, though they can also be presented separately. If you do choose to combine the two documents, note that the combined form cannot contain anything other than disclosure and authorization. 

One test for whether the form is FCRA compliant is to check whether each sentence can begin with either "We hereby disclose to you that ..." or "You hereby authorize us to ...". If not, there is likely extraneous information in the form that might threaten its FCRA compliance. Always consult with legal counsel when preparing these documents to ensure that they follow the letter of the law.

The primary purpose of these disclosure and consent forms is to comply with the FCRA. These forms also give the background screening company permission to perform the check. They may serve as verification to former employers or schools that they are permitted to give out information.

To better understand why the proper presentation of disclosure and consent documents matters, read this article about a court ruling from 2017. A court found that FCRA disclosures containing waivers were “willful” violations of the FCRA simply because they incorporated additional liability waiver terms.

Realize that these rules of proper disclosure and authorization don’t just apply to criminal history checks. In any situation where backgroundchecks.com obtains information for you based on an interview (for example, during reference checks), you must provide additional disclosures to the subject as follows:

You must inform the subject that you are obtaining an investigative consumer report about them, including information about character, general reputation, personal characteristics, or way of living. 

You must inform the subject that they have a right to request a description of the nature and scope of the investigation. If the subject requests that description, you must provide it within five days. 

Before the decision

If a background check returns no red flags, the employer may choose to move forward with hiring the subject of that report. In these situations, the employer has no more remaining obligations under the FCRA.

However, if the employer decides to rescind a job offer or disqualify a candidate based on background check findings, additional FCRA requirements apply. In the parlance of the FCRA, this decision is “adverse action.” Employers considering adverse action based on background check findings have a series of FCRA obligations they must follow before they consider or hire another candidate.

Specifically, if you are the employer, the FCRA requires you to send the candidate a “pre-adverse-action notice” before you officially finalize your decision. The pre-adverse action notice must include a copy of the background report and the Consumer Financial Protection Bureau’s summary of rights. 

You must send this pre-adverse notice a “reasonable time” before making a decision based on the report. The Federal Trade Commission states that five business days is a reasonable time for the notice to be delivered by first-class mail. If that five-day period elapses without a response from the subject, you may move forward with a decision based on the background check report.

If the subject disputes the background report or pre-adverse notice, you must halt the hiring process. Under the FCRA, you are not permitted to move forward with adverse action until the background check company has resolved the candidate’s dispute.

On the decision

If the subject does not respond to the pre-adverse action notice, you can officially take action and move forward with the hiring process. Similarly, if the background check company pursues the subject’s dispute but rules that the information included in the report is accurate, you can formally take the candidate out of employment consideration.

In either case, when you do officially take adverse action based on a background check report, you must take several additional steps to comply with the FCRA. These steps include the following:

1. Notify the subject of the decision
2. Notify the subject of the background check company’s business name, address, and telephone number
3. Notify the subject that the background check company did not make the decision
4. Notify the subject that they can request another free copy of their background report from the consumer reporting agency (the background check provider) within the next 62 days
5. Notify the subject that they can dispute any inaccurate or incomplete information in the report by contacting the background screening agency
6. In addition to these rules, many states (notably California) have additional requirements concerning using a background check company’s services.

Proper Disclosure & Consent

The first FCRA requirements that employers must follow apply before they run a check.

First, in writing, an employer must disclose to the candidate that they intend to obtain a report for employment purposes. They must present this disclosure form as either a standalone document or coupled with only an authorization and consent form.

Employers are prohibited from bundling the disclosure and consent agreements with any other employment or application-related materials, including an initial job application or liability release. Each candidate must know precisely what they agree to when they sign a consent form for a check.

To move forward with obtaining a report about a candidate, the employer must have a signed authorization form in hand from the candidate. If the candidate refuses to sign the consent form, the employer has the right to disqualify that candidate from employment consideration, but they cannot proceed with the screening without that consent.

These disclosure and consent forms serve multiple purposes:

1. They comply with the FCRA,
2. They notify the candidate that they are going to be subject to a check,
3. They observe the candidate’s right to refuse to permit the check if they so choose,
4. They give the screening company permission to conduct background checks, and
5. They can act as verification for the entities that will be contacted as part of the screening process—such as past employers or schools—that they can disclose information about the candidate.

Pre-Adverse Action

In an employment check, this term refers to an employment decision that negatively affects a job candidate, such as choosing to disqualify a candidate from job consideration because of a red flag on the criminal report.

Per the FCRA, employers are required to provide a candidate with a notice if they are considering making an adverse decision about the candidate based on background findings. Employers must provide this notice to the applicant before they finalize their decision, providing a “reasonable” amount of time for the candidate to review and respond.

In addition to a pre-adverse notice, the employer must provide the candidate with a copy of the report that led to the decision and a copy of the Consumer Financial Protection Bureau’s summary of consumer rights under the FCRA. The employer must then wait a reasonable amount of time before making the adverse decision official and moving on with the hiring process.

How long is a reasonable amount of time for the pre-adverse decision stage? According to the Federal Trade Commission, employers should provide their candidates at least five business days. This length of wait allows for the notice and other required documents to be delivered to the candidate via first-class mail.

The waiting period also provides time for the candidate to dispute the report. Perhaps the candidate wishes to challenge the report’s accuracy, or maybe they want to provide context for the screening report so that the employer has a fuller picture of what happened. Nonetheless, if the candidate does dispute the report, the FCRA forbids the employer from finalizing the adverse decision or moving forward with the hiring process until the dispute is resolved.

Adverse Action

Any adverse hiring decision made by an employer after a report activates a checklist of FCRA requirements that the employer must follow strictly.

If an employer chooses to take action against a candidate because of something they learned in a check, they must finalize the decision by taking the following steps:

•       Notify the candidate of the adverse decision,
•       Provide the candidate with information about the company that prepared the background reports, including the company name, address, and phone number,
•       Include a disclaimer to the candidate that the investigation company prepared the report but did not make the adverse decision,
•       Inform the candidate that they have the right to request another free copy of their report from the check company at any point within the next 62 days, and
•       Tell the candidate that they can dispute any information on the report with the screening company should they believe that information be inaccurate, incomplete, or outdated.

Employers should also check their state laws, which may stipulate additional requirements for this adverse decision step. Consulting with an attorney with expertise and experience navigating the nuances of employment law can be helpful here.

Sample FCRA Forms

At backgroundchecks.com, we strive to make compliance easy for our customers. We know that background check laws can be confusing. We also know that, with a law like the FCRA, the stakes for compliance are high, given that FCRA violations can lead to costly lawsuits and other problems for employers. By providing access to a dedicated compliance area in our web-based background checks ordering system, we strive to allow more clarity around what FCRA compliance looks like. On our website, you can view sample FCRA-compliant forms, notices, and other documents, which can help you navigate the process of designing a compliant background screening process for your organization.

Forms available through this portal include:

•       Sample disclosure forms
•       Sample authorization forms
•       Consumer summary of rights
•       Sample pre-adverse action notices
•       Sample adverse action notices
•       An overview of FCRA employer obligations
•       An overview of how the Driver's Privacy Protection Act of 1994 impacts the use of motor vehicle reports in consumer investigations

Equal Employment Opportunity Commission (EEOC)

While the FCRA is often considered the preeminent background check regulation, it is not the only word on legal compliance for investigations. Another factor to consider when striving to devise a compliant background screening policy for your business is the Equal Employment Opportunity Commission (EEOC).

The EEOC provides federal guidance on using background checks to protect the rights of minorities, women, people with disabilities, and other groups. The organization’s mission is “to stop and remedy unlawful employment discrimination in the workplace by enforcing federal laws that prohibit employment discrimination.

The EEOC argues that some uses of background checks in an employment context can lead, intentionally or not, to discrimination in hiring. If the EEOC deems there to be an issue of discrimination with an employer’s hiring policies, the commission may file a lawsuit against that employer. As such, employers throughout the country should consider EEOC guidance when devising their policies and protocols for vetting candidates.

Most generally, EEOC guidance on background checks simply encourages reviewing each candidate on a case-by-case basis. For instance, the EEOC cautions against disqualifying every candidate with a criminal record. Instead, employers are urged to look at each criminal conviction separately and determine the relevance to the job at hand. For a job with direct relevance to the position being sought (such as a candidate for a banking job who has a history of embezzlement), the employer has reasonable grounds to disqualify that person from hiring consideration. Other criminal history, though – such as past drug charges – may not be as relevant to the position and, therefore, should not be weighed as heavily in the hiring decision.

Similarly, the EEOC encourages employers to consider details such as the severity of the crime, how much time has elapsed since the conviction, whether the subject is a one-time or repeat offender, and other variables when considering criminal records.

Read our Learning Center page about the EEOC to learn more about this guidance and why it matters.

Common FCRA Violations

FCRA claims have become more common in recent years. Employers that fail to comply with every nuance of the law can find themselves in the defendant’s chair for costly lawsuits. Major employers such as Amazon.com, Uber, Avis, PostMates, and JPMorgan have all been sued over alleged violations of the FCRA. In 2019, a judge certified a class of five million job applicants in an FCRA class-action suit against Walmart. Clearly, even the biggest companies in the U.S. are not immune to the risks of an FCRA violation. Smaller businesses should not assume they are immune, either.

Understanding just how costly even a minor FCRA violation can be, will encourage employers of all sizes to approach compliance seriously. In addition, learning from the mistakes of other employers could help your business design a compliant policy.

Because knowledge of past FCRA violations can be useful in multiple ways, backgroundchecks.com regularly covers major FCRA lawsuits on our blog. Some of the most common violations in pre-employment investigations are related to the following compliance missteps:

•       Failing to provide disclosure and consent documents separate from other application materials
•       Conducting checks without notifying candidates or obtaining written permission
•       Not providing candidates with a reasonable amount of time to dispute their report before finalizing an adverse decision
•       Failing to notify candidates in writing that adverse action is based on findings from a background screening
•       Not furnishing the candidate with a copy of the report, a summary of their rights, and other materials, documents, or information required by law

This list is not a comprehensive accounting of the various reasons employers have been sued for violating the FCRA. Still, it does give an idea of where violations often occur. As such, this list is a valuable starting checklist for employers trying to lawsuit-proof their FCRA compliance.

Summary of Rights & Copy of Report

As part of FCRA compliance, any employer wishing to disqualify a candidate from job consideration based on background check findings must furnish the subject with a summary of their rights under the FCRA and a copy of the background check report.

You can find a full summary of consumer rights under the FCRA on the Consumer Financial Protection Bureau website. Employers must provide a copy of this document to all candidates during the pre-adverse process.

As for the background check, once an employer has received the report from a check agency, they can copy and distribute it to the job candidate for review.

At backgroundcheck.com, we can assist - an employer can provide us with email addresses for their candidates during the ordering process. If our reports lead to adverse decisions, we can send copies of the reports directly to the affected candidates. 

Further Reading

As part of the backgroundchecks.com blog, we regularly explore topics related to the FCRA and FCRA compliance. Here are some of our latest FCRA-related blogs for further reading and learning: 

• The Gilberg Decision: What a Recent Court Case Reminds Us about the FCRA
• Employers Continue to be Sued in Class Action Lawsuits Alleging FCRA Violations
• Plaintiff need not prove that defendant is a CRA under the FCRA to survive a motion to dismiss
• District Court Allows Class Action Suit Based On Technical Failures to Comply with FCRA
• Landlords in a Changing “Fair Chance” Landscape Must Have the Right Screening Tools
• Are Criminal Background Checks Subject to the FCRA?
• CFPB Updates Summary of Rights Under FCRA
• Commentary on E-Sign and the FCRA
• Employers Settle FCRA Documentation Class Actions for $5.9 Million 

Frequently Asked Questions

Which states follow the FCRA?

Because the Fair Credit Reporting Act is a federal law, all 50 states must abide by it, with zero exceptions. In fact, the FCRA not only applies to the 50 states but also U.S. territories such as Washington, D.C., Puerto Rico, and Guam.

What are the common FCRA background check violations? 

• Many of the most common FCRA check violations are simple process violations, for example:
• A disclosure form bundled with the job application instead of presented as a standalone document.
• The employer skipped steps before making an adverse hiring decision triggered by something on a background check report.
• Failure to provide the candidate with a copy of the history report or contact information for the provider who prepared the report. 

While seemingly minor, each of these issues violates federal law and can lead to expensive lawsuits, including class-action suits. 

What does FCRA compliant mean?

Staying compliant with the FCRA requires employers to follow a federal law called the Fair Credit Reporting Act (FCRA to the last letter. This law includes specific requirements regarding how employers use background checks for employment purposes. Specific sections of the FCRA cover nuanced guidelines for background check disclosure and authorization and what employers must do if they wish to disqualify a candidate from job consideration based on background check findings. Employers should establish written background screening policies that incorporate FCRA requirements.

What does FCRA mean on a credit report?

FCRA stands for “Fair Credit Reporting Act.” It is a federal law enacted in 1971 that regulates the consumer reporting agency industry and protects consumer privacy. All credit reporting bureaus are subject to the FCRA, including all background check companies. Entities that use consumer reports in their decision-making must also follow the FCRA, making it a relevant law for any employer that uses pre-employment background checks.

How do you comply with the FCRA?

All employers that wish to use background checks to guide employment decisions should review the FCRA in detail and seek guidance on FCRA compliance from their attorneys. 

What are my rights under FCRA? 

If you are a job seeker, you can count on the FCRA to protect you throughout the pre-employment background check process. No employer can launch an investigation into your background without first disclosing their intention to do so and obtaining your express written consent. In addition, employers cannot disqualify you from job consideration based on background check findings without first notifying you and giving you a chance to dispute those findings. 

What is the purpose of the Fair Credit Reporting Act?

The FCRA regulates consumer reporting agencies to conduct their business in fair, impartial, and respectful ways, particularly regarding consumer privacy.