FCRA Background Check Rules for Employers
Updated 11 min read
The FCRA requirements at a glance
- 01
Have a permissible purpose for the report
Before you order, 15 U.S.C. § 1681b(a)(3)(B)
- 02
Give the stand-alone disclosure and get written permission
Before you order, § 1681b(b)(2)(A)
- 03
Certify your compliance to the screening firm
When you order, § 1681b(b)(1)
- 04
Send the interview notice, if the firm will interview people
Within 3 days of ordering, § 1681d(a)(1)
- 05
Send the pre-adverse notice with the report and the Summary of Rights
Before you decide against, § 1681b(b)(3)(A)
- 06
Wait a reasonable period for the person to respond
5 business days is common practice, FTC staff letter, 1997
- 07
Send the final adverse action notice
After the decision, § 1681m(a)
- 08
Dispose of the report securely
Whenever you discard it, 16 CFR 682.3
The Fair Credit Reporting Act governs every background check you buy from a screening firm, which the statute calls a consumer reporting agency. Its employer rules come down to the eight steps above. Steps 02 and 05 are the ones a claim can be proved from paper alone: the disclosure page either stands alone or it does not, and the report copy either went out before the decision or it did not.
There is no headcount floor. The statute's definition of a “person” has no size limit, so the steps bind a one-person business ordering its first report exactly as they bind a national chain (15 U.S.C. § 1681a(b)). They also reach current staff: a report used for promotion, reassignment or retention is an employment-purpose report (§ 1681a(h)). FTC staff go further and read “employment purposes” to include a nonprofit staffed in whole or in part by volunteers, so a church or youth league follows the same steps; the volunteer screening planner sets the scope.
Permissible purpose and your certification
A screening firm may furnish a report to a person it has reason to believe “intends to use the information for employment purposes”. And no one may “use or obtain a consumer report for any purpose” unless the purpose is one the statute allows and it is certified to the firm.
15 U.S.C. § 1681b(a)(3)(B), § 1681b(f)
“Employment purposes” means evaluating someone for a job, a promotion, a reassignment or keeping them on. It does not cover a manager's curiosity about a neighbour, a customer or an ex-employee who has already left. Keep the purpose tied to a role, and write the role on the order.
Before the firm releases anything, you certify two things to it (§ 1681b(b)(1)): that you gave the disclosure and got written permission, and will follow the adverse-action steps if they come into play; and that you will not use the report in violation of any federal or state equal employment opportunity law. Most firms collect this certification in their account agreement or order screen. Read it: you are signing a promise the statute holds you to.
Knowingly and willfully obtaining a person's information from a screening firm under false pretenses is a federal crime: a fine under title 18, up to 2 years in prison, or both. Obtaining a report under false pretenses or knowingly without a permissible purpose also makes you liable to the screening firm for its actual damages or $1,000, whichever is greater.
15 U.S.C. § 1681q, § 1681n(b)
What to do
- Order a report only for a named role: hire, promotion, reassignment or retention.
- Read the certification in your screening firm's agreement before you sign it.
- Keep each order linked to the signed permission it relies on.
The stand-alone disclosure and written permission
“a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes”, and the person has authorized it in writing, which authorization may be on that same document.
15 U.S.C. § 1681b(b)(2)(A)
| What could go on the disclosure page | Status | Source |
|---|---|---|
| The statement that a report may be obtained for employment purposes | Required | § 1681b(b)(2)(A)(i) |
| The applicant's signature giving permission | Allowed on the same page | § 1681b(b)(2)(A)(ii) |
| A brief, minor addition that does not confuse or detract | Allowed, kept minor | FTC employer guidance, 2016 |
| A liability waiver or release | Not allowed | FTC staff letter (Hauxwell), 1998 |
| The job application itself | Not allowed | FTC employer guidance, 2016 |
| A state law notice | Ask counsel first | Statute: "consists solely of the disclosure" |
“Consists solely of the disclosure” is the phrase that decides most disputes over the form. The FTC's employer guidance says the notice must be in a stand-alone format and cannot sit in an employment application. A 1998 FTC staff letter said a liability waiver on the form breaks the rule, and the same letter said the disclosure and the permission may be combined. That is a staff view, not a ruling of the Commission, and it is the plainest reading of the statute's words.
Build the page with the disclosure form builder, then run the wording you already use through the FCRA disclosure checker. Some states add their own notice; check your state's statute, and keep any state text off the federal disclosure page unless counsel has cleared it.
FTC staff say a valid disclosure and consent remain effective throughout employment, so a signed form can cover later re-checks of the same person. Keep the signed original: it is your only proof.
Applicants for driving jobs under the Department of Transportation's hours-of-service rules who deal with you only by mail, phone or online may give oral, written or electronic consent, and get a notice within 3 business days after an adverse decision instead of the two letters. Everyone else gets the standard steps.
15 U.S.C. § 1681b(b)(2)(B)–(C), (b)(3)(B)
What to do
- Put the disclosure on its own page, with the signature line and nothing else of substance.
- Take any release or liability waiver off that page.
- Get the signature before you order, and file it with the report.
Investigative reports: when the firm interviews people
A report built from personal interviews with neighbours, friends, associates or others who know the person is an “investigative consumer report” (15 U.S.C. § 1681a(e)). For most employers that means one thing: reference calls made by the screening firm. It brings extra duties on top of the standard steps.
| Who makes the reference calls | What it is under the FCRA | Source |
|---|---|---|
| Your own staff call former employers | Not an investigative consumer report; section 606 does not apply | FTC staff, 606-2B |
| A screening firm calls or emails references | Investigative consumer report: notice within 3 days | § 1681d(a); FTC staff, 603(e)-3A |
| A screening firm passes on a former employer's reply | Consumer report, even when given by phone | FTC staff, 603(d)-6F |
Mail or deliver a written notice that the report will be made no later than three days after you first request it. It must tell the person they may ask for the nature and scope of the investigation and include the Summary of Rights. If they ask in writing, answer within five days of their request or of your order, whichever is later.
15 U.S.C. § 1681d(a)(1), § 1681d(b)
You also certify to the firm that you sent that notice and will answer a scope request; the firm may not prepare the report without that certification (§ 1681d(a)(2), (d)(1)). A negative remark from an interview must be confirmed by a second source with direct knowledge, unless the person interviewed is the best possible source (§ 1681d(d)(4)). And you escape liability for a slip on the notice or the scope answer only if you show you kept reasonable procedures to comply (§ 1681d(c)).
FTC staff allow a very limited notice of intent to order an investigative report alongside the main disclosure, but not the nature-and-scope description. In California, employers using investigative reports also answer to the state's Investigative Consumer Reporting Agencies Act (Civil Code § 1786 and following). Firms that run these calls are side by side in our reference check comparison.
Adverse action: two notices and a wait
Adverse action is not only a rejection. It is “a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee” (§ 1681a(k)(1)(B)(ii)): a withdrawn offer, a promotion refused, a transfer, a firing. If the report played any part in it, the two-notice sequence applies.
| Notice | When | What goes with it |
|---|---|---|
| Pre-adverse notice | Before the decision | A copy of the report; the CFPB's Summary of Your Rights (March 2023 version) |
| Final adverse action notice | After the decision | The firm's name, address and phone; that it did not decide; free copy within 60 days; right to dispute |
Federal law sets no fixed waiting period. FTC staff have said a “reasonable period” must pass, and a 1997 FTC staff letter called five business days reasonable, which is why many employers wait at least five business days. Some states and cities set their own, longer windows.
15 U.S.C. § 1681b(b)(3)(A); FTC staff letter to Weisberg, June 27, 1997
The point of the gap is the one the FTC gives: the person gets the chance to review the report and tell you if it is wrong. Read what they send. A court record that belongs to someone else with the same name is exactly what this step exists to catch. The adverse action timeline calculator dates every step for a given notice date, and the adverse action letter generator drafts both letters from one form.
The final notice carries the screening firm's name, address and phone number (toll-free if it is a nationwide firm), a statement that the firm did not make the decision and cannot say why it was made, the right to a free copy of the report if requested within 60 days, and the right to dispute anything inaccurate or incomplete with the firm (§ 1681m(a)). If you used a numerical credit score, add the score, its range, up to four key factors that lowered it, the date it was created and who provided it. The statute allows oral, written or electronic notice; send it in writing anyway, so you have a record.
| Where the person is | Response window before you decide | Source |
|---|---|---|
| Federal rule only | No fixed period; 5 business days is common practice | FTC staff letter, 1997 |
| California (5+ employees) | At least 5 business days from receipt; 5 more if disputing | 2 CCR § 11017.1(c) |
| New York City | At least 5 business days from receipt of both documents | NYC Admin. Code § 8-107(11-a) |
California and New York City put their own fair chance process on top, with their own notice contents; see the California Fair Chance Act steps and the NYC Fair Chance Act process. For criminal records anywhere, EEOC guidance asks you to weigh how serious the offense was, how long ago it was, and what the job involves; the individualized assessment guide shows how to document that. The letters side by side are in pre-adverse vs adverse action notice.
What to do
- Send the report copy and the current Summary of Rights before any decision that leans on the report.
- Wait at least five business days, longer where a state or city says so, and read any reply.
- Send the final notice as a separate letter, and file both with their dates.
What a report may contain: the seven-year limits
| Item | How old it may be | Cite |
|---|---|---|
| Bankruptcies | 10 years | § 1681c(a)(1) |
| Civil suits, civil judgments, arrest records | 7 years from entry, or the statute of limitations if longer | § 1681c(a)(2) |
| Paid tax liens | 7 years from payment | § 1681c(a)(3) |
| Collections and charge-offs | 7 years, starting 180 days after the delinquency began | § 1681c(a)(4), (c)(1) |
| Any other adverse item | 7 years | § 1681c(a)(5) |
| Criminal convictions | No federal limit | § 1681c(a)(5) |
These limits bind the screening firm, not you, but they shape what lands on your desk. Two details catch employers out. Convictions have no federal time limit, so a twenty-year-old conviction can appear; some states add their own limit. And the limits do not apply at all to a job paying, or reasonably expected to pay, $75,000 a year or more (§ 1681c(b)(3)). That figure is fixed in the statute and is not adjusted for inflation.
State law can be stricter than the report. In California, an arrest that did not lead to a conviction is off limits for hiring decisions even if a federal report could include it. The lookback checker tests a record date against these rules, and what shows up on a background check goes search by search. Credit reports carry extra state limits of their own; see credit checks for employment.
What your screening firm owes you and the applicant
- Reasonable procedures to assure maximum possible accuracy of what it reports (§ 1681e(b)).
- A written notice of your duties as a user of reports, the CFPB's Notice of User Responsibilities (§ 1681e(d)).
- For court records reported for a job: tell the applicant at the time, or keep strict procedures so the record is complete and current (§ 1681k(a)).
- A reinvestigation within 30 days of a dispute, extendable by up to 15 days if the person sends new information (§ 1681i(a)(1)).
- A free copy of the file to the person who asks within 60 days of receiving your final notice (§ 1681j(b)).
You cannot outsource your own steps: the disclosure, the certification and both notices stay yours even when the firm's platform sends them. What you can do is pick a firm whose process is audited. Professional Background Screening Association accreditation is voluntary, not required by law, and means an outside auditor checked the firm against a standard centred on FCRA compliance. Our PBSA-accredited screeners directory lists 131 firms, and the FCRA-compliant background check companies comparison sets the best known of them against these duties.
Keeping and disposing of reports
Anyone who keeps consumer information for a business purpose “must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” Consumer information includes any record that is, or is derived from, a consumer report.
16 CFR 682.3(a); 16 CFR 682.1(b)
The FTC's Disposal Rule gives examples: shredding, burning or pulverizing paper so it cannot practicably be read or reconstructed; destroying or erasing electronic files the same way; or a contract with a record-destruction company you have checked. That covers the report, the hiring manager's printout and the notes made from it.
No federal rule sets a minimum number of years to keep a background report. Check your EEOC and state record-keeping rules before you set a purge date, and keep reports apart from personnel files that many people can open.
What to do
- Keep reports in one restricted folder, not in the general personnel file.
- Set the purge date from your EEOC and state record-keeping rules.
- Shred paper and wipe files; keep the destruction contract if a vendor does it.
What a violation costs
A willful violation costs actual damages or statutory damages of $100 to $1,000 per affected person, plus any punitive damages the court allows, plus the other side's costs and reasonable attorney's fees. A negligent violation costs actual damages plus costs and fees. Claims must be filed within two years of discovery and no later than five years after the violation.
15 U.S.C. §§ 1681n(a), 1681o(a), 1681p
The per-person figure is why a defective disclosure form is expensive: the same form went to every applicant, so every applicant in the limitation period is a potential claimant. Fixing the form today stops the count growing.
Quick reference
- Disclosure
- Its own document, before you order15 U.S.C. § 1681b(b)(2)(A)
- Interview notice (investigative reports)
- Within 3 days of ordering§ 1681d(a)(1)
- Answer to a nature-and-scope request
- Within 5 days§ 1681d(b)
- Wait after the pre-adverse notice
- No fixed period; 5 business days is practiceFTC staff letter, 1997
- Summary of Rights edition
- March 2023, required since 2024-03-2012 CFR Part 1022, App. K
- Free copy request after the final notice
- 60 days from receipt§ 1681j(b)
- Firm's reinvestigation of a dispute
- 30 days, up to 15 more§ 1681i(a)(1)
- Lookback for most adverse items
- 7 years (bankruptcy 10); convictions none§ 1681c(a)
- Salary that lifts the lookback limits
- $75,000 a year or more§ 1681c(b)(3)
- Statutory damages, willful violation
- $100 to $1,000 per person§ 1681n(a)
- Time to sue
- 2 years from discovery, 5 at most§ 1681p
Questions employers ask
Does the FCRA apply to a small business?
Yes. The FCRA has no headcount floor: its hiring steps apply to any employer that orders a background report from a screening firm, a one-person business included.
Can the background check disclosure be part of the job application?
No. The statute requires a document that consists solely of the disclosure, and the FTC's employer guidance says it cannot be in an employment application. The signature giving permission may sit on the disclosure page.
How long do I have to wait after the pre-adverse action notice?
The FCRA sets no number of days. FTC staff say a reasonable period must pass, and a 1997 staff letter called five business days reasonable, so that is common practice. California and New York City set at least five business days by law, counted from when the person receives the notices; the timeline calculator counts them for you.
Can I send the pre-adverse and adverse action notices together?
No. FTC staff say the two notices may not be included in the same document: one goes before the decision, the other after it.
Do I need new permission to re-check a current employee?
FTC staff say a valid disclosure and consent remain effective throughout employment. A re-check that leads to a decision against the employee still needs both adverse-action notices.
Does the FCRA apply when my own staff call references?
FTC staff say no for the investigative-report rules: when your own people contact former employers, section 606 does not apply. When a screening firm makes the calls, by phone or email included, it does.