A Summary of Your Rights Under the FCRA: When Employers Must Send It
Updated 10 min read
When the Summary of Rights has to go out
| Moment | Who gives it to whom | Status | 15 U.S.C. § |
|---|---|---|---|
| The screening firm sends you a report | Screening firm to you | Required | 1681b(b)(1)(B) |
| You send the pre-adverse action notice | You to the person | Required | 1681b(b)(3)(A)(ii) |
| You order an investigative report (interviews) | You to the person | Required (see note) | 1681d(a)(1)(B) |
| A remote DOT driving applicant asks for the report | You to the person, within 3 business days | Required | 1681b(b)(3)(B)(ii) |
| The person asks the screening firm for their file | Screening firm to the person | Required | 1681g(c)(2) |
| You send the final adverse action notice | You to the person | Not required | 1681m(a) |
| You hand over the disclosure and authorization | You to the person | Not required | 1681b(b)(2)(A) |
For an employer, the moment that matters most is the second row. Before you take adverse action based in whole or in part on a background report, the person gets a copy of the report and “a description in writing of the rights of the consumer under this subchapter, as prescribed by the Bureau”. That description is the CFPB's A Summary of Your Rights Under the Fair Credit Reporting Act. Our guide to the pre-adverse and adverse action notices covers the rest of that package.
When a screening firm interviews references for you, the written notice you send within three days of ordering the report “includes a statement informing the consumer of his right to request the additional disclosures provided for under subsection (b) of this section and the written summary of the rights of the consumer”. The sentence can be read two ways; attaching the summary to that notice satisfies both.
15 U.S.C. § 1681d(a)(1)(B)
The first row runs the other way. The screening firm may furnish an employment report only if it provides the summary with the report or has provided it before, so your account with the firm should already hold a copy. That copy is for you to read; it does not replace the one you send with the pre-adverse notice.
Two moments need no summary at all. The final adverse action notice has its own list of contents in 15 U.S.C. § 1681m(a), and the summary is not on it. At the start of the process, nothing in the FCRA asks for it either. If you hand it out at that stage anyway, make it a separate sheet: the disclosure must sit in a document that “consists solely of the disclosure”. Our FCRA disclosure checker tests a draft against that rule.
What to do
- Put the current summary in every pre-adverse package, behind the copy of the report.
- Attach it to every investigative report notice.
- Keep it off the disclosure page. If you share it early, use its own sheet.
Which version is current
- Edition
- March 2023
- Required since
- March 20, 2024
- File name
- bcfp_
consumer- rights- summary_ 2018-09.pdf - Length
- 4 pages
- Rule
- 12 CFR Part 1022, App. K
The current form is the CFPB's March 2023 version. The Bureau updated the federal agency contact details that year, and compliance with the new version became mandatory on March 20, 2024. The confusing part is the file: the CFPB still serves it under a name ending “2018-09”, so a quick glance at the URL suggests an old form. It is not. The PDF's own document title reads “Summary of Consumer Rights Model Form (Mar. 2023)”, and the posted file already carries the technical corrections the CFPB published in August 2023.
On page 2, the opt-out number for prescreened offers reads 1-888-567-8688. On page 4, item 3 (air carriers) names the Office of Aviation Consumer Protection. If your printout says something else, it predates the current edition: download it again from the CFPB's PDF.
Appendix K to Regulation V sets how much room you have. You do not have to reproduce the CFPB's layout, but you cannot drift far from its words, and you cannot let the agency list go stale.
“The prescribed form for this summary is a disclosure that is substantially similar to the Bureau's model summary with all information clearly and prominently displayed. The list of Federal regulators that is included in the Bureau's prescribed summary may be provided separately so long as this is done in a clear and conspicuous way.”
Translations comply “provided that the translation is accurate and that it is provided in a language used by the recipient consumer.”
12 CFR Part 1022, App. K (88 FR 58066, Aug. 25, 2023)
The CFPB posts a Spanish version beside the English one on its FCRA model forms page (Spanish PDF). If your applicant reads Spanish, sending both costs nothing. The same page also holds the separate summary of identity theft rights, which is not the form a hiring file needs.
What to do
- Download the English PDF (and the Spanish one if it fits your workforce) from consumerfinance.gov.
- Do not retype it into your own template; a copy that drifts from the model is your problem, not the CFPB's.
- Recheck page 2 and page 4 whenever you refresh your letter templates.
What the summary tells the applicant
Read the form once from the applicant's side before you send it. It runs four pages: three of rights, written in bold lead sentences, and a fourth page listing the federal agencies that enforce the FCRA by type of business. These are its headings, word for word, with what each one means in a hiring file.
| The form says | What it means for you |
|---|---|
| You must be told if information in your file has been used against you. | Your two notices are how you keep this promise. |
| You have the right to know what is in your file. | A person you turned down because of a report gets a free file disclosure. |
| You have the right to ask for a credit score. | Matters only if you use credit reports in hiring. |
| You have the right to dispute incomplete or inaccurate information. | Disputes go to the screening firm, often during your wait. |
| Consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information. | The form says usually within 30 days. |
| Consumer reporting agencies may not report outdated negative information. | The seven- and ten-year limits; convictions are not covered by them. |
| Access to your file is limited. | Employers are among those with a valid need. |
| You must give your consent for reports to be provided to employers. | The written authorization you collected at the start. |
| You may limit “prescreened” offers of credit and insurance you get based on information in your credit report. | Not a hiring point. |
| Consumers have the right to obtain a security freeze. | Applies to nationwide credit bureaus. |
| You may seek damages from violators. | Including, in some cases, a user of reports, which is you. |
| Identity theft victims and active duty military personnel have additional rights. | Points to consumerfinance.gov/learnmore. |
Two lines are aimed squarely at employment. One tells the reader that anyone who uses a report to deny an application “for credit, insurance, or employment” must say so and name the agency. The other says a consumer reporting agency may not give information to an employer without the person's written consent, adding that “written consent generally is not required in the trucking industry.” That last clause mirrors the narrow rule for remote applicants to DOT-regulated driving jobs, covered in our FCRA background check rules for employers.
The free file disclosure list also matters to the people you turn away. The form says a person is entitled to one free if “a person has taken adverse action against you because of information in your credit report” and if “you are unemployed but expect to apply for employment within 60 days.” Your final notice adds the specific deadline: a free copy from the screening firm if requested within 60 days of receiving it.
What to tell your hiring team
- The summary explains rights against the screening firm; it is not a statement of your reasons.
- Questions about the report go to the screening firm named in your letters.
- Never edit the form to fit your letterhead. Attach it as the CFPB publishes it.
State notices that travel with it
- Federal
- MN
- NY
- CA
- NYC
The federal form itself warns that it is not the whole story: “States may enforce the FCRA, and many states have their own consumer reporting laws. In some cases, you may have more rights under state law.” In the states we read, the extra rules come as their own notices, which you send beside the federal summary, never instead of it.
| Where | What you add | Cite |
|---|---|---|
| Minnesota | After adverse action: the right to a copy if not already received, the firm's name and address, the right to dispute and correct errors | Minn. Stat. § 13C.03 |
| Minnesota | The disclosure carries a box the person can check to get a free copy of the report (how it sits beside the federal stand-alone rule is a question for counsel) | Minn. Stat. § 13C.02, subd. 2 |
| New York State | A printed or electronic copy of Correction Law Article 23-A when a report with conviction information comes back | N.Y. Gen. Bus. Law § 380-g(d) |
| California | Fair chance preliminary notice: the convictions, the report relied on, the right to respond | 2 CCR § 11017.1(c)(2) |
| New York City | A copy of the inquiry and the Fair Chance Notice, with 5+ business days to respond | NYC Admin. Code § 8-107(11-a) |
In Minnesota, if the person checks the box, the screening firm must send them the report within 24 hours of providing it to you, with a statement of the right to dispute and correct errors and of the federal procedures. The person cannot be charged for it.
The fair chance notices in California and New York City are their own documents with their own deadlines. The California Fair Chance Act guide and the NYC Fair Chance Act guide walk through each one, and the adverse action letter generator adds both to the pre-adverse letter when you pick the jurisdiction.
What to do
- Ask your screening firm which state notices it already sends to applicants, and get it in writing.
- Keep a per-state checklist next to your pre-adverse template.
- Never replace the federal summary with a state notice; send both.
Common mistakes
| Mistake | Fix |
|---|---|
| A pre-adverse letter that mentions the summary but does not enclose it | Attach the PDF itself |
| An old printout from before the 2023 edition | Check page 2 and page 4 |
| Retyping the form into a branded template | Send the CFPB file as published |
| Printing the summary on the disclosure page | Separate sheet, or leave it out at that stage |
| Sending the identity theft summary by mistake | The hiring form is the consumer rights summary |
| No record of what was enclosed | Keep a copy of the full package |
A pre-adverse notice without the summary is an incomplete notice. A willful FCRA violation can cost $100 to $1,000 per affected person in statutory damages, plus punitive damages and attorney's fees.
15 U.S.C. §§ 1681n(a), 1681o(a)
Your screening firm also owes you a document: a notice of your own duties as a user of reports, which the CFPB publishes as Appendix N to Regulation V. If you have never seen it, ask the firm for it; it is the employer-side companion to the summary you send applicants. More on what the firm owes you in what a consumer reporting agency is.
- Official title
- A Summary of Your Rights Under the Fair Credit Reporting Act
- Current edition
- March 202312 CFR Part 1022, App. K
- Required since
- March 20, 202488 FR 16531
- With the pre-adverse notice
- Required15 U.S.C. § 1681b(b)(3)(A)(ii)
- With an investigative report notice
- Attach it15 U.S.C. § 1681d(a)(1)(B)
- Remote DOT applicant asks
- Within 3 business days15 U.S.C. § 1681b(b)(3)(B)(ii)
- With the final notice
- Not required15 U.S.C. § 1681m(a)
- Translations
- Allowed if accurate12 CFR Part 1022, App. K
Questions employers ask
Is the 2018 Summary of Rights still valid?
The file on consumerfinance.gov still ends in “2018-09”, but its content is the March 2023 edition, required since March 20, 2024. What matters is the content: check that page 4, item 3 names the Office of Aviation Consumer Protection.
Do I have to send the Summary of Rights with the final adverse action notice?
No. The federal final notice has its own required contents and the summary is not among them. It goes with the pre-adverse notice. Attaching it again does no harm.
Can I send the Summary of Rights by email?
The statute asks for “a description in writing” and does not name a delivery method. If you email it, attach the PDF itself rather than a link, and keep the sent message. California and NYC have their own rules on emailed fair chance notices; see the notice guide.
Does the screening firm send it for me?
The firm must give the summary to you with the report, and to the person when they ask for their file. The pre-adverse duty is yours. Some firms send pre-adverse packages on an employer's behalf; check what your contract says and keep proof either way.
Do I need it if I never ran a background check through a screening firm?
The duty attaches to consumer reports used for employment. If no report from a consumer reporting agency was involved, the FCRA notices do not apply, though state law may still. Start with our background check disclosure form when you do order one.