FCRA Compliance for Employers: The Complete 2026 Guide

Permissible Purpose: Why the FCRA Applies at All

The FCRA regulates any "consumer report" — a report from a consumer reporting agency (CRA), often called a background check company, that bears on a person's character, reputation, or general mode of living. When you order a report from a CRA for employment purposes, you're required under 15 U.S.C. § 1681b to have a legitimate, specific reason — evaluating someone for hiring, promotion, reassignment, or retention. This is called permissible purpose, and it's the legal foundation the rest of the FCRA sits on.

In practice, permissible purpose isn't something you prove to a regulator up front — it's something you certify to your CRA and would need to defend if challenged. Most reputable background check vendors require you to certify, in writing, that you have a permissible purpose and will comply with FCRA disclosure and adverse action obligations before they'll run a report for you.

Disclosure and Authorization: What Must Happen Before You Run a Check

Before you ever request a consumer report on a job applicant, the FCRA requires two things, both spelled out in § 1681b(b)(2):

The standalone disclosure

You must provide the applicant a clear and conspicuous written disclosure, in a document that consists solely of the disclosure, stating that a consumer report may be obtained for employment purposes. Courts have interpreted "solely" strictly: liability waivers, at-will employment language, state-specific notices unrelated to the disclosure, or other application boilerplate mixed into the same document can void the disclosure entirely and expose you to a class-action claim, according to the FTC and reporting from SHRM.

Written authorization

The applicant must authorize the check in writing. The statute does allow the authorization to live on the same page as the disclosure (it's the only exception to the "solely" rule) — which is why most employers combine them into a single disclosure-and-authorization form.

• Keep the disclosure form separate from the job application, offer letter, or any liability waiver.
• Use plain, readable language — no dense legalese, no fine print.
• Get authorization signed (physical or e-signature) before you order the report, not after.
• If you plan to run ongoing or periodic checks during employment, disclose that upfront in the authorization language.

Where FCRA Meets Nondiscrimination Law

The FCRA is about *process* — disclosure, authorization, and notice. It says nothing about *what* you can consider in a report. That's governed separately by federal nondiscrimination law, enforced by the EEOC, which applies whenever background information — however you obtained it — factors into an employment decision.

• Apply the same screening standards to every candidate for a given role, regardless of race, color, national origin, sex, religion, disability, genetic information, or age (40+).
• Criminal record policies must be job-related and consistent with business necessity — a blanket "no felonies" policy can create disparate impact liability if it isn't tied to the job.
• Give individualized consideration to negative findings rather than applying automatic exclusions, and consider whether a disability caused an issue the check revealed.
• Never single out applicants of a particular background for closer background scrutiny than others.

See the EEOC's Background Checks: What Employers Need to Know guidance and its Enforcement Guidance on Arrest and Conviction Records for the full standard employers are held to under Title VII.

The Adverse Action Process: Two Steps, Not One

This is where most FCRA lawsuits originate. If you're going to take an adverse employment action — not hiring, rescinding an offer, terminating, or denying a promotion — based in whole or in part on a consumer report, the FCRA requires a two-step notice process, not a single rejection email.

Step 1: Pre-adverse action notice

Before you make a final decision, you must send the candidate:

• A copy of the consumer report you relied on.
• A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act" (a standardized CFPB/FTC model document CRAs typically provide).
• Notice that the report may result in an adverse decision, giving the candidate a chance to review it and flag inaccuracies before anything is final.

The waiting period

The FCRA doesn't set an exact number of days, but the generally accepted standard — reflected in FTC guidance and widely cited compliance practice — is that five business days is a reasonable minimum to let a candidate respond before proceeding. Some states go further: California requires at least five business days after confirmed receipt, and electronic notices are presumed received two days after sending, which effectively lengthens the window.

Step 2: Final adverse action notice

If, after the waiting period, you proceed with the adverse decision, you must send a second notice containing:

• The name, address, and phone number of the CRA that supplied the report (including a toll-free number if it's a nationwide CRA).
• A statement that the CRA did not make the hiring decision and cannot explain the specific reasons for it.
• Notice of the candidate's right to dispute the accuracy or completeness of the report directly with the CRA.
• Notice of the candidate's right to a free copy of their file from the CRA if requested within 60 days.

Recordkeeping: How Long to Keep Screening Records

The FCRA itself doesn't set a specific retention period, but several overlapping rules effectively dictate one. The EEOC requires employers to retain hiring-related records — including background check consent forms and results — for at least one year from when the record was made or the personnel action was taken, whichever is later. Separately, the FCRA's own statute of limitations for a consumer's claim is the earlier of two years from discovery of a violation or five years from the date it occurred, per 15 U.S.C. § 1681p.

Because of that exposure window, many compliance teams retain disclosure forms, authorizations, reports, and adverse action correspondence for at least the length of the statute of limitations — commonly cited as five to six years — rather than the one-year EEOC floor. Some states, like New York, require six years for records relevant to a human rights complaint.

• Store the signed disclosure and authorization form for every candidate, not just those who were hired.
• Keep a copy of every report ordered, along with the date it was requested and reviewed.
• Retain pre-adverse and final adverse action notices, including proof of when they were sent.
• Log any disputes raised by candidates and how they were resolved.

Common Compliance Mistakes Employers Make

Most FCRA violations aren't intentional — they're process gaps that compound across every candidate screened. According to SHRM and FTC enforcement history, the recurring mistakes are:

• Bundling the disclosure with the job application, an at-will statement, or a liability waiver — this alone has driven a large share of class-action settlements.
• Skipping the pre-adverse step and going straight to a final rejection or termination based on the report.
• Not sending the actual report to the candidate along with the pre-adverse notice — a copy must accompany it, not just a summary.
• Moving too fast through the waiting period before the candidate has had a reasonable chance to respond.
• Applying inconsistent standards — screening some candidates more heavily than others for the same role.
• No system for disputes — failing to pause the process when a candidate contests information in the report.
• Losing records — being unable to produce the signed authorization or notices if a claim is filed years later.

Failure to properly send a stand-alone disclosure or obtain written authorization has resulted in an increase of class-action settlements against employers — most of these situations result from simple mistakes rather than ill intent.

The financial stakes are real. Under 15 U.S.C. § 1681n, willful FCRA violations expose employers to statutory damages of $100–$1,000 per violation plus punitive damages and attorney's fees — and with a hiring pipeline of hundreds of candidates, a single flawed disclosure form can become a class-wide liability. Negligent violations, under § 1681o, still carry actual damages and attorney's fees even without intent.

Building a Compliant Screening Process

A defensible process is mostly about sequencing and documentation, not legal complexity. A workable checklist for most employers:

• Define permissible purpose for each role before ordering any check.
• Use a standalone disclosure and authorization form, reviewed for your state's additional requirements.
• Get signed authorization before ordering the report — never after.
• Apply the same screening criteria to every candidate for the same role.
• If a report raises a concern, send the pre-adverse notice with the report copy and Summary of Rights.
• Hold at least five business days (longer where state law requires) before finalizing anything.
• Pause immediately if the candidate disputes information in the report.
• Send the final adverse action notice with CRA contact info and dispute/free-report rights if you proceed.
• Retain every document — disclosure, authorization, report, notices — for at least five years.