One small paperwork mistake can turn a routine hire into a costly legal problem. When you order a background screening report as part of a hiring decision, that report becomes a “consumer report” under federal law, and strict rules apply (FTC).
The Fair Credit Reporting Act (FCRA) governs how you request, use, and act on these reports. This guide walks you through each step in plain language.
This is educational content, not legal advice. Consult qualified counsel for your specific situation.
Why Background Check FCRA Compliance Matters
Here is the core idea you cannot skip: the FCRA protects the accuracy, fairness, and privacy of information in consumer reports.
When a third-party screening company assembles a report on an applicant for employment purposes, that company is a consumer reporting agency (CRA), and the report is a consumer report under the law (FTC).
That status triggers duties for both the CRA and you, the employer. The FCRA defines a consumer report as information bearing on a person’s character, general reputation, personal characteristics, or mode of living used for employment purposes (15 U.S.C. § 1681a).
Get this wrong and the consequences are real. Noncompliance can expose your organization to legal liability and damage trust with candidates.
The good news? The rules follow a clear sequence. Follow that sequence and you build a defensible, repeatable process.
FCRA Background Check Requirements at a Glance
Before diving into steps, understand the four pillars that hold up every compliant screening program.
First, permissible purpose. You may only obtain a consumer report for a legally allowed reason, such as evaluating a person for employment (15 U.S.C. § 1681b).
Second, disclosure and consent. You must tell the applicant and get written permission before pulling a report (FTC).
Third, proper use and fairness. You must apply the results consistently and avoid discrimination (EEOC).
Fourth, adverse action rights. If a report leads you to reject someone, you must give specific notices (15 U.S.C. § 1681m).
With those pillars in mind, let’s build the process one step at a time.
Step 1: Confirm Your Permissible Purpose
Start at the foundation. You cannot legally order a consumer report without a permissible purpose recognized by the FCRA.
For hiring, that purpose is employment. The statute allows a report when you “intend to use the information for employment purposes” (15 U.S.C. § 1681b).
Employment purposes cover evaluating a person for hiring, promotion, reassignment, or retention (15 U.S.C. § 1681a).
Do not use employment screening data for unrelated reasons. Using a report outside its permissible purpose is a serious violation.
A worked example: You want to fill a warehouse role. Screening candidates for that role is a valid employment purpose. Pulling the same report later to evaluate someone as a personal tenant would not be authorized under that original purpose.
Step 2: Provide a Standalone FCRA Disclosure and Authorization
Now comes the paperwork that trips up many employers. The FCRA requires a specific two-part step before any report is ordered.
Here is where precision pays off.
The Standalone Disclosure Requirement
You must give the applicant a clear, written disclosure stating that a consumer report may be obtained for employment purposes. Critically, that disclosure must appear in a document that consists solely of the disclosure (15 U.S.C. § 1681b).
The FTC echoes this: the notice must be “in a stand-alone format” and cannot be buried in an employment application (FTC).
That means no extra language, no liability waivers, and no application text mixed in. Keep it clean and separate.
The Written Authorization Requirement
Along with the disclosure, you must get the person’s written authorization before you procure the report (15 U.S.C. § 1681b).
The FTC confirms you must “get the applicant’s or employee’s written permission” to obtain the report (FTC).
A worked example: A candidate signs a one-page form titled disclosure and authorization that states a background report may be obtained and gives permission. It contains no other clauses. That structure supports compliance.
Step 3: Certify Compliance to Your Screening Company
Before the CRA hands you a report, the law requires a promise from you. This is the employer certification step.
Want to know what makes this step easy to overlook? It happens behind the scenes, often inside a vendor agreement.
You must certify to the consumer reporting agency that you have a permissible purpose, that you made the required disclosure, that you obtained authorization, and that you will comply with adverse action and anti-discrimination obligations (15 U.S.C. § 1681b).
The FTC frames this plainly: you must certify to the company that you notified the applicant, got permission, complied with FCRA requirements, and will not misuse the information (FTC).
Practical tip: Keep a signed copy of your certification and your standalone forms on file. Documentation is your best defense if a process is ever questioned.
Step 4: Review the Report and Consider an Individualized Assessment
The report arrives. Now the human judgment begins, and this is where fairness rules matter most.
Federal anti-discrimination law intersects with the FCRA here.
Applying Results Consistently
Under Title VII, using criminal history in a way that disproportionately screens out protected groups can create liability unless the practice is job related and consistent with business necessity (EEOC).
The EEOC recommends employers avoid blanket exclusions and instead evaluate records in context.
The Individualized Assessment
The EEOC encourages an individualized assessment, which generally considers the nature of the offense, the time that has passed, and its relevance to the specific job (EEOC).
This lets an applicant explain circumstances before a final decision.
A worked example: A candidate for an accounting role has an old, unrelated minor offense. An individualized assessment weighs the age and nature of the record against the job’s duties, rather than an automatic rejection.
Step 5: Follow the Adverse Action Background Check Process
Suppose the report leads you to lean toward rejection. You cannot simply say no and move on.
This is the most legally sensitive part of the entire process, so slow down here.
The FCRA sets a two-stage adverse action process (15 U.S.C. § 1681b).
Pre-Adverse Action Notice
Before you take adverse action based in whole or in part on a report, you must give the person a copy of the report and a copy of A Summary of Your Rights Under the Fair Credit Reporting Act (15 U.S.C. § 1681b).
The CFPB publishes and maintains the model Summary of Rights that must be provided (CFPB).
Allow a Reasonable Review Period
After the pre-adverse notice, you must give the person a reasonable opportunity to review the report and dispute inaccuracies before you finalize the decision.
The FTC explains this step lets applicants “explain any negative information” in the report (FTC).
The FCRA does not set one fixed federal number of days for every case, so build in a genuinely reasonable window before proceeding. Do not rush this pause.
Final Adverse Action Notice
If you still decide against the applicant, you must provide an adverse action notice. It must include the CRA’s name, address, and phone number, a statement that the CRA did not make the decision, and notice of the person’s right to a free report and to dispute accuracy (15 U.S.C. § 1681m).
A worked example: You send a pre-adverse notice with the report and rights summary, wait a reasonable period, receive no dispute, then send a final adverse action notice with the required CRA details. That sequence tracks the statute.
Step 6: Secure and Dispose of Records Properly
You made your decision. Your compliance duties still are not finished.
Data you collect must be protected throughout its life.
The FTC’s Disposal Rule requires you to properly dispose of information derived from consumer reports so it cannot be read or reconstructed (FTC).
Reasonable measures include burning, pulverizing, or shredding paper and destroying or erasing electronic files (FTC).
Practical tip: Limit access to reports on a need-to-know basis. Store them securely and set a documented retention and destruction schedule.
ClearCheck stores results on a private dashboard for reference, which can help you keep records organized and access controlled (ClearCheck).
Watch for State and Local Law Caveats
Federal FCRA rules are the floor, not the ceiling. Many states and cities add their own requirements on top.
Curious what could still bite you after federal compliance?
Some jurisdictions impose “ban the box” limits on when you can ask about criminal history, extra disclosures, or stricter timelines. The EEOC notes that state and local laws may impose additional obligations on employers using criminal records (EEOC).
Because rules vary by location, confirm your obligations for every state and city where you hire. When in doubt, involve qualified counsel.
Employment Background Check Compliance Implementation Checklist
Use this concise checklist to operationalize the steps above. Treat it as a starting framework, not legal advice.
- Confirm permissible purpose for each screening (15 U.S.C. § 1681b).
- Provide a standalone written disclosure with no extra content (FTC).
- Obtain written authorization before ordering a report (15 U.S.C. § 1681b).
- Certify compliance to your CRA (FTC).
- Review results consistently and consider an individualized assessment (EEOC).
- Send pre-adverse notice with the report and Summary of Rights (CFPB).
- Allow a reasonable review period before finalizing (FTC).
- Send final adverse action notice with required CRA details (15 U.S.C. § 1681m).
- Dispose of records securely under the Disposal Rule (FTC).
- Check state and local laws for each hiring location.
Ready to put reliable data behind these steps? Learn how ClearCheck delivers secure results.
Put Employment Background Check Compliance Into Your Workflow
A policy only helps when the hiring team can follow it consistently. Assign one owner for screening compliance, keep the current disclosure and authorization forms in a controlled location, and document the permissible purpose for each report.
Create a simple hiring record that notes when the report was ordered, when each notice was sent, whether the candidate disputed anything, and who made the final decision. Keep a separate jurisdiction checklist for the states and cities where you hire, because local requirements can change the workflow.
Train recruiters and hiring managers on the sequence, then review a small sample of completed screenings on a regular schedule. The goal is not more paperwork. It is a process that makes the right step easy to repeat and creates a clear record if a candidate raises a question.
Frequently Asked Questions
What makes a background report a “consumer report” under the FCRA?
A report is a consumer report when a CRA assembles information about a person’s character or reputation and you use it as a factor in employment eligibility (FTC).
Can I include the disclosure inside my job application?
No. The disclosure must appear in a standalone document that consists solely of the disclosure (15 U.S.C. § 1681b).
Do I need written permission from the applicant?
Yes. You must obtain the person’s written authorization before you procure the report (FTC).
What must I send before rejecting someone based on a report?
Send a pre-adverse action notice that includes a copy of the report and the Summary of Your Rights Under the FCRA (15 U.S.C. § 1681b).
How long is the reasonable review period?
The FCRA does not fix one universal number of days for all situations. Provide a genuinely reasonable window so the person can review and dispute the report (FTC).
What goes in the final adverse action notice?
Include the CRA’s name, address, and phone number, a statement that the CRA did not make the decision, and the right to a free report and to dispute accuracy (15 U.S.C. § 1681m).
How should I dispose of old reports?
Use reasonable measures like shredding paper and erasing electronic files so the data cannot be reconstructed (FTC).
The Bottom Line
Here is the short version: FCRA compliance is a sequence, not a single step. Confirm permissible purpose, give a standalone disclosure, get written authorization, certify to your CRA, review fairly, follow the adverse action process with a reasonable pause, and dispose of records securely.
Layer state and local rules on top, and document everything you do.
Get those elements right and you protect both your organization and your candidates. That is the heart of background check FCRA compliance.
When you are ready for reliable, securely stored background information to support these steps, explore ClearCheck and see how it fits your process.
Remember: this guide is educational and not a substitute for legal advice from qualified counsel.
