FCRA Requirements for Employers: Notices, Deadlines, and Penalties

Employers who use a third-party background-check company to screen applicants or current workers must follow a fixed sequence under the Fair Credit Reporting Act: give a standalone written disclosure, get signed authorization, certify compliance to the vendor, share the report and a pre-adverse action notice before any rejection, and then send a final adverse action notice if the decision stands. The FCRA requirements for employers apply to hiring, promotions, reassignments, and retention decisions alike, and skipping any step opens the door to statutory damages, punitive damages, attorney’s fees, and class action exposure.¹

When the Rules Apply

The employer obligations turn on one thing: are you buying a “consumer report” from a third-party consumer reporting agency? Under the statute, that means any communication from a reporting agency touching on someone’s creditworthiness, character, reputation, personal characteristics, or mode of living, used to evaluate them for employment.¹ Criminal background checks, credit reports, driving records, and similar products from a screening vendor all qualify.

If you pick up the phone and call a former employer yourself, FCRA does not reach that conversation. The statute targets consumer reporting agencies, not an employer’s own firsthand inquiries. The moment a third-party screener enters the picture, every step below becomes mandatory.

“Employment purposes” is defined broadly. It covers evaluating someone for initial employment, promotion, reassignment, or retention.¹ Running a check on a current employee before deciding on a promotion carries the same duties as screening a new applicant.²

Disclosure and Written Authorization

Before ordering the report, give the applicant or employee a written disclosure stating that you may obtain a consumer report for employment purposes. The statute is unusually strict on format: the disclosure must be a standalone document containing nothing except this notice.³ You cannot bury it in the middle of a job application, and you cannot attach a liability waiver, an at-will acknowledgment, or other extraneous language to the same page.

This is where employers get sued. Courts have treated an added liability waiver as a willful violation, meaning affected applicants do not need to prove any actual harm to collect damages. That opens the door to class certification. The safe form is a single page with a plain heading, one or two sentences of disclosure, and a signature line.

Once the person has the disclosure, get their signed written authorization before requesting the report. The signature can appear on the same document as the disclosure.³ Digital portals work, so does a paper form during an interview. Keep the signed authorization on file. If a candidate later claims you pulled the report without permission, that document is your defense.

Certification to the Reporting Agency

The reporting agency cannot release the report until you certify to it that you have handled the preliminary steps. You must confirm two things: that you provided the standalone disclosure and obtained written authorization, and that you will not use the report in violation of any federal or state equal employment opportunity law.³ Most vendors build this certification into their ordering system. The legal responsibility for its accuracy still sits with you.

Extra Rules for Investigative Reports

A standard background check pulls records from databases. An investigative consumer report goes further, gathering information about someone’s character, reputation, personal characteristics, or lifestyle through interviews with people who know them. If you order one of these, additional FCRA rules stack on top of the standard requirements.

You must mail or deliver a written notice to the person no later than three days after the report is first requested, disclosing that an investigative report may be prepared, telling them they can request a description of its nature and scope, and enclosing a written summary of their FCRA rights.⁴

If they submit a written request for more detail, you have five days to provide a complete and accurate description of the investigation’s scope, measured from the date you received the request or the date the report was first requested, whichever is later.⁴ Those deadlines are tight. If your vendor conducts personal interviews as part of its product, confirm whether it qualifies as an investigative report and build these extra steps into your workflow.

The Pre-Adverse Action Step

If anything in the report might cause you to deny employment, refuse a promotion, terminate, or take any other negative action, stop and complete the pre-adverse action process before making the final call. Send the person two things: a copy of the actual consumer report you relied on, and a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act” published by the Consumer Financial Protection Bureau.³²

The point of the step is to give the person a real chance to review the report and flag errors before anything is finalized. The statute requires a “reasonable” interval between the pre-adverse action notice and the final decision but does not set a specific number of days. The FTC has informally recommended at least five business days. Waiting less than that invites an argument that the window was too short, particularly for a candidate who needs time to contact the reporting agency and produce corrected records.

Skipping this step is one of the most expensive FCRA mistakes an employer can make. Without the pre-adverse action notice, the person never gets to dispute an error that could be the product of identity theft, a courthouse data-entry mistake, or records belonging to someone with a similar name.

Final Adverse Action Notice

Once the waiting period has passed and you still plan to take adverse action, send the final adverse action notice. The statute spells out its required contents:⁵

The name, address, and phone number of the consumer reporting agency that furnished the report.
A statement that the agency did not make the adverse decision and cannot explain the specific reasons behind it.
Notice that the person can obtain a free copy of their consumer report from the agency within 60 days.
Notice that the person can dispute the accuracy or completeness of any information in the report directly with the agency.

The agency-disclaimer language matters. Applicants who receive a rejection sometimes direct their frustration at the background-check company, which cannot help them because it did not make the hiring decision. Clarifying that in the notice steers the person toward the right channels: disputing errors with the agency and taking any remaining questions about the decision to you.

Penalties: Willful vs. Negligent

FCRA creates two tiers of private liability. Which one applies depends on whether the violation was willful or merely negligent.

Willful Noncompliance

A willful violation lets the affected person collect statutory damages between $100 and $1,000 per violation without proving any actual financial harm. Courts may also award punitive damages in whatever amount they consider appropriate, plus attorney’s fees and court costs.⁶ Statutory damages are what make FCRA class actions viable. If a defective disclosure form went out to thousands of applicants, each one can claim $100 to $1,000 without showing individual injury, and the fee-shifting provision draws in plaintiffs’ lawyers.

Negligent Noncompliance

When a violation is negligent, the person can recover only actual damages they can prove, plus attorney’s fees.⁷ No statutory minimum, no punitive damages. Real risk remains if the person actually lost a job or suffered concrete harm, but the exposure is nothing like a willful-violation finding in the class context.

Class Action Exposure

The standalone-disclosure requirement is the single largest driver of FCRA class actions against employers. Extraneous language on the disclosure form, or a disclosure buried inside a longer application, creates a uniform defect affecting every person who signed. Multiply statutory damages up to $1,000 by hundreds or thousands of applicants, add punitive damages and attorney’s fees, and the settlement math runs into seven figures.

Deadlines, Recordkeeping, and Disposal

A person must file an FCRA lawsuit by the earlier of two dates: two years from when they discovered the violation, or five years from when the violation occurred.⁸ The discovery rule means an applicant who learns years later that a flawed background check cost them a job can still sue within two years of finding out, provided fewer than five years have passed since the violation itself.

EEOC regulations separately require employers to retain personnel and employment records for at least one year, and longer if an employee is involuntarily terminated or if a charge has been filed.⁹ Given FCRA’s five-year outer deadline, holding signed disclosures, authorizations, and background reports for at least five years is the safer floor.

When it is time to dispose of consumer report data, the FTC’s Disposal Rule requires destruction that prevents unauthorized access. The standard is “reasonable measures,” scaled to the sensitivity of the data and the size of the organization. Paper records must be shredded or burned so they cannot be read or reconstructed. Electronic files must be destroyed or erased so the data cannot practicably be recovered.¹⁰ A background report tossed in a recycling bin is how a closed hiring file becomes an identity-theft problem.

1
Office of the Law Revision Counsel. 15 U.S. Code 1681a – Definitions; Rules of Construction
2
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
3
Office of the Law Revision Counsel. 15 U.S.C. 1681b – Permissible Purposes of Consumer Reports
4
Office of the Law Revision Counsel. 15 U.S.C. 1681d – Disclosure of Investigative Consumer Reports
5
Office of the Law Revision Counsel. 15 U.S.C. 1681m – Requirements on Users of Consumer Reports
6
Office of the Law Revision Counsel. 15 U.S.C. 1681n – Civil Liability for Willful Noncompliance
7
Office of the Law Revision Counsel. 15 U.S.C. 1681o – Civil Liability for Negligent Noncompliance
8
Office of the Law Revision Counsel. 15 U.S. Code 1681p – Jurisdiction of Courts; Limitation of Actions
9
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
10
eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records