To start a fingerprinting business, you need to form a liability-shielding entity, invest roughly $15,000 to $30,000 in FBI-certified Live Scan equipment and a secure workspace, obtain state authorization and an Originating Agency Identifier (ORI) from FBI CJIS, and put the security, biometric-privacy, and staff-training controls in place before you accept your first client. The regulatory work is where most of the effort sits, and it has to be finished before revenue can start.
Pick Your Fingerprinting Method First
Every downstream decision depends on which services you plan to offer. Electronic Live Scan is now the dominant method: digital sensors capture the prints and transmit them to state or federal databases, and the rejection rate is significantly lower than with ink cards. Traditional ink-and-roll fingerprinting on FD-258 cards still serves certain federal applications, immigration filings, and international background checks.
Most successful shops offer both. Build the business around Live Scan as the primary service and keep ink cards as a secondary option for clients whose destination agency still requires a physical card.
Form the Business Entity
Because you’ll be handling sensitive biometric data, entity choice matters more than it does for an ordinary service business. A single breach or service error can produce claims from every affected client at once. An LLC or a corporation keeps those claims away from your personal assets; a sole proprietorship leaves everything you own exposed. LLCs give you flexibility in management and taxation. A corporation fits better if you plan to bring in investors or run multiple locations under a formal governance structure.
Register the entity with your state’s Secretary of State — articles of organization for an LLC, articles of incorporation for a corporation — before you apply for a federal Employer Identification Number. The IRS recommends forming your entity with the state first to avoid delays in the EIN process.1Internal Revenue Service. Get an Employer Identification Number
Once your state filing clears, apply for the EIN. You’ll need it to open a commercial bank account, hire employees, file tax returns, and complete most state fingerprinting-vendor applications. Online applications through IRS.gov return the EIN immediately. Form SS-4 is still available by fax (about four business days) or mail (four to five weeks).2Internal Revenue Service. Instructions for Form SS-4
Equipment and Startup Costs
Only Live Scan devices on the FBI’s Certified Products List meet the Next Generation Identification image quality standards required for background-check submissions. The list is updated regularly and covers full ten-print stations, single-finger capture devices, and mobile ID units. Check the current list before buying anything, and confirm with your State CJIS Systems Officer that the device meets your state’s requirements as well.3FBI BioSpecs. Certified Products List (CPL)
A non-certified scanner will produce rejected submissions no matter how well you use it. Certified devices have to meet the image quality specifications in Appendix F of the FBI’s Electronic Biometric Transmission Specifications, which governs resolution, contrast, and image dimensions.
Budget roughly $5,000 to $12,000 for a certified Live Scan station with bundled software. On top of that you’ll need a thermal printer capable of producing high-resolution FD-258 cards for clients who need physical copies, ink kits and cleaning supplies for manual services, a dedicated fingerprinting computer, a secure network, and basic office furniture. Most single-location startups spend between $15,000 and $30,000 to open, once you factor in equipment, security infrastructure, first and last month’s rent, and initial licensing fees.
Get State Authorization and an ORI
You cannot submit a single fingerprint to any government database without authorization from the relevant state agency and, typically, an Originating Agency Identifier. The ORI is a nine-character code assigned by FBI CJIS that validates your legal authorization to access criminal justice information and identifies your business in every transaction.4Department of Justice. How to Apply for a CJA ORI Without one, state transmission systems reject your submissions and results have nowhere to be routed.
The certification application is document-heavy. Expect to provide:
- Owner and officer identification, including Social Security numbers, residential history, and personal background details for anyone with an ownership stake or management role.
- Proof of business location, such as a signed lease or property deed.
- Technical specifications: the exact software version and hardware model, plus your network security setup.
- Personal fingerprint cards for owners and key personnel, so the agency can run its own criminal history check.
- Financial disclosures, including previous business failures or judgments that could affect reliability.
Most states require vendors to route electronic submissions through the state repository rather than sending them directly to the FBI. The FBI has confirmed that state agencies authorized to submit noncriminal justice fingerprints must go through their state repository unless that repository has specifically outsourced the channeling function.5Federal Bureau of Investigation. Channeler FAQs Learn your state’s channeling structure before you design your workflow.
Where states offer online portals, you’ll upload digital copies and receive a tracking number immediately. For physical submissions, send everything by certified mail. Missing information and inconsistencies between the application and supporting documents are the most common reasons for rejection. Certification fees vary by state and by scope, and some agencies charge separate fees for the background check on each individual listed. Payments are almost always non-refundable, and submitting the wrong amount or the wrong payment type often results in the whole package being returned.
Review periods run from about four to five weeks on the short end to several months for more complex applications. During that window, the agency may conduct a site visit or ask for clarification on your security protocols. Hold off on finalizing your equipment configuration until you have at least preliminary approval, because some states impose specific conditions or require particular hardware setups as part of authorization.
Meet Facility and Security Standards
Government agencies will not authorize an operation that can’t protect the biometric and demographic data it collects. You need both physical and digital controls, and site inspections can verify compliance at any time.
Physical Security
Fingerprinting has to take place in a private or semi-private area where unauthorized people cannot view screens or documents. Physical records need secure storage in locking filing cabinets that meet fire and theft resistance standards. Access to areas containing fingerprinting equipment must be limited to authorized personnel. These are conditions of your operating authorization, not suggestions.
Digital Security
The CJIS Security Policy sets the encryption floor for anyone transmitting criminal justice information. For data in transit outside a physically secure location, you must use cryptographic modules certified under FIPS 140-3, or a FIPS-validated AES algorithm with a symmetric key of at least 128-bit strength. Data stored locally must be encrypted with AES at 256-bit key strength.6Criminal Justice Information Services (CJIS) Security Policy. CJIS Security Policy Version 6.0 FIPS 140-2 certificates will no longer be acceptable after September 21, 2026, so any equipment relying on FIPS 140-2 modules needs to be upgraded to FIPS 140-3 before that date.
Your local network needs firewall protection and continuously updated anti-malware software. Any computer used for fingerprinting should be dedicated to that purpose. Using the same machine for general web browsing or email introduces vulnerabilities that can compromise the whole operation and your authorization to operate.
Data Retention and Destruction
Many states require biometric images to be purged from your local systems immediately after successful transmission to the government repository. Administrative logs, such as the date of service and applicant name, may need to be retained for several years for auditing. When records reach the end of their mandatory retention period, shred paper documents with a cross-cut shredder and wipe digital drives using professional data-destruction methods. Sloppy record-keeping is one of the easiest things for an auditor to flag.
Follow State Biometric Privacy Laws
This is the area new owners most often underestimate, and the penalties are severe. A growing number of states impose specific obligations on any business that collects fingerprints or other biometric identifiers. Typical requirements include informing individuals in writing about what biometric data you’re collecting, why, and how long you’ll retain it; obtaining written consent before you capture any prints; and publishing a data retention and destruction schedule.
Statutory damages in the strictest jurisdictions can reach $1,000 per negligent violation and $5,000 per intentional or reckless violation. When you’re processing dozens of clients per day, a single procedural mistake applied across a month of appointments can produce six-figure liability. Draft a written biometric data policy before you open, have every client sign a consent form before you roll a single print, and destroy data on a documented schedule.
Insurance You Actually Need
Standard general liability insurance will not cover the specific risks a fingerprinting business faces. You need at least three types of coverage:
- General liability insurance for slip-and-fall injuries at your location and basic property damage claims.
- Professional liability (errors and omissions) insurance for claims arising from service errors, such as submitting incorrect fingerprints or mishandling applicant data in a way that delays someone’s employment or licensing.
- Cyber liability insurance for the costs of a data breach, including notification expenses, legal defense, and regulatory penalties. Given the sensitivity of biometric data, this is the policy that matters most.
Read cyber policy exclusions closely. Insurers have been narrowing biometric-data coverage in response to lawsuits under state biometric privacy laws. Some policies now contain express exclusions for claims stemming from biometric privacy statute violations, and others apply sublimits that may not be adequate. Review your policy annually and ask your broker whether biometric privacy claims are covered, excluded, or sublimited.
Hire and Train Staff to CJIS Standards
Every employee who touches your fingerprinting systems has to clear a background check that matches the standards required for access to criminal justice information — state and federal criminal history checks. Individuals with convictions for identity theft, fraud, or similar offenses are generally disqualified from working in the industry. The screening applies to part-time staff and to contractors who might access your systems even indirectly.
After background clearance, new technicians need hands-on training in fingerprint capture technique and software operation. Most equipment vendors offer certification courses covering finger positioning, image quality troubleshooting, and demographic data entry. Some states also require attendance at a state-sponsored workshop covering the legal framework and administrative procedures of the background check system. The focus is reducing the rejection rate, because high rejection rates cost you money in reprocessing and can threaten your operating authorization.
Training is not a one-time event. The CJIS Security Policy requires security and privacy training for all system users at initial onboarding and annually thereafter. Role-based training for employees with specific access privileges also renews annually, and certified NCIC operators face biennial recertification testing.6Criminal Justice Information Services (CJIS) Security Policy. CJIS Security Policy Version 6.0 Keep records of every training completion, certification date, and background check result. Auditors will ask for them, and missing documentation is treated the same as missing training.
What Happens If You Don’t Comply
The consequences reach further than fines. The CJIS Security Policy states that improper access, use, or dissemination of criminal history record information may result in termination of services and state and federal criminal penalties.6Criminal Justice Information Services (CJIS) Security Policy. CJIS Security Policy Version 6.0 In practice that means losing your ORI and your ability to operate. You also have to maintain a formal sanctions process for personnel who fail to follow information security and privacy policies.
On the contract side, state agencies typically build quality control thresholds into vendor agreements. If your fingerprint rejection rate exceeds a set percentage — one common benchmark is 3 percent — or you remain non-compliant for three consecutive months or more than six months in a year, the agency can terminate your contract.7FBI. Civil Fingerprint Image Quality Strategy Guide Losing a state contract effectively shuts down the business, because you cannot submit prints without authorization.
Add Mobile Fingerprinting Once You’re Stable
Mobile service is one of the most effective ways to grow revenue once your core operation is running. You bring a portable setup to employers, schools, community events, and corporate offices. Organizations with dozens of employees who all need background checks will pay a premium to avoid sending each person off-site.
The equipment setup is straightforward: a portable fingerprint scanner from the CPL under the Mobile ID category, a laptop or tablet running your Live Scan software, and a secure internet connection. The same image quality standards and CJIS security requirements apply in the field as in your office. A mobile setup doesn’t get a lighter compliance burden.
Check whether your state authorization covers mobile operations or requires a separate endorsement. Some states need notification of each off-site location. Others treat your mobile unit as an extension of your authorized facility as long as your security protocols travel with it.
Where the Revenue Actually Comes From
Fingerprinting businesses that earn meaningful revenue aren’t processing walk-in customers one at a time. The real money comes from recurring relationships with organizations that need regular services: healthcare systems onboarding nurses and aides, school districts hiring teachers and support staff, staffing agencies placing workers in regulated industries, and real estate brokerages licensing agents through NMLS.
Financial services are a large recurring segment. Individuals applying for mortgage licensing through NMLS must complete a fingerprint-based criminal background check through an approved vendor as part of the licensing process.8NMLS Licensing Guides. Completing the Criminal Background Check Process That authorization expires after 180 days if prints aren’t submitted, and new prints are required if there’s been a break in licensure or registration. Mortgage companies and financial institutions generate ongoing demand as a result.
Price competitively but not cheaply. Most fingerprinting businesses charge $25 to $50 per person for Live Scan services, with higher rates for mobile or rush appointments. Ink card services typically fall in a similar range. Volume contracts with large organizations can be priced lower per person while still generating more total revenue than walk-in traffic. Profit margins for established fingerprinting businesses generally run between 20 and 40 percent, with the widest margins going to operators who’ve paid off their equipment and maintain steady organizational contracts.