Summary
Background checks are one of the most common hiring tools — and one of the most heavily regulated. The FCRA requires a specific sequence: a standalone written disclosure, written authorization, certification to your screening provider, and a two-step adverse action process if a report leads to a negative decision. Miss a step — an outdated Summary of Rights, a shortened waiting period, a bundled disclosure — and you're exposed to real litigation risk. This guide walks employers through each requirement, including how the FCRA now applies to AI-driven hiring tools.
Article Highlights
- The FCRA applies to every U.S. employer in every state, regardless of company size or industry — and violations carry statutory damages.
- The disclosure must stand alone: it can’t be bundled into a job application, handbook, or waiver — one of the most litigated compliance mistakes.
- Adverse action is a two-step process, not a single email — pre-adverse notice, a waiting period, then a final notice.
- The CFPB’s updated Summary of Rights became mandatory March 20, 2024 — using the outdated version is a violation.
- AI and algorithmic hiring tools are generally covered too — the full FCRA process still applies.
Background checks are one of the most common tools in hiring — and one of the most heavily regulated. The federal law governing them, the Fair Credit Reporting Act (FCRA), applies to every U.S. employer, in every state, regardless of company size or industry. Get it wrong, and the consequences aren’t hypothetical: FCRA violations carry statutory damages, and background-check litigation has become one of the more common forms of employment lawsuit in the country.
And the risk is rising. Even as federal regulatory activity slowed in 2025, private FCRA class-action filings climbed more than 30% year over year — plaintiffs’ attorneys have stepped in where regulators stepped back, with employers as the primary target. Most of these cases don’t involve bad actors. They come from ordinary paperwork mistakes: a disclosure form with one extra line of text, or an adverse action process that skips a required step.
The good news is that FCRA compliance isn’t complicated once you understand the sequence. Here’s what every employer needs to know before ordering that first report.
The 4-Step FCRA Compliance Sequence
Step 1: Give a Standalone Disclosure
Before you can run a background check on a candidate or employee, you must give them clear, written notice that a background check may be obtained for employment purposes. This disclosure has to stand completely on its own — it cannot be folded into the job application, an employee handbook, a liability waiver, or any other document. Courts have consistently enforced this “standalone” requirement (FCRA § 604(b)(2); 15 U.S.C. § 1681b(b)(2)), and bundling the disclosure with other paperwork is one of the most common — and most litigated — compliance mistakes employers make.
The disclosure itself needs to be written in plain, easy-to-understand language, free of legal jargon, and prominent enough that a candidate can’t reasonably overlook it. Even seemingly harmless additions — a liability release, a state-law notice tucked into the same paragraph — have been enough to trigger lawsuits.
Step 2: Get Written Authorization
Once the candidate has received the disclosure, you need their written permission — which can include electronic authorization — before you actually order the report. No authorization, no background check. Running one without it is a compliance violation on its own, independent of anything the report turns up.
The FCRA does allow you to combine the disclosure and authorization into a single standalone form, as long as that form still isn’t attached to any other hiring document.
Step 3: Certify to Your Screening Provider
Before a consumer reporting agency (CRA) like TruDiligence can deliver a report, the law requires the requesting employer to certify certain things (FCRA § 604(b)(1)) — most importantly, that proper disclosure was made, that authorization was obtained, and that the information will be used only for the stated purpose and not in violation of any federal or state equal employment opportunity law.
A quick note on scope: if a third party interviews references or others about a candidate’s character, general reputation, or lifestyle, the result may qualify as an investigative consumer report, which triggers additional disclosure obligations beyond the standard process above.
Step 4: Follow the Two-Step Adverse Action Process
If something in the report might lead you to reject a candidate, rescind an offer, or take other negative action, the FCRA requires a two-step process (§ 604(b)(3) and § 615; 15 U.S.C. §§ 1681b(b)(3), 1681m) — not a single email. This is the single most litigated part of FCRA compliance: skipping a step, shortening the waiting period, or omitting the Summary of Rights are among the most frequent reasons employers end up in class-action suits.
1. Pre-Adverse Action Notice
Before a final decision, give the candidate a complete copy of the background check report — the actual document from the CRA, not a summary — plus a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act.” This gives them a genuine chance to review and dispute anything inaccurate.
2. Wait a Reasonable Period
The FCRA doesn’t specify an exact number of days, but courts and compliance practitioners generally treat at least 5 business days as the accepted standard between the pre-adverse action notice and a final decision.
3. Final Adverse Action Notice
If you proceed, send a final notice with the CRA’s name, address, and phone number; a statement that the CRA didn’t make the decision; and notice of the candidate’s right to dispute and request a free report copy within 60 days.
Important 2024 Update
The CFPB issued a revised version of the Summary of Rights, and its use became mandatory for employers on March 20, 2024. Employers still distributing the outdated version after that date are in violation — a small detail that has become a common basis for claims. Make sure your provider is issuing the current form.
Does the FCRA Apply to AI and Algorithmic Hiring Tools?
Yes — and this is where many employers are newly exposed. As automated screening, “background dossiers,” and algorithmic candidate scores become more common, regulators have made clear these tools don’t sit outside the FCRA.
In its 2024 guidance (Consumer Financial Protection Circular 2024-06), the CFPB confirmed that background dossiers and algorithmic scores obtained from third parties and used to make hiring, promotion, reassignment, or retention decisions are generally “consumer reports” under the FCRA. That means the same rules apply: candidates have the right to notice, to know what’s in their file, and to dispute inaccurate or incomplete information — and employers must follow the full disclosure, authorization, and adverse action process before acting on those outputs.
The practical takeaway: if a vendor’s AI tool influences an employment decision, treat it like any other consumer report. Ensure human oversight, transparency with candidates, and consistent application — and confirm your provider’s tools are built to comply.
FACTOR 1
Nature and Gravity
The nature and gravity of the offense or conduct.
FACTOR 2
Time Passed
The time that has passed since the offense or completion of the sentence.
FACTOR 3
Job Relationship
The relationship between the offense and the specific job in question.
Documenting this kind of assessment doesn’t just reduce discrimination risk — it strengthens your defensibility if a decision is ever challenged.
Common Mistakes That Create Real Legal Risk
- Bundling the disclosure with other onboarding paperwork instead of keeping it standalone.
- Using an outdated Summary of Rights — the current CFPB version has been mandatory since March 20, 2024.
- Skipping or rushing pre-adverse action notice, denying candidates a meaningful chance to respond before a final decision.
- Cutting the waiting period short — moving to a final decision before the roughly 5-business-day window has passed.
- Automatically disqualifying a candidate because a record appears, rather than evaluating job-relatedness.
- Treating AI screening tools as exempt — algorithmic scores used in employment decisions are generally consumer reports too.
- Assuming one national policy covers every state. FCRA is the federal floor, not the ceiling — many states and cities layer on additional requirements.
- Not vetting the screening vendor itself. If your CRA mishandles reporting or isn’t independently accredited, that risk lands on you.
Building a Defensible Process
The employers who stay out of trouble treat FCRA compliance as a workflow, not a form. That means:
- Confirming your disclosure is genuinely standalone and your authorization language is current.
- Verifying your provider issues the current CFPB Summary of Rights.
- Building a consistent adverse action process — with a real waiting period and complete notices — rather than an ad hoc email.
- Reviewing how your team makes decisions on records that come back: job-relatedness and individualized assessment, not automatic rejection.
- Partnering with a screening provider that understands both federal FCRA requirements (see the FTC’s employer guidance) and the patchwork of state and local laws layered on top of them.
How TruDiligence Helps
TruDiligence has been a trusted, PBSA-accredited background screening partner for more than 30 years, and our screening programs are built around FCRA compliance from the ground up — from certified disclosure and authorization workflows to accurate, defensible reporting and a compliant, built-in adverse action process. Whether you’re hiring in one state or fifty, we help you build a process that protects your organization and treats candidates fairly.
This article is provided for general informational purposes and does not constitute legal advice. Employers should consult qualified legal counsel to ensure their specific hiring practices comply with the FCRA and all applicable state and local laws.
Frequently Asked Questions
Can I run a background check without the candidate’s consent?
No. The FCRA requires written authorization before you order a report. Running a check without it is a violation on its own, regardless of what the report contains.
How long do I have to wait during the adverse action process?
The FCRA doesn’t set an exact number, but courts and compliance experts generally treat at least 5 business days as the standard between the pre-adverse action notice and the final decision.
Can the disclosure be part of my job application?
No. The FCRA requires a standalone disclosure. Bundling it into an application, handbook, or waiver is one of the most common and most litigated compliance mistakes.
Do AI and algorithmic hiring tools have to follow the FCRA?
Generally, yes. Under CFPB guidance, third-party algorithmic scores and background dossiers used in employment decisions are typically consumer reports, so the full FCRA process applies.
Are Google or DIY internet searches compliant background checks?
No. Informal internet searches aren’t FCRA-compliant, can surface inaccurate or non-permissible information, and expose employers to discrimination and accuracy claims.
Who enforces FCRA background check compliance?
The FTC and the CFPB oversee FCRA enforcement, and private individuals can also bring lawsuits — increasingly, in the form of class actions.
Leave a Reply
Want to join the discussion?Feel free to contribute!