Business News Daily receives compensation from some of the companies listed on this page. Advertising Disclosure


FCRA Background Check Compliance for Employers

Patrick Proctor
Patrick Proctor

A pre-employment background check must comply with the Fair Credit Reporting Act.Here's how to ensure your background checks are legal.

  • Before you conduct pre-employment checks, it's important to understand the Fair Credit Reporting Act (FCRA) to ensure legal compliance.
  • FCRA-compliant background checks involve several steps. Although there are no shortcuts, the process is straightforward.
  • There are steps you must take if you decide not to hire a candidate or retain an employee based on information you discover in a background check.
  • This article is for business owners, managers and supervisors who want to learn more about FCRA compliance when conducting background checks.

The Fair Credit Reporting Act governs how employers execute, obtain, and manage consumer reports, including standard pre-employment and current employment-related background checks. This process not only protects personal data but also allows employers to fully assess whether a candidate is fit for employment. Your business is better off when you take the time to implement background checks correctly.

What is the Fair Credit Reporting Act?

The Fair Credit Reporting Act is a set of regulations that helps manage creditors' and potential employers' access to people's private data. For example, before running a background check, which falls under FCRA oversight, employers are required to disclose that a candidate's consumer report may be used for employment-related decisions. Further, employees must obtain written consent from an employee or candidate prior to conducting a background check. FCRA rules apply to the background check itself, who administers it and how it is executed.

Note that the FCRA does not simply govern employment background checks but also protects information collected by consumer reporting agencies, such as credit bureaus, medical information companies and tenant screening services. The FCRA also states that companies that provide information to consumer reporting agencies also have specific legal obligations, including the responsibility to investigate the disputed information. [Read related article: Choosing a Background Check Service]

Key TakeawayKey takeaway: The FCRA plays a major role in how and why background checks are administered. The law also ensures that people's personal information is carefully guarded and that only pertinent information is included in the report.

What is FCRA compliance?

In the context of background checks, FCRA compliance refers to the set of FCRA requirements that both the employer and the background check service that conducts the screening must comply with for pre-employment background screenings.

Editor's note: Looking for the right [category name] for your business? Fill out the below questionnaire to have our vendor partners contact you about your needs.

There are several key steps in ensuring FCRA compliance for pre-employment background checks. First, employers must notify the applicant that a background check will be conducted. This notice should be in writing, and the job candidate should sign the document.

Second, if the background check reveals something that leads you to not offer the job to the candidate, you must inform them via an adverse action letter and provide them with a written copy of the report that contains the information that was used to deny employment. You should also provide candidates the opportunity to dispute the results of the background check. 

TipTip: Before you conduct a background check, make sure you notify the candidate in writing and have the candidate sign off on it.

Employer responsibilities during the background check process

There are several rules companies must understand before administering a pre-employment background check. First and foremost, a company may not execute a background check of any kind solely based on a candidate's race, national origin, color, sex, religion, disability, genetic information or age.

The Equal Employment Opportunity Commission (EEOC), a federal agency that administers and enforces civil rights laws against workplace discrimination, also has a say in this process. The EEOC explicitly prohibits employers from excluding potential hires based purely on past arrests or criminal convictions. However, certain state and federal regulations may prohibit an individual with a criminal record from holding a particular job.

Common errors that result in FCRA violations

Oversights in the background check process can result in FCRA violations. Here are some common mistakes businesses make:

  • Inadequate or incomplete disclosure from the employer to the candidate that a background check will be conducted
  • Failure to report that the reason for not hiring a candidate was due, in full or in part, to data discovered during the background check
  • Improper adverse action taken after the background check was completed
  • Failure to acquire written consent prior to processing the background check
  • Inadequate disclosure of, or complete failure to share, the results with the candidate or employee
  • Failure to share the Summary of Rights under the FCRA

How to administer legally compliant background checks

Businesses should follow these steps when conducting pre-employment background screenings: 

  1. Get the necessary information. Every employer needs the job candidate's full (legal) name, any previous names, date of birth, Social Security number and home address to administer a background check.
  1. Obtain written and informed disclosure and consent. Along with providing a full and informed disclosure, acquire a written consent form from the candidate or employee prior to running a background check of any kind. Verbal approval is not good enough, as employers cannot prove that consent was given. You must get it in writing, and it must completely outline how and why the process works the way it does. 
  1. Execute the background check in a timely manner. It is not uncommon for background checks to take five to seven days or longer if the candidate has lived in multiple states or has used more than their current (first or last) name.
  1. Provide a copy of the report. Supply a copy to the candidate, particularly if you are denying an employment opportunity of any kind (e.g., full-time, part-time, contract, temp, volunteer).
  1. Store the data securely. Regardless of whether you hire the candidate, ensure that their information is stored or filed If you hire the candidate, the background check information can be stored in their human resources file. If the candidate is not hired, you can store all pertinent data, including background check reports, in the recruitment file to be kept within HR.

Did you know?Did you know? FCRA-related violations carry substantial financial risk in the form of actual or statutory damages of up to $1,000 per "discrete violation," plus punitive damages and attorneys' fees, according to law firm Davis Wright Tremaine LLP.

Employer responsibilities before and after adverse action is taken

Adverse action is the FCRA-related process that an employer must follow when considering not hiring or retaining the employment of a current employee, based, in whole or in part, on details discovered during the background check.

There are a number of reasons an employer may wish to take adverse action against a job candidate or current employee. Here are some common examples of background check findings that may lead employers to take this route:

  • Harassment in the workplace, as well as sexual offenses (confirmed by a sex offender registration) in general
  • Financial crimes (e.g., embezzlement, income tax evasion, fraud, other theft)
  • Evidence of previous acts of cybercrime (in any form)
  • Violent crime (a single event or a pattern), as well as a history of less serious but troublesome crimes
  • History of DUIs or drug-related offenses
  • Poor or unsafe driving record
  • In some cases, depending on the job, a poor credit history
  • Inaccurate or falsified work experience and/or education credentials
  • Dishonorable military discharge

Did you know?Did you know? Arrests are not the same as convictions, and the EEOC warns that employers that develop and act on absolute policies that disqualify candidates with arrest records make themselves vulnerable to discrimination-related liability under Title VII of the Civil Rights Act.

If an employer decides not to hire a candidate or retain an employee based on information obtained during the background check, the employer must notify the employee via a "pre-adverse action" letter.

Adverse employment actions can take many forms depending on the candidate's or employee's status with the employer, as well as the particular steps taken by the employer. Here are some examples of adverse employment actions:

  • Deciding not to offer employment to a candidate
  • Withdrawing an existing job offer for employment
  • Terminating the employment of a current employee
  • Suspending employment of a current employee
  • Withholding a promotion of a current employee

There are three primary steps to follow when taking adverse action:

  1. Pre-adverse action letter. Employers must send the employee a letter notifying them that the background check has identified issues of concern. In addition to the letter, the candidate or employee should be given a copy of the background check results and a written copy of the Consumer Financial Protection Bureau's Summary of Rights. These requirements allow the candidate or employee an opportunity to explain, discuss and/or refute the findings before the employer makes a final decision.
  1. Waiting period. The FCRA does not provide any specific timing requirements for when adverse action notices must be issued or how long employers are required to wait after issuing the pre-adverse action notice. However, the Federal Trade Commission's guidance on this matter suggests that a fair waiting period is five business days between issuing the pre-adverse action notice and acting on the employment-related decision of not hiring the candidate.
  1. Post-adverse action letter. Employers should send a final notice that informs the candidate that the adverse action has been taken and is finalized. The letter should spell out in simple, easy-to-understand terms why the decision was made and why they will not be receiving a job offer. This final letter should address the following points:
    • It should remind the candidate that they have the right to contact the consumer reporting agency within 60 days and request a free copy of the report that was utilized for the decision leading to the adverse action.
    • If the employer used a third-party consumer reporting agency, the employer should include the agency's contact information (including the name, corporate address, website and phone number).
    • Although this is not the case for employment-related background reporting, whenever the candidate's credit score is revealed, it must be shared with the customer, particularly if it contributed to an adverse action decision.
Image Credit: Dekdoyjaidee / Getty Images
Patrick Proctor
Patrick Proctor
Business News Daily Contributing Writer
Patrick Proctor, SHRM-SCP, is certified as a senior professional in human resources. His more than 15 years of executive level leadership inform his work on inclusive and engaging workplace culture, as well as educating senior leadership teams about human capital management and organizational strategy. Patrick has written dozens of articles on global business, human resources operations, management and leadership, business technology, risk management, and continuity planning