What Is FCRA? A Small Business Employer's Guide
FCRA stands for Fair Credit Reporting Act. Plain-English guide for SMBs running background checks. 5 employer duties, adverse action process, and penalties
What Is FCRA?
The Fair Credit Reporting Act explained for small business employers running background checks
The first time I ran a background check on a candidate, I had no idea there was a federal law governing the process. I used a third-party service, got the results, decided not to hire based on what the report showed, and sent the candidate a rejection email. I violated FCRA in at least three ways: I did not provide a standalone written disclosure before the check, I did not give the candidate a copy of the report before rejecting them, and I did not follow the adverse action process. Any one of those violations could have cost me $100 to $1,000 in statutory damages per violation, plus attorney fees.
FCRA is not a law most small business owners think about until they run their first background check. But if you use any third-party service to screen candidates, FCRA applies to you regardless of how many employees you have. This guide explains what FCRA is, what it requires from employers, and how to comply without needing an employment lawyer.
What Does FCRA Stand For?
FCRA stands for the Fair Credit Reporting Act. It is a federal law enacted in 1970 (Public Law 91-508, codified at 15 U.S.C. sections 1681 through 1681x) that regulates how consumer reporting agencies collect, distribute, and use consumer information, including background check reports used by employers.
In an HR context, FCRA governs the relationship between three parties: the employer (who requests the report), the consumer reporting agency or CRA (who provides the report), and the candidate or employee (whose information is in the report). The FTC provides specific guidance on employer obligations when using consumer reports. The law gives candidates specific rights (access to their report, the right to dispute inaccuracies, the right to know when a report is used against them) and imposes specific duties on employers (disclosure, authorization, adverse action process).
What Is the Fair Credit Reporting Act?
Most people associate FCRA with credit reports and debt collection. That is half the law. The other half, Section 604(b), governs employment-purpose consumer reports: criminal background checks, employment verification, education verification, motor vehicle records, and credit checks used for hiring decisions. This is the half that applies to every employer who uses a CRA to screen candidates.
The FTC and the Consumer Financial Protection Bureau (CFPB) enforce FCRA. Employers who violate FCRA face both individual lawsuits (private right of action) and regulatory enforcement. The EEOC also provides joint guidance on using background checks in compliance with both FCRA and anti-discrimination laws.
Does FCRA Apply to My Small Business?
Yes. If you use any third-party service (a consumer reporting agency) to obtain information about a candidate or employee for employment purposes, FCRA applies to you. There is no minimum employee count. There is no revenue threshold. There is no exemption for small businesses, startups, or nonprofits.
FCRA does not apply if you conduct your own investigation without using a CRA. If you personally google a candidate, check their LinkedIn, call their references, or run a court records search yourself (not through a service), FCRA does not apply to those activities. However, the moment you pay a service (Checkr, GoodHire, Sterling, HireRight, or any background check provider) to compile a report, FCRA kicks in.
What Counts as a Consumer Report Under FCRA?
| Covered by FCRA (if from a CRA) | NOT Covered by FCRA |
|---|---|
| Criminal background check via a background check provider | Googling the candidate's name yourself |
| Employment verification through a third-party service | Calling the candidate's former employer directly |
| Education verification through a verification service | Checking the candidate's LinkedIn profile |
| Credit report used for employment purposes | Checking public court records yourself (without a CRA) |
| Motor vehicle records obtained through a CRA | Asking the candidate about their criminal history in an interview (subject to state ban-the-box laws) |
| Drug test results when reported through a CRA | Internal reference checks you conduct personally |
The key distinction: FCRA applies when information is obtained from a consumer reporting agency (any entity that regularly assembles or evaluates consumer information for third parties). If you do the research yourself, directly, without an intermediary, FCRA does not apply. But practically, most small businesses use a CRA because doing background checks yourself is time-consuming and legally complex.
How Far Back a Background Check Can Legally Go
The question every owner asks after ordering their first report is why a conviction from 2009 appears while an arrest from 2016 does not. FCRA Section 605 (15 U.S.C. 1681c) sets time limits on what a consumer reporting agency may include, and the limits differ by item type.
| Item on the report | Federal reporting limit | Measured from |
|---|---|---|
| Criminal convictions | No federal time limit | Federal law lets a CRA report convictions indefinitely. State law is where the limits come from. |
| Records of arrest not resulting in conviction | 7 years | Date of entry of the record |
| Civil suits and civil judgments | 7 years, or until the governing statute of limitations expires, whichever is longer | Date of entry |
| Paid tax liens | 7 years | Date of payment |
| Accounts placed for collection or charged off | 7 years | Date of the delinquency that led to the action |
| Bankruptcies | 10 years | Date of entry of the order for relief or adjudication |
| Any other adverse item (other than convictions) | 7 years | Date the item antedates the report |
One distinction matters more than any of the dates above. Section 605 governs what the CRA may report to you. It says nothing about what you may consider. Fair-chance and ban-the-box laws in many states and cities restrict consideration separately, sometimes barring reliance on convictions the CRA was perfectly entitled to disclose. Receiving a record on a report is not permission to act on it.
The 5 Employer Duties Under FCRA
FCRA imposes five specific duties on employers who use consumer reports for employment purposes. Violating any one of them creates liability.
The most commonly violated duty is number 1: the standalone disclosure. The most commonly skipped duties are numbers 3 through 5: the adverse action sequence. Small businesses that run background checks but skip the adverse action process when they find negative results are violating FCRA every single time.
The notices FCRA requires, and what each one has to contain
Four notices carry almost the entire compliance burden, and three of them have contents prescribed by statute. Timing matters as much as wording here, because a notice that arrives after the decision has already been made is not a notice at all.
| Notice | When it goes out | What it has to contain |
|---|---|---|
| Disclosure and authorization | Before the report is ordered | A clear statement that you may obtain a consumer report for employment purposes, on a document that holds nothing else, plus the signature authorizing it |
| Investigative report notice | Within 3 days of requesting a report that includes interviews about character or reputation | That such a report may be obtained, that the person may ask about the nature and scope of the inquiry, and a summary of their rights |
| Pre-adverse action notice | Before you make the decision, followed by the waiting period | A copy of the report you relied on and a copy of the current CFPB summary of rights, with a letter saying you are considering acting on it |
| Final adverse action notice | After the waiting period, once the decision is made | The name, address and phone number of the CRA, a statement that the CRA did not make the decision and cannot give reasons for it, and the right to dispute the information and get a free copy of the report within 60 days |
Two of these get missed more than the others. Employers working through a vendor portal often never send the investigative report notice, because they do not realize their package includes reference interviews. And the final notice gets dropped by employers who treat the pre-adverse letter as the whole obligation, when it is the first half of one process rather than an alternative to the second.
What FCRA compliance actually means
Being FCRA compliant means four things are true at the same time: the disclosure document holds nothing but the disclosure and the authorization, the signature was captured before the report was ordered, the adverse action sequence ran every time a report influenced a decision, and you can show all three from a file instead of from memory.
That last part is the one small businesses skip. Keep the signed form, the report, both notices with their send dates, and a note of who was allowed to open the report, somewhere that is not an email thread. Re-read the disclosure page once a year and whenever you change screening vendors, because the most expensive violation in this law is a sentence somebody helpfully added to a form.
The Standalone Disclosure Trap
The single most expensive FCRA violation for employers: combining the background check disclosure with other documents. Section 1681b(b)(2)(A) requires that the disclosure be "in a document that consists solely of the disclosure." Courts have interpreted this strictly.
In practice, this means the disclosure cannot be part of the job application, cannot include a liability waiver, cannot include an at-will employment statement, and cannot include any language beyond the disclosure itself and the authorization. Even a single extraneous sentence can void the disclosure and create class-action liability.
The fix is simple: use a one-page form with two elements only. First, a clear statement that you may obtain a consumer report for employment purposes. Second, the candidate's signature authorizing the report. Nothing else on the page. E-signature tools make this easy: create the standalone form as a separate document in your e-signature workflow, and the candidate signs it digitally before you order the report.
The Adverse Action Process
If a background check reveals information that makes you consider not hiring the candidate, you cannot simply reject them. FCRA requires a three-step process with a mandatory waiting period.
This process exists to protect candidates from being rejected based on inaccurate information. The 5-day waiting period gives them the chance to dispute errors with the CRA before a final decision is made. Skipping or compressing this process is one of the most common FCRA violations and one of the easiest to prove in court: the employer either sent the notices or did not. There is no gray area.
Which means the log is the defense. Keep one line per candidate who reaches this stage, recording what went out, when, how, and what came back, so that a question two years from now is answered from a file rather than from memory.
| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Candidate or employee | Role | Report received on | What in the report prompted this | Pre-adverse notice sent (date) | Pre-adverse: how sent and what proof we kept | Copy of the report enclosed? (Y/N) | Summary of rights enclosed (version and date pulled) | Date the notice reached them, as far as we can show | Response deadline we gave | Response or dispute received (date and what it said) | What the agency came back with, and when | Final notice sent (date) | Final notice: how sent and what proof we kept | Outcome | Handled by | Where the file is stored |
| 2 | Example: candidate for a driving role | Record on the report we have not discussed with them yet | |||||||||||||||
| 3 | |||||||||||||||||
| 4 | |||||||||||||||||
| 5 | |||||||||||||||||
| 6 | |||||||||||||||||
| 7 | |||||||||||||||||
| 8 | |||||||||||||||||
| 9 |
Where the Background Check Fits in Your Hiring Sequence
Most FCRA problems at small companies are ordering problems, not paperwork problems. The forms are correct but they are signed at the wrong point in the process, or the report is ordered before the employer is allowed to ask. Here is the order that satisfies FCRA and keeps you out of trouble with fair-chance rules at the same time.
| Step | What happens | Why the order matters |
|---|---|---|
| 1. Application | No criminal history question on the form in ban-the-box jurisdictions | In many states and cities the question itself is unlawful at this stage, whether or not you ever run a report |
| 2. Interviews and selection | Evaluate on the scorecard. No report ordered yet | Ordering early wastes money on candidates you will not select and, in fair-chance jurisdictions, can be the violation by itself |
| 3. Conditional offer | Offer extended, contingent on a satisfactory background check | Several jurisdictions require the check to come after a conditional offer. Making this your default nationwide is simpler than tracking which ones |
| 4. Standalone disclosure and authorization | Candidate signs the one-purpose form, e-signature is fine | This must precede the order. A signature collected after the report exists does not cure the violation |
| 5. Certification to the CRA | You certify you made the disclosure, got authorization, will comply with EEO law, and will send the adverse action notices | Required by Section 1681b(b)(1). Vendors bury it in account setup, but it is a legal statement, not a checkbox |
| 6. Report ordered and reviewed | Compare findings against the job-related criteria you set in advance | Deciding what disqualifies before you see the results is what makes the later individualized assessment defensible |
| 7. Pre-adverse action, wait, final notice | The three-step sequence above | The clock does not start until the candidate actually receives the package. Use a delivery method you can prove |
Two operational notes. First, most background check vendors will send the pre-adverse and final notices for you, which is convenient and does not transfer liability: the employer remains responsible for the notices, the waiting period, and the decision. Configure the automation, then confirm each notice actually went out. Second, decide in advance who sees the report. If the hiring manager reads it before the interview scorecard is complete, you lose the ability to show that the decision rested on job-related criteria, which is the defense the EEOC guidance expects.
What It Costs When You Get It Wrong
FCRA provides a private right of action, meaning individual candidates can sue employers directly. It also allows class actions, which is where the truly large settlements occur.
| Violation Type | Penalty | Details |
|---|---|---|
| Negligent violation (Section 1681o) | Actual damages + costs + attorney fees | Did not follow the rules but not intentionally. No statutory damages, so the plaintiff must prove actual harm. Most common for SMBs who simply did not know the requirements. |
| Willful violation (Section 1681n) | Actual damages or statutory damages of $100-$1,000 per violation + punitive damages (uncapped) + attorney fees | Knew the rules and disregarded them, or acted in reckless disregard of a known requirement. Statutory damages are what make class actions viable, because no individual harm needs to be proven. |
| Class action (standalone disclosure violation) | $millions | Typical class: every candidate who signed a non-standalone form. Recent settlements range from $296K (small marketing firm) to $5.75M (staffing company). |
| FTC/CFPB enforcement | Civil penalties + injunctive relief | Regulatory action is rarer for SMBs but possible. CFPB has increased enforcement since 2021. |
The distinction between negligent and willful is where most of the money sits, and it is not as protective as it sounds. Courts have held that reckless disregard of a clear statutory requirement counts as willful, so "we did not know" is a weaker defense once the requirement is unambiguous, well publicized, and built into every commercial vendor's standard forms. That is precisely the situation with the standalone disclosure. A second point worth knowing before you panic: after the Supreme Court's 2021 decision in TransUnion LLC v. Ramirez, a plaintiff in federal court must show concrete harm rather than a bare procedural violation, which has narrowed some claims. It has not made compliance optional, and it does not help you in state court or with a candidate who genuinely lost a job over a report they never got to see.
State Laws That Stack on Top of FCRA
FCRA is the federal floor. Many states add requirements that go beyond federal law. You must comply with both FCRA and any applicable state or local law.
| State / City | Additional Requirement | Impact on Employers |
|---|---|---|
| California (ICRAA) | 7-year lookback limit on criminal records. Must provide specific CA disclosure language. | Cannot consider convictions older than 7 years. Must use California-specific disclosure form. |
| New York (Article 23-A) | Must provide candidate a copy of Article 23-A rights. Fair Chance Act (NYC) delays criminal check until conditional offer. | Additional document in pre-hire package. Cannot run criminal check until after conditional offer in NYC. |
| Massachusetts | Prohibits credit checks for most positions. Criminal record reform limits what can be considered. | Cannot use credit reports unless the role has a specific financial responsibility exception. |
| Illinois | Must comply with Employee Credit Privacy Act (limits credit checks). Chicago Ban-the-Box delays criminal inquiry. | Credit checks restricted to specific roles. Criminal history cannot be asked on initial application in Chicago. |
| Ban-the-Box jurisdictions | 37+ states/cities delay criminal history inquiry until after initial screening or conditional offer. | Must structure your process so the background check runs after the conditional offer, not before. |
The practical implication for small businesses: check your state and city requirements before running any background check. The SHRM maintains a comprehensive FCRA compliance checklist that includes state-by-state variations.
Edge Cases Small Employers Actually Hit
The five duties cover the straightforward case: one candidate, one report, one decision. Real hiring produces situations the checklist does not obviously answer.
| Situation | What FCRA requires | Practical handling |
|---|---|---|
| Re-checking a current employee (annual MVR, promotion, post-incident) | Employment purpose includes promotion, reassignment and retention, so the full sequence applies again: disclosure, authorization, adverse action notices | Some employers use an ongoing authorization that covers future checks during employment. It is permitted federally but restricted in some states, so confirm before relying on a single signature collected at hire |
| The report includes interviews about character or reputation | This is an investigative consumer report under Section 606. You must disclose it in writing within 3 days of requesting it, tell the person they may ask about the nature and scope of the inquiry, and answer that request within 5 days | Most standard criminal and employment verification packages are not investigative reports. Ask your vendor which of its products are, before you order one |
| Candidate disputes the report during the waiting period | Nothing in FCRA compels you to wait for the reinvestigation, but acting on information you have been told is wrong is where willfulness arguments begin | The CRA generally has 30 days to reinvestigate. Hold the decision, tell the candidate you are holding it, and document the pause |
| You decide not to hire for a reason unrelated to the report | No adverse action notice is required if the report played no part in the decision | Write down the actual reason at the time. A rejection that follows a report by two days will be assumed to be about the report unless your file says otherwise |
| Someone already started and the report comes back bad | Termination based in whole or in part on a consumer report is adverse action. The pre-adverse notice, waiting period and final notice all still apply | Do not walk them out the same afternoon. Suspend with pay if the finding is serious, then run the sequence |
| Staffing agency or PEO placements | Whoever obtains the report from the CRA carries the FCRA duties for it, and both entities can be exposed depending on who made the decision | Get in writing which party runs the check, holds the authorization, and sends the notices. Do not assume the agency did it |
| Contractors, gig workers, volunteers, and interns | FCRA follows the employment purpose, not the classification | Same forms, same sequence, regardless of whether the person receives a W-2 |
| You are done with the file | The FACTA disposal rule requires reasonable measures to protect against unauthorized access when disposing of consumer report information | Shred paper, wipe or destroy electronic copies, and keep reports out of shared drives and email threads while you still have them |
One more detail that catches employers who built their forms years ago: the pre-adverse action package must include the current version of the CFPB's "A Summary of Your Rights Under the Fair Credit Reporting Act." That model form has been revised, and sending a superseded version is a defect in an otherwise complete notice. Pull the current form from the CFPB rather than reusing the PDF saved in your hiring folder.
Stale paperwork is the failure mode here, and it is invisible until somebody asks. An annual pass over the forms themselves catches it: what is on the disclosure page today, which version of the rights summary sits in the pre-adverse pack, who signed the certification, and where reports are living between the portal and the file.
FCRA vs. EEOC: Two Laws, One Background Check
FCRA and EEOC anti-discrimination laws apply simultaneously to the same background check. FCRA governs the process (disclosure, authorization, adverse action notices). EEOC governs the substance (whether your use of the information discriminates against protected classes).
| FCRA | EEOC | |
|---|---|---|
| What it regulates | The process of obtaining and using consumer reports | Whether the hiring decision discriminates based on protected characteristics |
| Key requirement | Standalone disclosure, written consent, adverse action process | Individualized assessment considering nature of offense, time elapsed, and job relatedness |
| Enforced by | FTC, CFPB, private lawsuits | EEOC, private lawsuits |
| Applies at | All employers using a CRA (no size threshold) | 15+ employees (Title VII), 20+ (ADEA), 15+ (ADA) |
| Common violation | Non-standalone disclosure form | Blanket policy rejecting all candidates with criminal records |
The EEOC and FTC joint guidance recommends that employers conduct an individualized assessment before taking adverse action based on criminal history. This means considering the nature and gravity of the offense, the time that has passed, and the nature of the job. A blanket "no criminal history" policy violates EEOC guidance and may violate Title VII through disparate impact.
Frequently Asked Questions
What does FCRA stand for in HR?
In HR, FCRA stands for the Fair Credit Reporting Act, the federal law that governs how employers can use background checks (called 'consumer reports') in hiring decisions. It requires employers to get written consent before running a background check, provide the check on a standalone disclosure form, and follow a specific adverse action process if the results affect the hiring decision. FCRA applies to every US employer regardless of size.
Does FCRA apply to small businesses?
Yes. FCRA applies to every employer that uses a consumer reporting agency (CRA) to obtain a consumer report on a candidate or employee, regardless of company size. Whether you have 5 employees or 5,000, if you use a third-party service to run a background check, FCRA applies to you. The law does not have an employee-count threshold like Title VII (15+) or FMLA (50+).
Does FCRA cover independent contractors?
Yes. FCRA applies to background checks on employees, independent contractors, and volunteers. Any time you obtain a consumer report from a CRA for an employment purpose (hiring, promotion, reassignment, or retention), FCRA requirements apply regardless of the worker's classification.
What is the difference between FCRA and FACTA?
FACTA (Fair and Accurate Credit Transactions Act of 2003) is an amendment to FCRA, not a separate law. FACTA added requirements including the right to free annual credit reports, identity theft protections, and the disposal rule requiring secure destruction of consumer report information. For employers, the most relevant FACTA provision is the disposal rule: you must securely destroy consumer reports and related information when you no longer need them.
How long must I keep FCRA records?
FCRA itself does not specify a retention period for employer records, but the EEOC recommends retaining all hiring records for at least one year from the date of the hiring decision. If a charge of discrimination is filed, retain records until the case is resolved. Best practice for small businesses: keep consent forms, consumer reports, and adverse action notices for at least 5 years in a secure, access-controlled system.
Do I need a separate FCRA form for each state?
You need a single federal FCRA disclosure and authorization form for all states. However, several states require additional disclosures or have stricter rules. California requires a checkbox indicating the type of investigation. New York requires a copy of Article 23-A. San Francisco, Philadelphia, and other cities have ban-the-box timing requirements that affect when you can run the check. Check your state and local requirements in addition to federal FCRA.