What Is FCRA? A Small Business Employer's Guide
FCRA stands for Fair Credit Reporting Act. Plain-English guide for SMBs running background checks. 5 employer duties, adverse action process, and penalties
What Is FCRA?
The Fair Credit Reporting Act explained for small business employers running background checks
The first time I ran a background check on a candidate, I had no idea there was a federal law governing the process. I used a third-party service, got the results, decided not to hire based on what the report showed, and sent the candidate a rejection email.
I violated the Fair Credit Reporting Act (FCRA) in at least three ways: I did not provide a standalone written disclosure before the check, I did not give the candidate a copy of the report before rejecting them, and I did not follow the adverse action process. Any one of those could have cost me actual damages and attorney fees, and statutory damages of $100 to $1,000 for that candidate if a court had called it willful.
FCRA is not a law most small business owners think about until they run their first background check. But if you use any third-party service to screen candidates, FCRA applies to you regardless of how many employees you have. This guide explains what FCRA is, what it requires from employers, and how to comply without needing an employment lawyer.
What Does FCRA Stand For?
FCRA stands for the Fair Credit Reporting Act. It is a federal law enacted in 1970 (Public Law 91-508, codified at 15 U.S.C. sections 1681 through 1681x) that regulates how consumer reporting agencies collect, distribute, and use consumer information, including background check reports used by employers.
In an HR context, FCRA governs the relationship between three parties: the employer (who requests the report), the consumer reporting agency or CRA (who provides the report), and the candidate or employee (whose information is in the report).
The law gives candidates specific rights (access to their report, the right to dispute inaccuracies, the right to know when a report is used against them) and imposes specific duties on employers (disclosure, authorization, adverse action process). The Federal Trade Commission (FTC) publishes guidance that spells out those employer obligations when you use consumer reports.
What Is the Fair Credit Reporting Act?
Most people associate FCRA with credit reports and debt collection. That is half the law. The other half, Section 604(b), governs employment-purpose consumer reports: criminal background checks, employment verification, education verification, motor vehicle records, and credit checks used for hiring decisions. This is the half that applies to every employer who uses a CRA to screen candidates.
The FTC and the CFPB enforce FCRA. Employers who violate FCRA face both individual lawsuits (private right of action) and regulatory enforcement. The Equal Employment Opportunity Commission (EEOC) also provides joint guidance with the FTC on using background checks in compliance with both FCRA and anti-discrimination laws.
Does FCRA Apply to My Small Business?
Yes. If you use any third-party service (a consumer reporting agency) to obtain information about a candidate or employee for employment purposes, FCRA applies to you. There is no minimum employee count. There is no revenue threshold. There is no exemption for small businesses, startups, or nonprofits.
FCRA does not apply if you conduct your own investigation without using a CRA. If you personally google a candidate, check their LinkedIn, or call their references rather than routing any of it through a service, FCRA does not reach those activities.
The moment you pay a commercial screening service, meaning any background check provider, to compile a report on your behalf, FCRA applies to the whole transaction. Running a court records search yourself stays outside the law. Paying somebody to run the same search does not.
What Counts as a Consumer Report Under FCRA?
| Covered by FCRA (if from a CRA) | NOT Covered by FCRA |
|---|---|
| Criminal background check via a background check provider | Googling the candidate's name yourself |
| Employment verification through a third-party service | Calling the candidate's former employer directly |
| Education verification through a verification service | Checking the candidate's LinkedIn profile |
| Credit report used for employment purposes | Checking public court records yourself (without a CRA) |
| Motor vehicle records obtained through a CRA | Asking the candidate about their criminal history in an interview (subject to state ban-the-box laws) |
| Drug test results when reported through a CRA | Internal reference checks you conduct personally |
The key distinction: FCRA applies when information is obtained from a "consumer reporting agency," meaning any entity that regularly assembles or evaluates consumer information for third parties. If you do the research yourself, directly, without an intermediary, FCRA does not apply. Practically, though, most small businesses use a CRA because running checks yourself is slow and legally complex.
How Far Back a Background Check Can Legally Go
The question every owner asks after ordering their first report is why a conviction from 2009 appears while an arrest from 2016 does not. FCRA Section 605 (15 U.S.C. 1681c) sets time limits on what a consumer reporting agency may include, and the limits differ by item type.
| Item on the report | Federal reporting limit | Measured from |
|---|---|---|
| Criminal convictions | No federal time limit | Federal law lets a CRA report convictions indefinitely. State law is where the limits come from. |
| Records of arrest not resulting in conviction | 7 years, or until the governing statute of limitations expires, whichever is longer | Date of entry |
| Civil suits and civil judgments | 7 years, or until the governing statute of limitations expires, whichever is longer | Date of entry |
| Paid tax liens | 7 years | Date of payment |
| Accounts placed for collection or charged off | 7 years | 180 days after the start of the delinquency that led to the action |
| Bankruptcies | 10 years | Date of entry of the order for relief or adjudication |
| Any other adverse item (other than convictions) | 7 years | Date of the item |
One distinction matters more than any of the dates above. Section 605 governs what the CRA is allowed to report to you. It says nothing at all about what you are allowed to consider once the report is in your hands.
Fair-chance and ban-the-box laws in many states and cities restrict consideration separately, sometimes barring reliance on convictions the CRA was perfectly entitled to disclose. Receiving a record on a report is not permission to act on it.
The 5 Employer Duties Under FCRA
FCRA imposes five specific duties on employers who use consumer reports for employment purposes. Violating any one of them creates liability.
Duty number 1, the standalone disclosure, is the easiest to get wrong on paper. Duties 3 through 5, the adverse action sequence, are the easiest to skip. Small businesses that run background checks but skip the adverse action process when they find negative results are violating FCRA every single time.
The notices FCRA requires, and what each one has to contain
Four notices carry almost the entire compliance burden, and three of them have contents prescribed by statute. Timing matters as much as wording here, because a notice that arrives after the decision has already been made is not a notice at all.
| Notice | When it goes out | What it has to contain |
|---|---|---|
| Disclosure and authorization | Before the report is ordered | A clear statement that you may obtain a consumer report for employment purposes, on a document that holds nothing else, plus the signature authorizing it |
| Investigative report notice | Within 3 days of requesting a report that includes interviews about character or reputation | That such a report may be obtained, that the person may ask about the nature and scope of the inquiry, and a summary of their rights |
| Pre-adverse action notice | Before you make the decision, followed by the waiting period | A copy of the report you relied on and a copy of the current CFPB summary of rights, with a letter saying you are considering acting on it |
| Final adverse action notice | After the waiting period, once the decision is made | The name, address and phone number of the CRA, a statement that the CRA did not make the decision and cannot give reasons for it, and the right to dispute the information and get a free copy of the report within 60 days |
Two of these get missed more than the others. Employers working through a vendor portal often never send the investigative report notice, because they do not realize their package includes reference interviews. And the final notice gets dropped by employers who treat the pre-adverse letter as the whole obligation, when it is the first half of one process rather than an alternative to the second.
What FCRA compliance actually means
Being FCRA compliant means four things are true at the same time: the disclosure document holds nothing but the disclosure and the authorization, the signature was captured before the report was ordered, the adverse action sequence ran every time a report influenced a decision, and you can show all three from a file instead of from memory.
That last part is the one small businesses skip. Keep the signed form, the report, both notices with their send dates, and a note of who was allowed to open the report, somewhere that is not an email thread. Re-read the disclosure page once a year and whenever you change screening vendors, because one of the most expensive violations in this law is a sentence somebody helpfully added to a form.
The Standalone Disclosure Trap
Combining the background check disclosure with other documents is one of the most expensive FCRA violations an employer can make. Section 1681b(b)(2)(A) requires that the disclosure be "in a document that consists solely of the disclosure." Courts read it strictly: in Syed v. M-I, the Ninth Circuit held in 2017 that a liability waiver in the same document as the disclosure is a willful violation.
In practice, this means the disclosure cannot be part of the job application, cannot include a liability waiver, cannot include an at-will employment statement, and cannot include any language beyond the disclosure itself and the authorization. Even a single extraneous sentence can void the disclosure and create class-action liability.
The fix is simple: use a one-page form with two elements only. First, a clear statement that you may obtain a consumer report for employment purposes. Second, the candidate's signature authorizing the report. Nothing else on the page. E-signature tools make this easy: create the standalone form as a separate document in your e-signature workflow, and the candidate signs it digitally before you order the report.
The Adverse Action Process
If a background check reveals information that makes you consider not hiring the candidate, you cannot simply reject them. FCRA requires a three-step process with a mandatory waiting period.
This process exists to protect candidates from being rejected based on inaccurate information. The waiting period, generally 5 business days, gives them the chance to dispute errors with the CRA before a final decision is made.
Skipping or compressing this process is one of the most common FCRA violations and one of the easiest to prove in court: the employer either sent the notices or did not. There is no gray area.
That means the log is your defense. Keep one line per candidate who reaches this stage, recording what went out, when, how, and what came back, so that a question two years from now is answered from a file rather than from memory.
| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Candidate or employee | Role | Report received on | What in the report prompted this | Pre-adverse notice sent (date) | Pre-adverse: how sent and what proof we kept | Copy of the report enclosed? (Y/N) | Summary of rights enclosed (version and date pulled) | Date the notice reached them, as far as we can show | Response deadline we gave | Response or dispute received (date and what it said) | What the agency came back with, and when | Final notice sent (date) | Final notice: how sent and what proof we kept | Outcome | Handled by | Where the file is stored |
| 2 | Example: candidate for a driving role | Record on the report we have not discussed with them yet | |||||||||||||||
| 3 | |||||||||||||||||
| 4 | |||||||||||||||||
| 5 | |||||||||||||||||
| 6 | |||||||||||||||||
| 7 | |||||||||||||||||
| 8 | |||||||||||||||||
| 9 |
Where the Background Check Fits in Your Hiring Sequence
Most FCRA problems at small companies are ordering problems, not paperwork problems. The forms are correct but they are signed at the wrong point in the process, or the report is ordered before the employer is allowed to ask. Here is the order that satisfies FCRA and keeps you out of trouble with fair-chance rules at the same time.
| Step | What happens | Why the order matters |
|---|---|---|
| 1. Application | No criminal history question on the form in ban-the-box jurisdictions | In many states and cities the question itself is unlawful at this stage, whether or not you ever run a report |
| 2. Interviews and selection | Evaluate on the scorecard. No report ordered yet | Ordering early wastes money on candidates you will not select and, in fair-chance jurisdictions, can be the violation by itself |
| 3. Conditional offer | Offer extended, contingent on a satisfactory background check | Several jurisdictions require the check to come after a conditional offer. Making this your default nationwide is simpler than tracking which ones |
| 4. Standalone disclosure and authorization | Candidate signs the one-purpose form, e-signature is fine | This must precede the order. A signature collected after the report exists does not cure the violation |
| 5. Certification to the CRA | You certify you made the disclosure, got authorization, will comply with EEO law, and will send the adverse action notices | Required by Section 1681b(b)(1). Vendors bury it in account setup, but it is a legal statement, not a checkbox |
| 6. Report ordered and reviewed | Compare findings against the job-related criteria you set in advance | Deciding what disqualifies before you see the results is what makes the later individualized assessment defensible |
| 7. Pre-adverse action, wait, final notice | The three-step sequence above | The clock does not start until the candidate actually receives the package. Use a delivery method you can prove |
Two operational notes. First, most background check vendors will send the pre-adverse and final notices for you, which is convenient and does not transfer liability: the employer remains responsible for the notices, the waiting period, and the decision. Configure the automation, then confirm each notice actually went out.
Second, decide in advance who sees the report. If the hiring manager reads it before the interview scorecard is complete, you lose the ability to show that the decision rested on job-related criteria, which is the defense the EEOC guidance expects.
What It Costs When You Get It Wrong
FCRA provides a private right of action, meaning individual candidates can sue employers directly. It also allows class actions, which is where the truly large settlements occur.
| Violation Type | Penalty | Details |
|---|---|---|
| Negligent violation (Section 1681o) | Actual damages + costs + attorney fees | Did not follow the rules but not intentionally. No statutory damages, so the plaintiff must prove actual harm. Most common for SMBs who simply did not know the requirements. |
| Willful violation (Section 1681n) | Actual damages or statutory damages of $100 to $1,000 per consumer + punitive damages (uncapped) + attorney fees | Knew the rules and disregarded them, or acted in reckless disregard of a known requirement. Statutory damages are what make class actions viable, because no individual harm needs to be proven. |
| Class action (standalone disclosure violation) | Statutory damages multiplied by the size of the class | The class is every candidate who signed the same defective form. At the $1,000 top of the range, a few hundred applicants turn a paperwork defect into a six-figure claim before fees. |
| FTC/CFPB enforcement | Civil penalties + injunctive relief | Regulatory action against a small employer is rarer than a private suit, but both agencies hold authority over how employers use consumer reports. |
The line between negligent and willful is where most of the money sits, and it is easier to cross than it sounds. In Safeco Insurance Co. v. Burr (2007), the Supreme Court held that reckless disregard of a statutory requirement counts as willful.
Under Safeco, "we did not know" weakens fast as a defense once a requirement is unambiguous and built into every commercial vendor's standard forms. The standalone disclosure is precisely that kind of requirement.
A later Supreme Court decision cuts the other way. After TransUnion LLC v. Ramirez, decided June 25, 2021, a plaintiff in federal court must show concrete harm, not just a bare procedural violation, and that has narrowed some claims.
TransUnion has not made compliance optional, though. It does not help you in state court, and it does nothing for you against a candidate who genuinely lost a job over a report they never got the chance to see or correct.
State Laws That Stack on Top of FCRA
FCRA is the federal floor. Many states add requirements that go beyond federal law. You must comply with both FCRA and any applicable state or local law.
| State / Jurisdiction | Additional Requirement | Impact on Employers |
|---|---|---|
| California (ICRAA and the Fair Chance Act) | Seven-year cap on conviction reporting with no salary exception, plus a box on the form letting the applicant request a copy of the report. | Employers with five or more employees cannot ask about convictions before a conditional offer, and the federal $75,000 carve-out does not apply here. |
| New York (Correction Law Article 23-A) | Post Article 23-A in the workplace, assess each conviction against the statutory factors, and give written reasons for a denial within 30 days of a request. | No blanket rejections. In New York City the Fair Chance Act pushes the criminal check to after the conditional offer. |
| Massachusetts | No criminal record question on the initial written application, and no inquiry into a misdemeanor conviction three or more years old unless the person was convicted of something else inside those three years. | Ask about criminal history later in the process, and keep the older misdemeanors out of the conversation. |
| Illinois | The Employee Credit Privacy Act limits employment credit checks, and the Job Opportunities for Qualified Applicants Act runs statewide rather than only in Chicago. | No criminal history inquiry until the applicant is selected for an interview, or until a conditional offer where there is no interview. |
| Ban-the-box and fair-chance jurisdictions | Many states and cities delay the criminal history inquiry until after an interview or a conditional offer, and the list keeps growing. | Run the check after the conditional offer everywhere. It is simpler than tracking jurisdictions and it satisfies the strictest of them. |
The practical implication for small businesses: FCRA compliance starts with the federal duties, but it does not end there. Check your state and city requirements before running any background check, because they can change both what your form has to say and the point in hiring at which you may order the report.
You can verify three of those rows yourself in a few minutes. The Illinois Department of Labor publishes the point at which a criminal history question becomes lawful, the Massachusetts Attorney General publishes the same for the three-year misdemeanor rule, and California Civil Code 1786.16 sets out the check box the state disclosure has to carry.
Edge Cases Small Employers Actually Hit
The five duties cover the straightforward case: one candidate, one report, one decision. Real hiring produces situations the checklist does not obviously answer.
| Situation | What FCRA requires | Practical handling |
|---|---|---|
| Re-checking a current employee (annual MVR, promotion, post-incident) | Employment purpose includes promotion, reassignment and retention, so the full sequence applies again: disclosure, authorization, adverse action notices | Some employers use an ongoing authorization that covers future checks during employment. It is permitted federally but restricted in some states, so confirm before relying on a single signature collected at hire |
| The report includes interviews about character or reputation | This is an investigative consumer report under Section 606. You must disclose it in writing within 3 days of requesting it, tell the person they may ask about the nature and scope of the inquiry, and answer that request within 5 days | Most standard criminal and employment verification packages are not investigative reports. Ask your vendor which of its products are, before you order one |
| Candidate disputes the report during the waiting period | Nothing in FCRA compels you to wait for the reinvestigation, but acting on information you have been told is wrong is where willfulness arguments begin | The CRA generally has 30 days to reinvestigate. Hold the decision, tell the candidate you are holding it, and document the pause |
| You decide not to hire for a reason unrelated to the report | No adverse action notice is required if the report played no part in the decision | Write down the actual reason at the time. A rejection that follows a report by two days will be assumed to be about the report unless your file says otherwise |
| Someone already started and the report comes back bad | Termination based in whole or in part on a consumer report is adverse action. The pre-adverse notice, waiting period and final notice all still apply | Do not walk them out the same afternoon. Suspend with pay if the finding is serious, then run the sequence |
| Staffing agency or PEO placements | Whoever obtains the report from the CRA carries the FCRA duties for it, and both entities can be exposed depending on who made the decision | Get in writing which party runs the check, holds the authorization, and sends the notices. Do not assume the agency did it |
| Contractors, gig workers, volunteers, and interns | FTC staff read employment purpose broadly enough to reach non-employees such as owner-operator drivers and volunteers, though several federal district courts have held that independent contractors fall outside the employment rules | Same forms, same sequence, regardless of whether the person receives a W-2. The unsettled case law is a reason to comply, not a loophole |
| You are done with the file | The FACTA disposal rule requires reasonable measures to protect against unauthorized access when disposing of consumer report information | Shred paper, wipe or destroy electronic copies, and keep reports out of shared drives and email threads while you still have them |
One more detail catches employers who built their forms years ago. The pre-adverse action package must include the current version of the CFPB's "A Summary of Your Rights Under the Fair Credit Reporting Act." That model form has been revised, and sending a superseded copy is a defect in an otherwise complete notice.
Pull the current form from the CFPB rather than reusing the PDF saved in your hiring folder. The summary of rights is published as Appendix K to Regulation V, the CFPB's rule implementing FCRA, alongside the other model disclosures. That gives you one authoritative place to check what you are sending.
Stale paperwork is the failure mode here, and it is invisible until somebody asks. An annual pass over the forms themselves catches it: what is on the disclosure page today, which version of the rights summary sits in the pre-adverse pack, who signed the certification, and where reports are living between the portal and the file.
FCRA vs. EEOC: Two Laws, One Background Check
FCRA and the anti-discrimination laws the EEOC enforces apply simultaneously to the same background check. FCRA governs the process: disclosure, authorization, and the adverse action notices. EEOC governs the substance, meaning whether your use of the information discriminates against protected classes.
| FCRA | EEOC | |
|---|---|---|
| What it regulates | The process of obtaining and using consumer reports | Whether the hiring decision discriminates based on protected characteristics |
| Key requirement | Standalone disclosure, written consent, adverse action process | Job-related screening, with an individualized assessment (nature of offense, time elapsed, nature of the job) recommended |
| Enforced by | FTC, CFPB, private lawsuits | EEOC, private lawsuits |
| Applies at | All employers using a CRA (no size threshold) | 15+ employees (Title VII), 20+ (ADEA), 15+ (ADA) |
| Common violation | Non-standalone disclosure form | Blanket policy rejecting all candidates with criminal records |
In its 2012 enforcement guidance on arrest and conviction records, the EEOC recommends an individualized assessment before taking adverse action based on criminal history. This means considering the nature and gravity of the offense, the time that has passed, and the nature of the job. The guidance says Title VII does not require that assessment in every case, but a screen without one is harder to defend.
The EEOC and FTC joint guidance adds the warning that matters most for a blanket "no criminal history" policy. A rule that excludes people with certain records can violate Title VII through disparate impact if it significantly disadvantages a protected group and does not accurately predict who will be a reliable or safe employee.
For a small employer, the practical routine is short. Decide which records actually matter for the job before you order the report. Then weigh each candidate's record on its own facts, including anything they tell you during the waiting period, before you make the final decision.
Frequently Asked Questions
What does FCRA stand for in HR?
In HR, FCRA stands for the Fair Credit Reporting Act, the federal law that governs how employers can use background checks (called 'consumer reports') in hiring decisions. Before the check, the employer must hand the candidate a standalone disclosure form and get their written consent. If the results then affect the hiring decision, the employer must follow a specific adverse action process. These rules reach any US employer, of any size, that orders a background check through a third-party screening company.
Does FCRA apply to small businesses?
Yes. Company size makes no difference. Any employer that gets a consumer report on a candidate or employee from a consumer reporting agency (CRA) is covered, from a small business ordering its first background check through a third-party service to an enterprise screening at scale. Unlike Title VII (15+) or FMLA (50+), the law sets no employee-count threshold, so there is no size at which the rules switch on.
Does FCRA cover independent contractors?
Often, yes, and the safe course is to assume it does. In the FTC staff's reading, 'employment purposes' is a wide term that takes in people who are not technically employees, such as owner-operator truck drivers, contractors a company signs with regularly, and volunteers. Several federal district courts have disagreed since 2012, holding that the employment rules follow the common-law meaning of employment and so leave independent contractors out. Because the question is unsettled, the practical answer is to treat a contractor check like any other employment check: a standalone disclosure, written authorization, and the full adverse action sequence if the report affects your decision. The extra paperwork costs little next to defending a claim that the rules applied after all.
What is the difference between FCRA and FACTA?
FACTA (Fair and Accurate Credit Transactions Act of 2003) is an amendment to FCRA, not a separate law. FACTA added requirements including the right to free annual credit reports, identity theft protections, and the disposal rule requiring secure destruction of consumer report information. For employers, the most relevant FACTA provision is the disposal rule: you must securely destroy consumer reports and related information when you no longer need them.
How long must I keep FCRA records?
FCRA itself does not specify a retention period for employer records. EEOC regulations, though, require employers covered by federal anti-discrimination law to keep hiring records for one year from the date the record was made or the decision was taken, whichever is later. If a charge of discrimination is filed, retain records until the case is resolved. Best practice for small businesses: keep consent forms, consumer reports, and adverse action notices for at least 5 years in a secure, access-controlled system. That matches the outer limit for FCRA lawsuits, which must be filed within two years of discovering a violation and no later than five years after it happened.
Do I need a separate FCRA form for each state?
One federal disclosure and authorization form covers every state, but several states add requirements on top of it. In California, the form needs a box the applicant can check to get a copy of the report, and convictions older than seven years cannot be reported, whatever the job pays. New York employers must post Article 23-A of the Correction Law at the workplace and weigh every conviction individually. Massachusetts bars the criminal history question from the initial written application. Illinois limits credit checks for employment and, statewide, holds criminal history questions back until an interview or a conditional offer. New York City, San Francisco, Philadelphia, and other cities layer their own timing rules on top. Check the state and city where the person will work, not where your company is registered.