TL;DR: When a third party runs an employment background check, the FCRA requires disclosure, authorization, and specific notices before and after an adverse decision. The screening order is easy. The surrounding workflow is where employers create risk.
FCRA background check requirements can apply to criminal history, driving records, credit history, and employment verification reports obtained from a screening company. The common mistake is treating the vendor order as the whole process. Business owners need a documented sequence before the next hire.
Start with guHRoo’s background check overview, then use this guide to tighten disclosure, authorization, candidate review, final notice, and recordkeeping steps.
When Does the FCRA Apply to an Employment Background Check?
The FCRA generally applies when an employer obtains a consumer report from a third-party screening company for an employment decision. Examples include criminal background reports, driving records, credit reports, and employment verification reports ordered through a vendor. If a third-party company is compiling the information and handing it to you as a report, the FCRA is almost certainly in play.
Direct reference checks performed in house, where you personally call a former supervisor, may follow different rules, since you are not obtaining a consumer report from a screening company. That said, federal discrimination laws and state requirements can still apply to how you use whatever information you gather, so a lighter FCRA footprint does not mean zero compliance obligations.
The Mistake: Bundling the Disclosure With Other Hiring Forms
The single most common FCRA mistake is burying the background check disclosure inside an application, an offer letter, a liability waiver, or an onboarding packet. Federal law requires the disclosure to be clear, conspicuous, written, and presented in a document devoted only to the background check disclosure. When it is mixed in with a dozen other forms, that requirement is not met, no matter how clearly the paragraph itself is written.
Federal law does permit written authorization on that same standalone disclosure document, so the authorization does not have to live on a separate piece of paper. What it cannot do is share space with unrelated liability waivers, arbitration clauses, or general employment terms. Keep the disclosure document narrowly focused on the background check and nothing else.
The Three-Step FCRA Background Check Process
Once the standalone disclosure problem is fixed, the rest of the process follows a predictable three-step sequence.
Step 1: Provide Disclosure and Obtain Authorization
Give the candidate the standalone disclosure and obtain written authorization before ordering the report. Confirm that the screening company has received the employer’s required certification that you will use the report properly and will not discriminate based on its contents.
Step 2: Send the Pre-Adverse Action Materials
Before making an unfavorable decision based partly or entirely on the report, provide a pre-adverse action notice, a copy of the report, and the current Summary of Your Rights Under the Fair Credit Reporting Act. This step gives the candidate a meaningful opportunity to identify or dispute inaccurate information before the decision becomes final.
Step 3: Send the Final Adverse Action Notice
If the employer proceeds after considering any response, send the final adverse action notice. It should include the screening company’s name, address, and telephone number, explain that the screening company did not make the hiring decision, and state the candidate’s rights to dispute the report and request another free copy within 60 days.
What Can an FCRA Violation Cost an Employer?
Willful noncompliance may result in actual damages or statutory damages of $100 to $1,000 per violation, possible punitive damages, and attorney’s fees. Negligent noncompliance may result in actual damages and attorney’s fees even without a showing of intent. This connects directly to costly HR violations, and it is worth remembering that one defective workflow repeated across multiple candidates can increase aggregate exposure, including class action risk, far beyond what a single mistake might suggest.
Audit Your Background Check Process Before the Next Hire
Four immediate actions will tell you where you stand. Review the last five screening files you completed, correct the disclosure and authorization form if it is bundled with other paperwork, document the adverse action sequence you actually followed, and check the rules for every state and municipality where candidates will work. guHRoo’s guidance on compliance with HR regulations is a good next stop after this audit.
For employers with South Carolina operations, Bound Payroll’s South Carolina employer cost calculator is a useful separate resource for planning the full cost of a new hire.
FCRA Background Check FAQs
Does the FCRA apply to employment background checks?
Yes, when an employer obtains a consumer report from a third-party screening company for an employment decision. The report may cover criminal history, driving records, credit history, or employment verification. Direct reference checks performed by the employer may follow different rules, so confirm the process with qualified counsel.
What must an employer do before running a background check?
Before ordering the report, give the candidate a clear, conspicuous written disclosure in a document devoted only to the background check disclosure, then obtain written authorization. Federal law allows the authorization on that same disclosure document, but extra releases or unrelated language can create compliance risk.
What is a pre-adverse action notice?
A pre-adverse action notice tells a candidate that the employer is considering an unfavorable decision based partly or entirely on a consumer report. Before deciding, provide the notice, a copy of the report, and the current Summary of Your Rights Under the Fair Credit Reporting Act so the candidate can review or dispute information.
How long should an employer wait after a pre-adverse action notice?
The FCRA does not state a fixed number of days. The candidate must receive a meaningful opportunity to review and dispute the report before the employer makes a final decision. Many workflows allow five business days, but employers should set timing with employment counsel and account for applicable state and local rules.
Can background check authorization be included with the disclosure?
Yes. Federal law permits the written authorization to appear on the same standalone disclosure document rather than as a separate form. The important limit is that unrelated language, such as general liability waivers or other employment terms, should stay off that document.
What are the penalties for violating the FCRA?
For willful noncompliance, the FCRA permits actual damages or statutory damages of $100 to $1,000, plus possible punitive damages and attorney’s fees. Negligent noncompliance can lead to actual damages and attorney’s fees. Repeating one defective workflow across many candidates can increase aggregate exposure, including class action risk.
Fix the Process Before the Next Screening Order
A background check is not complete when the vendor returns a report. A compliant process begins before the order and continues through disclosure, authorization, candidate review, final notice, recordkeeping, and secure disposal. Documenting those steps protects both the business and the candidate.
Multistate employers face an added layer of complexity, since several states and cities impose additional notice periods, salary history restrictions, or fair chance requirements that stack on top of the federal FCRA baseline. A workflow that satisfies federal law in one state can still fall short in another, so the state and local check should happen every time you open a role in a new location.
If your hiring workflow has not been reviewed recently, guHRoo’s HR audit service can help identify documentation and process gaps before they become larger problems. For ongoing guidance across hiring, onboarding, policies, and multistate compliance, explore guHRoo’s outsourced HR support.
