Background checks are a powerful risk-management tool, but only when they’re done correctly. Employers, schools, and organizations that fail to follow background check compliance laws can face fines, lawsuits, and reputational damage. This guide explains FCRA background check compliance in plain terms, focusing on what organizations must do to remain compliant.
Background check compliance means following all applicable laws and regulations when requesting, reviewing, and acting on background check information.
The primary law governing background checks is the Fair Credit Reporting Act (FCRA), which applies whenever an organization uses a third-party background screening provider.
Compliance typically requires organizations to:
The Fair Credit Reporting Act is a federal law enacted in 1970 that regulates how consumer information (including background check data) is collected, used, and shared. It applies to employers, lenders, landlords, and anyone else who uses consumer reports to make eligibility decisions.
For employers, the FCRA governs the entire background screening process: how you must notify applicants, what consent you need, what steps to follow before rejecting someone based on their report, and what rights the candidate retains throughout.
Who enforces it? The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) both enforce the FCRA. Employers can also face private lawsuits from applicants, including class actions.
The FCRA applies whenever an employer uses a Consumer Reporting Agency (CRA), a third-party company, to compile a background report. It does not apply to in-house background checks conducted without a third party.
It covers more than just full-time employees. The FCRA also applies when vetting:
1. It’s the Law
Failure to comply with the FCRA can result in regulatory penalties, lawsuits, and class-action claims.
2. Background Reports Can Contain Errors
Criminal records may be outdated or misattributed. Compliance ensures individuals have the right to dispute inaccuracies.
3. Compliance Reduces Legal Liability
Following required procedures demonstrates fairness and consistency, reducing exposure to negligent hiring or discrimination claims.
4. Schools and Youth Organizations Face Higher Scrutiny
Organizations working with children are often held to stricter compliance expectations.
5. Trust Depends on Fair Processes
Applicants and volunteers are more likely to trust organizations that follow transparent, lawful screening practices.
This is where most employers make their first mistake. The FCRA has very specific requirements for how you notify applicants and obtain consent, and getting the format wrong is enough to trigger a violation.
Before ordering any background check, you must provide the applicant with a written disclosure stating that a consumer report may be obtained for employment purposes. The disclosure must:
Courts are strict on this. A disclosure bundled with an application, even on a separate page, has been found non-compliant. It must truly stand alone.
After receiving the disclosure, the applicant must provide written (or electronic) authorization before you run the check. The FCRA permits you to combine the disclosure and authorization into one standalone form, but it still cannot be attached to any other hiring document.
Before the CRA delivers the report, you must certify to them that you:
Here are the steps you need to follow to do a compliant background check:
Give the individual a standalone disclosure stating that a background check will be conducted.
The disclosure must:
You must receive written permission - often electronic - from the individual before proceeding.
Without authorization, running a background check is a compliance violation.
Using free databases or DIY searches can lead to inaccurate results and legal risk.
A compliant provider should offer:
Organizations should evaluate background check results by considering:
If you may deny employment, volunteer approval, or access based on a background check, you must follow adverse action procedures.
This includes:
The adverse action process is the most litigated part of FCRA compliance. Skipping or rushing any step is the most common reason employers face class-action suits.
Before making any final negative decision, you must send the applicant a pre-adverse action notice that includes:
2024 Update: The CFPB issued an updated version of the rights summary in April 2023, which became mandatory for employers to use from March 20, 2024. Employers using the old version after that date are in violation.
After sending the pre-adverse action notice, you must give the applicant a reasonable amount of time to review the report and dispute any errors. The FCRA does not specify an exact number of days, but courts and compliance experts generally interpret it as at least 5 business days. Do not make your final decision before this period elapses.
If you proceed with the negative decision after the waiting period, send a final adverse action notice to the applicant. This notice must include:
Every applicant subject to a background check has the following rights, and your process must protect them:
The FCRA governs how you run background checks. The EEOC governs how you use what you find, specifically when it comes to criminal history.
Under Title VII and related laws enforced by the EEOC, employers cannot make hiring decisions that discriminate based on race, color, national origin, sex, religion, disability, age (40+), or genetic information.
Employers may consider criminal records in hiring, but must do so carefully:
The FCRA is a federal baseline; states can and do add additional restrictions. Employers must comply with both. Here are the most common state-level rules:
|
State Rule |
What It Means |
Example States |
|
Ban the Box |
Employers must delay asking about criminal history until later in the hiring process |
CA, NY, IL, MA, CO, and many cities |
|
Arrest Record Limits |
Some states prohibit using arrests without convictions in any employment decision |
CA, NY, HI, MA |
|
Lookback Limits |
Convictions older than a set number of years (often 7) cannot be reported or considered |
CA (7 yrs), NY (varies), MA (varies) |
|
Expunged Records |
Sealed or expunged records cannot be reported by CRAs or used in hiring decisions |
Most states |
|
Salary History Bans |
Some states also restrict what other information can be collected during hiring |
CA, NY, IL, WA, NJ |
|
Credit Check Limits |
Some states restrict or prohibit the use of credit reports for most employment decisions |
CA, NY, IL, MD, CT |
Organizations often fall out of compliance by:
The FCRA limits how far back CRAs can report certain types of information for positions paying under $75,000 annually:
|
Information Type |
FCRA Reporting Limit |
|
Criminal convictions |
No federal limit (unless expunged or state law applies) |
|
Civil judgments & liens |
7 years |
|
Bankruptcies |
10 years |
|
Other adverse information |
7 years |
|
Expunged/sealed records |
Cannot be reported at any time |
Note: These federal limits don't apply to positions with salaries above $75,000, and many states impose stricter limits regardless of salary. Always confirm what's reportable under applicable state law.
Organizations that prioritize compliance gain:
Bchex helps organizations stay compliant by providing:
By standardizing the screening process, Bchex helps reduce human error and compliance gaps.
Background check compliance isn’t optional - it’s essential. By understanding and following FCRA requirements, organizations can protect themselves legally while ensuring fair, transparent screening practices.
Looking for a compliant screening solution you can trust?
Bchex provides FCRA-compliant background checks with built-in compliance safeguards to help organizations screen confidently.
Q: Does the FCRA apply to volunteers?
Yes - if a third-party background check provider is used.
Q: Can I run background checks without consent?
No. Written authorization is required under the FCRA.
Q: How long should I wait during adverse action?
Most organizations wait at least 5 business days.
Q: Are Google searches compliant background checks?
No - DIY searches are unreliable and non-compliant.
Q: Who enforces background check compliance?
The FTC and CFPB oversee FCRA enforcement.