The Fair Credit Reporting Act (FCRA) is a federal consumer protection law enacted in 1970. It governs how Consumer Reporting Agencies (CRAs) — the third-party companies that compile and sell information about individuals — collect, maintain, and report that information, and it sets specific obligations for employers who use those reports in employment decisions.
The FCRA has three primary goals: protecting consumer privacy, ensuring the accuracy of reported information, and giving individuals rights to know about, dispute, and correct information used against them. For employers, the law creates a defined set of procedural obligations every time they use a consumer report in a hiring, promotion, reassignment, or termination decision.
Non-compliance is not a technicality. FCRA violations carry statutory damages of $100 to $1,000 per violation — which, in class action litigation involving hundreds or thousands of employees, can produce multi-million dollar settlements. A $600,000 class action against one employer stemmed from a single footnote on a disclosure form that a judge ruled violated the FCRA's requirement that disclosures be clear, standalone documents without extraneous language. The exposure is real and the margin for error is narrow.
The FCRA defines a consumer report broadly. According to the FTC, background screening reports are consumer reports under the FCRA when they serve as a factor in determining a person's eligibility for employment, credit, insurance, housing, or other purposes — and they include information "bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living."
That definition is intentionally broad. It covers far more than a credit report. In the employment context, the following all qualify as consumer reports when obtained from a third-party CRA:
The key trigger is not what type of information is being reported. It's whether a third-party CRA is compiling and delivering that information for use in an employment decision. If yes — the FCRA applies.
What does NOT qualify as a consumer report:
This distinction matters because it's what determines whether FCRA obligations apply. An employer who calls a reference themselves is not producing a consumer report. An employer who hires a background screening company to conduct those same reference interviews is — and the additional requirements for investigative consumer reports apply. See the section below on the difference between consumer reports and investigative consumer reports.
A Consumer Reporting Agency is any company that regularly assembles or evaluates consumer information for the purpose of furnishing consumer reports to third parties. Under the FCRA, a company doesn't need to call itself a "background check company" or a "credit bureau" to be a CRA. The FTC has confirmed that even if a company doesn't think of itself as a consumer reporting agency, it may be one if it provides information about people to employers for use in hiring or other employment decisions.
PBSA-accredited screening providers like Bchex are CRAs — they compile criminal records, employment verifications, and other screening data and deliver it to employers for use in employment decisions. That's the definition. And it means both the CRA and the employer using the report have obligations under the FCRA.
An investigative consumer report (ICR) is a specific type of consumer report that goes beyond records and databases. The FCRA defines it as a report in which information on a consumer's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, associates, or others who know the individual.
The practical difference: a standard consumer report is compiled from records — criminal databases, court records, credit files, employer data. An investigative consumer report is compiled partly or wholly from interviews with people who know the subject — a reference who is asked about a candidate's judgment and character, a former supervisor interviewed about performance and reliability, or a neighbor asked about conduct at home.
Employment verification that stays factual — confirming job titles and dates — is generally a standard consumer report. Employment verification that asks a former employer about the candidate's character, reliability, or judgment is likely an investigative consumer report.
Why the distinction matters: Investigative consumer reports carry additional FCRA obligations beyond those for standard consumer reports. Under FTC guidance, employers using investigative reports must:
These requirements are in addition to — not instead of — the standard FCRA disclosure and authorization requirements. Failing to provide ICR-specific notice when one is obtained is a separate FCRA violation from failing to provide standard disclosure.
Any time an employer obtains a consumer report from a CRA for employment purposes, the FCRA requires the following:
Step 1: Written disclosure. Before ordering the report, the employer must provide the candidate with a clear, standalone written disclosure that a consumer report may be obtained. The disclosure must be a separate document — it cannot be embedded in an employment application, buried in an offer letter, or cluttered with other information. The $600,000 class action referenced earlier arose from a disclosure form that included a single extraneous footnote. That's the standard of clarity the FCRA requires.
Step 2: Written authorization. The employer must obtain written consent from the candidate before ordering the report. This must be a separate authorization — not just a general agreement to the application process.
Step 3: Certification to the CRA. Before the CRA delivers the report, the employer must certify that it has followed the FCRA disclosure and authorization requirements, that the report will only be used for lawful employment purposes, and that it will follow adverse action procedures if required.
Step 4: Pre-adverse action notice. If the employer is considering taking adverse action — declining to hire, failing to promote, reassigning, or terminating — based on the consumer report, it must first send the candidate a pre-adverse action notice that includes: a copy of the report, a copy of the FTC/CFPB's "Summary of Your Rights Under the Fair Credit Reporting Act," and a reasonable waiting period (commonly five business days) for the candidate to review and dispute the information.
Step 5: Adverse action notice. After the waiting period, if the employer proceeds with the adverse action, it must send a final adverse action notice informing the candidate of the decision, the name and contact information of the CRA that provided the report, a statement that the CRA did not make the hiring decision, and a notice of the candidate's right to dispute inaccurate information with the CRA within 60 days.
Skipping or shortcutting any of these steps is an FCRA violation. The most common employer failures are: providing disclosure inside the employment application rather than as a standalone document, taking adverse action before completing the pre-adverse notice sequence, and failing to provide the Summary of Rights with the pre-adverse notice. For a step-by-step walkthrough of the complete adverse action process, see our FCRA compliance guide.
The consumer — the candidate or employee whose report was obtained — has specific rights under the FCRA that employers must respect and facilitate:
These rights are not theoretical — they are enforced, and class action litigation on behalf of candidates who weren't provided their rights under the FCRA is active and growing.
The practical implication for employers is straightforward: if a third party is involved in assembling information about a candidate for use in a hiring decision, assume the FCRA applies and build your process accordingly.
This means:
For employers with multi-state operations, state laws add additional layers — many states have their own consumer protection laws that go further than the federal FCRA.
Bchex is a PBSA-accredited Consumer Reporting Agency. Every report Bchex delivers is a consumer report under the FCRA — which means the full compliance framework applies to every order: disclosure, authorization, adverse action workflows, candidate rights documentation, and dispute handling.
Bchex's platform automates the disclosure and authorization step — candidates receive and sign compliant, standalone disclosure documents before any check is initiated. When a report comes back with a flag that may support adverse action, the platform guides employers through the pre-adverse and adverse action notice sequence — including generating the required notices and tracking the waiting period before a final decision is made.
For employers who aren't certain whether their current process is FCRA-compliant, the FCRA compliance guide walks through every step. And for employers evaluating background check providers, PBSA accreditation is the most reliable indicator that the CRA's own processes — data sourcing, accuracy standards, dispute handling — meet an independently audited standard.
A consumer report is any communication from a Consumer Reporting Agency that bears on a person's creditworthiness, credit standing, character, general reputation, personal characteristics, or mode of living — used to evaluate them for employment, credit, housing, or insurance. In the employment context, this covers criminal background checks, employment and education verification, credit checks, MVR reports, drug tests, and third-party social media screening reports. The full definition is in 15 U.S.C. § 1681a.
Yes — when a drug test is coordinated through a third-party provider and the results are used in an employment decision, the results constitute a consumer report under the FCRA. Written disclosure and authorization are required before testing, and the adverse action process applies if the employer takes action based on a positive result.
A standard consumer report is compiled from records — criminal databases, court records, credit files, employer data. An investigative consumer report is compiled partly or wholly from personal interviews with people who know the subject — references, neighbors, former colleagues asked about character and judgment. Investigative consumer reports carry additional FCRA disclosure obligations including written notice within three days of requesting the report and the candidate's right to request additional disclosures about the scope of the investigation.
FCRA violations carry statutory damages of $100 to $1,000 per violation, plus actual damages, punitive damages for willful violations, and attorney's fees. In class action litigation — where multiple employees or applicants were affected by the same procedural failure — these amounts multiply rapidly. Multi-million dollar settlements are not uncommon. Common violations include disclosure forms that aren't standalone documents, taking adverse action before completing the pre-adverse notice sequence, and failing to provide the Summary of Rights.
Yes. The FCRA applies to consumer reports used in any employment decision — including promotion, reassignment, retention, and termination — not just pre-hire screening. If you're running a background check on an existing employee through a third-party CRA, the same disclosure and authorization requirements apply. Rescreening existing employees without fresh consent is a common compliance gap.
No — the FCRA is triggered by the use of a Consumer Reporting Agency. If an employer personally calls a reference, searches public court records, or conducts its own research without using a third-party CRA, the FCRA does not apply to that specific activity. However, if any third party — including a vendor, a private investigator, or a background check platform — is involved in assembling that information, the FCRA likely applies.
The Summary of Rights is a document published by the Consumer Financial Protection Bureau (CFPB) that outlines a consumer's rights under the FCRA — including the right to dispute inaccurate information, the right to a free copy of their report, and the right to know when a consumer report was used against them in an adverse decision. Employers are required to provide this document to candidates as part of the pre-adverse action notice. PBSA-accredited screening providers include it automatically.
The FCRA's definition of a consumer report is broader than most employers realize — and the obligations that attach once something qualifies are specific, non-negotiable, and actively enforced. Criminal background checks are the most obvious example, but employment verifications, drug tests, MVR reports, credit checks, and third-party social media screening reports all qualify. The moment a third party is compiling information about a candidate for your employment decision, the FCRA's disclosure, authorization, and adverse action requirements apply. Building those steps into your hiring process isn't optional — and a well-configured screening platform with a PBSA-accredited provider handles most of it automatically.
Ready to build a screening program with FCRA compliance built in? Explore Bchex Core Screening — PBSA-accredited, with automated disclosure, consent, and adverse action workflows on every order.