FCRA compliance guide for employers

1. Have a permissible purpose

The FCRA lets employers obtain a consumer report, which includes a background check from a consumer reporting agency, for "employment purposes": evaluating a person for hiring, promotion, reassignment or retention. Before a consumer reporting agency will provide reports, you must certify that you'll use them only for that purpose and that you'll follow the FCRA's disclosure, authorization and adverse action rules.

The FCRA applies to independent contractors and volunteers too, not just employees, whenever a report is used to decide whether to engage them.

2. Give a standalone disclosure

Before ordering a report, tell the candidate in writing that you may obtain a consumer report for employment purposes. The disclosure must be clear and conspicuous and in a document that consists solely of the disclosure. Courts have found that extra content, such as liability waivers, state notices or unrelated terms, can violate this "standalone" requirement.

• Keep the disclosure short, plain and on its own page.
• Present state-specific notices separately rather than mixing them into the federal disclosure.
• If the report may include interviews with references (an investigative consumer report), say so and explain the candidate's right to ask about the nature and scope of the investigation.

3. Get written authorization

You also need the candidate's written authorization before the report is obtained. An electronic signature counts when it's collected properly. Keep evidence of it: who signed, what they signed and when.

Give candidates A Summary of Your Rights Under the Fair Credit Reporting Act, published by the CFPB, with the disclosure.

4. Follow state and local rules

Many states and cities add to the FCRA. The most common additions are:

• Fair-chance and ban-the-box laws limit when you may ask about or check criminal history. California and Hawaii allow it only after a conditional offer; Illinois, Minnesota and Washington, only after you've determined the candidate is otherwise qualified. Cities such as New York City, Los Angeles, San Francisco and Philadelphia have their own rules.
• State disclosures and notices, such as California's Investigative Consumer Reporting Agencies Act notice and New York's Article 23-A.
• Free-copy rights: in California, Minnesota and Oklahoma, candidates must be offered a free copy of their report.
• Longer waiting periods and assessment requirements before adverse action based on conviction history, for example in California and New York City.

Which rules apply usually depends on where the job is located and, sometimes, where the candidate lives.

5. Evaluate results fairly

A report with records isn't a decision. The EEOC's guidance on arrest and conviction records recommends against blanket exclusions and encourages an individualized assessment that considers:

• the nature and gravity of the offense;
• the time that has passed since the offense or the end of the sentence; and
• the nature of the job, including its duties and environment.

Give candidates a chance to share context, such as evidence of rehabilitation, and keep criminal history with the people who make decisions rather than everyone involved in hiring.

6. Follow the adverse action process

If you may decide not to hire, or to take other adverse action, based in whole or in part on a report, the FCRA requires two steps.

Before the decision: pre-adverse action notice

• Send the candidate a copy of the report and A Summary of Your Rights Under the FCRA.
• Wait a reasonable period before deciding, so they can review the report and dispute errors. Five business days is common; some states and cities require longer.

After the decision: adverse action notice

Tell the candidate, orally, in writing or electronically:

• that you took adverse action based on the report;
• the name, address and phone number of the consumer reporting agency;
• that the agency didn't make the decision and can't explain why it was made;
• their right to dispute the accuracy or completeness of the report with the agency; and
• their right to a free copy of the report from the agency within 60 days.

7. Keep records and protect data

Keep disclosures, authorizations, notices and decisions with each check. Claims under the FCRA can be brought up to five years after a violation, so many employers keep screening records for at least that long. Background reports contain sensitive information: limit who can see them, and dispose of them securely when you no longer need them.

How eScreenly helps

• A standalone FCRA disclosure, with state notices on their own pages for the job's state and the candidate's home state.
• E-signed authorization, with the signature, time, IP address and device kept as evidence.
• Fair-chance certifications before criminal searches in California, Hawaii, Illinois, Minnesota and Washington, stored with each order.
• A free-copy request for every candidate, and results visible only to the people on your team who decide.
• Reports limited to reportable information, with a reminder of the adverse action steps when a report needs review.

Employers remain responsible for their own compliance, including sending adverse action notices.