Compliance · 24 min read

Adverse action notices

Two notices, one undefined waiting period, and a rule everyone quotes but almost nobody can source. Here is the whole sequence, including the parts that are conventions rather than law.

What counts as adverse action

Adverse action, for employment purposes, is a negative decision about someone that was based in whole or in part on a consumer report. The four words carry most of the weight. A decision does not have to rest on the report alone; it is enough that the report contributed to it.

In practice that reaches further than most employers expect. Refusing to hire, withdrawing an offer, denying a promotion, declining a transfer, removing someone from a schedule, and terminating employment all count. So does declining to place a candidate with a client, which is the case staffing firms meet most often.

The phrase has a second life elsewhere. In discrimination law an “adverse employment action” is a materially adverse change in the terms or conditions of employment, and that body of case law is Title VII and has nothing to do with screening reports. The two get tangled in search results constantly. Everything on this page is about the FCRA meaning.

The two notices, and the two statutes behind them

Every vendor page describes a “two-step process.” That framing is accurate and it hides the thing that generates litigation, which is that the two steps come from two different sections of the statute, with different required contents, and satisfying one has never satisfied the other.

Step one: §1681b(b)(3), before you act

Before taking adverse action based in whole or in part on a consumer report, the employer must provide the consumer with a copy of the report and a description of their rights under the FCRA in writing. The purpose is stated in the legislative history and repeated in the FTC's guidance: it gives the person a chance to review what the report says and tell you if it is wrong, before the decision becomes final.

This is the notice the industry calls the pre-adverse action notice. Note what it does not require: no particular number of days, no particular delivery method, and no requirement that the decision be described. It requires the report and the rights summary, in writing, in advance.

Step two: §1681m(a), after you act

If adverse action is taken based in whole or in part on the report, the employer must then notify the consumer. This notice has its own content requirements, and they are different:

• the name, address and telephone number of the consumer reporting agency
• a statement that the agency did not make the decision and cannot give the specific reasons for it
• notice of the right to dispute the accuracy or completeness of the information with the agency
• notice of the right to a free copy of the report from the agency, if requested within 60 days

This one is required at the point of decision, not before it, and it may be delivered orally, in writing, or electronically.

Why the two are not one step

The obvious and frequently asked question is whether complying with step one makes step two unnecessary. The FTC was asked directly in 1997 and said no.

The opinion letter to Weisberg, dated 27 June 1997, rejected the redundancy argument. The Commission found the duplication may well be intentional, and that the post-decision notice serves to highlight two rights that the pre-decision package does not: the right to a free copy of the report within 60 days, which matters because a credit file routinely changes and the copy supplied beforehand does not answer for the file two months later, and the right to dispute inaccurate or incomplete information. A later letter to Solganik, on 23 October 1997, confirmed the same reading from the other direction: §1681b(b)(3) alone is not enough for §1681m, nor the reverse.

Solganik adds the practical relief. The two notices may be combined into a single document, provided everything both sections require is in it. So the sequence is two communications, not necessarily two pieces of paper, and an employer who wants to minimize duplication is permitted to.

Where the five business day rule comes from

This is the most repeated number in the field and the least examined. Search for adverse action and nearly every result will tell you to wait five business days between the two notices. Almost none of them will tell you where the figure comes from, and the reason is that it comes from somewhere less solid than the tone of those pages suggests.

It comes from a set of FTC staff advisory opinions issued in 1997 and 1998. The statute says only that the report and rights summary must be provided “in advance” of the action. It sets no period. So employers asked the Commission's staff what “in advance” meant, and the staff answered case by case:

• Weisberg (27 June 1997) asked whether §604(b)(3) compliance removed the need for §615(a) disclosures. The answer was no, as above, and in the course of it the staff said five business days from the date of the pre-adverse notice appeared reasonable.
• Hawkey (1997) and Coffey (1998) framed the purpose the waiting period serves: letting the consumer discuss the report, or otherwise respond to it, before action is taken.
• Lewis (1998) said the wait will vary depending on the circumstances, including the nature of the job and how the employer operates. That is the letter that pulls against reading five days as a fixed rule.
• Rosen (1998) confirmed the duty applies even where the report data would automatically disqualify the person under the employer's own policy. A policy that decides the outcome by itself does not remove the sequence.

What follows from that

Two things, and they point in opposite directions depending on how much you want to argue.

The first is that five business days is not a safe harbor. Waiting five days does not make a process lawful if the notice went out by a method the candidate never received, if it omitted the report, or if the decision had already been communicated. Compliance is about whether the person actually got a meaningful chance to respond, and the day count is a proxy for that rather than the thing itself.

The second is that there is no rule that says five days is enough, so a process built to the minimum is exposed. The vendor who defaults to ten business days does so for a reason worth borrowing: at ten days you exceed every statutory window in the country, and the counting argument drops out of an audit entirely. That is a real cost saving for the employer who does it, paid for in ten days of a vacancy.

The middle path most published guidance lands on, five to seven business days, is the honest read of an undefined standard, and it is worth understanding it as a hedge rather than as a rule.

Counting the days, and proving the count

Almost every page says five business days without saying from when. That omission is where the exposure lives, because the case law turns on receipt.

In Beverly v. Wal-Mart (E.D. Va. 2008) the employer sent the report and rights summary on 1 September and the adverse action notice on 6 September. The court found that too soon, and the reason was the calendar: Labor Day fell in the interval and mail delivery took time out of it. Five days on the wall was not five days of opportunity.

In Johnson v. ADP Screening (D. Minn. 2011) the gap ran from 11 February to 25 February, ten business days, and the court found that gave ample opportunity to dispute.

So the operative question is not how long you waited but what the candidate had. Two consequences follow for how a process is built.

• Start the clock at receipt, not at sending. If the notice goes by post, you do not know when it arrived, and the honest answer is that you cannot prove the window ran at all. Where the notice is delivered electronically, receipt can be evidenced, which is a strong argument for electronic delivery on a recorded channel.
• Business days are not weekends, and they are not holidays either. Which holidays depends on where you are. Federal holidays are not business days for this purpose. State holidays are a live question and the answer varies, which is one more reason to give margin rather than count exactly.

California adds its own wrinkle. The clock runs from the candidate's receipt rather than from mailing, and the regulations create a presumption that frames a mailed notice in a particular way. New York City runs its own clock from the day after receipt and skips weekends and federal holidays. Both are described in the fair chance section below, because both arise under local law rather than federal.

The five, seven and ten day divergence, explained

Vendors disagree about the waiting period, publicly and often. Rather than pick one and assert it, here is who says what, because the disagreement is itself the information.

The divergence has four causes and none of them is disagreement about the law, because there is no law to disagree about.

Different assumptions about receipt. A vendor counting from sending and a vendor counting from receipt are not describing the same interval. Five days from sending is a shorter window than five days from receipt, and the two recommendations can both be reasonable while producing different calendars.

Different risk tolerances. A vendor selling an automated workflow has an interest in a short default, because the wait is dead time in their customer's hiring process. A vendor selling compliance has an interest in a long one.

State overlays pulling the number up. California extends to ten business days where the candidate disputes the accuracy of a conviction record. New York City requires three business days from receipt of its own Fair Chance Notice, Seattle two, and neither is a five day rule. So the national default has to be at least the longest applicable state window, which is why several vendors land above five.

None of them is a safe harbor. This is the part worth holding on to. Five, seven and ten are all defensible readings of an undefined standard, and any of them can fail if the notice did not reach the candidate or did not contain what the statute requires.

What the pre-adverse notice must contain

• A copy of the consumer report you relied on.
• A description of the consumer's rights under the FCRA. In practice this means the CFPB's Summary of Consumer Rights, and the currency question is dealt with below.
• Anything a state or local jurisdiction adds. Several require the notice to identify the specific record at issue, and some require the reasoning.

Two details that matter and are easy to miss. The attachments belong on separate pages from the notice itself, which appears nowhere in the statute but is stated in the client-facing guidance the largest screening companies give their customers, and it exists so that the notice is legible as a notice rather than buried inside a report. And the notice should not be accompanied by verbal communication that suggests the decision is already made; the same guidance warns that extraneous conversation with the candidate at this stage can undermine the written notices.

What the final notice must contain

• the CRA's name, address and telephone number
• a statement that the CRA did not make the decision and cannot explain the reasons for it
• notice of the right to dispute accuracy or completeness with the CRA
• notice of the right to a free report from the CRA within 60 days

That third-party statement is the one that gets dropped, and it is the one that protects the screening company as much as the employer. It exists so that a rejected candidate who telephones the screening company is told, in advance and in writing, that the screening company cannot tell them why. Without it, calls arrive at a company that has no answer.

Who sends which notice

The employer sends both notices. This is stated by every vendor and it is correct, but it is worth understanding why the question keeps being asked. Screening companies supply templates, populate them with the report, and send them on the employer's behalf. That automation makes it feel like a service being performed, and it is not a duty being transferred.

The obligation is the employer's, it is not delegable, and a screening company that operates the workflow does so as the employer's agent. If the sequence fails, the employer is who the claim is brought against, and the screening company is named separately for its own duties, which are different ones.

While a dispute is open

The candidate's right to dispute runs to the screening company, not to the employer, and the investigation has a statutory clock. Under §1681i the agency must reinvestigate and record the current status of the disputed information, generally within 30 days, and §1681i(a)(2)(B) provides a 15 day extension where the consumer supplies additional relevant information during the period.

Here is the point almost every page skips. A dispute does not toll the FCRA waiting period. There is nothing in the statute that stops the clock while an investigation runs. But the practical answer is that the clock should be paused anyway, and the reason is the entire purpose of the process: if the candidate has told you the record is wrong and you proceed to a final decision before the agency has finished determining whether it is wrong, you have taken adverse action on information that may be inaccurate, and you have done it with notice of the doubt. That is a bad fact pattern, and it is a worse one when the final notice goes out the same week the dispute was filed.

So the operating rule is to hold the position until the reinvestigation concludes or the statutory period runs out, and to document that you did. Where a dispute produces a corrected report, the sequence generally starts again from the corrected information, because you are now relying on something different.

One question has no clean answer and it is worth knowing that in advance: what to do if the dispute is still open when the reinvestigation period expires. The statute does not say. It is a decision for counsel on your own facts, and an article that pretended otherwise would be inventing a rule.

Delivery, receipt, and the notice that cannot be delivered

The FCRA permits the final notice orally, in writing, or electronically, and the FTC's guidance says so explicitly. Electronic delivery is therefore available and it is also the only method that produces reliable evidence of receipt, which makes it the right default for the same reason it is convenient.

What to retain is covered below. What to do when delivery fails is not covered anywhere, and it is a live operational hole for any employer with a high volume or frontline workforce. An emailed notice to an address that bounces is not a notice, and a process that has no step for the bounced case will eventually produce a decision that rests on a document the candidate never saw.

The defensible approach is to treat a failed delivery as a stop rather than a warning: try the secondary channel, document the attempts, and where no channel works, make a reasoned decision and record what was tried. That is not a statutory procedure because the statute does not provide one. It is the record you would want to be holding if the question were ever asked.

How long to keep all of it

The FCRA sets no retention period for adverse action records. Anyone who tells you it does has confused it with the seven year reporting limits in §1681c, which govern what a screening company may report, not what an employer must keep. This is one of the more common conflations in the field.

The duty comes from elsewhere, and it is a stack rather than a single rule:

• One year, from the EEOC. 29 CFR §1602.14 requires employment records relevant to a charge of discrimination to be kept for one year from the date the record was made or the personnel action was taken, whichever is later.
• Two years, for some employers. The same section extends the period to two years for state and local governments, educational institutions, and federal contractors and subcontractors with 150 or more employees or a government contract of $150,000 or more under Executive Order 11246.
• Until final disposition, if a charge is filed. Once a discrimination charge or a lawsuit is pending, the retention obligation runs until the matter reaches final disposition rather than to a date.
• Other floors apply to parts of the file. Payroll records carry a three year floor under the FLSA. OSHA logs have their own period. Form I-9 is retained for three years after hire or one year after termination, whichever is later.

The practical figure most compliance-minded employers land on is seven years for the adverse action file specifically, which exceeds every floor above and matches the period that the FCRA allows a screening company to report most adverse information. Seven is a convention rather than a requirement, for the same reason five is.

What matters more than the number is what is in the file, because the point of the file is to be reproducible two years later when nobody remembers the case. The toolkit article sets out a retention schedule as a document you can adapt. The short list is: both letters as delivered, the delivery method and its timestamps, the receipt evidence, the version of the rights summary that was enclosed, who made the decision, and any dispute with its reinvestigation result.

When the report is a credit report

This section is the one nobody publishes, and it matters to anyone who runs a credit check on a role that involves money.

If you are a lender as well as an employer, and a screening decision touches a credit report, a second federal statute joins the sequence. The Equal Credit Opportunity Act, implemented by Regulation B at 12 CFR 1002.9, imposes its own adverse action notice duty, with its own contents and its own timing. That regime is about credit applicants rather than employees, and it contains no five business day rule anywhere.

The two regimes do not satisfy each other, and this is written down explicitly. Comment 9(b)(2)-9 to §1002.9 spells out the relationship:

• Regulation B requires a statement of the principal reasons for the decision, and citing internal standards or a failure to reach a qualifying score is not sufficient.
• The FCRA requires disclosure where the decision was based in whole or in part on information from a third party.
• Saying only that a credit report was obtained and used does not satisfy Regulation B.
• The FCRA's credit score and key adverse factor disclosure does not satisfy Regulation B either.

Appendix C to Regulation B carries Forms C-1 through C-5, which combine both sets of disclosures in one document. If you are in the position where both statutes apply, that is the form family to start from rather than either statute's notice alone.

Two state restrictions are worth knowing about even if you never make a credit decision, because they restrict the check rather than the notice. California permits an employment credit check only for certain categories of role, including managerial positions, roles with access to financial or asset information, law enforcement, and fiduciary or trade-secret-exempt positions, and the exemption relied on has to be identified on the authorization. New York State has its own restriction regime with narrow exceptions. These are described in the state guides.

What it costs when it goes wrong

Under §1681n a willful violation carries actual damages or statutory damages of between $100 and $1,000 per violation, whichever the plaintiff elects, plus punitive damages at the court's discretion and attorney's fees. Negligent violations under §1681o carry actual damages and fees. The statutory range is what makes the arithmetic dangerous: a per-violation figure applied to a class is a large number before anyone has proved a dollar of harm.

The recent record bears that out. A class action against a national carrier settled for $5 million covering a class of roughly 14,915. A settlement against a staffing firm came to $2,258,909.85 with final approval in May 2025, working out to about $955.95 per class member against a $1,000 statutory maximum. A health care system settlement of $420,566 in 2024 included a separate subclass of about 111 people drawn from a class of about 13,149, which is the shape these cases take when the pre-adverse notice specifically is the defect. A pet retailer settled for $1.2 million in 2019. A screening company paid $2.6 million to the FTC in 2012 over accuracy, file disclosure and dispute investigation failures.

The mistakes that actually get made

• Sending both notices at once, or nearly at once. This is the failure the case law is most direct about. If the interval is short enough that no meaningful response was possible, the sequence did not happen. Automated workflows make this easy to do by accident, which is why the interval should be enforced by the system rather than by a person remembering.
• Omitting the report from the pre-adverse package. The notice is the smaller half of the requirement. §1681b(b)(3) requires the report itself, and it is the report that gives the candidate something to respond to.
• Using a superseded rights summary. Covered above, and it is a class-wide defect by construction.
• Never sending the second notice. The failure mode where the employer does the pre-adverse step diligently and then considers the matter closed. §1681m(a) is a separate duty and it does not lapse because the candidate did not respond.
• Treating a matrix as the decision. If the adjudication policy determines the outcome by itself, the notice sequence becomes a formality, and a formality is what a plaintiff will call it. The toolkit article deals with this directly.
• Undocumented verbal communication. Telling a hiring manager the role is going to someone else before the first notice goes out is the fact pattern that undermines everything sent afterwards.

What we do

Personnelgraph is a consumer reporting agency, which means the notices described here are the ones we generate for our clients and the dispute process described above is the one we run. We supply both notices populated with the report, the current rights summary, and the state and local riders that apply to the candidate's jurisdiction, and we operate the dispute channel.

What we cannot do is make the decision or send the notices in your name, for the reason set out above: the obligation is yours and it is not transferable. If that division is the part you want to talk through, book a demo and we will walk through how it works in practice.

Sources

• FTC, Using Consumer Reports: What Employers Need to Know
• FTC staff advisory opinion to Weisberg, 27 June 1997
• FTC staff advisory opinion to Solganik, 23 October 1997
• CFPB, 12 CFR 1002.9 (Regulation B, adverse action)
• CFPB, Summary of Consumer Rights, Appendix K to Part 1022
• 15 U.S.C. §1681b(b)(3) (disclosure before adverse action)
• 15 U.S.C. §1681m(a) (adverse action notice requirements)
• 15 U.S.C. §1681i (reinvestigation of disputed information)
• 15 U.S.C. §1681n and §1681o (civil liability)
• 29 CFR §1602.14 (EEOC record retention)
• FTC Disposal Rule, 16 CFR Part 682
• Beverly v. Wal-Mart Stores, Inc., No. 3:07-cv-587 (E.D. Va. 2008)
• Johnson v. ADP Screening & Selection Services, 768 F. Supp. 2d 979 (D. Minn. 2011)

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.