Program design · 11 min read

Contractor and staffing screening

When an agency, a PEO or a vendor sits between the employer and the worker, the statutory duties do not split along the contractual lines. The contract allocates cost, not obligation.

Three parties, and a statute written for two

The FCRA's employment provisions are drafted around a simple shape: an employer wants to know something about an applicant, obtains a report, and may act on it. Two parties, one sequence.

Contingent staffing breaks that shape. There is a staffing agency that employs the worker and runs payroll, a client that controls the day to day work and can ask for the worker to be removed, and sometimes a managed service provider or a PEO layered between them. A background check in that arrangement can be ordered by any of them, paid for by a different one, and acted on by a third.

The statute does not have a provision for this. It does not say that duties are allocated by contract, and it does not say they are allocated by who employs the person. What it does is attach specific duties to specific roles, and in a three-party arrangement those roles are frequently filled by two different companies. Everything difficult about contingent screening follows from that.

The two roles, and what attaches to each

Read the employment provisions together and they resolve into two roles.

The person who procures the report owes the duties in §1681b(b). That means the clear and conspicuous standalone disclosure and the written authorization before the report is obtained, under (b)(2). It also means making the certification to the consumer reporting agency under (b)(1), which is where the procurement duties get teeth: the agency may furnish an employment report only if the person obtaining it certifies that the disclosures were made and the authorization obtained, that the information will not be used in violation of any federal or state equal employment law, and that the user will comply with the notice requirement in (b)(3).

The person who takes the adverse action owes the duties in §1681b(b)(3) and §1681m(a): the copy of the report and the rights summary before the decision becomes final, and the final notice naming the agency after it does. That obligation attaches to taking the action based in whole or in part on the report, not to having ordered it.

In an ordinary hire both roles sit in one company, which is why the sequence is normally described as a single process. In contingent staffing they can split, and the split is the whole subject.

The two arrangements

Most contingent screening runs in one of two ways, and they produce different answers.

The agency procures, and the agency decides

The agency obtains the report, reviews it, and makes the decision about whether to hire or retain the worker. The client never sees the report, only the outcome.

This is the clean case. The agency holds both roles, so it owes the whole sequence: the disclosure and authorization, the certification to the agency it buys from, the pre-adverse notice with the report and the rights summary, the waiting period, and the final notice. The client owes nothing under the FCRA, because it neither procured the report nor took the decision on it.

The thing that breaks this case is informal practice. A client that asks to see the report before the worker starts, or that asks what the agency found, has changed the arrangement, and the more often it does so the less the written process describes what is happening.

The client procures, or the client decides

The report may be obtained by the agency but shared with the client, or the client may obtain its own. The client then decides whether to accept the worker, whether to keep them on the assignment, or whether to ask for them to be removed.

Now the roles have split. The client is the person taking adverse action, and §1681b(b)(3) applies to it. The sequence has to run with the client as the sender, or with the agency running it on the client's behalf and on the client's account. Either is workable. What is not workable is the assumption that the agency's process covered it, because the agency's process was about the agency's decision and there may not have been one.

There is a further wrinkle worth naming. Where the client receives the report, the client has also obtained a consumer report, and obtaining one requires its own permissible purpose. Employment purposes under §1681b(a)(3)(B) requires that the report be used for employment purposes, which brings the disclosure and authorization duties with it. A client that takes a report from an agency without its own authorization is relying on paperwork it did not collect.

The label does not control the answer

Everything above assumes the worker is an employee of somebody. When the worker is engaged as an independent contractor, the analysis changes, because the FCRA reaches workers through a definition that is written around employment.

§1681a(h) defines employment purposes as a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee. On the adverse action side, §1681a(k)(1)(B)(ii) covers a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee. Both are framed around employees.

The other items in that definition do not pick up the slack. Item (i) is insurance underwriting, item (iii) is licenses and benefits under §1681b(a)(3)(D), and item (iv) is determinations connected to a consumer-initiated application, transaction or account review. None of them describes a decision about whether to engage an independent contractor.

So for a genuine independent contractor the employment-specific duties may not attach at all, and the report is obtained under a different permissible purpose. The common route is the worker's own written instruction under §1681b(a)(2), which is why contractor screening forms are usually framed as the worker authorizing the check rather than as an employer disclosure. A legitimate business need under §1681b(a)(3)(F) can also apply. Neither route brings the standalone disclosure or the pre-adverse notice with it.

The point that matters, and the one that gets lost, is that this turns on the substance of the engagement and not on the words in the contract. Calling someone a contractor and paying them on a 1099 does not make them one, and a worker who is in fact an employee is inside the definition whatever the agreement says. The tests for that are the ordinary classification tests, they vary by jurisdiction, and a business that has built a screening process on the assumption that its contractors are contractors has built it on a conclusion it has not tested.

The practical rule that follows is deliberately unsubtle. Where the classification is arguable, run the employment sequence: disclosure, authorization, pre-adverse notice with the report and the rights summary, waiting period, final notice. For a genuine contractor this is unnecessary, and the cost of it is a few days and one extra signature. For a mislabelled employee it is the difference between a defense and an argument about a definition conducted after the decision has already been made. There is no version of this where the cheaper option is the risky one.

The contract decides who pays, not who owes

This is the part clients find most unwelcome, and it is worth being exact about.

A contract between a staffing agency and a client can say that the agency is responsible for all FCRA compliance, that the agency indemnifies the client for any claim, and that the client has no obligations in respect of background checks. Those clauses are enforceable between the two companies and they are worth having. What they cannot do is remove a duty the statute places on the client.

If the client takes adverse action based on a report and no notice was sent, the worker has a claim against the client if the client is a proper defendant, and the fourth clause of the services agreement is not a defense to it. The clause converts the client's loss into a claim against the agency, which is not the same as not having the loss. It also does nothing about the claim itself, the demand letter, the time, or the fact that the client's name is on the notice that was never sent.

What actually protects a client in this arrangement is knowing which of the two roles it holds for each decision, and having the process that matches. The contract should say which party sends the pre-adverse and adverse notices, which party holds the authorization, which party responds when a worker disputes, and how the client tells the agency that it is removing someone and why. That last one is the operational hinge: if the reason never leaves the client, the agency cannot run the sequence on the client's behalf, and nobody does.

Where a PEO or an employer of record changes the answer

A PEO or an employer of record arrangement is sometimes described as removing the client from the employment relationship altogether. That is a description of the payroll and benefits relationship, not of the FCRA analysis. The question under the statute is who procured the report and who took the adverse action, and a client that decides a worker should not return to its site has taken adverse action whatever the PEO does with the paperwork.

There are arrangements where the PEO or the agency genuinely holds both roles and the client has no decision to make, only a shift to fill. Those exist, and in them the analysis really does sit with the agency. The test is whether the client can say no to a particular worker. If it can, it is deciding, and the duties follow the decision.

Investigations, and the exclusion that does not cover this

There is an exclusion at §1681a(y) for an employer investigating suspected misconduct, and it is sometimes reached for in contingent arrangements when a client wants to look into something about a worker on its site. The conditions are set out in the consumer reporting agency article, and the short version is that it covers an investigation of suspected misconduct, not a routine check that happened to find something.

It is a poor fit here for a reason specific to the three-party case. The exclusion runs to a communication made to an employer investigating misconduct relating to employment. A client investigating a worker it does not employ is in an awkward position to claim it, since the exclusion is framed around the employment relationship and the client has spent the rest of the contract arguing that it is not the employer. The two positions are difficult to hold at once.

What we do

We furnish reports into contingent arrangements, and we will furnish them to whichever party holds the procurement role, provided the certification is made by that party. We do not accept a certification made on someone else's behalf, because the certification is a statement by the person procuring the report and it cannot be delegated to a company that is not making it.

Where a client and an agency are dividing the roles, we will document which party we are furnishing to and which party the notices will come from, so that the split is recorded before a decision is made rather than reconstructed afterwards. That record is cheap and it is the thing that settles the argument about who was responsible.

The policy template and the retention schedule in the toolkit both carry contingent worker sections, including the authorization language for a worker whose engagement is not employment.

Sources

• 15 U.S.C. §1681a(h) (definition of employment purposes)
• 15 U.S.C. §1681a(k)(1)(B) (adverse action definitions)
• 15 U.S.C. §1681a(f) (definition of consumer reporting agency)
• 15 U.S.C. §1681b(a)(2) (written instructions of the consumer)
• 15 U.S.C. §1681b(a)(3)(B) and (F) (permissible purposes)
• 15 U.S.C. §1681b(b)(1), (b)(2), (b)(3)
• 15 U.S.C. §1681m(a) (adverse action notice)
• FTC, Using Consumer Reports: What Employers Need to Know

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.