Compliance · 19 min read

FCRA compliance for employers

Adverse action is the part of the FCRA that gets written about, because it is where the settlements are. This is the other half: what you may order, what has to be signed first, and what the statute will not let a report contain.

The four duties, and the one everybody writes about

The FCRA imposes four separate kinds of obligation on an employer that runs background checks, and almost all published guidance collapses them into one. The collapse is not dishonest, but it hides the fact that three of the four have nothing to do with adverse action and would still apply to an employer who hired everyone who applied.

• Procurement. You need a permissible purpose, a disclosure that meets §1681b(b)(2), a written authorization, and you have to certify something to the agency before it will sell you the report.
• Content. §1681c limits what a report may contain at all. A report that includes something the statute forbids is a report you should not have been given, and acting on it is its own problem.
• Use. The adverse action sequence. This is the one that gets written about, and it has its own article.
• Records. What you keep, for how long, and how you dispose of it when the time comes. The schedule and the inventory are in the toolkit.

The rest of this page is the first two, plus the accuracy duty that sits behind them.

The FCRA reference sets out the statute section by section, and which of these duties fall to us rather than to you.

Permissible purpose, and why employment is the odd one out

A consumer reporting agency may not hand a report to anyone who asks. It may only furnish one for a purpose the statute lists, and for employment that is §1681b(a)(3)(B): a person who the agency has reason to believe intends to use the information for employment purposes.

“Employment purposes” is defined in §1681a(h) and it is wider than hiring. It means evaluating a consumer for employment, promotion, reassignment or retention. Promotion and reassignment are the two that get forgotten, and they are why running a check on an existing employee is not a favor you are doing yourself. See rescreening and post hire screeningfor that case.

Here is the part that makes employment unusual. Every permissible purpose gets an agency comfortable with releasing the report. Only employment comes with a duty on the user to go to the consumer first, before the report exists. Credit grantors, insurers and landlords do not have to tell you they are about to pull your file. An employer does.

That asymmetry is the reason the disclosure is treated as seriously as it is. It is not a consent form in the ordinary sense of the word. It is the price the statute charges for letting an employer look.

The disclosure that must consist solely of the disclosure

§1681b(b)(2)(A) sets three conditions before an employer may procure a report, and the middle one has generated more litigation than the rest of the section combined. The disclosure must be:

• clear and conspicuous;
• in writing, at any time before the report is procured;
• in a document that consists solely of the disclosure that a consumer report may be obtained for employment purposes.

“Clear and conspicuous” is familiar language from a hundred statutes. “Consists solely of the disclosure” is not, and it is the phrase that decides cases. It means what it says: the document carries the disclosure and nothing else.

How the courts have read “solely”

The Ninth Circuit has read it twice, against employers, and the two cases together describe the whole risk.

Syed v. M-I, LLC (2017) involved a disclosure form that also carried a liability waiver. The court held that “solely” unambiguously excludes other content, so the form failed, and that the failure was willful. The employer's argument that it had read the statute in good faith was rejected on the reasoning that the text was unambiguous, so there was nothing to interpret.

Gilberg v. California Check Cashing Stores (2019) is the more commercially important decision, because it establishes that Syed is not about waivers. Gilberg's form included disclosures required by other states, and the court held that any surplusage breaks the standalone requirement. It declined to read in exceptions Congress had not written, and observed that the extra material was at least as likely to confuse as to inform.

Gilberg also separated the two adjectives in a way worth remembering. A disclosure is conspicuous if it is readily noticeable, and clear if it is reasonably understandable. Gilberg's form was conspicuous and still failed, because a document that mixes federal requirements with four other states' rules is not reasonably understandable to the person signing it.

What may actually appear on it

The statute answers this more precisely than most summaries suggest. The disclosure document may carry the disclosure itself and the authorization, because §1681b(b)(2)(A)(ii) expressly permits the authorization to be made on the same document. That is the whole list.

So these belong on their own pages or in their own documents: your state law notices, the Summary of Consumer Rights, your drug testing policy, any arbitration agreement, at-will statements, and anything about how the screening company handles data. The instinct to produce one tidy packet is the instinct these cases punish, and the more jurisdictions you hire in, the stronger that instinct gets, because the state notices are the ones with the most pressure to consolidate.

One narrow exception worth knowing if you hire drivers. Where the position is subject to regulation by the Secretary of Transportation, and the only contact with the applicant was by mail, telephone or computer, §1681b(b)(2)(B) replaces the written disclosure with a notice in any form and allows oral consent. It is a real exception and it is a narrow one, and it does not apply to a driver who walked into a depot and filled in a form.

The authorization is a separate thing that may share a page

The authorization is the second half of the pair. It must be in writing, and the statute contemplates it sitting on the disclosure document, which it permits by name. Where employers get into trouble is not the authorization itself but its surroundings: a signature line buried in a stack of onboarding paperwork, or a clause that reads as a general release rather than a permission to procure a specific kind of report.

Two practical points. First, the authorization should identify the type of report being authorized, because an authorization to obtain a consumer report is not naturally an authorization to obtain an investigative consumer report, which is a different animal and is covered below. Second, an electronic signature satisfies “in writing” under the federal E-SIGN Act and its state equivalents, which is how nearly every applicant tracking system does it, but the consent to do business electronically has to be its own separate step rather than another line on the form.

The certification you send the agency

Nothing in §1681b(b)(2) applies to the agency. What applies to the agency is §1681b(b)(1), which says it may not furnish a report for employment purposes unless the user certifies that it will use the information for employment purposes and no other, that it will not use it in violation of any federal or state equal employment opportunity law, and that it will comply with §1681b(b)(2) and (b)(3).

It is easy to treat that certification as a click-through. It is a representation you make, and the second clause of it is the one that matters on this page, because it is the point where the FCRA and the EEOC's position on criminal records touch. Certifying that you will not use a report in violation of equal employment opportunity law is a promise about your adjudication process, made before you have seen a single report.

The seven year limits, paragraph by paragraph

§1681c(a) is a list of things a consumer reporting agency may not put in a report, with a time limit on each. The whole thing is short enough to state, which is worth doing because the summary versions in circulation tend to flatten it into “seven years for everything”.

• Bankruptcies. Ten years, running from the order for relief or the date of adjudication. The only item with a ten year window.
• Civil suits, civil judgments, and records of arrest. Seven years from the date of entry, or until the governing statute of limitations has expired, whichever is longer. That “whichever is longer” is unique to this paragraph and means a judgment can stay reportable past seven years where the limitation period runs longer.
• Paid tax liens. Seven years from the date of payment, not from the date the lien was filed.
• Accounts placed for collection or charged to profit and loss. Seven years.
• Any other adverse item of information, other than records of convictions of crimes. Seven years.

There is also a sixth paragraph about medical information that does not arise in employment screening and is best left to the statute.

Note who the prohibition binds. It is addressed to the consumer reporting agency, not the employer, so the employer's exposure is not a direct violation of §1681c. It is that you asked for, received and then acted on a report containing an item the agency should never have included, which is a different and worse position to explain. The practical form of the duty is to know which items your package requests and why, and to notice when a vendor's default package asks for more than the statute allows.

Why convictions are not among them

Look again at the last two paragraphs above, because the difference between them is the single most misread pair of sentences in employment screening.

Paragraph (2) covers records of arrest and caps them at seven years. Paragraph (5) is the catch-all, and it says “any other adverse item of information, other than records of convictions of crimes”. The exception clause is doing all the work. A conviction is expressly removed from the seven year limit, which means that under federal law a conviction has no time limit at all. A twenty year old felony is reportable. A misdemeanor from 2011 is reportable. An arrest from 2011 is not.

This is not drafting stray. Before the 1998 amendment, paragraph (5) read “records of arrest, indictment, or conviction of crime” and measured its seven years from the date of disposition, release or parole. Congress removed convictions from that list, removed the reference to indictment, and struck the disposition date. Employers who rely on a “seven year rule” for criminal records are applying a rule that was repealed a generation ago.

The salary threshold that almost nobody applies

§1681c(b) exempts five of those paragraphs from applying at all, in three situations: a credit transaction of $150,000 or more, life insurance underwriting with a face amount of $150,000 or more, and employment at an annual salary that equals or may reasonably be expected to equal $75,000 or more.

The employment threshold is the one that gets repeated, usually as “over $75,000 the seven year rule does not apply”. That is approximately right and precisely wrong, and the gap between the two is worth the two paragraphs it takes to explain.

The exemption is written as applying to “any consumer credit report” used in connection with those situations. Not consumer report. Consumer credit report. Those are different terms in this statute, and a criminal history search is not a credit report. Read narrowly, the $75,000 threshold lifts the obsolescence limits on the credit information in a file and leaves the criminal record limits exactly where they were, so a high-salary employer still cannot lawfully be given a ten year old arrest. Read broadly, the phrase is loose drafting for “consumer report” and the exemption reaches everything in §1681c(a).

Both readings are in circulation and the honest answer is that the text favors the narrower one, that no court appears to have settled it, and that the difference only matters for the items in §1681c(a) that a criminal screen would carry, which is records of arrest. Convictions are outside the section entirely, so the threshold has nothing to do with them either way. An employer at $80,000 who assumes the threshold unlocked old arrests is relying on the broad reading without knowing there was a choice.

Two notes that do matter in practice. The figure was $20,000 until 1998, so guidance written before then is describing a very different statute. And several states have their own version of the threshold at the same $75,000, which means the federal and state answers can coincide while resting on different text.

Public record information, and the notice in §1681k

§1681k applies to an agency that supplies a report for employment purposes and reports public record information that is likely to have an adverse effect on the consumer's ability to get the job. It gives the agency a choice, and the choice is the interesting part:

• notify the consumer at the time the information is reported, giving the name and address of the employer who received it; or
• maintain strict procedures designed to ensure that the information, when reported, is complete and up to date.

The section then defines “complete and up to date” for this purpose, and the definition is operational rather than abstract: information about an arrest, indictment, conviction, suit, tax lien or outstanding judgment is current if the status being reported is the record's present status at the time of the report.

That is where the courthouse verification step in a serious screening program comes from. Almost every large agency takes the second option, because a contemporaneous notice to every candidate with a public record would be unworkable at volume. Taking the second option obliges the agency to have real procedures behind the promise, and it is why the question to ask a prospective screening partner is not whether they verify at the source but what their procedure is when the source is a courthouse that will not answer the phone.

There is a related rule on the agency side in §1681d(d)(3): public record information about an arrest, indictment, conviction, civil judicial action, tax lien or outstanding judgment may not be furnished unless its accuracy was verified within the thirty day period ending when the report is furnished. That is a floor, not a best practice, and it is stated as a prohibition rather than a goal.

Investigative consumer reports, and the interviews behind them

An investigative consumer report is a consumer report where information about character, general reputation, personal characteristics or mode of living is obtained through personal interviews. The definition is in §1681a(e), and it catches more than the name suggests: a reference interview beyond a dates-and-title check, a neighborhood canvass, or a “professional reference check” where someone is asked about a candidate's judgment is the kind of thing the section was written for.

The employer's duties here sit in §1681d(a) and are additional to the ones above. You must disclose to the consumer, in writing, that an investigative consumer report may be made, and the disclosure has to include a statement of the consumer's right to request the further disclosure described below and the current Summary of Consumer Rights. You must also certify to the agency that you made those disclosures and will comply with the rest of the section.

If the consumer asks in writing, §1681d(b) requires a complete and accurate written disclosure of the nature and scope of the investigation. This is not a summary of findings. It is an explanation of what is being investigated and how, and it is the reason a vendor that runs interviews should be able to describe its method in plain language.

Two agency-side rules in §1681d(d) are worth knowing even though they are not yours. Adverse information from an interview with a neighbor, friend, associate or acquaintance may not be included unless the agency used reasonable procedures to confirm it from an additional source with independent and direct knowledge, or the person interviewed is the best possible source. And the agency is barred from making an employment inquiry where an employer's inquiry would itself violate equal employment opportunity law.

One section of the statute provides a safe harbor rather than a duty: under §1681d(c), a person escapes liability for the notice and scope obligations by showing by a preponderance of the evidence that they maintained reasonable procedures to assure compliance. It is a defense, which means it is worth having the procedures whether or not you expect to need it.

Accuracy, and the part of it that is yours

§1681e(b) requires a consumer reporting agency to follow reasonable procedures to assure maximum possible accuracy of the information in a report. It binds the agency, and the natural employer reaction is that it is therefore not the employer's problem. A few things make it partly yours anyway.

You choose the agency, and the standard is reasonableness rather than perfection, so what counts is the procedure rather than the outcome. You can ask what a vendor's procedure is for matching a record to a person, which is where the errors actually come from: a common name, a recycled Social Security number, a middle initial that does not match. And the certification you signed under §1681b(b)(1) already promised that you would not use the report in violation of equal employment opportunity law, which imports a standard of care into a document most employers never read twice.

The practical version of the duty is a written policy that says what happens when a report comes back with a record, who decides, and what evidence the decision has to rest on. The toolkit carries a policy, an adjudication matrix and an individualized assessment worksheet for exactly this, and the reasoning behind each choice.

What the states add, and where to look it up

Everything above is the federal floor and it is not close to the whole picture. California's own consumer credit reporting statute sits alongside the FCRA and restricts employment credit checks to specified categories of role. New York restricts them as well, and has been widening that restriction. Massachusetts limits what many employers may see to felony convictions and pending cases. Several states cap convictions at their own seven years, which is lawful because a state may be stricter than the federal statute.

Then there is the second layer, which is not about what may be reported at all but about what you have to do before deciding. Ban the box and fair chance laws add their own notices and their own timing on top of the FCRA sequence, and they apply in different combinations depending on where the candidate lives and where the job is. The fair chance articlecovers that layer, and the compliance section covers the state-by-state position.

What we do

The practical test we apply to our own product is the one this page is built around. A screening program is lawfully designed when you can answer four questions in writing before the first report is ordered: what purpose you have, what the disclosure document contains and what it does not, which items your package requests and which of them the statute permits, and who adjudicates and on what basis.

The first two are paperwork and are solved once. The second two change as you add states, roles and vendors, which is why they are the ones that stay on the list.

Sources

• 15 U.S.C. §1681a(h) (definition of employment purposes)
• 15 U.S.C. §1681b(a)(3)(B) (permissible purpose, employment)
• 15 U.S.C. §1681b(b)(1) (certification from the user of the report)
• 15 U.S.C. §1681b(b)(2) (disclosure and authorization)
• 15 U.S.C. §1681b(b)(3) (conditions on use for adverse actions)
• 15 U.S.C. §1681c(a) and (b) (obsolete information and the exemptions)
• 15 U.S.C. §1681d (investigative consumer reports)
• 15 U.S.C. §1681e(b) (reasonable procedures to assure maximum possible accuracy)
• 15 U.S.C. §1681k (public record information for employment purposes)
• 15 U.S.C. §1681n and §1681o (civil liability for willful and negligent violations)
• FTC, Using Consumer Reports: What Employers Need to Know
• CFPB, Summary of Consumer Rights, Appendix K to Part 1022
• Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017)
• Gilberg v. California Check Cashing Stores, LLC, 913 F.3d 1169 (9th Cir. 2019)
• Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007)
• Milbourne v. JRK Residential America, LLC, 92 F. Supp. 3d 425 (E.D. Va. 2015)
• EEOC Enforcement Guidance No. 915.002, Consideration of Arrest and Conviction Records (2012)
• FTC Disposal Rule, 16 CFR Part 682

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.