Program design · 11 min read

Rescreening and post hire screening

A check on someone who already works for you is not the pre-employment process with a different date on it. Three things break, and one of them is the assumption that a serious finding lets you skip the notices.

The question is not whether the FCRA applies

Employers tend to assume the statute is a hiring statute: you run a check on an applicant, you run a notice sequence, and once the person is on payroll the subject is closed. That reading does not survive contact with the definitions.

“Employment purposes” is defined at §1681a(h) as a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee. Promotion, reassignment and retention are things that happen to people who already work for you. The post-hire case is not at the edge of the definition, it is named in it.

The adverse action definition closes the point. §1681a(k)(1)(B)(ii) covers a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee. Current is in the text. A demotion, a denial of promotion, a reassignment and a termination are all adverse action, and the notice duties that attach to adverse action attach to them.

So there is no threshold argument to have here. The only questions are whether the consent you hold covers what you are doing, whether what you received is a consumer report, and whether you ran the sequence before you acted.

Consent has to reach forward in time

§1681b(b)(2) requires a clear and conspicuous disclosure before a report is procured, and the consumer's written authorization. For a one-off pre-employment check that is straightforward. For a program that checks quarterly, or that monitors continuously for years, it is where the foundations are usually missing.

The disclosure and authorization collected at onboarding was written for the check that was run at onboarding. Whether it also covers a check run eighteen months later is a question about what the document said, and the honest answer for most onboarding paperwork is that nobody thought about it. The failure is quiet: monitoring runs, alerts arrive, decisions get made, and somewhere behind all of it is a signature that was about something else.

What a defensible arrangement looks like is not complicated, and it costs one document.

• A separate authorization for ongoing screening, not a clause inside the onboarding packet. It should say that the employer may obtain reports during employment, not merely in connection with hiring.
• A stated scope. Which categories of information, from which sources. A worker asked to agree to indefinite monitoring of anything is being asked for something a court will read narrowly.
• A stated duration and a renewal. An authorization with a term, renewed on a defined cycle, is easier to defend than one written to last forever, and it also forces the program to be reviewed.
• A way to withdraw. Consent that cannot be withdrawn is not much of a consent, and the employer needs to have decided in advance what happens when someone does.
• A copy kept. The disclosure must be given to the worker to keep, and the record of that is part of the file.

One practical note that matters more than it sounds. A blanket authorization collected years ago, before the program existed, covering checks nobody had designed yet, is the document that gets produced in a claim. Re-papering the workforce is annoying and it is cheaper than the alternative.

An alert is not yet a report

Continuous monitoring products send alerts. An alert arrives, someone in HR reads it, and the instinct is to treat it as a finding. Whether it is a consumer report determines which duties the employer now owes, and the answer turns on what the vendor did to produce it.

The test that matters is the one in the agency definition, which the consumer reporting agency article sets out in full: a consumer reporting agency is a person who, for a fee, regularly assembles or evaluates consumer information for the purpose of furnishing consumer reports to third parties. A vendor that assembles information from sources other than the employer receiving it is doing the thing the definition describes.

That produces a spectrum with two clear ends.

• The vendor tells the employer what it already knows about its own relationship with the worker. That is a first party account under §1681a(d)(2)(A)(i), is not a consumer report, and sits outside the sequence. The word that limits it is solely: the moment the vendor adds information from anywhere else, the exclusion stops applying.
• The vendor searches public records and commercial databases and tells the employer what it found. It assembled and evaluated consumer information from third party sources. It is furnishing consumer reports, and a report about a worker that bears on their employment is one for employment purposes. The full sequence applies to each one.

Most monitoring products sit at the second end, because assembling from third party sources is what the product is. The operational consequence is that the employer cannot treat an alert as an internal data point that it may act on quietly. If it came from a vendor doing the above, the employer obtained a consumer report, and everything that follows from that follows from it.

There is a second consequence that catches people. A monitoring program produces many reports and most are unremarkable. Each one that is used in a decision is a report that was used in a decision, and the duties are not discharged by the fact that the previous forty were clean.

There is no severity exception

This is the most expensive misunderstanding in post-hire screening, and it is nearly universal.

An alert arrives saying an employee has been charged with something serious. The instinct is that the seriousness of the finding must change the process, because it would be absurd to keep someone in a safety-sensitive role while a notice period runs. So the employee is suspended or terminated the same day, and the notices go out afterwards, or never.

There is nothing in §1681b(b)(3) that supports this. The provision is unconditional: if adverse action is going to be taken based in whole or in part on a consumer report, the employer must first furnish a copy of the report and a description of the consumer's rights. There is no carve-out for serious findings, no exception for safety-sensitive roles, and no emergency provision. The seriousness of the record is an argument for moving quickly through the sequence. It is not an argument for skipping it, because the sequence is what gives the employee the chance to say that the record is wrong, and a serious record is exactly the one a person has the most reason to challenge.

What an employer can legitimately do in the meantime is a separate question from the notice question, and it is worth separating cleanly.

• Suspension with pay pending review is generally not itself an adverse action, because it does not change the terms of employment adversely in a lasting way. It is the normal answer for a safety-sensitive role.
• Suspension without pay, demotion, reassignment and termination are adverse actions, and if a consumer report contributed to any of them, the sequence comes first.
• Removing someone from a shift while a question is resolved is a judgment call that depends on what it does to pay and status. Where it is unclear, treat it as adverse and run the sequence. The cost is a few days.

The reason this section matters more than it looks is that the pressure to skip runs in one direction. Every incentive in the moment says act now and document later. The sequence is the thing that protects the employer who was right about the record, and it is the first thing dropped when the finding is alarming.

The 2024 guidance that went away, and what did not

In November 2024 the Consumer Financial Protection Bureau published a circular on background dossiers and algorithmic scores for hiring, promotion and other employment decisions. It took the position that workplace monitoring technology can trigger the FCRA, and that ongoing employment purposes are covered rather than only initial hiring.

That circular was withdrawn. On 12 May 2025 the Bureau withdrew sixty-seven guidance documents, this one among them, published at 90 Fed. Reg. 20,084, and stated that it would not enforce the withdrawn documents and that people should not rely on them.

Both halves of that are worth being precise about, because the field is imprecise in both directions.

Citing the circular as current authority is wrong. It is withdrawn, and a compliance page that presents it as the Bureau's position is describing a document that no longer exists. Several pages that were written in 2024 are still saying so.

Treating the withdrawal as a change in the law is more wrong, and it is the error that actually costs money. A circular is not a rule. It does not create the obligations it describes, it describes obligations that come from somewhere else, and in this case that somewhere else is the statutory text quoted above. Employment purposes includes retention because §1681a(h) says so. Adverse action reaches current employees because §1681a(k)(1)(B)(ii) says so. A vendor that assembles consumer information for a fee is a consumer reporting agency because §1681a(f) says so. Withdrawing a document that restated those provisions did not repeal them.

The withdrawal does change one thing, and it is not the law. It changes who is likely to be enforcing, which is a fact about risk rather than about obligation. The Bureau has said it will not enforce the circular. The statute remains enforceable by the Bureau under its other authority, by the FTC, and by private claimants, and private claimants are the ones who were never relying on the circular in the first place.

The general lesson is the one this section is here to make. When a rule's provenance is a guidance document rather than a statute or a regulation, the rule can be withdrawn on a Tuesday, and the only way to know whether it still binds is to be able to say where it came from.

Investigations are a different thing, and the difference is narrow

There is a real exclusion for an employer's own misconduct investigation, at §1681a(y). A communication made to an employer investigating suspected misconduct relating to employment, or compliance with law or the employer's written policies, is excluded from being a consumer report provided the conditions in the provision are met. One of those conditions is a duty to give the employee a summary of the nature and substance of the communication after the investigation concludes, and the exclusion is not about creditworthiness.

The exclusion is narrow and it is easy to over-read. It covers an investigation of suspected misconduct. It does not cover a routine rescreening check that happens to turn up something, because nothing was suspected when the check was ordered. An employer who wants the exclusion has to actually be investigating, which means a specific suspicion, a scope, and a record. Theagency article sets out the conditions, since the exclusion is really a point about the definition.

The practical warning is the one that matters here. Reaching for the investigation exclusion to justify acting quickly on a monitoring alert is a common move and it usually fails, because the alert arrived before anyone suspected anything.

What we do

We furnish reports for rescreening and continuous monitoring, and we furnish them the same way we furnish a pre-employment report: with the sources and verification dates attached, and with the notices the sequence requires available for the employer to send.

We do not make the decision. That is not a disclaimer, it is the design. A monitoring product that tells an employer what a finding means has moved into the adjudication the employer is legally responsible for, and the employer has lost the ability to say that it considered the circumstances. Our job ends at an accurate record and the information needed to assess it.

If you are building this, the policy and the retention schedule in the toolkit cover the post-hire case alongside the pre-employment one, including the language for an authorization that reaches forward.

Sources

• 15 U.S.C. §1681a(h) (definition of employment purposes)
• 15 U.S.C. §1681a(k)(1)(B)(ii) (adverse action, employment)
• 15 U.S.C. §1681a(d)(2)(A) (first party exclusions)
• 15 U.S.C. §1681a(y) (exclusion for employee investigations)
• 15 U.S.C. §1681b(a)(3)(B) and (b)(2), (b)(3)
• 15 U.S.C. §1681m(a) (adverse action notice)
• CFPB Circular 2024-06, withdrawn 90 Fed. Reg. 20,084 (12 May 2025)
• FTC, Using Consumer Reports: What Employers Need to Know
• FTC staff advisory opinion to Weisberg, 27 June 1997

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.