What Employers Need to Know about FCRA Compliance

February 23 2024
5 min read

Background checks provide information from various sources, including credit reports, criminal records, government data sources and lists, employer history records, and education and professional license credential records. Performing a background check on potential hires and current employees can help you keep your workplace safe and avoid negligent hiring lawsuits.

However, anytime you use information from background checks to make employment decisions, including hiring, retention, promotion, or reassignment. You must comply with the Fair Credit Reporting Act (FCRA). Under the FCRA, background checks are considered "consumer reports." Before running a background check (consumer report), employers must follow all the steps outlined in the FCRA.

This post, we'll cover:

What is the Fair Credit Reporting Act?

The Fair Credit Reporting Act (FCRA) is a federal law designed to regulate the use of consumer report information and other background information received about individuals from consumer reporting agencies (CRA) like Orange Tree.

The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) have enforcement authority for the FCRA. Some states have their consumer protection and/or employment laws that may apply. 

Here are some helpful terms to help you better understand the FCRA and how it applies to background checks. 

  • Consumer Report – The background check. A Consumer Report contains only accurate information, such as employment dates, criminal records, and driving history.

  • Consumer Reporting Agency – The background screening provider preparing the background report; often referred to as a "CRA."

  • Investigative Consumer Report – Also a background check, but unlike a Consumer Report, includes information obtained through personal interviews. 

  • Disclosure – The document used to inform the consumer that they may be the subject of a background check.

  • Authorization – The document signed by the consumer in which they authorizes preparation of the background check.

  • Adverse Action – The process you must follow when considering an unfavorable employment decision based on the background or drug test. 

  • Consumer – The person who is the subject of the background check.

  • User – The person who is requesting and using the background check (typically the employer or prospective employer). 

    Watch FCRA Compliance Webinar On-Demand and Earn SHRM and HRCI Credits

Earn SHRM and HRCI Credits

What are the employer's responsibilities under the FCRA? 

The FCRA is a consumer rights law with strict procedures that must be followed to ensure the information contained in "consumer reports" is as accurate as possible. Employers are required to both disclose their intention to obtain a consumer report and obtain written consent from applicants or current employees before requesting a consumer report. 

Before getting a consumer report: 

Step 1: Provide Disclosure 

Make a clear and conspicuous written disclosure to the candidate or employee that you might use information in their consumer report for decisions related to their employment.  

  • This must be in writing and a stand-alone format. 

  • The notice cannot be in an employment application.

  • The notice should not be combined with any other form.  

Step 2: Obtain Authorization 

Get written authorization from the candidate or employee to do the background check.  

  • If you combine this authorization form with any other form, be sure to keep it separate from the Disclosure.  

  • If you want the authorization to allow you to get consumer reports throughout the entire length of a person's employment (evergreen consent), make sure you say so clearly and conspicuously.

What is an Investigative Consumer Report? 

If the consumer report asks for information such as job performance, it falls into a special category of consumer report called an "Investigative Consumer Report."

When an Investigative Consumer Report is requested, employers must: 

  • Disclose to the applicant that an investigative consumer report is being requested, along with a certain specified language. 

  • Unless it is contained in the initial Disclosure, the consumer must receive this additional Disclosure within three days after the request is made. 

  • The Disclosure must tell the applicant that they have a right to request additional information about the investigation's nature.

If your CRA (background screening provider) is not obtaining authorization and Disclosure on your behalf, you must certify you have done the following: 

  • Have made the above Disclosure and gotten authorization from the candidate or employee to get a consumer report. 

  • Have and will comply with all of the FCRA requirements.

  • Will not discriminate against the candidate or employee or otherwise misuse the information, as provided by any applicable federal or state equal opportunity laws or regulations.

Other compliance considerations to note 

Some states have their consumer protection and/or employment laws that may apply. Some states and local jurisdictions also limit the timing of when a prospective employer may ask about or consider criminal record information about a candidate. Some states also restrict the consideration of credit history information in the employment context.

How the right background screening partner can help

The right background screening partner can be a strategic resource to help ensure you are FCRA compliant and on top of federal and state legislation and guidance.

Orange Tree can help you promote compliance through your talent acquisition, human resources, and security processes.

We provide a range of tools to streamline the screening process and keep you in compliance:

  • FCRA compliant authorization and disclosure forms that can be delivered and signed electronically. 

  • Automated adverse action letters.

  • Federal and State-specific documents. 

Schedule a free consultation to learn how to help streamline your business processes and mitigate risk by managing things like the authorization and disclosure process on your behalf, allowing your team to remain focused on key priorities.  




Share this post: