Home › FCRA basics
FCRA basics for employers
The Fair Credit Reporting Act governs what you must do before you order a background report through a third party, and before you act on one.
Not legal advice. This is a general summary of a federal
statute. State and city law frequently adds requirements on top, and several states regulate
this area far more tightly than federal law does. Confirm specifics with counsel licensed
where you hire.
Does it even apply?
The FCRA attaches when you obtain a consumer report from a consumer reporting agency and use it for employment purposes. The practical test is whether a third party assembled or evaluated the information for you.
| What you did | Usually a consumer report? |
|---|---|
| You called a former manager yourself | No |
| You searched the open web yourself | No — but see the caution below |
| You paid a screening vendor for a criminal or credit report | Yes |
| You paid a vendor to call references for you | Yes, commonly — the vendor assembled it |
| You paid for verified employment or education history | Yes |
Doing it yourself avoids the FCRA, not everything else. Anti-discrimination
law, state privacy law, and off-limits-question rules apply regardless of who gathers the
information. "We googled them ourselves" is not a defence to a discrimination claim.
The sequence, in order
- Disclose, in writing, in a standalone document. Federal law requires the disclosure be in a document consisting solely of the disclosure. Burying it in an application or an offer letter is the single most litigated mistake in this area. See disclosure and authorisation.
- Get written authorisation from the candidate. Separate from, though commonly presented alongside, the disclosure.
- Certify to the screening vendor. You confirm you disclosed, obtained authorisation, and will not use the report in violation of equal opportunity law.
- If the report might cost them the job, run the two-step adverse action process. Pre-adverse notice first, with the report and the rights summary, then a real pause, then the adverse action notice. See adverse action.
The parts people get wrong
- Standalone means standalone. Extra waivers or liability releases inside the disclosure document have repeatedly been held to break it.
- The pause is the point. Pre-adverse notice exists so the candidate can see the report and dispute an error before the decision becomes final. Sending both notices together defeats it.
- You must hand over the rights summary. A copy of the report alone is not enough; the CFPB's A Summary of Your Rights Under the Fair Credit Reporting Act goes with it.
- Criminal history is separately regulated. Many states and cities restrict when you may ask about or consider it, and EEOC guidance expects an individualised assessment rather than a blanket rule.
Primary sources worth reading directly: the FTC/EEOC joint guidance for employers and the CFPB's FCRA resources.