FCRA Compliance for Small Business Background Checks: Complete Guide 2025
FCRA Compliance for Small Business Background Checks: Complete Guide 2025
Planning to run background checks on job candidates? You must comply with the Fair Credit Reporting Act (FCRA) — or risk penalties up to $1,000 per violation.
The good news? FCRA compliance isn't complicated once you understand the requirements.
This guide covers:
- What is FCRA and who must comply
- Step-by-step FCRA compliance process
- Required forms and notices
- Common mistakes and how to avoid them
- FCRA penalties and how to protect your business
What is the Fair Credit Reporting Act (FCRA)?
The Fair Credit Reporting Act (FCRA) is a federal law that regulates how employers can use background check information for hiring decisions.
Enacted: 1970 Purpose: Protect job applicants' privacy and ensure accurate, fair background screening Enforced by: Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB)
Who Must Comply with FCRA?
ANY employer using a third-party background check service, regardless of:
- Company size (1 employee or 10,000 employees)
- Industry (retail, tech, healthcare, etc.)
- Hiring frequency (1 hire per year or 100 per year)
If you use GoodHire, Checkr, Sterling, or any background check service, you MUST follow FCRA guidelines.
What Does FCRA Cover?
FCRA applies to background checks that include:
- Criminal records
- Credit history
- Employment history
- Education verification
- Driving records
- Social Security verification
- Reference checks conducted by third parties
Note: FCRA does not apply if you conduct background checks yourself (without a third-party service). However, DIY background checks carry significant legal risks and are not recommended.
FCRA Compliance Requirements: 5 Essential Steps
Step 1: Provide Written Disclosure
Before running a background check, you must:
✅ Provide a standalone disclosure document informing the candidate that you intend to conduct a background check.
Key Requirements:
- Must be a separate document (cannot be part of the job application)
- Must clearly state that a background check will be conducted
- Must identify the background check company you're using
- Cannot include liability waivers or other extraneous information
✅ Correct Example:
DISCLOSURE REGARDING BACKGROUND INVESTIGATION
[Your Company Name] may obtain information about you from a consumer reporting agency for employment purposes. This information may include your credit history, criminal records, motor vehicle records, employment history, and education history.
The consumer reporting agency we use is [Background Check Company Name].
Your signature below acknowledges that you have received this disclosure.
___________________________
Signature Date
❌ Incorrect Example:
Adding the disclosure to the bottom of a job application or including liability waivers in the same document.
Step 2: Obtain Written Authorization
After providing disclosure, you must obtain written authorization from the candidate before conducting the background check.
Key Requirements:
- Must be a clear, conspicuous authorization
- Should be on the same standalone document as the disclosure
- Candidate must sign and date
- Keep a copy for your records
✅ Example Authorization:
AUTHORIZATION FOR BACKGROUND CHECK
I acknowledge that I have received and reviewed the Disclosure Regarding Background Investigation.
I hereby authorize [Your Company Name] and its designated agents to conduct a comprehensive background investigation, including but not limited to criminal records, employment history, education verification, and driving records.
I understand that this information will be used for employment purposes.
___________________________
Signature Date
___________________________
Printed Name
Step 3: Wait for the Background Check Results
After obtaining authorization, order the background check from your chosen provider (GoodHire, Checkr, etc.).
Turnaround Time:
- Basic checks: Instant to 24 hours
- County criminal searches: 1-3 business days
- Employment/education verification: 2-5 business days
During this time:
- Do NOT make any hiring decisions
- Do NOT ask the candidate about anything that might appear on the report
- Wait for the complete report before proceeding
Step 4: Review the Report and Make a Decision
Once you receive the background check report, review it carefully.
If the report is favorable (no issues): ✅ Proceed with hiring ✅ No additional FCRA steps required
If the report contains negative information that could affect your hiring decision: ⚠️ You MUST follow the "Adverse Action" process (Step 5)
Step 5: Follow the Adverse Action Process
If you plan to deny employment (or take any adverse action) based on information in the background check report, FCRA requires a two-step adverse action process:
Part A: Pre-Adverse Action Notice
Before making a final decision, you must:
-
Provide the candidate with:
- A copy of the background check report
- A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act" (provided by the background check company)
- A Pre-Adverse Action Letter
-
Wait at least 5 business days to give the candidate time to dispute any inaccurate information
✅ Pre-Adverse Action Letter Template:
[Your Company Letterhead]
[Date]
[Candidate Name]
[Address]
Dear [Candidate Name],
We are writing to inform you that we are considering taking adverse action regarding your application for employment with [Your Company Name].
This decision is based, in whole or in part, on information obtained in a consumer report from [Background Check Company Name].
Enclosed you will find:
1. A copy of the consumer report
2. A Summary of Your Rights Under the Fair Credit Reporting Act
Before we make a final decision, you have the right to:
- Review the information in the report
- Dispute any inaccurate or incomplete information with the consumer reporting agency
- Provide us with additional information
If you believe any information in the report is inaccurate, please contact:
[Background Check Company Name]
[Phone Number]
[Email Address]
We will wait [5] business days before making a final decision.
Sincerely,
[Your Name]
[Title]
[Company Name]
Part B: Final Adverse Action Notice
After waiting 5 business days, if you still decide not to hire the candidate, you must send a Final Adverse Action Notice.
Must Include:
- Name, address, and phone number of the background check company
- Statement that the background check company did not make the hiring decision
- Notice of the candidate's right to dispute the accuracy of the report
- Notice of the candidate's right to obtain a free copy of the report within 60 days
✅ Final Adverse Action Letter Template:
[Your Company Letterhead]
[Date]
[Candidate Name]
[Address]
Dear [Candidate Name],
This letter is to inform you that we have decided not to proceed with your application for employment with [Your Company Name].
This decision was based, in whole or in part, on information in the consumer report we obtained from:
[Background Check Company Name]
[Phone Number]
[Address]
This company did not make the decision not to hire you and cannot provide specific reasons for our decision.
You have the right to:
- Obtain a free copy of the report from [Background Check Company] within 60 days
- Dispute the accuracy or completeness of any information in the report directly with [Background Check Company]
If you have any questions, please contact us at [Your Phone Number] or [Your Email].
Sincerely,
[Your Name]
[Title]
[Company Name]
Common FCRA Mistakes (and How to Avoid Them)
❌ Mistake #1: Not Using a Standalone Disclosure
Wrong: Adding the background check disclosure to the bottom of your job application.
Right: Providing a separate, standalone document with only the disclosure and authorization.
Penalty: Up to $1,000 per violation
❌ Mistake #2: Running Background Checks Without Written Consent
Wrong: Assuming verbal permission or an unsigned form is sufficient.
Right: Always obtain a signed, written authorization before ordering a background check.
Penalty: $100-$1,000 per violation + potential class-action lawsuit
❌ Mistake #3: Skipping the Pre-Adverse Action Process
Wrong: Rejecting a candidate immediately after seeing a negative background check without giving them a chance to dispute it.
Right: Always send a Pre-Adverse Action Notice and wait at least 5 business days before making a final decision.
Penalty: $100-$1,000 per violation + potential class-action lawsuit
❌ Mistake #4: Not Keeping Proper Records
Wrong: Throwing away background check records after hiring or rejecting a candidate.
Right: Keep all background check records (disclosure, authorization, reports, adverse action notices) for at least 5 years.
Why: You may need these records to defend against discrimination claims or FCRA lawsuits.
❌ Mistake #5: Using Background Checks Inconsistently
Wrong: Only running background checks on certain candidates (e.g., based on race, age, gender).
Right: Apply background checks consistently to all candidates for similar positions.
Penalty: EEOC discrimination lawsuit (penalties up to $300,000+)
❌ Mistake #6: Using Outdated Information
Wrong: Relying on background check information older than 7 years.
Right: FCRA limits how far back criminal records, bankruptcies, and other negative information can be reported:
- Criminal convictions: No limit (can be reported indefinitely)
- Arrests without conviction: 7 years
- Bankruptcies: 10 years
- Civil suits and judgments: 7 years
- Tax liens: 7 years from payment
❌ Mistake #7: Asking About Criminal History Too Early
Ban-the-Box Laws: Many states and cities prohibit asking about criminal history on job applications or during initial interviews.
Right: Wait until after a conditional job offer to conduct a background check (in ban-the-box jurisdictions).
Check your state laws: SHRM Ban-the-Box Map
FCRA Penalties and Enforcement
Civil Penalties
Willful Violations: $100-$1,000 per violation Negligent Violations: Actual damages + court costs + attorney fees Class-Action Lawsuits: Can reach millions of dollars in settlements
Recent Examples:
- Uber (2020): $1.9 million settlement for FCRA violations
- Amazon (2021): Class-action lawsuit for improper adverse action procedures
- Publix (2019): $6.8 million settlement for not following adverse action process
Criminal Penalties
Willfully obtaining background check information under false pretenses: Up to $5,000 fine and 1 year in prison
State-Specific Background Check Laws
In addition to FCRA, many states have additional requirements:
California (ICRAA)
- Requires additional disclosures
- Candidate must check a box explicitly authorizing the background check
- Stricter adverse action requirements
New York
- Ban-the-Box applies to employers with 4+ employees
- Cannot ask about criminal history until after a conditional job offer
Massachusetts
- Cannot use credit reports for employment unless job-related
- 3-year lookback limit on criminal records for most jobs
Colorado
- Requires providing a copy of the background check to the candidate before using it for employment decisions
Always check your state laws before conducting background checks.
How to Ensure FCRA Compliance (Checklist)
✅ Use a certified background check provider (GoodHire, Checkr, Sterling) ✅ Provide a standalone disclosure document ✅ Obtain written authorization before ordering the check ✅ Wait for the complete report before making decisions ✅ Send a Pre-Adverse Action Notice if planning to deny employment ✅ Wait at least 5 business days ✅ Send a Final Adverse Action Notice if you decide not to hire ✅ Keep all records for at least 5 years ✅ Apply background checks consistently to all candidates ✅ Check state-specific laws (ban-the-box, lookback limits, etc.)
Frequently Asked Questions
Q: Do I need a lawyer to comply with FCRA?
A: Not necessarily. Most background check providers (GoodHire, Checkr) provide FCRA-compliant forms and guidance. However, consulting an employment lawyer is recommended if you're unsure about your specific situation.
Q: Can I run a background check before offering the job?
A: Yes, but:
- You must obtain written authorization first
- In "ban-the-box" states, you may need to wait until after a conditional job offer
Q: What if a candidate refuses to sign the authorization?
A: You can decline to hire them. However, you cannot run a background check without authorization.
Q: Can I ask candidates to pay for their own background check?
A: Some states allow this, but it's not recommended. Most background checks cost $30-$80, and asking candidates to pay can discourage qualified applicants.
Q: What if a candidate disputes the background check?
A: Pause your hiring decision and contact the background check provider. They will investigate the dispute. If the information is inaccurate, request an updated report.
Q: Are small businesses exempt from FCRA?
A: No. FCRA applies to ALL employers, regardless of size.
Bottom Line: FCRA Compliance is Non-Negotiable
Failing to comply with FCRA can cost your business thousands of dollars in fines and lawsuits.
But compliance is straightforward:
- Use a certified background check provider
- Provide disclosure and get written authorization
- Follow the adverse action process if you don't hire
- Keep proper records
- Apply background checks consistently
The easiest way to ensure compliance? Use a background check provider that handles FCRA compliance for you.
Recommended FCRA-Compliant Background Check Providers
All of these providers include:
- FCRA-compliant disclosure and authorization forms
- Automated adverse action workflows
- Compliance guidance and support
-
GoodHire: Best for small businesses, instant results, phone support Learn More →
-
Checkr: Best for growing startups, 100+ ATS integrations Learn More →
-
Sterling: Best for enterprise, custom packages Learn More →
Not sure which provider is right for you?
Use our free recommendation tool to get personalized suggestions in 30 seconds:
Last updated: January 10, 2025
Disclaimer: This guide is for informational purposes only and does not constitute legal advice. Consult with an employment attorney for advice specific to your business and jurisdiction.