Fair Credit Reporting Act Compliance: A Guide for Employers

Credit and criminal background checks are part of the standard hiring process for many employers. These checks provide a snapshot of job candidates and help you make informed hiring decisions.

Requiring a background check for employment purposes is legal. But employers must comply with specific requirements under the Fair Credit Reporting Act (FCRA) when using third-party companies to obtain this information. Checking a prospective employee’s credit information could bring legal problems if done improperly or in a state that bars the practice.

In this article, we’ll explain what information is collected in an employment-related credit check, which businesses must comply with the FCRA, and what their obligations are when making employment decisions.

What Is the Fair Credit Reporting Act?

The Fair Credit Reporting Act (FCRA)​ is a federal law that governs how companies collect, share, and use credit information, such as credit reports. Employers requesting a copy of someone’s credit report must comply with the FCRA.

Credit reports contain sensitive information that can leave consumers vulnerable to identity theft if it isn’t handled with care. The FCRA aims to protect the information obtained from credit bureaus by limiting how consumer reports are used and shared.

Under the FCRA, employers must get the applicant’s written permission before ordering a report. Some states have additional requirements beyond federal law.

Pre-Employment Background Checks

Potential employers must pay for employee background checks, so it’s common to screen job applicants only after making a conditional job offer. A typical employer pre-employment background check includes:

• Criminal background check (includes a report on any criminal records for the job applicant)

• Employment screening (covers the job applicant‘s employment history)

• Credit history

While lenders use consumer credit information to determine creditworthiness for loans and credit cards, employers use these reports to assess financial responsibility. An employee with a credit history showing bad debts or financial mismanagement may pose risks in positions involving financial responsibilities, access to sensitive data, or security clearances.

An employment credit report includes:

• Available credit (credit cards)

• Late payments

• Foreclosures, if applicable

• Payment history

An employment credit report does not include the job applicant‘s credit score.

Investigative consumer reports differ from standard background checks because they involve interviews with personal and professional references about an individual’s character and lifestyle, rather than just reviewing existing records.

If you use investigative consumer reports that examine an individual’s character, general reputation, personal characteristics, or lifestyle, additional FCRA obligations apply, including providing written notice of the right to request additional disclosures about the scope and substance of the investigation.

When Do Employers Need to Comply With the Fair Credit Reporting Act?

Most employers conducting background checks​ obtain credit information through credit reporting agencies such as Experian, Equifax, and TransUnion, or specialized employment screening companies. Your business must comply with the FCRA whenever you use third-party consumer reporting agencies to conduct background checks on employees or applicants.

If you conduct employment background checks in-house without using a third-party consumer reporting agency, the FCRA’s requirements generally do not apply. However, you must still comply with other applicable laws governing background checks, employee privacy, and anti-discrimination laws such as Title VII of the Civil Rights Act.

What Steps Must Employers Follow When Using Consumer Reports for Hiring?

When performing background checks in your screening process, you should understand the timing, disclosure requirements, and consent obligations under the FCRA. Here is what employers must do to remain compliant:

• Determine when you can legally perform background checks: Verify compliance with applicable federal, state, and local laws, including any “ban the box” restrictions on timing.

• Provide a standalone written disclosure: Give the applicant or employee a stand-alone notice in writing​ that you might use the information for decisions about their employment. This notice must be a separate document—it cannot be buried in an employment application.

• Provide a rights summary: Give the individual a Summary of Your Rights Under the Fair Credit Reporting Act​ from the Consumer Financial Protection Bureau (CFPB).

• Obtain written consent: Get written permission from the applicant or employee to conduct the background check. This consent can be included in the same document as the notice.

• Certify compliance: Certify to the company providing the report that you have notified the applicant and received permission to obtain the background report, complied with all FCRA requirements, and will not discriminate against the applicant or employee, or otherwise misuse the information in violation of federal or state equal opportunity laws or regulations.

• Conduct the background check and review results: You’ll need the job applicant‘s Social Security number and date of birth. The employment credit report is a soft inquiry into the job applicant‘s credit file, so it should not negatively affect their credit score. Once you receive the report, review it for any concerning information.

• Proceed with hiring decision or adverse action process: If no concerning information exists, proceed with your hiring decision. If concerning information exists that may affect your decision, initiate the adverse action process before making a final decision.

You must use the report information for a permissible purpose and cannot use it to discriminate unfairly against applicants based on protected characteristics.

What If I Decide Not to Hire Based on the Credit Check?

A background check​ can reveal pertinent information that may sway your decision to hire a potential candidate. When choosing not to hire a person based on background information obtained through a background check company, the FCRA has additional requirements that must be followed.

Pre-Adverse Action Notice

Before taking action to inform the candidate that he or she will not be hired, the employer must give the applicant a pre-adverse action notice. In this notice, the employer must include:

• A copy of the consumer report

• A copy of “A Summary of Your Rights Under the Fair Credit Reporting Act” (the company you purchased the report from should provide a copy that you can pass along to the applicant)

This advance notice gives the applicant an opportunity to review the report, identify any inaccuracies, and explain negative information.

Adverse Action Notice

If the applicant does not respond to the disputed information after a specified period of time, the employer must send an adverse action notice​ informing the applicant that:

• They were rejected because of information in the report

• The name, address, and phone number of the company that sold the report

• The company selling the report didn’t make the hiring decision, and cannot give specific reasons for it

• They have a right to dispute the accuracy or completeness of the report, and to get an additional free credit report from the reporting company within 60 days

The FCRA does not specify the time period for an applicant to respond. Most employers give applicants five business days for a chance to dispute errors.

Proper Disposal of Background Information

Once the hiring process​ is complete, you should properly dispose of background information obtained for candidates you didn’t hire.

The FCRA requires that you dispose of consumer reports and information derived from them in a secure manner. Acceptable disposal methods include:

• Burning, pulverizing, or shredding paper documents

• Permanently erasing or destroying electronic files so they cannot be read or reconstructed

Failing to properly dispose of this sensitive information can expose your business to liability for identity theft or data breaches.

Under Equal Employment Opportunity Commission (EEOC) rules, employers must keep hiring records for at least one year from the date of the hiring decision. Many employers retain background check records for five years as a best practice, given the statute of limitations for FCRA claims.

State Laws on Pre-Employment Credit Checks

While the FCRA sets federal standards for how employers must conduct credit checks, several states have enacted laws that go further by restricting or prohibiting the use of credit history in employment decisions. These laws were passed amid concerns that credit checks could unfairly prevent qualified applicants from getting jobs, particularly when credit problems resulted from circumstances beyond their control, such as medical debt or economic downturns.

Several states restrict the use of pre-employment credit checks in hiring decisions. These states include:

• California​

• Colorado​

• Connecticut​

• Hawaii​

• Illinois​

• Maryland​

• Nevada​

• New York​

• Oregon​

• Vermont​

• Washington​

These states generally do not prohibit credit checks altogether. Instead, they limit them to specific job categories. Common exceptions that allow credit checks include:

• Positions with financial responsibilities, such as accountants, financial managers, or employees handling large sums of money

• Jobs requiring access to confidential or proprietary information

• Positions with security clearance requirements

• Executive and managerial roles

• Law enforcement and other positions where credit checks are required by law

• Jobs with signatory authority over business accounts

The specific exceptions vary by state, so employers must review the particular requirements in their jurisdiction. Some states have narrow exceptions, while others provide broader categories of exempt positions.

In addition to state laws, some cities and counties have enacted their own restrictions on employment credit checks. Employers should check local ordinances where they operate to ensure full compliance.

Violating state credit check restrictions can result in penalties, including fines, damages to affected applicants, and potential lawsuits. Some state laws allow applicants to sue for violations and recover attorney’s fees, making compliance particularly important.

Even in states without specific restrictions, employers should carefully consider whether a credit check is truly job-related and necessary for the position. Using credit information that isn’t relevant to job duties could expose employers to discrimination claims if the practice disproportionately affects applicants from protected groups.

Common FCRA Compliance Mistakes to Avoid

Many employers, particularly small businesses, inadvertently violate the FCRA during background screening for job applicants. Common mistakes include:

• Including the disclosure in the employment application rather than providing a stand-alone notice

• Failing to wait between providing the pre-adverse action notice and sending the final adverse action notice

• Not providing all required notices and documentation

• Using background information to discriminate based on protected characteristics

• Failing to properly secure and dispose of sensitive information

Non-compliance with the FCRA can result in lawsuits, statutory damages, and costly litigation. Investing in proper legal guidance upfront can protect your business from these risks.

Getting Legal Help

As an employer using background checks, consulting an employer-focused employment attorney​ can help ensure your disclosures and notifications comply with local, state, and federal laws. An attorney can review your background check process, help you develop compliant forms and procedures, and advise you on how to handle adverse information.

If you’re facing a complaint or lawsuit related to your background check practices, consult an employment attorney​ experienced in FCRA compliance. Job applicants who believe their FCRA rights were violated may file complaints with the Federal Trade Commission (FTC) or Consumer Financial Protection Bureau (CFPB), which can lead to investigations and enforcement actions against your business. It’s important to have someone on your side who can protect your interests and guide you through the process.