The Complete Guide to FCRA-Compliant Background Checks

If you read every FCRA class-action complaint filed in the last five years, you would notice they all open the same way. The plaintiff's firm cites the disclosure form, the authorization, and the adverse-action packet. The report itself is barely referenced. The case is about the documents around the report, not the report.

This is the document checklist that keeps the case from making it past the motion to dismiss.

Before the report is ordered

• Standalone FCRA disclosure form — single document, no liability waiver, no continuing authorization, no logos, no application-tracking codes.
• Standalone authorization form — separate document, immediately following the disclosure in the workflow.
• State-specific notices: California ICRAA disclosure, New York Article 23-A notice, Washington consumer-rights notice, Maine Form A, Minnesota notice.
• ICRAA check-box for California candidates requesting a free copy of the report.
• Federal investigative-consumer-report notice if any reference call will be made.

After the report is received

• Report stored in tamper-evident system with access logging.
• Individualized assessment worksheet generated for any potentially-disqualifying conviction.
• Hiring-manager view restricted to the components relevant to the role (segregated criminal/non-criminal in NYC, for example).

When adverse action is contemplated

• Pre-adverse action notice + copy of the report + CFPB Summary of Rights (March 2024 version).
• Audited delivery channel with receipt confirmation and time-stamp.
• Waiting period of 5-10 business days from candidate receipt, jurisdiction-appropriate.
• Dispute-triggered pause if the candidate raises any accuracy issue.

When adverse action is finalized

• Final adverse action notice with CRA name, address, telephone number, and the FCRA-required statement that the CRA did not make the decision and is unable to provide the specific reasons.
• Continuing-rights notice including the right to a free copy of the report and the right to dispute accuracy.
• Documented final decision rationale tied to the individualized assessment.

Retention

Seven years from the date of the report on every document above. The SafestHires hiring file produces a single-button export of the complete package — the exact bundle a plaintiff's firm subpoenas first.