FCRA Compliance Checklist for Small Employers

The Fair Credit Reporting Act (FCRA) governs how employers request, use, and act on background checks. It applies to every U.S. employer that obtains a consumer report for employment purposes — there is no small-business exemption and no employee-count threshold. The good news is that compliance is procedural, not complicated. This checklist walks through the requirements a small employer must meet at each stage of the hiring process.

Before you order a background check

1. Written policy

Document a written background check policy that describes which roles receive which checks, how results are evaluated, and how adverse action is handled. Applying the policy consistently is the single strongest defense against discrimination claims.

2. Standalone disclosure

Provide the candidate with a clear, conspicuous, standalone written disclosure that a consumer report may be obtained for employment purposes. The disclosure must be a separate document — not buried in the employment application or the offer letter.

3. Written authorization

Obtain the candidate's written authorization before ordering the report. Electronic signature is acceptable. Verbal consent is not.

4. State and local disclosures

Several states and cities require additional disclosures — California, New York, New York City, Washington, and others. If you hire across state lines, use compliant multi-jurisdiction disclosure templates rather than a single federal-only form.

When the report comes back

5. Review the report against a consistent adjudication matrix

An adjudication matrix defines which offenses, at which recency, are relevant to which roles. It removes ad-hoc decision-making and creates a defensible audit trail. The EEOC's guidance on the use of arrest and conviction records expects individualized assessment — an adjudication matrix supports that assessment, it does not replace it.

6. Consider ban-the-box and fair-chance laws

More than 35 states and 150 cities have fair-chance hiring laws that regulate when and how you can consider criminal history. Some require delaying the background check until after a conditional offer; others require an individualized assessment before disqualifying a candidate.

If you are considering adverse action

7. Pre-adverse action notice

Before making a final negative decision based in whole or in part on the report, send the candidate a pre-adverse action notice that includes a copy of the report and the federal Summary of Rights Under the FCRA. Include any state or local rights summaries required in the candidate's jurisdiction.

8. Reasonable waiting period

Give the candidate a reasonable opportunity to dispute inaccurate information before making the final decision. The FCRA does not define 'reasonable' by statute, but industry practice and SHRM guidance recommend at least five to seven business days.

9. Final adverse action notice

If the decision is confirmed, send a final adverse action notice that includes the screening company's contact information, a statement that the screening company did not make the hiring decision, and a notice of the candidate's right to dispute the accuracy of the report.

Ongoing compliance

10. Recordkeeping

Retain background check records, disclosures, authorizations, and adverse action correspondence for a minimum of five years, or longer if state law or industry regulation requires. Time-stamp everything — the FTC and plaintiffs' attorneys will ask for the audit trail.

11. Continuous monitoring consent

If you use post-hire continuous criminal monitoring, obtain evergreen or renewed authorization consistent with FCRA and applicable state law. A one-time pre-employment authorization is not always sufficient for ongoing monitoring.

12. Vendor oversight

You remain responsible for FCRA compliance even when a screening vendor performs the searches. Review your vendor's certifications, dispute-handling process, and data-security controls annually.

Common small-employer mistakes

• Combining the disclosure with the employment application
• Sending both adverse action notices on the same day
• Applying background check policies inconsistently across candidates
• Failing to include the FCRA Summary of Rights with the pre-adverse action notice
• Skipping state-specific disclosures for candidates outside the employer's home state
• Treating arrests without convictions as automatic disqualifiers
• Failing to document the individualized assessment when criminal history is considered

Frequently asked questions

Does the FCRA apply if I only hire a few people a year?

Yes. The FCRA applies to any employer that obtains a consumer report for employment purposes, regardless of company size or hiring volume.

Can I use a single disclosure form for candidates in every state?

Only if the form incorporates every required state and local disclosure. In practice, most small employers use a base federal disclosure plus jurisdiction-specific addenda.

How long should the waiting period be between pre- and final adverse action notices?

The FCRA requires a 'reasonable' period. Five to seven business days is the widely accepted industry standard.

Key takeaways

• FCRA compliance is procedural — get the process right and you are almost always fine
• Standalone disclosure and written authorization are non-negotiable
• Adverse action is a two-step, time-separated process — never same-day
• State and local laws often add requirements on top of the federal baseline
• Documentation is the difference between a defensible program and a costly one