FCRA compliance checklist generator

Short answer

FCRA compliance for employers comes down to a stand-alone disclosure, written authorization, a permissible purpose, and the two-step adverse action sequence — documented and retained.

Before ordering: give a clear, stand-alone disclosure with no liability waiver, obtain signed authorization, and certify permissible purpose to the screening agency. After the report: review it before acting, run an individualized assessment where required, and follow the pre-adverse and final adverse action steps. Keep disclosures, authorizations, notices, and delivery dates on file.

Applicant state

Role add-ons

Investigative consumer report

Reference interviews, character inquiries, in-depth verification.

MVR (any driving role)

Motor vehicle record required for the role.

DOT-regulated CDL driver

Adds Clearinghouse, PSP, §391.23, DOT drug test.

Healthcare / federal programs

Any Medicare/Medicaid/TRICARE-touching role.

Your checklist

Pre-order (before running the report)

☐ Stand-alone FCRA disclosure delivered
FCRA §1681b(b)(2)(A) — clear and conspicuous disclosure in a document that consists solely of the disclosure.
☐ Written authorization obtained
Signed by the applicant, retained in the personnel file for at least 5 years after the hire decision.
☐ Permissible purpose documented
Employment purposes under FCRA §1681b(a)(3)(B) certified to the CRA.
☐ California state disclosure layered on top
Dual ICRAA + CCRAA disclosure; July 2024 FEHA regulations expand criminal-record assessment requirements.

If adverse action considered

☐ Pre-adverse action notice delivered
FCRA §1681b(b)(3)(A) — includes a copy of the consumer report and the CFPB Summary of Rights.
☐ Reasonable waiting period observed
5 business days minimum (FTC guidance); longer where state or local law requires (Philadelphia 10, San Francisco 7).
☐ California Fair Chance / individualized-assessment steps
Cal. Gov. Code §12952 requires a conditional offer before the criminal inquiry, an individualized assessment, and a five-business-day pre-adverse and post-adverse notice sequence. Los Angeles, San Francisco, San Diego, and Long Beach add overlays.
☐ Final adverse action notice delivered
Includes CRA name/address/phone, statement that the CRA did not make the decision, and applicant's right to a free file disclosure and §1681i dispute rights.

Retention & documentation

☐ Consumer report and disclosures retained ≥ 5 years
Best practice under FCRA and state recordkeeping statutes.
☐ Adverse action audit trail retained
Copy of pre-adverse, waiting-period documentation, applicant response (if any), individualized-assessment worksheet, final adverse action letter.

Adverse action timeline calculator — day-by-day pre-adverse and final adverse dates.
Adverse action letter generator — draft the actual notices.
Sample forms library — free, editable disclosure and authorization forms.
State matrix — every state's lookback, ban-the-box, salary history, and cannabis rules.

Educational tool. Not legal advice. Confirm any final compliance decisions with employment counsel.

FCRA compliance checklist generator.