The FCRA §615 adverse-action playbook

Why this playbook exists

FCRA §615(a) is the most-cited and least-followed section of the Fair Credit Reporting Act in employment screening. Most adverse-action workflows we audit fail on one of four points: the candidate didn't get the report before the decision, the waiting period was miscounted, the second notice was never sent, or the documentation can't be reproduced two years later when the CFPB or a plaintiff's attorney asks. This playbook walks through the rule as it actually operates, with the SafestHires implementation as the worked example.

The two-letter sequence in plain English

An "adverse action" in FCRA is any employment decision — rescinded offer, denied promotion, withdrawn assignment — based in whole or in part on a consumer report. §615 requires two communications, in order, with a meaningful gap between them.

Pre-adverse action notice (the first letter)

• Delivered before the final decision is made. The decision must remain reversible.
• Includes a copy of the consumer report that prompted the concern.
• Includes the CFPB's Summary of Your Rights Under the FCRA (the current bilingual version).
• Identifies the consumer reporting agency by name, address, and toll-free number.
• States that the CRA did not make the decision and cannot explain the reasons for it.

Final adverse action notice (the second letter)

• Delivered after the waiting period has elapsed with no successful dispute.
• Confirms the decision and the candidate's continued right to dispute the report's accuracy directly with the CRA.
• Repeats the CRA's contact details and the Summary of Rights.

The timing math no one teaches you

FCRA does not specify a numeric waiting period. The 1997 FTC Weisberg opinion letter and a long line of district court rulings have settled on five business days as the safe-harbor floor in most jurisdictions — long enough for the candidate to receive the letter by mail, request the report if not enclosed, and initiate a dispute. Several state and city overlays (NYC, San Francisco, Los Angeles, Cook County, parts of New Jersey) extend this to seven calendar days plus an individualized assessment step.

SafestHires defaults to a seven-business-day clock and re-counts it from delivery confirmation, not from print date. When a candidate opens the secure portal to download their report, that timestamp becomes the floor for the second notice — never the print job that the ATS triggered the night before.

Candidate-friendly language that still protects the employer

The most common reason a pre-adverse letter fails in litigation is plain language: it reads like a denial. A compliant pre-adverse letter must keep the decision reversible, which means the prose must not announce a decision. SafestHires templates lead with: "We received your background report and want to give you a chance to review it before we make our final hiring decision." The substantive change in candidate response rates is measurable — disputes filed in the seven-day window rose 38% when we moved to this format, and frivolous disputes (those withdrawn within 24 hours) fell.

The documentation that survives a CFPB inquiry

For each adverse action SafestHires preserves, for seven years:

• The exact PDF rendering of both letters as delivered.
• Delivery method, timestamp, and proof of receipt (email open + portal login + USPS tracking when applicable).
• The version of the Summary of Rights enclosed, with hash of the source file.
• The decision-maker's identity, the requisition ID, and the data points cited.
• Any dispute filed by the candidate and the resulting reinvestigation outcome.

State and city overlays that re-shape the workflow

FCRA is a federal floor. Twenty-seven states and forty-plus cities add steps that change what "compliant" means in the local jurisdiction. The biggest re-shapers:

• New York City Fair Chance Act: requires a written Article 23-A individualized assessment delivered with the pre-adverse letter, plus a minimum five-business-day response window.
• California ICRAA: adds a parallel consumer notice and a requirement to provide the report electronically if the candidate elects.
• Los Angeles Fair Chance Initiative: requires a written assessment, a five-business-day candidate response window, and posting of a workplace notice.
• San Francisco Fair Chance Ordinance: mirrors LA with additional ordinance-specific posting and recordkeeping.
• New Jersey Opportunity to Compete Act: bars consideration of certain records categorically; adverse action analysis must precede the §615 letters.

Common failure modes we see in audit

1. The "automated" pre-adverse: the ATS sends the letter the same minute the report flags red. No human reviewed the report. CFPB regards this as evidence the decision was already made.
2. Counting the wrong days: employer counts from print date. Letter sits in mail four days. Candidate gets one business day to respond. Plaintiff wins on willfulness.
3. Missing Summary of Rights: employer used a 2018 PDF. The CFPB rewrote it in 2023. Class certified.
4. No final notice: employer sent the pre-adverse, candidate didn't respond, employer never sent the second letter. Per §615(a), the candidate never received notice that the decision became final.

How SafestHires automates this without removing the human

Every adverse action workflow has a required human checkpoint: a designated adjudicator reviews the report, selects the matrix outcome, and confirms intent before the pre-adverse letter generates. The platform then handles delivery, the waiting-period countdown, the dispute window, the candidate communication, and the final notice trigger. The adjudicator gets one more checkpoint before the second letter releases. Two human decisions per case, twenty-eight automated steps in between, and a fully reconstructable audit trail at the end.