FCRA Checklist for Hiring Managers: Compliance Steps

=

The FCRA Checklist Every Hiring Manager Should Print and Tape to Their Desk

Estimated reading time: 6 minutes

• Confirm permissible purpose
  • Verify the job legitimately requires a consumer report (employment is a permissible purpose). If you’re screening volunteers or contractors, confirm whether the same rules apply.
  • Check applicable state and local restrictions (credit checks, criminal-history screening, and “ban-the-box” rules vary widely).
• Obtain a proper disclosure and written authorization — before ordering the report
  • Use a standalone disclosure that clearly states you may obtain a consumer report for employment purposes; do not bury it in an employment application or combine it with other authorizations.
  • Obtain a clear, signed (or electronic) authorization from the applicant. Retain this authorization.
• Use job-related screening criteria and documented policies
  • Create and apply consistent, role-specific policies that explain which records are disqualifying and why (e.g., driving offenses for driving roles).
  • For criminal-history decisions, use individualized assessments when required by federal guidance or local law: consider nature of offense, time elapsed, and relationship to job duties.
• Order the report from a CRA and certify compliance
  • When you place the order, certify to the CRA that you have a permissible purpose and will comply with the FCRA requirements for disclosure, authorization, and adverse action.
• Review reports carefully and verify identity
  • Confirm the report belongs to the candidate (name, DOB, SSN last four, etc.) before using it for decision-making.
  • If identity is uncertain, pause the decision and request clarification or additional verification.
• Handle preliminary concerns with a pre-adverse action process
  • If the report contains information that could lead to a rejection or rescinded offer, provide a pre-adverse action packet that includes:
    • A copy of the consumer report used
    • A summary of the consumer’s rights under the FCRA (the CRA is required to provide this)
  • Allow reasonable time for the candidate to review and dispute inaccuracies before you take final adverse action.
• If you proceed to adverse action, send an adverse action notice
  • The adverse action notice must include:
    • The name, address, and phone number of the CRA that supplied the report
    • A statement that the CRA did not make the adverse decision and cannot provide specific reasons
    • A notice of the candidate’s right to obtain a free copy of the report within 60 days and to dispute accuracy
  • Keep copies of the notice and proof of mailing or delivery.
• Document every step and retain records
  • Save a copy of the disclosure, the signed authorization, the consumer report used for the decision, any pre-adverse/adverse notices, and notes of the decision-making process.
  • Establish a retention schedule consistent with company policy and legal counsel recommendations; maintain audit trails for at least the period during which claims could arise.
• Respond promptly to disputes and CRA reinvestigations
  • If a candidate disputes report accuracy, rely on the CRA’s reinvestigation but coordinate and update your hiring decision if the record is corrected.
  • Avoid taking irreversible adverse action while a dispute is active, especially if corrections are likely.
• Apply state/local rules and credit-report restrictions
  • Before ordering credit reports or using certain public records, verify whether state law limits their use for employment decisions.
  • Respect local “fair chance” ordinances that may require delaying inquiries into criminal history until later in the process.
• Train interviewers and hiring staff
  • Ensure everyone who sees background information understands what they can and cannot use in selection decisions and how to follow the pre-adverse/adverse action steps.
  • Restrict access to consumer reports to personnel with a legitimate business need.

1. Before posting or screening:
   • Confirm the position’s screening rules and whether a consumer report is necessary.
   • Update your job-related disqualification criteria and have legal or HR review for high-risk roles.
2. When you decide to screen:
   • Deliver the standalone disclosure and collect the written authorization.
   • Place the order with your CRA and certify permissible purpose.
3. After receiving the report:
   • Verify the report pertains to the candidate.
   • Evaluate findings against your documented criteria.
   • If findings could disqualify, issue a pre-adverse action packet and pause.
4. After the candidate’s response window:
   • If no dispute or the dispute does not change the outcome, send the adverse action notice with required CRA contact details.
   • Document the decision and retain records.

• Mistake: Combining the disclosure with other documents or burying it in an application.
  
  Fix: Use a clear, standalone disclosure every time.
• Mistake: Failing to provide a pre-adverse action packet before rescinding an offer.
  
  Fix: Always provide the candidate a copy of the report and the summary of rights and allow time to respond.
• Mistake: Treating all criminal records the same regardless of job relevance or time elapsed.
  
  Fix: Use individualized, job-related assessments and follow state/local rules.
• Mistake: Ignoring recordkeeping and proof of compliance.
  
  Fix: Keep stamped copies, delivery receipts, or electronic logs that demonstrate you followed FCRA steps.

• Standardize and document. Create templates for disclosures, authorizations, pre-adverse packets, and adverse action notices so every hiring manager follows the same compliant workflow.
• Make job-relatedness your north star. Decisions tied to specific job duties are more defensible than blanket exclusions.
• Treat disputes as a pause. If a candidate challenges accuracy, delay adverse action until the CRA reinvestigation is complete or you have additional corroboration.
• Keep state rules in your operating playbook. Build a quick-reference matrix of state/local limitations and share it with interviewers.
• Train and limit access. Only authorized personnel should see consumer reports, and everyone who reviews them must understand the pre-adverse/adverse process.

Stand-alone disclosure given and signed before ordering
Written authorization obtained and saved
CRA certified with permissible purpose
Identity verified on report (DOB/SSN match)
Pre-adverse packet sent if considering negative action
Candidate allowed time to dispute (and dispute considered)
Adverse action notice sent with CRA details if proceeding
All documents saved in the candidate file

• Provide compliant disclosure and authorization templates and integrate them into your hiring workflow
• Maintain audit trails and documentation of all communications
• Deliver pre-adverse and adverse action notices formatted to meet FCRA requirements
• Flag state and local restrictions and recommend job-related policy language
• Offer dispute-management support and coordinate CRA reinvestigations

Choosing a partner that prioritizes compliance helps shift administrative burden away from hiring managers, reduces errors, and builds a defensible hiring process.