FCRA Adverse Action Process: A Step-by-Step Guide for Employers

When an employer intends to take action that negatively impacts an individual’s employment based on a background screening check, federal law requires they follow a specific process to protect the rights of the applicant/employee. This process, known as adverse action, applies to any negative employment decision influenced by a consumer report (whether that means rejecting an applicant, rescinding a job offer, denying a promotion, etc.).

The following is a step-by-step guide for employers to initiate the adverse action process, which can help protect you and your candidates by ensuring fairness and accuracy in hiring decisions.  

What Is Adverse Action Under the FCRA?

Adverse action refers to any employment decision based wholly or partially on information contained in a background check report that negatively affects a job applicant or current employee. The Federal Trade Commission, via the Fair Credit Reporting Act, defines adverse action broadly to include the following:

• Refusing to hire an applicant
• Rescinding a conditional job offer
• Denying a promotion or reassignment
• Terminating employment
• Reducing job responsibilities or compensation

Adverse action requirements cover all work arrangements, even those of contractors and temporary workers, not just those of full-time employees.

When Is the Adverse Action Process Required?

The critical factor is whether the background check information influenced your decision "in whole or in part." In other words, even if other factors contributed to your decision against hiring, promoting, or retaining someone, if the background report played any role, you are bound to the adverse action procedures outlined by federal law.  

This requirement applies to various types of background checks, including the following:

• Criminal history reports
• Credit reports (where legally permitted)
• Employment and education verification
• Driving records
• Professional license verification

And for healthcare employers, adverse action decisions often involve license verification, OIG exclusions, and Joint Commission standards.  

The Three-Step Adverse Action Process

The FCRA, along with FTC and best practice guidance, establishes a clear three-step framework that employers should follow before making a final negative employment decision.

Step 1: Send a Pre–Adverse Action Notice (FCRA Requirement)

Before making any final decision, employers should provide the applicant with a pre-adverse action notice, informing the individual of the possibility of adverse action based on the background check results.

Per the FCRA, the pre–adverse action notice should include two specific components:

1. A complete copy of the background check report: This copy allows the applicant to see exactly what information the employer reviewed. The report should be the actual document from the consumer reporting agency, not a summary or partial excerpt.
2. A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act": This standardized document from the Consumer Financial Protection Bureau (CFPB) explains the applicant's legal rights, including their right to dispute inaccurate information and obtain additional free copies of their report. (State law may require additional notices, depending on the applicant’s state of residence or job location.)

Additionally, though not required by the FCRA, the notice should also include these elements:

1. An indication that you are considering taking adverse action, not that you have already made a final decision.
2. The name and contact information of the credit reporting agency that provided the report, so the candidate can contact them to dispute any items of information they consider inaccurate.
3. The client’s phone number and/or email address for their own company, so the candidate can reach out to provide additional documents or evidence of rehabilitation and mitigating circumstances.

The FCRA doesn't explicitly require businesses to provide the pre-adverse notice in writing, but best practice dictates that employers should always provide written documentation.  

Step 2: Provide a Reasonable Waiting Period

After sending the pre-adverse action notice, the FTC states that employers should wait a "reasonable" amount of time before proceeding with a final decision, which allows the applicant to review the background check report and take action if they identify errors or wish to provide context about the findings.

The FTC recommends waiting at least five business days to provide adequate time, especially if the applicant needs to gather documentation or contact the consumer reporting agency.

State and local laws may require waiting periods of varying lengths. Examples include the following:

• California: Requires employers to wait at least five business days after confirmation of receipt. When notices are sent electronically, California law presumes the notice is received two days after sending, adding to the total waiting period.
• Washington State: Beginning July 2026, the Washington Fair Chance Act will impose two-day waiting requirements for employers with 15 or more employees.
• New York City: The Fair Chance Act requires that the job stay open for five business days, and allows employers to provide extra time to gather more information.

The applicant may respond in several ways:

• Dispute inaccurate information: If the applicant identifies errors in the report, they can file a dispute with the consumer reporting agency. When this occurs, the adverse action process should pause while the CRA investigates. Under FCRA guidelines, consumer reporting agencies have 30 days to complete their investigation and provide updated results, if applicable.
• Provide additional context to the employer: The applicant might explain circumstances surrounding the background check findings, such as evidence of rehabilitation, extenuating circumstances, or information showing the record doesn't reflect current character.
• No response: If the applicant doesn't dispute the findings or provide additional information within the waiting period, employers may proceed to the final step.

During this waiting period, employers should avoid making any internal decisions that would be difficult to reverse, such as marking the candidate as "rejected,” informing other team members that the position has been filled, or communicating with the candidate in ways that suggest a final decision has been made.

Step 3: Issue the Final Adverse Action Notice

If you decide to proceed with the adverse action after the waiting period has concluded, either because the applicant failed to respond, their dispute was resolved in favor of the original report, or the additional context they provided didn't change your decision, you must send a final adverse action notice (within three business days of the action) that includes the following:  

1. Confirmation that adverse action has been taken, which states clearly that that adverse action has been taken based in whole or in part on a consumer report received from information in the background check report.
2. The name, address, and phone number of the consumer reporting agency, which allows the applicant to contact the CRA directly if they have questions about the report.
3. A statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide to the consumer the specific reasons why the adverse action was taken.
4. Notice of the applicant's right to dispute the report's accuracy or completeness with the CRA.
5. Notice of the right to obtain a free copy of the report, which applicants can do within 60 days.

The final notice officially concludes the adverse action process and documents your compliance with federal law. Like with the pre-adverse notice, best practices dictate that this communication be given in writing and retained in your records.

Individualized Assessment and the EEOC Green Factors

While not explicitly required by the FCRA,  many employers have adopted individualized assessment best practices to reduce discrimination risk and strengthen compliance defensibility. These assessments involve evaluating criminal history information in the context of the specific job, rather than applying blanket disqualification policies.

According to EEOC Enforcement Guidance, employers can demonstrate that a criminal background check policy is job-related by considering at least three factors (known as the "Green factors" from a 1975 court case):

1. The nature and gravity of the offense. How serious was the criminal conduct? Does it directly relate to the job responsibilities?
2. The time that has passed. How long ago did the offense occur? Has sufficient time elapsed to demonstrate rehabilitation?
3. The nature of the job. Would the applicant’s criminal history directly affect their job duties?

Some jurisdictions, including Los Angeles, legally require individualized assessments before employers can take adverse action based on criminal records. Even where not legally mandated, these assessments demonstrate good faith efforts to comply with anti-discrimination laws and can reduce legal liability.

Common Adverse Action Mistakes (And How to Avoid Them)

Despite the relatively straightforward framework, employers frequently make some costly errors during the adverse action process that potentially opens them up to litigation:

Mistake #1: Skipping the Pre-Adverse Action Step

Some employers mistakenly believe they can move directly to rejecting an applicant without first providing a pre-adverse action notice and waiting period.  

However, skipping the pre-adverse notice can result in a class action lawsuit. Major employers have faced significant litigation for failing to provide proper pre-adverse action notices.

Implement clear policies requiring pre-adverse action notices for any negative employment decision influenced by background check results.  

Mistake #2: Providing Insufficient Waiting Time

Due to hiring pressure, some employers provide pre-adverse action notices but fail to wait an adequate period before making final decisions. But insufficient waiting periods contravene the FCRA's recommendation for "reasonable" time and can invalidate your entire adverse action process.

Establish a standard waiting period of at least five business days as your baseline, and research specific requirements for the states and localities where your applicants are located. Document the date you sent the pre-adverse notice and consider using calendar reminders or automated systems to ensure you don't proceed prematurely.

Mistake #3: Failing to Include All Required Documents

Complete adverse action notices require specific attachments, including the background check report itself and the CFPB's Summary of Rights document. Some employers provide partial reports or summaries, fail to take required state notices and/or FC forms into account, or forget to include the rights document altogether.

These incomplete notices, however, fail to meet FCRA requirements and deprive applicants of their legal right to review complete information and understand their options for disputing inaccuracies.

Consider creating a checklist for both pre-adverse and final adverse action notices listing all required components.  

Mistake #4: Making Internal Decisions Before the Process Concludes

Employers sometimes mark candidates as rejected in their systems, communicate internally that a position has been filled, or make commitments to other candidates before completing the adverse action process. But these premature actions can signal that the employer never genuinely considered the applicant's response or gave them a fair opportunity to dispute findings, undermining the entire purpose of the FCRA's protections.

Consider training hiring managers and HR personnel to treat pre-adverse action as exactly what it says: a preliminary notice before any final decision. Keep applications active in your system until you send the final adverse action notice.

Mistake #5: Ignoring State and Local Fair Chance Laws

Beyond federal FCRA requirements, many states and cities have enacted ban-the-box and fair chance hiring laws that impose additional obligations during the adverse action process. If you violate these laws, you could incur separate penalties beyond FCRA damages, including fines, mandated policy changes, and additional litigation exposure.

Make sure to conduct regular reviews of hiring laws in all jurisdictions where you recruit and employ workers.  

Best Practices for Maintaining FCRA Compliance

Consider implementing proactive compliance strategies to strengthen your adverse action process and reduce legal risk.

Develop Clear Written Policies

Create comprehensive written policies that outline your organization's entire background check process, from initial disclosure through final adverse action. Consider specifying

• which positions require background checks;
• what types of checks will be conducted;
• the criteria used to evaluate background check results;
• the step-by-step adverse action procedure;
• timeframes for each stage of the process; and
• roles and responsibilities for HR staff and hiring managers.

Written policies ensure consistency across your organization and provide evidence of your good faith compliance efforts if regulators ever question your procedures.

Train Hiring Managers and HR Personnel

Even the best policies fail if the people implementing them don't understand their obligations. Provide regular training to everyone involved in hiring decisions, covering

• basic FCRA requirements and why they matter;
• how to recognize when adverse action procedures are necessary;
• step-by-step guidance for conducting pre-adverse and final adverse action;
• state and local law variations that apply to your organization; and
• common mistakes and how to avoid them

Consider providing quick reference guides or checklists that hiring managers can consult when making employment decisions.

Leverage Technology and Automation

Modern background screening platforms offer built-in adverse action workflows that guide users through each required step, automatically generate compliant notices, track waiting periods, and maintain documentation. These systems can

• prevent users from proceeding to final decisions before waiting periods conclude;
• generate standardized notices that include all required elements;
• maintain audit logs documenting when each notice was sent;
• send automatic reminders to hiring managers about pending adverse action cases; and
• integrate with applicant tracking systems to ensure consistent processes.

Automation helps busy hiring managers cover the critical compliance steps they might otherwise inadvertently miss.

Document Everything

Maintain detailed records of your entire adverse action process for each candidate, including

• dates when pre-adverse and final adverse action notices were sent;
• copies of all notices and attachments provided to applicants;
• documentation of the waiting period;
• records of any applicant responses or disputes;
• notes from individualized assessments; and
• final hiring decisions and the reasons for those decisions;

Proper documentation helps protect your organization if an applicant later claims you failed to follow required procedures. The FCRA requires that employers securely dispose of background check information according to the FTC's Disposal Rule, which means shredding paper documents and permanently erasing electronic files when you no longer need them.

Conduct Regular Compliance Audits

Periodically review your background check and adverse action processes to identify potential compliance gaps. Consider

• reviewing a sample of recent adverse action cases to ensure all steps were followed correctly;
• checking whether your disclosure and authorization forms still comply with current legal standards;
• verifying that hiring managers are following documented policies;
• updating procedures to reflect new state and local laws; and
• assessing whether your waiting periods are adequate for all relevant jurisdictions.

Regular audits help catch problems before they result in violations and demonstrate your organization's commitment to compliance.

The Financial and Reputational Cost of Non-Compliance

If you fail to follow FCRA regulations regarding adverse action, your business may face these potential consequences.

Statutory Damages

Negligent violations (i.e., honest mistakes) can result in actual damages plus reasonable attorney’s fees, where willful violations (i.e., when you should have known better) can result in actual or statutory damages of $100 - $1,000 per violation, plus punitive damages, and reasonable attorney’s fees.  

When a company's non-compliant practices affect hundreds or thousands of applicants, these statutory damages multiply quickly; class action settlements commonly reach millions of dollars.

Operational Disruption

Beyond financial penalties, FCRA litigation can result in the following:

• Court orders requiring companies to halt background check programs while implementing emergency compliance measures
• Mandatory changes to hiring processes and documentation
• Intensive internal audits requiring significant staff time and resources

Reputation Damage

News of FCRA violations and class action lawsuits can harm an organization's reputation among job seekers, customers, and investors. In today's environment, where candidates research potential employers extensively, companies known for unfair hiring practices may struggle to attract top talent.

Conclusion: Building a Compliant and Fair Hiring Process

The FCRA adverse action process exists to balance two important interests: employers' need to make informed hiring decisions and applicants' rights to fair treatment and accurate information. By following the appropriate steps—pre-adverse action notice, reasonable waiting period, and final adverse action notice—you can demonstrate your respect for applicants while helping protect yourself from legal liability.