Celebrating 40 Years of Compliance Leadership
The hiring process requires more than just finding the right candidate: it means adhering to federal regulations to protect your organization and your applicants. The Fair Credit Reporting Act (FCRA) establishes strict guidelines for employers (referred to as “end-users”) who need to utilize background checks for employment decisions.
Regulatory compliance to the FCRA’s provisions is non-negotiable; in a recent webinar entitled “The FCRA and You,” DISA Global Solutions’ Compliance Investigation Manager Eden Hutchinson broke down the essential responsibilities for end-users under the FCRA.
According to federal law, an end-user must have a permissible purpose under the FCRA to request a background check; employers cannot simply order a report without a legally sound reason. The FCRA explicitly lists several permissible purposes for obtaining these reports, with the two most common and widely accepted purposes being as follows:
Employment purposes are straightforward: they cover situations like hiring a new applicant or retaining a current employee. In these cases, the FCRA requires the employer to provide specific certification to the credit reporting agency (CRA) to certify that 1) they have complied with disclosure and authorization requirements, 2) that they will follow adverse action rules if applicable, and 3) that they will not use the information to violate equal opportunity laws.
Obtaining a report at the written instruction of the consumer is less common; usually, these requests involve scenarios like placing a contractor at a worksite.
Before an employer can procure a consumer report for employment purposes, they are legally required to provide the candidate with proper disclosure in writing.
This disclosure should never be combined with other job elements like benefits information or a criminal history questionnaire. In her webinar, Hutchinson noted that "those types of things, when they are combined with the disclosure, are considered to be extraneous." She further emphasized that, according to recent case law, adding extraneous information explicitly violates the FCRA's strict "solely" requirement.
Employers are also required to obtain written authorization, often called a consent form, from the consumer before the employer actually procures the consumer report. While the FCRA technically permits combining the disclosure and the authorization on the same document, Hutchinson recommended keeping those two documents separate.
Any employment decision that 1) negatively impacts the consumer based in any way 2) is based on a CRA report, needs to follow the FCRA’s adverse action steps.
As Hutchinson pointed out, "a lot of people think that adverse action only applies when you decide not to hire an applicant. But really, in the realm of employment, adverse action can mean a lot of different things." Adverse action can involve firing an existing employee, demoting an individual, or restricting job responsibilities like driving privileges.
The federal adverse action process generally consists of three distinct steps:
While not a direct requirement of the federal FCRA, Hutchinson recommended using individualized assessments as a best practice to avoid disparate impact discrimination. This step helps determine whether the background information is genuinely applicable and relevant to the specific role.
The Equal Employment Opportunity Commission (EEOC) provides a strong framework for this assessment through the use of "Green factors,” which guide employers in considering important context before taking final adverse action. These factors include the following:
Taking these proactive steps fosters a fair, compliant hiring environment and helps mitigate risk for compliant organizations.
At DISA Global Solutions, we understand that remaining compliant with the FCRA can be a complex and time-consuming process. From securing standalone, written disclosures to executing the multi-step adverse action process, every detail matters when utilizing consumer reports for employment decisions; we are dedicated to helping employers stay FCRA compliant by supporting you through every step of the hiring journey.
Our comprehensive background check services assist employers with the heavy lifting of the adverse action process. DISA provides our corporate clients with essential email notifications to streamline this workflow, including the following:
Additionally, for clients enrolled in DISA's consortium (site access) program, we take it a step further by directly mailing the adverse action letter to the applicant on your behalf.
Whether you are a large enterprise managing recruiting complexities across multiple departments and locations or a small business needing occasional screenings, our platform is easily configurable to fit the way you recruit. DISA provides the robust tools and deep industry expertise you need to hire with confidence. Contact us today to learn more about safeguarding your organization from compliance risks.
Yes, generally electronic signatures are acceptable as long as you comply fully with the eSign Act. You should consider using a safe and secure method for obtaining them and secure the consumer's permission to use electronic signatures. However, some specific forms, like certain DOT authorizations, require a wet signature.
While the FCRA does not technically require waiting for the entire report to finish, you are legally required to provide a copy of the report with your pre-adverse action notice. It is very difficult to satisfy this requirement without a completely finalized report. Best practice strongly suggests waiting until the background check is fully complete before starting the adverse action process.
Combining these disclosures is not recommended. The FCRA requires an investigative consumer report disclosure to contain a statement informing the consumer of their right to request details on the investigation's nature and scope. Including this specific language in a standard disclosure is considered extraneous information, which violates the FCRA's strict "solely" requirement.
Technically, no. The FCRA adverse action requirements only apply when an employment decision is based in whole or in part on information obtained from a Consumer Reporting Agency. If the decision relies entirely on information gathered independently by the employer without a consumer report, the FCRA action steps do not apply.
DISA Global Solutions aims to provide accurate and informative content for educational purposes only and does not constitute legal advice. The reader retains full responsibility for the use of the information contained herein. Always consult with a professional or legal expert.
March 17, 2026
