FCRA compliance is sold as a feature by screening providers, which obscures the important point: the duties in the Act fall on you as the user of the consumer report, and no amount of software moves them. A provider can give you templates, enforce a waiting period and generate letters. It cannot take the obligation. This page sets out what you actually owe, in the order it comes up.
Before you order: disclosure and authorisation
The Act requires a clear and conspicuous disclosure in writing, in a document that consists solely of that disclosure, telling the applicant that a consumer report may be obtained for employment purposes, plus the applicant's written authorisation. The standalone requirement is the part employers get wrong: a disclosure combined with a liability waiver, an at-will acknowledgement or the application form itself has been the subject of a great deal of litigation. Keep it on its own page, keep the authorisation with it, and keep both.
You must certify your purpose
Before a consumer reporting agency will provide the report it requires you to certify that you have a permissible purpose, that you have made the disclosure and obtained authorisation, and that you will not use the information in violation of equal employment opportunity law. That certification is a representation you are making, not a formality the provider needs for its own files, and it is the hook by which a provider's compliance depends on your honesty rather than the other way round.
Before you act: the pre-adverse step
If you are considering taking adverse action, which includes not hiring, not promoting and withdrawing an offer, based in whole or in part on the report, you must first give the applicant a copy of the report and a copy of the Summary of Your Rights Under the Fair Credit Reporting Act, and allow a reasonable period for them to respond. The Act does not set a number of days; five business days is the widely used convention, and several state statutes set their own longer period. The point of the wait is a real opportunity to dispute an error, so a process that sends both notices on the same day defeats it.
Choosing a provider that helps rather than hinders
What to look for is not a compliance badge. It is whether the provider enforces the waiting period rather than letting you skip it, whether it confirms database hits at the originating court before reporting them, whether its disclosure template is genuinely standalone, and whether it configures state-specific rules such as California's seven-year conviction cap. Ask those four questions directly. A provider that answers them precisely is more useful than one whose marketing page says FCRA compliant in large type.
Questions people ask about fcra compliance
Who is responsible for FCRA compliance, me or my provider?
Both, for different duties. The provider owes accuracy procedures and the consumer's dispute rights. The disclosure, the authorisation, the certification of permissible purpose and the adverse action sequence are yours, and software cannot take them.
Can the disclosure go in the application form?
No. The Act requires a document consisting solely of the disclosure. Combining it with a waiver, an at-will acknowledgement or the application itself is the single most litigated error in employment screening.
How long must I wait after the pre-adverse action notice?
A reasonable period. The Act sets no number; five business days is the common convention, and some states require longer. The purpose is a genuine chance to dispute, so sending both notices together defeats it.
What is a permissible purpose?
A lawful reason to obtain a consumer report, which for hiring is employment purposes with the applicant's authorisation. You certify it to the provider before the report is released.