Quick answer

Under the FCRA you must (1) obtain a written disclosure and consent before ordering a consumer report, (2) send a pre-adverse action notice that includes a copy of the report and the FCRA Summary of Rights and wait a reasonable time (commonly at least five business days), then (3) if you proceed, send a final adverse action notice with the FCRA-mandated elements.

Quick overview — Adverse Action Process Step-by-Step: the two-step workflow

The FCRA prescribes a two-step adverse action workflow for employment screening:

  1. Pre-adverse action notice: provide the applicant the consumer report and the FCRA Summary of Rights so they can review and dispute inaccuracies.
  2. Final adverse action notice: if you still deny employment, notify the applicant, and include the CRA contact information and dispute rights.

Also: obtain a written disclosure and consent before running any report. No consent, no report, no adverse-action process. For the federal baseline on disclosure and consent, see our FCRA background check requirements for employers.

Step 1 — Obtain disclosure and written consent before any background check

Do this first:

  • Provide a clear, standalone written disclosure that you may obtain a consumer report for employment purposes. Do not bury it in an application or combine it with other authorizations.
  • Get the applicant’s written consent (signed or electronic) before ordering the report.

Include the FCRA Summary of Rights where required or provide access. Many screening vendors supply a compliant disclosure and the Summary of Rights. If you operate in a jurisdiction with a “ban-the-box” or fair-chance law, you may be barred from requesting conviction history or asking criminal-history questions until later — check local rules before running a criminal search.

Practical tip: standardize your disclosure and consent forms and have your screening vendor host electronic consent to reduce lost signatures and audit gaps.

Step 2 — Pre-Adverse Action Notice: what to send and why

Before you take adverse action (deny hire, rescind offer, or terminate based on a consumer report), provide the applicant:

  • A copy of the consumer report you relied on.
  • A copy of the FCRA Summary of Rights.

Why: the applicant must have a chance to review and correct errors before you act. Many suits arise because employers skipped this step or used an old/incomplete report.

Delivery: email is acceptable if you can show receipt (delivery/read receipts, secure candidate portal). Certified mail is safer for high-risk roles or when local law requires signed delivery. Your vendor can often email the report and track delivery timestamps.

Practical employer tips:

  • Send the pre-adverse package promptly after you receive the report. Delay increases risk.
  • Give plain-language context: state what report component triggered concern (e.g., “criminal conviction on 3/12/2016 for theft”) and invite the applicant to respond or submit documentation.
  • Keep the exact report copy you sent. That’s proof if there’s a dispute.

Sample pre-adverse action notice content (must-haves)

Required:

  • Copy of the full consumer report the CRA provided.
  • Copy of the FCRA Summary of Rights (or link and printed copy).

Suggested additions (not legally required but helpful):

  • Employer ID and job applied for.
  • Plain statement: “This is a pre-adverse action notice. We are considering not hiring you based on information in the attached report. You may dispute the report with the consumer reporting agency or provide documentation to us within [X days].”
  • How to submit supporting documents (email address or portal).
  • Recommended wait: request a response within five business days.

Example text you can adapt:

“Attached is the consumer report we received from [CRA name]. This is a pre-adverse action notice required by federal law. You have the right to dispute the accuracy of this report with [CRA contact info], and you may also provide documentation to us that you’d like us to consider. Please send documents to HR@[yourcompany].com within 5 business days.”

Step 3 — Waiting period and what “reasonable” means

The FCRA doesn’t set a fixed number of days between pre-adverse and final notices. Common practice — and sensible risk management — is at least five business days for the applicant to dispute the report.

A five-business-day window:

  • Gives the applicant time to receive and read the report.
  • Keeps hiring moving.
  • Is defensible in audits and litigation.

If you mailed copies, add mailing time. If state or local law requires a longer wait, follow that. For conservative practice in high-risk hires, consider seven business days.

Five business days is the minimum you should accept unless local law says otherwise. Fewer than three business days increases litigation risk; more than ten will stall hiring.

Step 4 — Final Adverse Action Notice: content and delivery

If, after the waiting period, you still plan to take adverse action, send a final adverse action notice. FCRA-required content:

  • A clear statement that adverse action was taken (e.g., offer withdrawn, employment terminated).
  • The name, address, and telephone number of the consumer reporting agency (CRA) that supplied the report.
  • A statement that the CRA did not make the adverse decision and cannot provide the reasons for it.
  • Notice of the consumer’s right to obtain a free copy of the report from the CRA within 60 days.
  • Notice that the consumer has the right to dispute the accuracy or completeness of the report with the CRA.

Delivery: use the same considerations as the pre-adverse notice. Email with proof of delivery is common; certified mail reduces dispute risk.

Sample final adverse action notice content (must-haves)

Required per FCRA — practical wording:

  • “We are writing to inform you that [Company Name] has decided not to [hire/continue employment] you. This decision was based in whole or in part on information contained in a consumer report obtained from [CRA Name, Address, Phone].”
  • “You have the right to obtain an additional free copy of the report from [CRA] within 60 days and to dispute the accuracy or completeness of any information by contacting them directly.”
  • “The consumer reporting agency did not make the decision to take the adverse action and is unable to provide specific reasons for it.”

Optional add-on:

“If you believe this information is incorrect, you can contact [CRA] at [phone, website] to dispute. You may also send supporting documents to HR@[yourcompany].com.”

Keep a copy of the final notice and proof of delivery.

State and local variations employers must check before acting

States and municipalities often add rules on top of the FCRA:

  • Some require longer waiting periods between pre-adverse and final notices.
  • “Ban-the-box” / fair-chance laws may limit when you can ask about criminal history or require individualized assessments before adverse action.
  • Several states have 7-year limits on reporting certain convictions or civil judgments — you cannot rely on records older than state law allows.
  • Some localities require specific language in notices or translations.

Always check state and local law before sending notices. When in doubt, consult counsel or a compliant screening vendor. For guidance on choosing a vendor that helps with these settings, see choosing the right background check service provider.

Example: hiring a delivery driver in Ohio with a 2012 conviction. Ohio may not follow a seven-year restriction that other states enforce; local fair-chance ordinances could require an individualized assessment. Check both state and municipal rules before acting.

EEOC/anti-discrimination considerations in adverse actions

Apply the same standards to all applicants. When relying on criminal records:

  • Consider the nature and gravity of the offense.
  • Consider the time since the offense or completion of the sentence.
  • Consider the nature of the job — is the conviction relevant?

The EEOC recommends individualized assessments for criminal records that disproportionately affect protected classes. Treat criminal-history screening as a potential disparate-impact risk and document your job-relatedness analysis.

Industry- and role-specific rules to watch (DOT, healthcare, etc.)

Some industries add federal or state rules:

  • DOT: regulated drug-testing and driver record checks with specific timelines and record requirements.
  • Healthcare: fingerprint-based checks, exclusion-list screens (OIG/GSA), and special retention rules.
  • Financial services: FINRA or banking regulations about disclosure and timing.

Follow both the FCRA and industry rules. Your screening partner should flag these requirements.

Recordkeeping, documentation, and retention timelines

Keep documentation of the entire adverse-action sequence. Best practice (and commonly required): retain records for at least five years. Include:

  • The disclosure and consent form.
  • The exact consumer report used.
  • Copies of pre-adverse and final notices sent.
  • Proof of delivery and timestamps.
  • Any correspondence or candidate-supplied documents.

Five years is the baseline. Some states or contracts require longer retention.

Costs, penalties, and enforcement risks

Non-compliance carries real costs:

  • FCRA statutory damages typically range from $100 to $1,000 per violation in individual suits.
  • Willful violations can increase damages and lead to attorney’s fees.
  • Class actions can produce multi-million-dollar settlements.
  • Regulatory enforcement may result in civil penalties and corrective measures.

The cost of good processes and a reputable screening provider is usually far less than litigation and settlement exposure.

Role of background screening companies — how they help and what to verify

A competent screening company should:

  • Provide compliant disclosure and consent forms.
  • Deliver copy-of-report packages for pre-adverse notice and track delivery.
  • Generate final adverse action notices populated with CRA contact info and required FCRA language.
  • Track timelines, store sent notices, and produce audit logs.
  • Flag state/local nuances, ban-the-box rules, and industry-specific requirements.

Verify when hiring a vendor:

  • Will they host electronic consent and provide delivery receipts?
  • Do they supply FCRA Summary of Rights and localized notice templates?
  • Can they configure waiting-period timers to match state/local rules?
  • Do they carry errors-and-omissions insurance and provide sample contract language that allocates compliance responsibilities?

If you’re deciding whether to outsource, see the benefits of outsourcing background check services for small businesses and our guide on choosing the right background check service provider.

Practical employer checklist and timeline template (step-by-step)

Step sequence (quick view):

  1. Candidate applies → obtain written disclosure & consent (before ordering).
  2. Run the consumer report(s).
  3. Receive report → determine adverse action risk.
  4. Send pre-adverse action notice with report + FCRA Summary of Rights (Day 0).
  5. Allow at least five business days for response (Day 1–5).
  6. If still adverse, send final adverse action notice (Day 6+).
  7. Record and retain all documents for at least five years.

Checklist:

  • [ ] Signed disclosure & consent on file.
  • [ ] Report saved and timestamped.
  • [ ] Pre-adverse notice sent; delivery proof stored.
  • [ ] Candidate response monitored; documents stored.
  • [ ] Final adverse notice sent with CRA contact info; delivery proof stored.
  • [ ] Records archived for ≥5 years.

Comparison: email vs. certified mail

  • Email: fast, lower cost, acceptable if you can prove delivery/read.
  • Certified mail: stronger proof, higher cost, slower.

Match the method to the hire’s risk level.

Training, audits, and ongoing compliance best practices

Regularly:

  • Train HR and hiring managers on the two-step process and state-specific rules.
  • Audit a sample of adverse-action files quarterly to verify forms, timelines, and retention.
  • Update disclosure and notice templates after regulatory changes.
  • Consult employment counsel for hires in jurisdictions with complex fair-chance or reporting laws.

Audits prevent larger problems. Train now; it’s cheaper than a lawsuit.

Appendix — quick reference: required elements for pre-adverse and final notices

Pre-adverse action required elements:

  • Copy of the consumer report used.
  • Copy of the FCRA Summary of Rights.
  • Clear statement that this is a pre-adverse action and the employer may take adverse action based on the report.

Final adverse action required elements:

  • Notice that adverse action was taken (e.g., offer rescinded).
  • Name, address, and telephone number of the CRA that furnished the report.
  • Statement that the CRA did not make the decision and cannot provide reasons for it.
  • Notice of the right to obtain a free copy of the report within 60 days from the CRA.
  • Notice of the right to dispute the accuracy or completeness of the report with the CRA.

FCRA Summary of Rights (official): FCRA Summary of Rights (PDF)