TL;DR

A Consumer Reporting Agency (CRA) is any company that assembles or evaluates information on individuals and provides it to third parties for credit, employment, or other permissible purposes. Under the FCRA, CRAs bear significant legal obligations around data accuracy, candidate rights, and how they respond to disputes.

What Makes a Company a CRA

The definition is functional, not based on what a company calls itself. Under 15 U.S.C. § 1681a(f), a CRA is any person who regularly engages in the practice of assembling or evaluating consumer credit information or other consumer information for the purpose of furnishing reports to third parties. That sweeps in a wide range of vendors: traditional background check companies, credit bureaus, tenant screening services, and employment verification platforms.

Size is irrelevant. A two-person firm doing employment screening is a CRA. So is Equifax. What matters is whether the company is regularly collecting and selling consumer information for permissible purposes.

The three major credit bureaus — Equifax, Experian, TransUnion — are CRAs. So are the specialized employment background check vendors that most HR departments contract with: First Advantage, Sterling, HireRight, Checkr, and dozens of others.

Legal Obligations a CRA Carries

A CRA is not a neutral data pipe. The FCRA imposes direct obligations on CRAs that run parallel to the obligations placed on employers who use the reports.

CRAs must follow reasonable procedures to ensure maximum possible accuracy of information. They must provide candidates with a free copy of their file on request. When a candidate disputes the accuracy of information in a report, the CRA must investigate and either correct the error or remove the disputed item — within 30 days, with a possible 15-day extension if the consumer provides new evidence during the process.

CRAs can only furnish reports for permissible purposes: credit transactions, employment, insurance underwriting, tenant screening, court orders, and a short list of others. Selling a consumer report to someone who just wants to investigate a neighbor is a violation.

For employment specifically, CRAs must: certify that the employer has a permissible purpose, certify that required disclosures and authorizations were obtained, and maintain records of who received each report.

Why It Matters for Recruitment

Choosing a CRA is not a procurement formality. When your company signs a contract with a background check vendor, you are entering a compliance relationship with shared obligations under the FCRA.

Employers certify to the CRA that they will use reports only for employment purposes, that they provided required disclosures, and that they obtained written authorization. The CRA is supposed to have its own procedures to ensure these certifications are accurate. In practice, both sides share liability when something goes wrong.

CRA errors are common enough that there is sustained class action litigation against the largest vendors. Candidates have the right to dispute errors in their reports, and a CRA that fails to investigate properly is directly liable. That can expose employers too, especially if they relied on an inaccurate report for an adverse action without checking.

In Practice

A company uses a national CRA to screen 500 candidates annually. A candidate disputes a criminal record that belongs to someone with the same name — a mixed file error. The CRA is legally required to investigate within 30 days, identify the error, and correct the candidate's report. If the company already withdrew the job offer based on the inaccurate report, they may need to reinstate the candidate and potentially face liability for FCRA non-compliance. The $1,000 per-violation statutory damages available under the FCRA, multiplied across a class of plaintiffs, is why the major CRAs have faced nine-figure settlements.

Key Facts