TL;DR

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., is a US federal law that governs how employers and staffing agencies use consumer reports — including criminal background checks, credit reports, and motor vehicle records — in hiring decisions. Agencies must obtain written authorization before ordering a report and follow a two-step adverse action process before withdrawing an offer. Willful violations carry statutory damages of $100–$1,000 per affected individual plus actual damages, punitive damages, and attorney fees, making class action exposure substantial. The UK equivalent is the Data Protection Act 2018, which has no comparable pre-adverse action notice requirement.

Key Takeaways

• Before ordering any consumer report, the agency or employer must (1) make a clear written disclosure — in a document consisting solely of that disclosure — and (2) obtain the candidate's written authorization; combining the disclosure with an employment application violates the FCRA
• Adverse action requires a two-step process: first a pre-adverse action notice (with a copy of the report and the FCRA Summary of Consumer Rights), then a waiting period of at least five business days before sending the final adverse action notice
• Willful FCRA violations: statutory damages of $100–$1,000 per violation, plus punitive damages and attorney fees; negligent violations: only actual damages and attorney fees — courts have found class-action liability running into hundreds of millions of dollars for disclosure form defects alone
• FCRA applies to any "consumer reporting agency" (CRA) — including major background check vendors — and to the staffing agency or employer using the report; both parties have independent compliance obligations

FAQ

Q: Does the FCRA apply to staffing agencies, or only to direct employers?

A: The FCRA applies to any entity that uses a consumer report for employment purposes, explicitly including staffing agencies. Under 15 U.S.C. § 1681b(b), a staffing agency must obtain proper disclosure and authorization before ordering a background check on a candidate it intends to place. The agency is also responsible for following the two-step adverse action process if it decides not to place a candidate based on the report — regardless of whether the client requested the background check.

Q: What is the correct FCRA adverse action process for a staffing agency?

A: The process has two steps. First, before taking adverse action, the agency must send a pre-adverse action notice that includes: a copy of the consumer report, the FCRA Summary of Rights, and notice that the candidate may dispute inaccuracies directly with the CRA. Second, after giving the candidate a reasonable period to respond (typically interpreted as at least five business days), the agency sends a final adverse action notice confirming the decision and providing contact information for the CRA. Both steps are required — sending only the final notice without the pre-adverse action notice is a common violation.

Q: Can a staffing agency use a single form to get background check disclosure and employment authorization at the same time?

A: No. The FCRA requires that the disclosure document consist "solely" of the disclosure. Embedding the disclosure within a general employment application, onboarding packet, or authorization to release information creates a willful FCRA violation. Courts have awarded class-action damages exceeding $100 million in cases where companies used combined forms. The disclosure must be a standalone document — though the authorization can be on the same page as the disclosure.

What the FCRA Requires of Staffing Agencies

FCRA compliance for staffing agencies operates in three mandatory stages: disclosure and authorization before ordering the report, pre-adverse action notice if the report may result in a negative hiring decision, and final adverse action notice if the decision is confirmed. Skipping or combining any of these stages creates a willful or negligent FCRA violation, and courts have declined to accept "we didn't know the rules" as a defense.

The disclosure stage is where most agencies make their most consequential mistakes. The FCRA requires a clear and conspicuous written disclosure made "in a document that consists solely of the disclosure." Courts have interpreted this to mean the disclosure must be a standalone document — not embedded in an employment application, an onboarding packet, or a multi-purpose consent form. The disclosure must inform the candidate that a consumer report may be obtained for employment purposes. The candidate's written authorization — which can appear on the same standalone disclosure document — must be obtained before the report is ordered. A staffing agency that includes the disclosure in paragraph seven of a five-page application form has committed a willful violation, regardless of whether any individual candidate was actually harmed.

The report may include criminal records, credit history, motor vehicle records, civil records, or employment and education verifications — depending on the scope the agency orders and the position. Once ordered, the report belongs to the agency. If the report reveals information that will negatively influence a placement decision, the pre-adverse action process begins immediately.

How FCRA Adverse Action Works in Practice

An industrial staffing agency runs a background check on a candidate for a forklift operator role. The report returns a conviction for reckless driving three years ago. The agency decides this disqualifies the candidate for a role operating heavy equipment on a warehouse floor. Before making that decision final, the agency must send a pre-adverse action package to the candidate. This package must include: a copy of the consumer report, a copy of CFPB's A Summary of Your Rights Under the Fair Credit Reporting Act, and a notice that the agency is considering taking adverse action based on the report.

The candidate then has a reasonable period — the FCRA does not specify a number of days, but five business days is the widely-observed industry standard — to contact the consumer reporting agency to dispute any inaccuracies, or to provide the staffing agency with context (the conviction was expunged, the record belongs to a different person with the same name, or mitigating circumstances exist). If after that waiting period the agency confirms its decision, it sends the final adverse action notice, which must state that adverse action was taken, identify the CRA and provide their contact information, state that the CRA did not make the employment decision and cannot explain why, and inform the candidate of their right to a free copy of the report from the CRA within 60 days and their right to dispute the accuracy of the report.

FCRA in the US vs UK

The FCRA has no direct equivalent in the UK. UK employers and staffing agencies conducting background checks are governed by the Data Protection Act 2018 and the ICO's guidance on criminal record checks under the Rehabilitation of Offenders Act 1974. The UK framework focuses on lawful basis for processing (typically legitimate interests), proportionality, and subject access rights — but contains no pre-adverse action notice requirement equivalent to the FCRA's mandatory two-step sequence.

The Rehabilitation of Offenders Act 1974 creates a framework for when convictions become "spent" and employers cannot legally ask about them. Standard and Enhanced DBS (Disclosure and Barring Service) checks — which can reveal spent convictions — are only available for specific regulated roles (working with children, certain financial positions, healthcare). For most staffing placements, UK recruiters can only access basic disclosure, showing unspent convictions only. This is a significant operational difference: a US staffing agency can obtain a comprehensive criminal background report on any candidate with consent, while a UK agency's access to criminal history is legally restricted by role type.

Penalties and Enforcement

The FCRA distinguishes between willful and negligent violations. For willful violations — which include reckless disregard for the statute's requirements, not just deliberate intent to violate — statutory damages of $100 to $1,000 per violation are available, along with actual damages, punitive damages, and attorney fees. For negligent violations, only actual damages and attorney fees are recoverable. The willful-negligent distinction matters enormously in class action exposure: in a class of 10,000 candidates, statutory damages alone could total $10 million without proving that any individual was actually harmed.

Consumer reporting agencies are also subject to FCRA enforcement by the CFPB, and the FTC enforces FCRA against employers and agencies. Class action lawsuits are the dominant enforcement mechanism against staffing companies — plaintiff firms have built practices around auditing employer disclosure forms for technical defects and filing class actions. Large staffing companies have settled FCRA class actions for amounts ranging from $1 million to over $30 million, primarily based on standalone disclosure form failures. The lowest-cost compliance measure available to a staffing agency is a legal review of its background check disclosure and authorization forms.