Federal baseline

The Fair Credit Reporting Act

The FCRA is the statute that governs background screening in the United States. It binds two parties who are usually described as though they were one: the agency that assembles the report, and the employer who uses it. Most of the confusion in this category, including some of it published by screening companies themselves, comes from assigning a duty to the wrong one.

This page is the federal baseline for the rest of this section. Every state guide links back here rather than restating it, because federal law is the floor everywhere and the state overlays only make sense on top of it.

What the FCRA is, and what a consumer reporting agency is

The Fair Credit Reporting Act is at 15 U.S.C. §1681 et seq. It was enacted in 1970 and has been amended repeatedly since, most substantially by the Fair and Accurate Credit Transactions Act of 2003 and the Dodd-Frank Act of 2010, which moved most federal rulemaking and enforcement to the Consumer Financial Protection Bureau.

A consumer reporting agency is defined at 15 U.S.C. §1681a(f). The definition turns on three things: the entity regularly assembles or evaluates consumer information, for the purpose of furnishing consumer reports to third parties, for a fee or on a cooperative nonprofit basis. A company that does that for employment decisions is a CRA, and the obligations in the statute attach to it directly rather than to its customers.

Personnelgraph is a consumer reporting agency. That is the sentence in the footer of every page on this site, and it is not a formality. It is the reason this section exists.

“Employment purposes” is itself a defined term at§1681a(h), covering hiring, promotion, reassignment and retention. A report furnished for any of those purposes is an employment report, which brings a set of duties that do not apply to a report pulled for credit.

Permissible purpose, and the certification duty

A CRA may furnish a consumer report only for a permissible purpose. Employment is one, at §1681b(a)(3)(B), and only where the employer intends to use the information for that purpose and no other.

The provision that makes this enforceable is §1681e(a), which requires a CRA to obtain certifications from its users and to maintain reasonable procedures to limit furnishing to permissible purposes. It is the duty that turns a CRA from a passive data supplier into a gatekeeper, and it is missing from most summaries of the statute, including the page this one replaces.

In practice the certification is the contract between the agency and the employer. It is also the document that allocates responsibility when something goes wrong, which is why it is worth reading rather than filing.

Disclosure and authorization

Before an employer may procure a report for employment purposes, it must comply with §1681b(b)(2). Two requirements sit here, and the first is the one that generates litigation.

The disclosure must be standalone. Under§1681b(b)(2)(A)(i) it must be in a document that consists solely of the disclosure. A liability waiver, an arbitration clause, a state-law notice or an application form printed on the same page takes it outside the safe harbour. This is the most common source of class actions against both employers and CRAs, and it is a formatting failure rather than a substantive one, which is what makes it so expensive.

The disclosure must be clear and conspicuous, and it must be given before the report is procured rather than before it is used.

The authorization must be written. Under§1681b(b)(2)(A)(ii) the consumer must authorize procurement in writing. The authorization may appear on the disclosure document itself, so the two can share a page. The disclosure may not share a page with anything else.

The seven-year limits

§1681c(a) sets the obsolescence periods. They are the most cited and least accurately described part of the statute.

Convictions are excluded from the limit. The seven-year cap in §1681c(a)(5) applies to “any other adverse item of information, other than records of convictions of crimes”. A criminal conviction may therefore be reported indefinitely under federal law, no matter how old it is.

This is the single most misunderstood point in the category, and it cuts against the intuition of almost everyone who has not read the subsection. Most people assume everything falls off after seven years. Under federal law nothing about a conviction does. The seven-year instinct is not baseless, because a number of states have imposed limits that federal law does not, and a few of them reach convictions. Those are state overlays on top of a federal floor that has no such limit.

The salary threshold, and what it is not

§1681c(b)(3) creates an exception to the obsolescence periods. Where the report is to be used in connection with employment at an annual salary that equals or exceeds $75,000, the limits in subsection (a) do not apply.

The figure is not indexed. There is no CPI clause anywhere in §1681c, and the $75,000 has not moved since it was set. A number of published summaries describe it as rising annually. It does not.

The confusion has a specific origin. There is an FCRA figure that is adjusted every year: the maximum charge a CRA may impose for a file disclosure under §1681j(f), which is set at$16.00 for 2026 and published asRegulation V, Appendix O. That is a price cap for consumers, not a salary threshold for employers. The two get conflated because both are round federal numbers in the same statute.

Several states have set their own threshold, and where they have, the state figure governs in that state.

Where a state has no threshold of its own, the federal $75,000 applies. Washington is one of a small number of states that never updated the pre-1998 federal figure of $20,000. At that level the seven-year cap reaches essentially every job in the state, which is the operationally important consequence and the reason a national screening process cannot run on one set of rules.

Public record notice, and the provision that matters most here

§1681k(a) applies where a CRA furnishes a report for employment purposes that contains public record information likely to have an adverse effect on the consumer’s ability to obtain employment. In that situation the CRA must do one of two things:

1. notify the consumer at the same time that the public record information is reported to the employer, under§1681k(a)(1); or
2. maintain strict procedures designed to ensure that the information is complete and up to date, under §1681k(a)(2).

This is the statutory backbone for court record selection.It is the section that governs what a background screening company's public records process actually has to do, and it is absent from the page this article replaces.

The reason it matters is what “complete and up to date” means for an arrest. A record that shows an arrest but not its disposition is neither. Where a charge was dismissed, a record reporting only the arrest is incomplete, and reporting it invites exactly the adverse effect the section is written to prevent. The obligation is a completeness obligation, not a disclosure one, and it is the difference between searching a name and resolving a case.

It is also a stronger argument for structured court record selection than any claim about automation. A process that documents which courts were searched, what each returned, and what was resolved is the evidence that the procedures are strict. A process that cannot show that is relying on the notification route whether it knows it or not.

Adverse action

§1681b(b)(3) sets out a two-step sequence. It runs through the employer, not the agency, and it is the part of the process most often compressed into one step by accident.

Step one, before the decision. Under§1681b(b)(3)(A), before taking adverse action based in whole or in part on the report, the employer must provide the consumer with a copy of the report and the summary of consumer rights required by§1681g(c).

Step two, after the decision. Under§1681b(b)(3)(B), after taking adverse action, the employer must give notice of the adverse action, the name, address and telephone number of the CRA that furnished the report, a statement that the CRA did not make the decision and cannot give the reasons for it, and notice of the consumer’s right to dispute the accuracy or completeness of the information and to obtain a free copy of the report within 60 days.

The statute sets no number of days between the two steps.It requires only that the copy and the summary reach the consumer before the adverse action is taken. In practice a defined waiting period is what makes that verifiable rather than arguable, and five business days is the period the industry has settled on. A process that says “a reasonable period” has no period, and cannot be audited or defended.

Disputes and reinvestigation

§1681i is the dispute provision, and it is the obligation that our own dispute process exists to serve.

When a consumer disputes the completeness or accuracy of an item, the CRA must reinvestigate free of charge and either record the current status of the information or delete it. The reinvestigation must be completed within 30 days of receiving the dispute, under §1681i(a)(1)(A). That period may be extended by up to15 additional days where the consumer provides further information during the initial 30, under §1681i(a)(1)(B).

The CRA must notify the furnisher of the dispute within5 business days, under §1681i(a)(2), and must provide written notice of the results within5 business days of completing the reinvestigation, under §1681i(a)(6). Where information is found to be inaccurate or incomplete it must be promptly deleted or modified, under§1681i(a)(5)(A).

A consumer who remains dissatisfied may file a brief statement of dispute under §1681i(b), and where it is filed it must be included in any subsequent report, under §1681i(d). The statement is not a footnote. It travels with the record.

Identity theft, alerts and freezes

Two adjacent sections are routinely conflated, and they impose different duties with different clocks.

§1681c-2, the FCRA §605B block. Where a consumer submits an identity theft report and identifies information resulting from identity theft, the CRA must block that information from the report within 4 business days, and may not re-report it.

§1681c-1, the FCRA §605A alerts. This section covers fraud alerts, active duty alerts and security freezes. It governs how a file is flagged and restricted, not what is removed from it.

The difference matters operationally. An identity theft block removes information. A freeze restricts access. A process that treats them as the same thing will fail one of the two clocks.

Summary of consumer rights

§1681g(c) requires the summary of consumer rights to be provided to consumers. The prescribed text isRegulation V, Appendix K, at12 CFR part 1022.

Appendix K was not replaced. There is no successor appendix, and no FCRA disclosure form rulemaking between 2024 and 2026. Cite it by name and nothing else. A summary that invents a citation here is worse than one that cites nothing, because it reads as authority.

The summary must accompany every pre-adverse action notice, because step one of the adverse action sequence requires it alongside the report.

What the employer owes, as distinct from what we owe

This section is the merged content of the former employer responsibilities page, and it exists because the duties split cleanly and are constantly muddled.

The accuracy duty belongs to the agency.§1681e(b) requires a CRA to follow reasonable procedures to assure maximum possible accuracy of the information it reports. That is our obligation. It is not an employer obligation, and an employer cannot discharge it by asking a screening company to be careful.

The employer’s duties are these four.

1. Certify the permissible purpose to the CRA, and use the report for no other purpose, under §1681b(b)(1).
2. Give the standalone disclosure and obtain written authorization before procuring the report, under §1681b(b)(2).
3. Follow the two-step adverse action sequence, under§1681b(b)(3).
4. Not use the report for a purpose the consumer did not authorize, and not retain it longer than the business need and applicable law allow.

There is one more duty worth naming because it appears on no checklist: when a consumer disputes something in a report, the employer may not simply proceed. If the employer has been told a dispute is pending and takes adverse action on the disputed item anyway, the sequence in§1681b(b)(3) has been run ahead of the information it was meant to test.

Where federal law is not the whole story

Federal law is a floor. A number of states have their own consumer reporting statutes that are stricter, and where they are stricter they generally govern the reports furnished about consumers in that state.

That is not a settled proposition at the federal level. In October 2025 the CFPB published an interpretive rule reading§1681t(b)(1) as occupying the field and displacing state screening law. The agency states in the same document that the rule is interpretive, binds no one outside the federal government, and has no force of law. States continue to enforce their own statutes. Courts will decide.

We describe the position as contested because that is what it is. A summary that treats the preemption question as resolved is overstating a document whose author says it is not binding.

The practical rule for an employer screening in more than one state is to apply the stricter of the two, and to expect the gap to widen. The state guides in this section set out what changes where.

See the state guides

Current developments

This section is dated on purpose. A compliance article that cannot show when it was last checked is a liability rather than an asset, because federal guidance in this area has moved recently and in a direction that most published summaries have not caught up with.

The pattern is worth stating plainly. The federal government withdrew more than it added over this period, and several of the documents a screening company would naturally cite no longer exist. That is why this page cites statutory text and the current Regulation V appendix, and nothing else.

Sources

• Fair Credit Reporting Act, 15 U.S.C. §1681 et seq.
• Regulation V, 12 CFR part 1022, including Appendices K and O.
• Consumer Financial Protection Bureau, withdrawal of guidance items, 90 FR 20084 (12 May 2025).
• Consumer Financial Protection Bureau, preemption interpretive rule, 90 FR 48710 (28 October 2025).
• State statutes as cited in the table above and in the individual state guides.

Last reviewed 23 September 2026. This page is checked on a quarterly cycle against primary sources. Nothing on it is legal advice, and the terms of use govern its use.