Overview

When conducting background checks for employment, companies must comply with the Fair Credit Reporting Act (FCRA), a federal law designed to protect consumer privacy. One of the FCRA’s key provisions is the requirement that an employer must have a permissible purpose to obtain a consumer report. This article explains what qualifies as a permissible purpose, the steps you must take before accessing a report, and how to stay compliant throughout the process.

What Is a Permissible Purpose?

Under the FCRA (15 U.S.C. § 1681b), a permissible purpose refers to a legally acceptable reason for accessing a consumer report. For employers, the most relevant permissible purpose is employment, which includes hiring, promotion, reassignment, or retention decisions.

Common Permissible Purposes in Employment:

• Pre-employment screening: Reviewing a candidate’s background before making a job offer.

• Promotions or reassignments: Assessing whether a current employee is suitable for a new role.

• Retention decisions: Conducting periodic checks to ensure continued suitability for employment.

• DOT or state-mandated checks: Complying with federal or state regulations that require background checks (e.g., for CDL drivers or safety-sensitive positions).

Important: The background check must be relevant to the job role, particularly when it comes to financial, driving, or criminal history.

Requirements for Employers Under FCRA

To comply with the FCRA when using background checks for employment purposes, employers must complete the following steps:

1. Provide Clear Disclosure

Before obtaining a consumer report, employers must provide the individual with a clear and conspicuous written disclosure stating that a background check may be conducted. This disclosure:

• Must be in a standalone document (not embedded in other paperwork like job applications).

• Must use plain language and be free of extraneous information.

2. Obtain Written Authorization

You must obtain written consent from the individual before accessing their consumer report. This authorization can be part of the standalone disclosure or a separate document.

3. Certify Permissible Purpose to the CRA

The employer must certify to the consumer reporting agency (CRA) that:

• They have a permissible purpose for requesting the report.

• They have provided proper disclosure and obtained written authorization.

• They will comply with the FCRA’s pre-adverse and adverse action requirements if the report results in a negative employment decision.

4. Take Additional Steps if Making an Adverse Decision

If you decide not to hire or promote someone based on the contents of the report, you must follow the adverse action process:

• Pre-adverse action notice: Provide the individual with a copy of the report and a summary of their rights under the FCRA.

• Waiting period: Allow a reasonable time (typically 5 business days) for the individual to dispute the report.

• Final adverse action notice: Notify the individual of the final decision and include required FCRA language.

DOT-Regulated Employers: Special Considerations

If you are an employer regulated by the U.S. Department of Transportation (DOT), you may also be required by federal law to conduct certain background checks, such as:

• Motor vehicle reports (MVRs) for commercial driver’s license (CDL) holders.

• Drug and alcohol testing history as required by 49 CFR Part 40 and 49 CFR Part 391.

• Safety performance history inquiries to former employers under 49 CFR § 391.23.

Even though these checks are required by DOT rules, the FCRA still applies. This means you must:

• Disclose the background check.

• Obtain written consent.

• Follow adverse action procedures.

Note: A DOT-regulated background check is still considered a “consumer report” under FCRA if a CRA provides it.

Tips to Maintain Compliance

• Always use a trusted and FCRA-compliant consumer reporting agency (CRA).

• Separate your disclosure and authorization forms from the application.

• Do not conduct background checks until you’ve received proper consent.

• Document all steps taken during the background check and adverse action process.

FAQs

Q: Can I run a background check before making a job offer?
Yes, but you must provide disclosure and obtain written authorization first. It’s common to run checks after a conditional offer has been made to limit risk.

Q: Do I need to get permission every time I run a background check on a current employee?
It depends. If ongoing monitoring is part of your company policy and the original authorization includes language about recurring checks, additional consent may not be needed—but best practice is to renew consent periodically.

Q: What happens if I run a check without permission?
Violating the FCRA can lead to legal liability, including statutory damages, attorney fees, and punitive damages in cases of willful noncompliance.

Regulatory References

• Fair Credit Reporting Act (FCRA) – 15 U.S.C. § 1681b: Link to FTC Summary

• DOT Driver Investigation Requirements – 49 CFR § 391.23: Link to eCFR

• FCRA Summary of Rights (provided by CRAs): FTC Template

Last Updated

May 1, 2025 — Reflects federal guidance effective as of this date.