What "adverse action" means
Under the FCRA, adverse action is any decision that denies employment, promotion, reassignment, or retention based in whole or in part on a consumer report. If a background check contributes to any negative hiring decision, the FCRA's adverse action rules apply. That's true even if other factors contributed.
The FCRA requires a two-step process: (1) a pre-adverse action notice, (2) a final adverse action notice, separated by a reasonable waiting period during which the applicant can dispute the report. Skipping or collapsing these steps is the most common FCRA violation and is easily caught in a class-action discovery process.
Step 1: Individualized assessment
Before you issue a pre-adverse action notice, document an individualized assessment of the finding. This isn't technically required by the FCRA itself, but it is required by EEOC guidance (EEOC Enforcement Guidance 915.002) and by California, New York, and several other state laws. The assessment should consider:
- The nature and gravity of the offense.
- The time since the offense or completion of sentence.
- The nature of the job - what duties and responsibilities, what environment, what access or authority.
Write the assessment down. In a dispute or lawsuit, the difference between "we considered the nature of the offense and the role" and a single-line rejection is the difference between a defensible decision and a settled class action.
Step 2: Pre-adverse action notice
Send the applicant a pre-adverse action notice that includes:
- A copy of the consumer report you are considering.
- A copy of the FCRA Summary of Consumer Rights (we attach this automatically).
- A statement that you are considering taking adverse action based on the report and that the applicant has the right to dispute its accuracy or completeness.
- Contact information for the consumer reporting agency (that's us - we populate this automatically).
- A statement that the agency did not make the decision and is unable to explain why it was made.
The portal generates this notice automatically if you choose - from the report, click "Start adverse action" and the system walks through sending the pre-adverse notice to the applicant by email (and paper copy to the address on file, if you've enabled that). You can also do it manually outside the portal; either way, the content requirements are the same.
Step 3: Wait
The FCRA doesn't specify a fixed waiting period, but courts and the FTC have consistently interpreted "reasonable" as at least 5 business days. A handful of states and city ordinances require longer - California's Fair Chance Act requires at least 5 business days, and some local ordinances (e.g., New York City) effectively require longer because of their dispute windows.
The practical guidance: wait 5 business days at minimum, 7 calendar days for safety. The portal enforces this automatically - the "Issue final adverse action" button is disabled until the minimum window has passed.
If the applicant responds during the waiting period with a dispute, document the dispute and hold the adverse action until the reinvestigation completes. Typical reinvestigation: 30 days or fewer. If the dispute resolves in the applicant's favor, the basis for adverse action may no longer exist - review before proceeding.
Step 4: Final adverse action notice
If the waiting period passes with no dispute (or if a dispute has been investigated and the basis for adverse action still holds), issue the final adverse action notice. It must include:
- Notice that adverse action has been or will be taken based in whole or in part on the consumer report.
- The name, address, and telephone number of the consumer reporting agency.
- A statement that the agency did not make the adverse decision and is unable to explain why.
- Notice of the consumer's right to obtain a free copy of the report within 60 days.
- Notice of the consumer's right to dispute the accuracy or completeness of the report.
The portal generates this notice on click and logs both the pre-adverse and final notices to the order's audit trail.
Common mistakes
Collapsing the two steps into one
The single most common FCRA violation is sending a single letter that communicates both "we're considering adverse action" and "you're not hired." This is not a notice - it's a decision. The applicant's right to dispute before the decision is finalized is the whole purpose of the two-step process.
Not providing the report itself
The pre-adverse action notice must include a copy of the report. Simply saying "we are considering adverse action based on your background check" without the report does not satisfy the FCRA. The applicant has to be able to see what you're acting on in order to dispute it.
Moving too fast
"We gave them a day to respond" is not reasonable. Courts have found 2-business-day windows insufficient. Stick to 5 business days or longer.
Not keeping records
If you're audited, a regulator or an attorney will ask for the pre-adverse notice, the final notice, the individualized assessment, and any dispute correspondence. Keep them for at least 5 years (longer in some states). The portal retains these for you, but exporting to your HR file is strongly recommended.
When the applicant disputes
If the applicant disputes the report during the waiting period, notify us immediately. We reinvestigate at no cost and typically complete within 30 days. The reinvestigation checks the source - the court clerk, the former employer, the registrar - to confirm or correct the record. If corrected, we reissue the report and notify you. You then reassess based on the corrected record.
Before final adverse action on a disputed record
Do not issue a final adverse action notice on a finding that is under active dispute. If you do, and the dispute later resolves in the applicant's favor, you may have a wrongful-action exposure. Wait for the reinvestigation to complete, then proceed based on the corrected record.
State-specific overlays
Several states and cities require additional steps or modified disclosures:
- California. ICRAA requires an applicant-request option for a copy of the report at no cost. Fair Chance Act requires specific pre-adverse action disclosures when criminal history is involved.
- New York. Article 23-A requires an individualized-assessment letter reciting the eight Article 23-A factors.
- Illinois. The Employee Credit Privacy Act restricts credit-based adverse action except for listed roles.
- Massachusetts. CORI laws regulate how criminal records can be used.
The portal applies state-specific templates automatically based on the applicant's state of residence. If the applicant is in a state with overlays, the notice includes the required additional language.
Questions?
The adverse action process is easier than it looks once you've done it two or three times. If you're on your first one, call us - (800) 707-2450 - and we'll walk through the specific decision with you. Our compliance team reviews about 50 adverse action flows a week and can tell you upfront if something in the finding, the timing, or the state overlay is going to create an exposure.