The FCRA Adverse Action Sequence

A recruiter reads a background check, decides against the candidate, and sends the rejection. The report goes out afterwards, with an apologetic note. That order is wrong. The FCRA adverse action rules are among the few US privacy requirements where getting the sequence backwards is itself the violation.

When a background check becomes a consumer report

The Fair Credit Reporting Act reaches employment screening through its definitions rather than through any employment-specific chapter.

Start with 15 U.S.C. 1681a(d). A consumer report is a communication by a consumer reporting agency bearing on a consumer’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living”. It must be used, or expected to be used, as a factor in establishing eligibility for credit, insurance or employment purposes. Character and general reputation are the words that pull ordinary background checks in.

Two consequences follow. An employer running its own internal check usually sits outside the Act. No consumer reporting agency is furnishing anything. An employer buying a screening report from a vendor sits squarely inside it, and the adverse action rules come with the purchase.

The definition of adverse action at 1681a(k) is broader than it looks. For employment it means “a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee”. Refusing to hire qualifies. So does demotion, reassignment and dismissal.

The disclosure that precedes any adverse action

Before the report is ever ordered, 15 U.S.C. 1681b(b)(2) imposes two conditions.

A clear and conspicuous written disclosure must reach the consumer first. It has to arrive “in a document that consists solely of the disclosure”. Then the consumer must authorise the procurement in writing.

Where the word “solely” attaches

This is the trap, and it turns on one word. The “solely” requirement sits on the disclosure document. It does not sit on the authorisation.

The statute says so on its face. Clause (ii) permits the authorisation to be made “on the document referred to in clause (i)”. So a single page carrying the disclosure and a signature line is compliant. The same page carrying a liability waiver, a state law notice and an at-will employment acknowledgement is not.

The two-step adverse action process

The report arrives and the employer is minded to act. At that point the FCRA splits one decision into two notices.

Step one, before the decision takes effect

Section 1681b(b)(3)(A) is unambiguous about timing. Before taking any adverse action based in whole or in part on the report, the employer owes the consumer two things. A copy of the report. And a written description of the consumer’s rights “as prescribed by the Bureau under section 1681g(c)(3)”.

That description is the Summary of Consumer Rights. The Consumer Financial Protection Bureau prescribes it, and it sits at Appendix K to 12 CFR Part 1022. Employers do not draft it.

The FTC and EEOC’s joint guidance for employers puts the purpose plainly. Giving the notice in advance means “the person has an opportunity to review the report and explain any negative information”. Reports contain errors. This step exists so the candidate can find them before the adverse action lands.

Step two, after the decision

Section 1681m(a) then governs the notice that follows. The employer must give oral, written or electronic notice of the adverse action. It must supply the name, address and telephone number of the consumer reporting agency that furnished the report.

It must also state that the agency did not make the decision and cannot give the specific reasons for it. Two rights follow. A free copy of the report from the agency within 60 days, and the right to dispute the accuracy or completeness of the information.

How long between the two adverse action notices

Nothing in the statute answers this. Section 1681b(b)(3)(A) says only “before taking any adverse action”, with no number of days attached anywhere.

Neither current FTC business guidance page states a period either. The widely repeated five business days figure has no home in the statute or in that guidance, so treat any exam option asserting a statutory waiting period with suspicion.

One day count does appear, as an exception rather than a rule. Section 1681b(b)(3)(B) covers certain remote transportation-sector applicants. There the employer notifies within three business days of taking the action, in place of the two-step process entirely.

What changed in 2025

This is where recent CIPP/US preparation goes wrong, because a great deal of 2024 material on employment screening no longer applies.

On 12 May 2025 the CFPB withdrew a large body of its own guidance. Two withdrawn items bear directly on this subject. One is the January 2024 advisory opinion on fair credit reporting and background screening. The other is Circular 2024-06, on background dossiers and algorithmic scores used in hiring and promotion decisions. Three days later the Bureau withdrew its proposed data broker rule, saying it would take no further action on it.

So the governing law on employment background screening is the statute and Regulation V as they stood before 2024. Nothing new is in force. An answer that leans on the 2024 CFPB gloss is leaning on withdrawn guidance.

Litigation exposure moved too. In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court held that only plaintiffs concretely harmed by a statutory violation have standing to seek damages in federal court. The Court compressed it to five words: no concrete harm, no standing. Class members whose inaccurate files were never disclosed to anyone lost on that ground.

How CIPP/US tests adverse action

The Body of Knowledge is the IAPP’s published map of what each exam covers, and this material appears twice: under financial sector law and again under workplace privacy. Both treatments test process rather than doctrine.

Scenario items reward three checks. Find out whether a third party supplied the report, because that decides whether the Act applies at all. Establish what the employer sent, and when, relative to the adverse action. Then read the disclosure document for anything sitting alongside the disclosure.

The pattern here rhymes with the rest of US privacy law. Sector-specific statutes prescribe a procedure. Failing that procedure is the violation, whether or not the underlying decision was sound. That is the same structure behind unfair or deceptive practices under the FTC Act, and behind the definitional gatekeeping that decides who counts as a VPPA consumer.

Sequencing questions are where careful candidates lose marks to careless reading rather than to gaps in knowledge. The CIPP/US Exam Question Masterclass works on that specific failure.