The FCRA Adverse Action Workflow: A Two-Step Process to Protect Against Class Action Exposure

Skipping the pre-adverse action notice or compressing the waiting period can cost employers millions in statutory damages and attorney fees.

Executive Summary: The Two-Step Adverse Action Requirement

The Fair Credit Reporting Act (FCRA) requires employers to follow a strict two-step process before denying employment based on information in a consumer report (background check). This requirement, codified at 15 U.S.C. § 1681b(b)(3)(A), is frequently misunderstood and violated, exposing employers to statutory damages of $100 to $1,000 per applicant, plus actual damages and attorney’s fees.

The FCRA adverse action process is this:

Step 1: Pre-Adverse Action Notice. Before denying employment based in whole or in part on information in a consumer report, the employer must provide the applicant with written notice that includes: (a) disclosure that an adverse action may be taken based on the report, (b) a copy of the consumer report, (c) a summary of the applicant’s rights under the FCRA (including the right to dispute the accuracy of the report), and (d) information on how to contact the consumer reporting agency to challenge information.

Step 2: Reasonable Waiting Period and Final Adverse Action Notice. After providing the pre-adverse action notice, the employer must allow a “reasonable period” (typically interpreted as 5 business days) during which the applicant may dispute the accuracy of information in the report or request reinvestigation. Only after this waiting period expires may the employer send a final adverse action notice, formally denying employment.

This two-step process reflects a fundamental FCRA principle: individuals have a right to know what information triggered their employment rejection and have an opportunity to correct inaccurate information before a final employment decision is made. Employers who skip the pre-adverse action notice, provide incomplete notice, or compress the waiting period expose themselves to significant liability.

This article provides a comprehensive guide to compliant FCRA adverse action workflows, including statutory requirements, practical timing protocols, state-specific variations, documentation best practices, and litigation risk analysis.

Statutory Requirements Under 15 U.S.C. § 1681b(b)(3)

The FCRA statutory requirement for adverse action is found at 15 U.S.C. § 1681b(b)(3)(A), which mandates:

“In using a consumer report for employment purposes, before taking any adverse action based in whole or in part on the report, the person intending to take such adverse action shall provide to the consumer—(A) written notice of the user’s intended adverse action; and (B) disclosure of the consumer’s right to dispute the accuracy or completeness of any information in a consumer report furnished by the consumer reporting agency…”

This language is deceptively simple but contains multiple critical requirements. An “adverse action” is broadly defined in 15 U.S.C. § 1681a(k) and includes any unfavorable employment decision, including: denial of employment, denial of promotion, suspension, demotion, firing, or any other action that negatively impacts the individual’s employment status or economic interest. The requirement applies whether the employer obtained the consumer report directly from the applicant or through a background check company.

Critical Requirement 1: The “intended adverse action” notice must be provided before (not after) the employer denies employment. Some employers send rejection emails immediately upon determining the applicant is not selected, then attempt to provide the adverse action notice afterward. This violates the statute. The notice must precede any definitive communication to the applicant that employment is denied.

Critical Requirement 2: The notice must disclose that the adverse action is “based in whole or in part” on the consumer report. If the employer’s decision involves multiple factors (educational credentials, interview performance, skill assessment, and background report), the notice must explicitly state that the background report was a material factor in the decision.

Critical Requirement 3: The notice must include the actual consumer report or a copy of it. Some employers provide a summary or list of information they reviewed. The FCRA requires the actual report—or a substantially similar document that allows the applicant to identify what was reviewed.

Critical Requirement 4: The notice must include a summary of the applicant’s rights under the FCRA, including the right to dispute information and the right to contact the consumer reporting agency to request reinvestigation. The FTC provides a standard summary notice, and use of that notice (or substantially similar language) is compliant.

Violations of any of these four requirements constitute separate FCRA violations, each carrying statutory damages of $100 to $1,000. In class action contexts with high-volume hiring, this multiplies quickly. A company that processes 5,000 applications per year and provides defective adverse action notices to 200 unsuccessful applicants faces potential statutory damages of $20,000,000 to $200,000,000 (200 applicants × 5 violations × $100-$1,000 per violation).

Pre-Adverse Action Notice: Content and Delivery Requirements

A compliant pre-adverse action notice includes six components:

**Component 1: Notice of Intended Adverse Action**

The notice must explicitly state: “We are considering taking action regarding your application for employment with [Company] based in whole or in part upon information obtained from a consumer report. Before we make a final decision, we want you to have an opportunity to review the information and provide any additional information you believe relevant.”

The language must communicate that the decision has not yet been finalized and the applicant has an opportunity to respond.

**Component 2: Copy of the Consumer Report**

The notice must include a copy of the actual consumer report provided by the background check company. If the report contains financial information, trade secrets, or other highly sensitive data, the employer may redact confidential information concerning third parties (such as references), but information about the applicant must be provided in full.

Reporting companies (such as LexisNexis, Checkr, Sterling, or GoodHire) typically provide the actual report in the form they maintain. Employers should provide this report without modification or summary. Some employers create internal summaries like “criminal convictions identified: felony theft in 2010” instead of providing the full report. Courts have found that summaries do not comply with the statutory requirement.

**Component 3: Summary of Rights Under the FCRA**

The notice must include the FTC’s summary of rights, which includes:

• The right to request a copy of the report and challenge the accuracy of any information in the report by contacting the consumer reporting agency.
• The right to request that the consumer reporting agency reopen its investigation if the applicant disputes the accuracy of information in the report.
• The right to dispute directly with the employer any information the employer believes is inaccurate.
• The right to add a statement to the file if the dispute is not resolved to the applicant’s satisfaction.
• If the consumer reporting agency is found to have violated the FCRA, the applicant may sue for damages.
• The right to lodge a complaint with the Federal Trade Commission (FTC) if the applicant believes there has been a violation of the FCRA.

The FTC provides a standardized statement that satisfies this requirement. Employers should use this statement or substantially similar language.

**Component 4: Consumer Reporting Agency Contact Information**

The notice must include the name, address, and phone number of the consumer reporting agency that compiled the report. For example: “This report was prepared by Checkr, Inc. You may contact them at: 225 Bush Street, Suite 1500, San Francisco, CA 94104, (844) 832-3724.”

**Component 5: Explicit Notice of Right to Dispute and Waiting Period**

The notice must explicitly state: “You have the right to dispute the accuracy of information in this report. You may do so by contacting the consumer reporting agency directly. You also may dispute any information with us directly. Please allow [5-10] business days for us to receive and consider your dispute before we make a final decision.”

**Component 6: Timeline for Response**

The notice must communicate the timeframe the applicant has to respond. The FCRA requires a “reasonable period,” typically interpreted as 5 business days. Some employers use 10 business days to allow more time for applicants to contact the reporting agency. The notice should state the deadline clearly.

**Delivery Methods**:

The pre-adverse action notice must be in writing and should be delivered in the method most likely to reach the applicant. Acceptable methods include: personal delivery (hand delivery), email (if the applicant provided an email address), certified mail, overnight courier, or other traceable method. Email is acceptable if the employer has confirmed the applicant’s email address during the application process.

Important: Text message alone is generally not sufficient, as FCRA requires “written” notice and text messages may not be preserved adequately. Email or paper mail is preferable. Best practice is to deliver via email (to ensure receipt confirmation) and certified mail (to create evidence of delivery).

The Reasonable Waiting Period: Timing Requirements and Applicant Rights

After providing the pre-adverse action notice, the employer must allow a “reasonable period” before finalizing the adverse action. The FCRA does not specify a duration, creating some ambiguity. However, FTC guidance and case law establish a standard of 5 business days as the minimum reasonable period.

**The 5-Business-Day Standard**:

FTC staff guidance indicates that 5 business days is a reasonable period for the applicant to dispute information with the consumer reporting agency. This timeframe allows the applicant to: (1) review the report, (2) contact the consumer reporting agency, (3) submit a dispute, and (4) allow the agency time to investigate the dispute (if the dispute is filed immediately).

Some employers use longer periods (7-10 business days), which provides additional buffer and reduces litigation risk. Some employers use shorter periods (2-3 days), which courts have scrutinized as potentially inadequate, particularly if the applicant disputes any information.

**The Clock Starts When?**:

A critical question is when the “reasonable period” begins. The FCRA does not specify, but case law and FTC guidance indicate that the clock starts when the applicant receives the pre-adverse action notice. If the notice is delivered by email, the clock typically starts when the email is sent (or when the applicant opens it, depending on email system confirmation). If delivered by certified mail, the clock starts when the applicant receives the notice.

Best practice is to document precisely when the notice was sent or delivered. Many employers use email delivery with read receipt confirmation or require the applicant to acknowledge receipt of the pre-adverse action notice in writing.

**What Can the Applicant Do During the Waiting Period?**:

During the waiting period, the applicant may:

1. Contact the consumer reporting agency and dispute any information believed to be inaccurate.
2. Contact the employer directly and provide a written explanation or additional information explaining or contextualizing information in the report.
3. Request the consumer reporting agency to reinvestigate any disputed information.
4. Provide documentation showing information in the report is inaccurate (for example, providing court documents showing a case was dismissed or expunged).

If the applicant disputes information and requests reinvestigation, the consumer reporting agency typically has up to 30 days to conduct an investigation. This period may extend beyond the employer’s 5-business-day waiting period. The question then arises: must the employer wait for the consumer reporting agency investigation to complete before finalizing the adverse action?

**Dispute Resolution and Extended Waiting Periods**:

If the applicant disputes information in the report during the waiting period, best practice (and in some states, a legal requirement) is to provide an extended waiting period to allow the consumer reporting agency to complete its reinvestigation. Many employers use a 30-day window after the pre-adverse action notice to allow for dispute resolution.

Some states impose explicit requirements here. For example, California requires employers to allow a full reinvestigation by the consumer reporting agency before taking final adverse action. New York requires at least 10 business days and may require longer if a dispute is pending.

Important consequence: If the applicant disputes information during the waiting period, the employer may not take final adverse action until the dispute is resolved. Doing so violates the FCRA and exposes the employer to liability even if the information was ultimately accurate. The applicant’s right to dispute must be honored even if the employer believes the information is correct.

**Continuing Employment During Dispute**:

A frequently litigated question is whether the applicant must be continued in the hiring process (or retained, if employed) during the waiting period. The FCRA does not explicitly require this. However, some states (particularly California and New York) require that if the applicant disputes information, the employer must not finalize the adverse action until the dispute is resolved. In other words, the applicant cannot be rejected pending resolution of the dispute.

Practical consequence: An applicant who immediately disputes the accuracy of information in a report during the waiting period has effectively created a period during which they remain in the candidate pool pending dispute resolution. For hiring managers and HR staff, this can create operational complexity. Nevertheless, FCRA compliance requires respecting this right.

Final Adverse Action Notice and Documentation

After the waiting period has expired (and any disputes have been resolved), the employer may send a final adverse action notice. This notice should be in writing and must include:

**Required Elements**:

1. Clear Statement of Adverse Action: “We regret to inform you that we have decided not to move forward with your application for the position of [Job Title] at [Company]. This decision is based in whole or in part upon information obtained from your consumer report.”
2. Reference to the Consumer Report: “Specifically, the following information in your consumer report was material to our decision: [specify the information, e.g., ‘felony conviction for theft in 2010,’ ‘misdemeanor DUI in 2008,’ or ‘credit score below 650’].”
3. Notice of Right to Challenge the Decision: “If you believe this decision is based upon inaccurate information in your consumer report, you may contact [Consumer Reporting Agency Name] to dispute the information or request a reinvestigation.”
4. Contact Information: Include the consumer reporting agency’s phone number and address.
5. FTC Complaint Right: “You also have the right to lodge a complaint with the Federal Trade Commission regarding this decision.”

**Timing of Final Notice**:

The final adverse action notice should not be sent until after the waiting period expires. Best practice is to send it 1-2 business days after the waiting period expires, allowing time for any disputes filed at the last moment to reach the employer’s attention.

**Documentation and Record-Keeping**:

The employer should maintain comprehensive records of the adverse action process:

1. Copy of the Pre-Adverse Action Notice Sent: Retain the exact notice provided to the applicant, including the consumer report and summary of rights.
2. Proof of Delivery: Maintain email confirmation, certified mail receipts, or other evidence showing when and how the pre-adverse action notice was delivered.
3. Applicant Response or Silence: Document whether the applicant disputed the information, provided additional information, or took no action during the waiting period.
4. Dispute Resolution Timeline: If the applicant disputed information, document when the dispute was filed, how the employer and consumer reporting agency handled it, and when it was resolved.
5. Final Adverse Action Notice: Retain a copy of the final notice sent to the applicant.
6. Communication Log: Maintain a chronological log of all communications between the employer, applicant, and consumer reporting agency regarding the adverse action.

This documentation is critical in litigation. If an applicant sues alleging the employer violated the FCRA, the employer must demonstrate that it followed the statutory process precisely. Incomplete documentation makes it difficult to defend against allegations of procedural violations.

**ATS Implementation**:

High-volume employers using ATS platforms like SmartSuite should implement workflow automation that: (1) generates the pre-adverse action notice automatically when a background check report is received with disqualifying information, (2) logs the date and time the notice is sent, (3) calculates and tracks the waiting period, (4) flags the application for follow-up after the waiting period expires, (5) generates the final adverse action notice, and (6) archives all documentation in the applicant’s record. Automation dramatically reduces the risk of procedural errors and ensures consistent compliance across thousands of applicant decisions.

State-Specific Requirements and Variations

While the FCRA establishes the federal baseline, several states impose additional or stricter requirements:

**California**:

California requires employers to provide applicants with at least 5 business days to dispute information in a background report before taking final adverse action. California also requires that if an applicant disputes information and requests reinvestigation by the consumer reporting agency, the employer must wait for the reinvestigation to be completed before finalizing the adverse action. This can extend the waiting period beyond 5 business days.

Additionally, California Labor Code Section 432.7 prohibits employers from denying employment based on arrests or detentions not resulting in conviction (except in limited circumstances). Pre-adverse action notices in California must explicitly inform applicants of these protections.

**New York**:

New York requires at least 10 business days’ notice before an employer takes final adverse action based on a background report (compared to the federal 5-day minimum). New York also requires that employers provide applicants with a copy of their consumer report, a summary of their rights, and information about how to dispute information. Applicants have a right to submit a written rebuttal to any information in the report, and the employer must consider this rebuttal before finalizing the adverse action.

**Illinois**:

Illinois requires employers to provide written notice and an opportunity to respond to background information before making an adverse employment decision. The state does not specify a minimum number of days, but use of 5-7 business days is common. Illinois also requires that employers maintain detailed records of compliance with these requirements.

**Massachusetts**:

Massachusetts requires employers to provide written notice and allow the applicant a reasonable opportunity to respond to or dispute information in a background report. The state imposes a particularly strict requirement that employers cannot consider records of conviction of a crime unless a conviction determination has been rendered in the applicant’s favor, or the applicant’s conviction is not substantially related to the position sought, or the employer can demonstrate substantial business necessity.

Massachusetts pre-adverse action notices must therefore include explicit notification of these limitations on use of criminal history.

**Colorado**:

Colorado requires employers to provide applicants with a copy of the background report, a summary of their rights, and a reasonable opportunity to dispute information before taking adverse action. Colorado does not specify a minimum number of days but recommends 5-7 business days.

**Washington**:

Washington requires that before denying employment based on criminal history, employers must provide written notice of the decision, the information that formed the basis of the decision, and the applicant’s right to respond or appeal. Washington is particularly protective of applicants with criminal history and restricts employer consideration of many offenses.

**Multi-State Compliance**:

For employers operating in multiple states, the safest approach is to implement the most protective standard across all jurisdictions. This typically means: 10 business days minimum waiting period (New York standard) across all applicants, full reinvestigation completion before final adverse action (California standard), and explicit notice of limitations on consideration of criminal history (Massachusetts and Washington standards).

Consulting with employment counsel regarding state-specific requirements is essential for nationwide employers.

Litigation Risk and Recent Case Law

Two major Supreme Court decisions have shaped adverse action litigation:

**Ramirez v. TransUnion LLC, 141 S. Ct. 2190 (2021)**:

In Ramirez, the Supreme Court held that individuals who have been injured by a company’s violation of the FCRA have statutory standing to sue for damages, even if they cannot prove actual financial injury. The Court held that statutory damages are themselves an injury sufficient to confer standing, meaning that applicants can sue employers for procedural violations of the adverse action requirements even if they ultimately would not have been hired anyway.

This decision significantly expanded FCRA litigation risk. Prior to Ramirez, employers sometimes argued that applicants lacked standing to sue for technical procedural violations if the underlying background information was accurate. Ramirez eliminated this defense. Now, even a technically compliant substantive decision combined with a procedurally deficient adverse action notice exposes employers to liability.

**Spokeo, Inc. v. Robins, 578 U.S. 330 (2016)**:

In Spokeo, the Supreme Court addressed whether a consumer can sue under the FCRA for inaccurate or misleading information without showing concrete harm. The Court held that statutory violations alone, without concrete injury, may not confer standing. However, subsequent decisions (including Ramirez) have clarified that FCRA violations do cause concrete injury because they deprive individuals of their statutory rights under the FCRA.

**Class Action Exposure**:

Because adverse action violations often affect hundreds or thousands of applicants (all of whom received the same defective notice), class action litigation is common. In a class action, one or two named plaintiffs sue on behalf of all applicants who received the defective notice. Damages are then multiplied by the number of class members.

Example: An employer with a defective adverse action notice process that affects 2,000 applicants over a two-year period faces potential statutory damages of $200,000 to $2,000,000 (2,000 applicants × $100-$1,000 per violation), plus attorney’s fees of $500,000 to $3,000,000.

Recent settlements illustrate the exposure:

• A major financial services company settled an FCRA adverse action notice class action in 2022 for $9.2 million, affecting approximately 4,600 applicants.
• A retail company settled in 2021 for $3.8 million, affecting approximately 1,900 applicants.
• A healthcare system settled in 2023 for $6.5 million, affecting approximately 3,200 applicants.

**Common Defects in Adverse Action Notices**:

Litigation has identified several common mistakes that trigger liability:

1. Failing to specify which information in the report was material to the adverse action decision.
2. Providing a summary of the report rather than a copy of the actual report.
3. Failing to include the consumer reporting agency’s contact information.
4. Providing the final adverse action notice before the waiting period expires.
5. Taking final adverse action without addressing applicant disputes filed during the waiting period.
6. Failing to provide the FTC’s summary of rights or substantially similar language.

Each of these errors is litigated regularly, and employers continue to lose cases based on these defects.

Workflow Diagram and Practical Implementation

A compliant adverse action workflow follows this sequence:

**Phase 1: Background Report Receipt**

When the background check company returns a consumer report:

1. Hiring Manager Reviews Report: The hiring manager reviews the report and determines whether the information would disqualify the candidate or be material to the hiring decision.
2. Completeness Check: Before proceeding with adverse action, verify that the report is complete, readable, and includes all relevant information about the applicant’s background.
3. Trigger Decision: If the hiring manager determines that the background information will result in non-hire or other adverse action, proceed to Phase 2.

**Phase 2: Pre-Adverse Action Notice**

1. Generate Notice: The ATS or HR system automatically generates a pre-adverse action notice that includes: (a) the actual consumer report, (b) notice of intended adverse action, (c) FTC summary of rights, (d) consumer reporting agency contact information, and (e) explicit waiting period (typically 5-10 business days).
2. Deliver Notice: Send the notice via email (with read receipt requested) and/or certified mail. Log the delivery date and method in the ATS.
3. Calculate Deadline: The ATS automatically calculates the expiration date of the waiting period (5 or 10 business days from delivery date) and flags the application for follow-up.

**Phase 3: Waiting Period**

1. Applicant Review Period: The applicant has 5-10 business days to review the report and contact the consumer reporting agency or employer with disputes or additional information.
2. Dispute Logging: Any disputes filed by the applicant are logged in the ATS, and the dispute is escalated to HR/Legal for review.
3. Dispute Resolution: If the applicant disputes information and requests reinvestigation, work with the consumer reporting agency to complete the investigation. Retain the investigation results in the applicant’s file.

**Phase 4: Final Adverse Action Notice**

1. Post-Waiting-Period Review: After the waiting period expires (and any disputes are resolved), generate the final adverse action notice.
2. Specify Disqualifying Information: Clearly state which information in the report was material to the adverse action decision.
3. Deliver Final Notice: Send via email and/or certified mail, logging delivery in the ATS.
4. Archive Documentation: Retain all documentation (pre-adverse notice, consumer report, applicant disputes, dispute resolution results, final notice) in the applicant’s file.

**Timeline Example**:

Monday, April 15: Background report received; hiring manager determines applicant will not be hired due to disqualifying criminal history.

Monday, April 15: Pre-adverse action notice generated and sent to applicant via email and certified mail.

April 15-April 22: Waiting period (5 business days).

Tuesday, April 23: Waiting period expires. No disputes filed by applicant.

Tuesday, April 23: Final adverse action notice generated and sent to applicant.

This timeline is tracked automatically in the ATS, reducing manual error and ensuring compliance.

Audit Checklist and Risk Mitigation

Use the following checklist to assess adverse action notice compliance:

□ Are all adverse action decisions based on background information preceded by written pre-adverse action notice?

□ Does the pre-adverse action notice include the actual consumer report (not a summary)?

□ Does the pre-adverse action notice specify the information that will trigger adverse action?

□ Does the notice include the FTC’s summary of rights or substantially similar language?

□ Does the notice include the consumer reporting agency’s name, address, and phone number?

□ Does the notice explicitly state the waiting period (5-10 business days) during which the applicant may dispute information?

□ Are pre-adverse action notices delivered via email (with confirmation) and/or certified mail (with proof of receipt)?

□ Does your ATS log the date and time pre-adverse action notices are sent and delivered?

□ Does your ATS calculate the expiration date of the waiting period and flag for follow-up?

□ If an applicant disputes information during the waiting period, does your system escalate the dispute and delay final adverse action until the dispute is resolved?

□ Are final adverse action notices sent only after the waiting period expires (and disputes are resolved)?

□ Do final adverse action notices specify which information in the consumer report was material to the decision?

□ Do final adverse action notices include contact information for the consumer reporting agency?

□ Are final adverse action notices delivered via email and/or certified mail with proof of receipt?

□ Is all documentation (pre-adverse notice, report, disputes, final notice) archived in the applicant’s file?

□ Have you reviewed your adverse action process against the specific requirements of all states where you hire?

Next Steps: Conduct an audit of your current adverse action notices by reviewing recent denials. Compare the notices you used against the requirements outlined in this article. If deficiencies are identified, implement corrective measures immediately and consider whether past applicants were affected (potential class action exposure). Consulting with employment counsel to assess past liability and implement compliant processes going forward is strongly recommended.

References and Further Reading

• 15 U.S.C. § 1681b(b)(3)(A) – FCRA Adverse Action Requirements
• 15 U.S.C. § 1681a(k) – Definition of Adverse Action
• Ramirez v. TransUnion LLC, 141 S. Ct. 2190 (2021) – Standing to Sue for Statutory Violations
• Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) – Concrete Injury Requirement
• FTC Guidance on Adverse Action Notices, 16 CFR Part 600.8
• FTC Summary of Consumer Rights Under the FCRA
• California Labor Code Section 432.7 – Criminal History Limitations
• California Code of Civil Procedure Section 1050 – Background Check Requirements
• New York General Business Law Section 380-l – Adverse Action Procedures
• Illinois FCRA, 50 Ill. Adm. Code 907 – State Adverse Action Requirements
• Massachusetts Consumer Report Law, Mass. Gen. Laws c. 149, § 24L
• Washington Consumer Report Law, Rev. Code § 19.255.010 et seq.
• Colorado Consumer Reporting Agencies Act, Colo. Rev. Stat. § 12-14.3-101 et seq.
• FTC Staff Commentary on FCRA Compliance – http://www.ftc.gov

How Cadient Talent SmartSuite™ Helps

Cadient Talent’s SmartSuite™ platform automates compliance workflows, embeds regulatory guardrails directly into your hiring process, and maintains audit-ready documentation at every stage—so your team can focus on finding great talent while staying protected from costly violations.