FCRA Adverse Action Mistakes Getting Employers Sued

FCRA litigation is climbing fast: WebRecon's federal litigation tracker counted FCRA filings up 37.4% in 2025 alone, and on the employment side the adverse action process is where employers get caught most often. Three structural factors keep fueling it:

1. No general cap on statutory damages. Exposure scales with the number of affected applicants.
2. Class certification is remarkably easy. If one standardized template is defective, every applicant who received it is a potential class member.
3. These are paperwork-driven violations, provable from the employer's own records without expensive discovery battles.

Plaintiffs' firms have built practices around exactly this. If your organization uses criminal background checks or any third-party consumer report for hiring, promotion, or termination decisions, every one of these rules applies to you.

What the FCRA Adverse Action Process Requires

An adverse action is any negative employment decision based in whole or in part on a consumer report from a consumer reporting agency (CRA): not hiring, rescinding an offer, declining a promotion, or terminating. The statute requires two distinct steps, set out in the FTC's guidance for employers using consumer reports, and skipping either is a violation.

Step 1: Pre-adverse action. Before a final negative decision, send a written notice that you're considering action based on the report, attaching a complete copy of the report and the current CFPB "A Summary of Your Rights Under the Fair Credit Reporting Act". Then wait a "reasonable" period for the candidate to review and dispute. The statute doesn't set a number of days; courts and compliance professionals generally treat five business days as the minimum safe standard.

Step 2: Final adverse action notice. After the waiting period and any disputes, the final notice must include the CRA's name, address, and phone number; a statement that the CRA did not make the decision and cannot explain it; the right to dispute the report's accuracy or completeness with the CRA; and the right to a free additional copy within 60 days.

One nuance that trips up employers: the FCRA protects the right to dispute accuracy, not a federal right to argue that accurate information should be disregarded. Federal appeals courts have confirmed the distinction. Best practice still favors letting candidates provide context (some fair-chance laws independently require it), and KRESS's automated adverse action process builds every required step into the screening workflow.

The 8 Mistakes Driving Lawsuits Right Now

1. Skipping the pre-adverse action notice entirely. Auto-rejecting the moment a report flags an offense, with no notice, no copy of the report, and no Summary of Rights, is the easiest violation to certify as a class action: every applicant in the workflow experienced the same omission, provable from your own ATS records.
2. Sending pre-adverse action but omitting required documents. A bare "we're reconsidering your application" email doesn't satisfy the statute without the full report and the CFPB Summary of Rights, and the form version matters: the updated CFPB Summary became mandatory on March 20, 2024. Distributing the old version is provable with a side-by-side comparison.
3. Not allowing a reasonable waiting period. Same-day pre-adverse and final notices are more common than you'd expect. Five business days is the accepted minimum; treating the notice as a checkbox you clear the same afternoon defeats its purpose and creates straightforward grounds for litigation.
4. Failing to send a final adverse action notice. Some employers send the pre-adverse notice, decide not to hire, and simply move on. The final notice isn't optional, and its uniform absence across rejected applicants is a textbook class scenario.
5. Making the CRA appear to be the decision-maker. Automated messages labeling reports "eligible" or "ineligible" can support claims that applicants were misled about who decided. Review every applicant-facing communication your CRA sends and fix any that blur the line.
6. Acting before a dispute is resolved. Finalizing a rejection while a dispute is open, before the CRA completes its reinvestigation, undermines the FCRA's core purpose. If disputed information is corrected, reconsider the candidate on the updated report and document it.
7. Inconsistent screening criteria. One candidate with a five-year-old misdemeanor hired, another with the same record rejected, and no documented reasoning: that's FCRA and EEO exposure at once. EEOC enforcement guidance calls for individualized assessments; written criteria, consistently applied, are your best defense.
8. Using non-CRA data without FCRA procedures. DIY Google searches, non-compliant data brokers, and informal social media checks don't exempt you: if the source meets the FCRA's definition of a consumer report, the full process applies. Use a compliant CRA. Follow the process.

How One Bad Form Becomes a Class Action

The same template that handles ten thousand applicants identically means one flaw creates ten thousand identical violations. Statutory damages apply per person, punitive damages and attorneys' fees stack on top, and there's no general cap. And don't bank on "nobody was really harmed": courts have recognized deprivation of required disclosures and dispute time as a cognizable informational injury.

Building an Audit-Proof Workflow

• Keep forms current: every required element present, full report and current CFPB Summary attached, and a monitoring process that pushes template updates the week a new form is published.
• Hard-code the waiting period in your ATS: a mandatory five-business-day hold after the pre-adverse notice, with timestamps recorded for both notices.
• Centralize dispute handling: route disputes to the CRA immediately, freeze the decision until reinvestigation completes, and document every step.
• Clarify employer vs. CRA roles in every applicant-facing message.
• Document decision criteria (offense nature, time elapsed, job relevance, and rehabilitation) and train every hiring manager on them.
• Partner with a compliant screening provider: your compliance partner should handle the routine procedural steps correctly by default. It doesn't replace counsel, but it removes the failure modes that generate most lawsuits.

Your Adverse Action Compliance Checklist

For a deeper walkthrough, see the KRESS guide on sending an adverse action notification the right way.

Before ordering a report: provide a standalone FCRA disclosure (not bundled into the application) and obtain the candidate's written or electronic authorization.

When a report contains potentially disqualifying information: pause the decision, send the pre-adverse notice, and attach the full report and the current CFPB Summary of Rights.

During the waiting period: allow at least five business days, route any dispute to your CRA immediately, and freeze decisions until reinvestigation completes.

If you finalize adverse action: send the final notice with the CRA's contact details, the not-the-decision-maker statement, and the candidate's dispute and free-report rights.

Ongoing: audit a sample of adverse action files quarterly, update templates immediately when regulators revise forms, and run annual FCRA training for HR and hiring managers.

Frequently Asked Questions

What is the FCRA adverse action process for employers?

Two steps: a pre-adverse action notice with the report and CFPB Summary of Rights attached, then, after a reasonable waiting period, a final notice with the CRA's contact details, the statement that the CRA didn't decide, and the candidate's dispute and free-report rights.

How long do you have to wait between the two notices?

The FCRA says "reasonable" without a number. Five business days is the generally accepted minimum; same-day or one-to-two-day gaps are a common trigger for class actions.

What happens if an applicant disputes information during the process?

Freeze the decision, route the dispute to the CRA for reinvestigation, and only act once it's complete and any corrections are reviewed. Proceeding mid-dispute is a common litigation trigger.

Does the FCRA require employers to let candidates explain their criminal record?

Not exactly. Federal appeals courts have ruled the FCRA protects disputing accuracy, not relitigating accurate records. But best practice, and some state and local fair-chance laws, favor an explanation opportunity, so check your jurisdictions.

FCRA adverse action compliance is operationally complex, but you don't have to manage every step manually. KRESS's automated adverse action workflow handles the notices, timing, attachments, and tracking so your team can focus on making good hiring decisions. See how KRESS can protect your process.