The required sequence
- 1. Standalone disclosure and written authorization before the check is ordered — not buried in an application.
- 2. Pre-adverse action notice, including a copy of the report and the CFPB Summary of Rights.
- 3. A reasonable waiting period. Five business days is common practice; some jurisdictions require more.
- 4. Individualized assessment if the candidate responds with context or a dispute.
- 5. Final adverse action notice naming the screening company, stating it did not make the decision, and restating dispute rights.
Where programs get this wrong
- Combining the disclosure with other documents, which violates the standalone requirement.
- Sending both notices the same day, leaving no real chance to respond.
- Letting an ATS auto-reject on a report flag before the process runs.
- Failing to keep an auditable record of what was sent and when.
Automated, timestamped adverse action workflows exist precisely because manual handling of this process is the single most common source of FCRA claims.
Frequently asked
How long between pre-adverse and final notice?
The FCRA says reasonable. Five business days is the widely used standard; certain state and local rules require longer.
Does adverse action apply to current employees?
Yes — any employment decision based on a consumer report, including from continuous monitoring, requires the same process.