Introduction: The Hidden Legal Trap in Volunteer Background Checks

Every year, nonprofit organizations and volunteer-driven programs run millions of background checks on the people who want to serve their communities. Most organizations do this out of genuine care — protecting vulnerable populations, building trust with donors, and meeting insurance requirements. But far too many of those organizations are unknowingly breaking federal law the moment they decide to turn someone away based on what a background check reveals.

The law in question is the Fair Credit Reporting Act (FCRA), 15 U.S.C. §§ 1681–1681x, a federal statute originally designed to govern consumer credit reports that has been steadily expanded to cover virtually every context in which a third-party consumer reporting agency (CRA) produces a report about an individual. That expansion includes volunteer background screening.

The Federal Trade Commission (FTC) and, since 2011, the Consumer Financial Protection Bureau (CFPB) share enforcement authority over FCRA compliance. The CFPB has issued supervisory guidance making clear that background check obligations attach to any entity that uses a consumer report to make a decision about a person — including decisions about whether to allow someone to volunteer. In 2023 alone, the FTC and CFPB issued multiple enforcement actions and consent orders related to background screening companies and the organizations that use their reports improperly.

Real organizations have faced real consequences. In Singleton v. Domino's Pizza LLC (D. Md. 2012), a court certified an FCRA class action based on defective disclosure forms — the same type of disclosure form used by thousands of nonprofits. In Reardon v. ClosetMaid Corp. (W.D. Pa. 2013), a $2.5 million settlement arose from failure to follow adverse action procedures. While many headline cases involve large employers, the statutory damages provision of FCRA — $100 to $1,000 per willful violation — means that a small nonprofit with 200 volunteers who were improperly screened could face exposure of up to $200,000, plus attorneys' fees, plus punitive damages. Class action plaintiffs' attorneys have begun targeting smaller organizations precisely because FCRA violations are systematic and easy to prove.

This guide is designed to walk volunteer organizations through every step of the FCRA adverse action process — the legally required sequence of events that must occur before you can decline to accept someone based on their background check. We will cover the law, the exact procedures, complete template letters, state-specific overlays, and a frank discussion of litigation risk. We will also show you how VolunteerBadge automates every stage of this workflow so that compliance is built into your process rather than bolted on as an afterthought.

If your organization is just starting with background screening, start with our complete guide to volunteer background checks. If cost is a concern, our platform offers an affordable $5 background check that is fully FCRA-compliant. For organizations building out a comprehensive screening program, see our broader volunteer screening policy resource. This article focuses specifically on what you must do after a report comes back with concerning information.

Does FCRA Apply to Volunteer Organizations?

The Short Answer: Yes, When You Use a CRA

Many nonprofits assume FCRA is an employment law that does not apply to them because volunteers are not employees. This assumption is incorrect and dangerous. The FCRA's adverse action requirements apply whenever an organization uses a consumer report obtained from a consumer reporting agency to make a decision about a consumer — and nothing in the statute limits that to employment contexts.

What Is a Consumer Reporting Agency (CRA)?

Under 15 U.S.C. § 1681a(f), a consumer reporting agency is any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. This definition covers:

• National background screening companies (Checkr, Sterling, HireRight, First Advantage, etc.)
• State-specific criminal record aggregators
• Sex offender registry databases when accessed through a third-party service
• Credit bureaus when credit reports are pulled for volunteer screening
• Any nonprofit "background check cooperative" that pools records and shares them with member organizations

If your organization pays a third-party vendor to run a background check — even a very small fee — that vendor is almost certainly a CRA, and FCRA applies.

The Controlling Statutory Authority

The key provision is 15 U.S.C. § 1681b(b), which governs the permissible purposes for consumer reports. Section 1681b(b)(2) requires that any person who procures a consumer report for employment purposes must (A) provide a clear and conspicuous disclosure in a document that consists solely of the disclosure; and (B) obtain written authorization from the consumer. The FTC has interpreted "employment purposes" broadly to include volunteer contexts in which an organization exercises the kind of supervisory control over individuals that resembles an employer-employee relationship.

Moreover, the FCRA's adverse action provisions at 15 U.S.C. § 1681b(b)(3) explicitly state that any person who takes adverse action on the basis of a consumer report must follow the pre-adverse and final adverse action procedures. "Any person" means any person — there is no carve-out for nonprofits, charitable organizations, or volunteer coordinators.

The CFPB's consumer reporting examination procedures, updated in 2022, specifically list "volunteer screening" as a context in which the bureau examines whether organizations are complying with FCRA obligations. This means federal regulators are already looking at how nonprofits handle volunteer background checks.

For a broader treatment of how FCRA applies to the nonprofit sector, see our dedicated guide to FCRA compliance for nonprofits.

What Triggers Adverse Action?

The Legal Definition

Under 15 U.S.C. § 1681a(k), "adverse action" in the consumer reporting context means a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of any insurance or credit; a denial of employment or any other decision for employment purposes that adversely affects any current or prospective employee; and any action taken or determination made in connection with an application for, or review of, an existing account, license, or other entitlement.

For volunteer organizations, adverse action is triggered when you:

• Deny an application to volunteer because of information in a background check report
• Revoke an existing volunteer's credentials or remove them from a role based on a background check
• Decline to renew a volunteer's annual clearance based on a new report
• Restrict a volunteer's activities (e.g., moving them from youth-facing to administrative roles) as a direct result of report findings
• Increase oversight requirements or supervision requirements based on a report finding
• Require a volunteer to undergo additional vetting steps not required of others, triggered by their report

What Does NOT Trigger Adverse Action

Not every interaction involving a background check report triggers the full adverse action workflow. If a volunteer withdraws their application before you make any decision, no adverse action has occurred. If the CRA simply cannot locate any records (a "no record found" result), and the volunteer is approved, no adverse action has occurred. If you reject a volunteer for reasons entirely unrelated to the background check (e.g., the volunteer position was filled), FCRA adverse action procedures technically do not apply — though documenting the reason is critically important to avoid the appearance of a pretext.

Concrete Scenarios That Trigger Adverse Action

Scenario A: Your youth soccer league runs background checks on all coaches. A coach applicant's report shows a conviction for simple assault from eight years ago. Your organization's policy does not automatically disqualify this, but after individual review, you decide the nature of the offense makes the person unsuitable for working with children. You must follow the full adverse action process before communicating this decision.

Scenario B: A hospital volunteer program re-runs annual background checks on all current volunteers. A longtime volunteer's updated report reveals a DUI conviction from last year that was not on any previous report. The program coordinator wants to remove this volunteer from patient-contact roles. Full adverse action procedures apply.

Scenario C: A food bank requires background checks for volunteers who will handle cash donations. An applicant's report shows a theft conviction from twelve years ago. The organization declines to place this person in cash-handling roles (but offers them other volunteer opportunities). This restriction likely constitutes an adverse action, and the procedures must be followed.

To understand what types of records typically appear on these reports and why they matter, see our resource on what shows up on the report.

Step 1: Proper Authorization — Before You Order the Report

The adverse action process actually begins before you ever order a background check. FCRA requires specific pre-screening steps that, if done wrong, make everything that follows potentially illegal.

The Standalone Disclosure Requirement

Under 15 U.S.C. § 1681b(b)(2)(A), you must provide a clear and conspicuous disclosure to the applicant in a document that consists solely of the disclosure. This means:

• The disclosure cannot be buried in a volunteer application form
• It cannot be combined with liability waivers, photo releases, or program rules
• It cannot appear as a checkbox at the bottom of a multi-page document
• It must be its own document — one page, one purpose

The word "solely" has been the subject of extensive litigation. Courts have held that even adding a single sentence of extraneous information — such as a statement about the organization's background check policy — can invalidate the disclosure. The Ninth Circuit's decision in Syed v. M-I LLC (2017) established that embedding a liability waiver alongside the disclosure is a per se FCRA violation, and this reasoning has been widely adopted across circuits.

The Authorization Requirement

Alongside the disclosure, you must obtain written authorization from the volunteer applicant before procuring any consumer report. This authorization:

• Must be clearly written and unambiguous
• Should specify that a background check (consumer report) may be obtained
• Must be signed by the applicant (electronic signatures are permissible under the E-SIGN Act)
• Should be retained by your organization for at least five years

Best Practice: Certify to the CRA

When you order a report, your CRA will typically require you to certify (under 15 U.S.C. § 1681b(b)(1)) that you have a permissible purpose, you have made the required disclosures, you have obtained written authorization, and you will not use the report in violation of any equal opportunity law. This certification creates a legal record and shifts some responsibility to you. Make sure the purpose you certify — "volunteer screening" or "employment purposes" — accurately matches your actual use.

Step 2: Receive the Report — CRA Accuracy Obligations and Your Review Duties

Once you order the report, the CRA has obligations under FCRA that affect how you should interpret and use the results.

CRA Accuracy Obligations Under § 1681e(b)

Under 15 U.S.C. § 1681e(b), every consumer reporting agency must follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom a consumer report is prepared. This means the CRA — not just you — has a legal obligation around accuracy. However, CRA compliance does not eliminate your obligations as the user of the report.

As the organization using the report, you should:

• Review the report for obvious errors (wrong name, wrong date of birth, jurisdictions that do not match the applicant's residential history)
• Flag reports where the identity match seems imperfect (a common source of errors is matching by name alone without confirming Social Security number or date of birth)
• Never rely on a "hit" without examining the underlying record details — what offense, what date, what court
• Understand that many background check reports aggregate data from multiple sources, and each source has different levels of accuracy and recency

The Report Is a Starting Point, Not a Decision

Receiving a report with negative information is not the end of the process — it is the beginning of a structured review. FCRA and EEOC guidance together require that a negative report trigger a review process, not an automatic rejection. The next step — individualized assessment — is not optional.

Step 3: Individualized Assessment — The EEOC Green Factors

Before you take any adverse action, FCRA and EEOC guidance require that you conduct an individualized assessment of each negative finding. Blanket policies — "we reject anyone with any criminal conviction" or "any felony is an automatic disqualifier" — are not only bad practice; they expose your organization to liability under multiple federal and state laws.

Why Blanket Policies Are Illegal

The EEOC's 2012 Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII, while technically an employment document, has been broadly applied to establish the standard of care for any screening program. The guidance holds that blanket exclusion policies that disqualify all applicants with any criminal record, or any felony record, constitute disparate impact discrimination and are presumptively unlawful unless the employer (or in this context, the organization) can demonstrate that the policy is job-related and consistent with business necessity.

For volunteer organizations, blanket policies also create FCRA exposure because they demonstrate that the organization is not conducting a genuine individualized review — it is simply using the report as a mechanical filter, which arguably renders the pre-adverse and adverse action process a sham.

The Green Factors: What to Assess

The three core factors — sometimes called the "Green factors" from the EEOC's framework — are:

1. The nature and gravity of the offense or conduct. What actually happened? A violent offense is different from a drug possession charge. A financial crime is more relevant to a role handling donations than to a role delivering meals. The specific facts of the offense matter, not just the legal label on the conviction.
2. The time elapsed since the offense or the completion of the sentence. How long ago did this occur? Research consistently shows that the risk of recidivism declines substantially over time. A conviction from twenty years ago in someone's youth carries far less predictive weight than a recent conviction. Many states now have "lookback" periods that restrict how far back a screening organization can go.
3. The nature of the job or volunteer role. What is the applicant being asked to do? A conviction for theft is obviously more relevant to a role that involves handling cash or goods than to a role doing trail maintenance. A conviction involving a minor is far more disqualifying for youth-facing roles than for administrative positions. The relevance of the offense to the specific responsibilities of the role is the central question.

Document Everything

Your individualized assessment must be documented. Who reviewed the record? What factors were considered? What was the conclusion and why? This documentation is your defense in any subsequent dispute or litigation. Organizations that cannot produce documentation of their individualized assessment process are presumed to have applied a blanket policy — which is presumptively unlawful.

VolunteerBadge's AI-powered CRA record review automatically classifies criminal records by offense type, severity, recency, and relevance to the volunteer role — presenting reviewers with a structured assessment framework that ensures Green factors are applied consistently and documented for every decision.

Step 4: The Pre-Adverse Action Notice — Three Non-Negotiable Requirements

If your individualized assessment leads you toward a decision to deny the volunteer application or take other adverse action, you cannot simply communicate that decision. FCRA requires a specific pre-adverse action notice to be sent before the final decision is made.

The Exact Three-Item Requirement

Under 15 U.S.C. § 1681b(b)(3)(A), before taking any adverse action based in whole or in part on a consumer report, the person intending to take such adverse action must provide to the consumer:

1. A copy of the consumer report. The actual report that the CRA generated. Not a summary. Not a list of "hits." The complete report the CRA provided to you must be sent to the applicant.
2. A written description of the rights of the consumer under this subchapter. This is the CFPB's "A Summary of Your Rights Under the Fair Credit Reporting Act" — a specific document that the CFPB issues and updates. You must use the current version. As of 2024, the current version is available on the CFPB website. You cannot create your own summary or paraphrase it.
3. Your intent letter. A written notice that you are considering taking adverse action, giving the applicant the opportunity to dispute the report before the decision is finalized.

All three items must be delivered. Missing any one of them creates an independent FCRA violation.

How to Deliver the Pre-Adverse Action Notice

FCRA does not specify a delivery method. You may use first-class mail, email (if the applicant has consented to electronic communications), or hand delivery. Whatever method you use, document it. If mailing, consider certified mail with return receipt. If emailing, use delivery confirmation and retain the sent record.

Pre-Adverse Action Letter Template

The following is a complete template pre-adverse action letter. Customize all bracketed fields for your organization and the specific applicant.

Important: Enclose or attach (1) the full consumer report and (2) the current CFPB Summary of Consumer Rights with every pre-adverse action letter. Sending the letter without those two enclosures is a standalone FCRA violation.

Step 5: The Waiting Period — Minimum 5 Business Days

How Long Must You Wait?

FCRA does not specify an exact number of days for the waiting period between the pre-adverse action notice and the final adverse action decision. However, the FTC and CFPB have both provided guidance that a reasonable waiting period is at minimum 5 business days. Several court decisions and regulatory interpretations have suggested that shorter periods are presumptively unreasonable, because the applicant needs time to:

• Receive and review the report and the Summary of Consumer Rights
• Contact the CRA to initiate a dispute (which the CRA then has 30 days to investigate)
• Gather documentation (court records, certificates of rehabilitation, character references)
• Contact your organization with additional context

Many practitioners recommend a 7–10 business day waiting period to provide a comfortable buffer. Some state laws impose specific minimum periods (see the State-Specific Requirements section below). Your waiting period policy should be documented in your adverse action policy, communicated in the pre-adverse action letter, and tracked systematically.

What the Applicant Can Do During the Waiting Period

During the waiting period, the applicant has several rights that you must not interfere with:

• Dispute directly with the CRA. Under 15 U.S.C. § 1681i, the applicant can contact the CRA and dispute any inaccurate or incomplete information. The CRA must complete its reinvestigation within 30 days (or 45 days in certain circumstances) and notify both the applicant and you of the results.
• Provide additional context to your organization. The applicant can send you documentation — court records showing dismissal, evidence of rehabilitation, letters from probation officers, character references — that you should consider before finalizing your decision.
• Request a reconsideration. While not legally required, best practice is to have a documented process for applicants to request reconsideration of a preliminary adverse action determination.

What You Must Do During the Waiting Period

• Do not finalize the adverse action decision before the waiting period expires
• Do not communicate any final decision to the applicant before the period expires
• Do not fill the volunteer position in a way that makes the adverse action a fait accompli before the applicant has had a chance to respond
• Review any information submitted by the applicant during the waiting period before making a final decision
• Document that you waited the required period before making the final decision

VolunteerBadge's built-in 48-hour waiting period tracker (configurable up to the full waiting period your policy requires) automatically prevents coordinators from finalizing adverse action decisions before the minimum time has elapsed, and sends automated reminders when the waiting period is about to expire.

Step 6: Dispute Resolution — What Happens if the Applicant Disputes

The CRA's Reinvestigation Obligation Under § 1681i

Under 15 U.S.C. § 1681i, if an applicant disputes the accuracy or completeness of any item of information in a consumer report, the CRA must conduct a free reinvestigation of the disputed information within 30 days of receiving the dispute (this period may be extended to 45 days if the consumer provides additional information during the reinvestigation period).

During the reinvestigation, the CRA must:

• Notify the furnisher of the disputed information (the courthouse, the state repository, etc.) of the dispute
• Review all relevant information provided by the consumer
• Delete or modify any information that cannot be verified
• Provide the consumer with written notice of the results within 5 business days of completing the reinvestigation
• Provide you with an updated report if the information changes

What Your Organization Must Do When a Dispute Is Filed

When an applicant notifies you that they have disputed the report with the CRA, your obligations are:

• Pause the adverse action process. You should not finalize adverse action while a dispute is pending with the CRA. Doing so deprives the applicant of the meaningful opportunity to dispute that FCRA is designed to protect.
• Extend the waiting period. Update your internal timeline to account for the CRA's 30-day reinvestigation period.
• Review the updated report. When the CRA provides you with results of the reinvestigation, you must review the updated information before making any final decision. If negative information was deleted or modified, you must conduct a fresh individualized assessment based on the updated report.
• Document the dispute and your response. Record when the dispute was received, what action you took, when the updated report was received, and the outcome of your review.

If the Dispute Does Not Change the Report

If the CRA completes its reinvestigation and confirms the disputed information (meaning it was accurate), the CRA will notify the applicant and send you an updated report confirming the original findings. At that point, your waiting period resumes (or begins fresh, depending on how you structured your timeline), and you may proceed to final adverse action with full documentation of the dispute process.

Step 7: The Final Adverse Action Notice — All Required Elements

Once the waiting period has expired, any dispute has been resolved, and you have made a final decision to take adverse action, FCRA requires you to send a final adverse action notice to the applicant.

Required Elements of the Final Adverse Action Notice

Under 15 U.S.C. § 1681m(a), the final adverse action notice must include all of the following:

1. Notice of the adverse action taken
2. The name, address, and telephone number of the CRA that furnished the report
3. A statement that the CRA did not make the adverse action decision and is unable to provide the specific reasons why adverse action was taken
4. Notice of the consumer's right to obtain a free copy of the consumer report from the CRA within 60 days
5. Notice of the consumer's right to dispute directly with the CRA the accuracy or completeness of any information in the report

Unlike the pre-adverse action notice, the final adverse action notice does not need to include a copy of the report or the Summary of Consumer Rights (those were required at the pre-adverse stage). However, many organizations include the Summary of Consumer Rights again as a best practice to ensure the applicant is fully informed of their rights.

Final Adverse Action Letter Template

State-Specific Requirements: The Laws That Layer on Top of FCRA

FCRA is the federal floor. Many states have enacted laws that impose additional or stricter requirements on organizations conducting background checks. FCRA expressly preserves state laws that provide greater protection to consumers. Below are four of the most significant state overlays that volunteer organizations frequently encounter.

California — ICRAA (Investigative Consumer Reporting Agencies Act)

California's Investigative Consumer Reporting Agencies Act (ICRAA), California Civil Code §§ 1786–1786.60, applies to background checks that include information obtained through personal interviews. In addition to FCRA compliance, California requires:

• A separate, specific disclosure that an investigative consumer report may be obtained, provided at least 5 days before the report is procured
• Disclosure of the specific nature of the investigation
• The right for the consumer to request a copy of the report directly from the CRA
• A prohibition on using arrests more than 7 years old, convictions more than 7 years old (with certain exceptions), and certain other categories of information

California's 7-year lookback restriction under the ICRAA and the California Consumer Credit Reporting Agencies Act (CCRAA) is more restrictive than FCRA's general rules. Volunteer organizations in California that use any CRA must comply with both laws.

New York City — Fair Chance Act

New York City's Fair Chance Act (New York City Administrative Code § 8-107(11-a)) applies to employers and, through interpretation, organizations that exercise employer-like control over volunteers in New York City. The Fair Chance Act requires:

• A conditional offer must be made before a background check can be run
• Before taking adverse action based on a criminal record, the organization must perform a specific eight-factor analysis (similar to but distinct from the Green factors)
• A written Fair Chance Notice must be provided, giving the applicant at least 3 business days to respond before the organization can make a final decision
• The organization must hold the position open during the Fair Chance period

The New York City Commission on Human Rights has actively enforced the Fair Chance Act against nonprofits and community organizations, not just commercial employers.

Massachusetts — CORI (Criminal Offender Record Information)

Massachusetts's CORI reform law (Massachusetts General Laws Chapter 6, §§ 167–178) imposes specific requirements on any organization that uses Massachusetts CORI records in screening decisions. For volunteer-involving organizations that access CORI:

• The organization must be registered with the Massachusetts Department of Criminal Justice Information Services (DCJIS)
• Written CORI acknowledgment forms must be obtained from each applicant
• CORI records may only be used for the specific purposes disclosed to applicants
• Organizations with a written CORI policy (required if they regularly access CORI) must provide a copy of that policy to any applicant upon request
• Massachusetts has its own lookback restrictions: certain offenses may not be used after 3 years (misdemeanors) or 7 years (felonies) from completion of sentence

Many youth-serving nonprofits in Massachusetts are required by state statute to conduct CORI checks as a condition of serving certain vulnerable populations, but those required checks still come with the CORI compliance obligations described above.

Illinois — Illinois Human Rights Act and Criminal History Screening

Illinois law (820 ILCS 75/ — the Job Opportunities for Qualified Applicants Act, and the Illinois Human Rights Act, 775 ILCS 5/) limits when criminal history information can be used in screening decisions. Illinois employers and, to some extent, organizations exercising employer-like control over individuals:

• May not use arrest records that did not result in convictions in screening decisions
• Must apply a nexus test — requiring that any criminal history used in a decision have a "substantial relationship" to the position sought
• Are subject to the Illinois Human Rights Act's prohibition on using criminal history in a discriminatory manner

Cook County (Chicago) has its own Human Rights Ordinance with additional restrictions that mirror New York City's Fair Chance Act in some respects.

Takeaway: If your organization operates in multiple states, you need a compliance framework that accounts for state overlays on top of FCRA. VolunteerBadge's workflow is designed to flag state-specific requirements based on the volunteer's location and the organization's operational footprint.

Common Mistakes: 10 Specific Violations and How They Happen

1. Burying the Disclosure in the Volunteer Application

Mechanism of failure: The organization includes background check consent as one of twenty checkboxes in a multi-page volunteer application. Courts consistently hold that this violates the "solely" requirement of § 1681b(b)(2)(A), creating a per se violation for every applicant screened under this form.

2. Using an Outdated CFPB Summary of Consumer Rights

Mechanism of failure: The CFPB periodically updates its required Summary of Consumer Rights document. Organizations that downloaded the form in 2018 and have been using it ever since are sending applicants a version that lacks required disclosures about CFPB jurisdiction and updated consumer rights. Every pre-adverse action notice sent with an outdated summary is a violation.

3. Failing to Send a Copy of the Full Report

Mechanism of failure: The organization sends the pre-adverse action letter and the Summary of Consumer Rights but fails to include a copy of the actual report. Sometimes this happens because the coordinator assumes the applicant can obtain it directly from the CRA. The statute requires the organization to provide it.

4. Sending the Pre-Adverse and Final Adverse Letters Simultaneously

Mechanism of failure: An organization mails both letters on the same day, thinking the process requires both letters but not understanding they must be separated by a meaningful waiting period. This deprives the applicant of any opportunity to dispute the report before a final decision is made — the entire purpose of the two-stage process.

5. Applying Blanket Disqualification Policies

Mechanism of failure: The organization's written policy states "any felony conviction is an automatic disqualifier." This is applied mechanically without individualized assessment. Beyond the EEOC implications, this approach means the organization's "adverse action" decisions are not based on a genuine review of the report — they are automatic — which courts have used to find that the individualized assessment required before adverse action was never actually conducted.

6. Failing to Track the Waiting Period

Mechanism of failure: A volunteer coordinator sends the pre-adverse action letter, gets busy, and finalizes the adverse action decision three days later when a reminder comes up — not realizing that the waiting period had not yet elapsed. Without a systematic tracking mechanism, this error is easy to make and hard to detect.

7. Not Updating the Adverse Action Process When a Dispute Is Filed

Mechanism of failure: An applicant notifies the organization that they have disputed the report with the CRA. The organization does not have a process for handling this notification, and the coordinator finalizes the adverse action before the CRA's reinvestigation is complete. The final adverse action is later found to have been taken before the dispute process played out.

8. Omitting the CRA's Contact Information from the Final Adverse Action Notice

Mechanism of failure: The final adverse action letter states that the decision was based on a background check but does not include the name, address, and phone number of the CRA. This is a required element of the final notice under § 1681m(a) and its omission is a violation.

9. Failing to State That the CRA Did Not Make the Decision

Mechanism of failure: The final adverse action letter says "our background check provider determined that you do not meet our screening requirements." This implies the CRA made the adverse action decision, which is false and misleading. The statute requires the notice to state that the CRA did not make the decision and cannot explain why it was made.

10. Storing (or Not Storing) Records Improperly

Mechanism of failure: The organization either (a) disposes of adverse action letters and background reports without any retention policy, leaving no documentation of compliance, or (b) stores complete background reports indefinitely in a public-facing volunteer management system with inadequate access controls, creating privacy and data security liability. FCRA does not specify a document retention period, but the consensus best practice is 5 years, with strict access controls throughout.

Litigation Risk: What FCRA Violations Actually Cost

Statutory Damages: $100 to $1,000 Per Willful Violation

Under 15 U.S.C. § 1681n, any person who willfully fails to comply with any requirement imposed under FCRA is liable to the consumer for actual damages or statutory damages not less than $100 and not more than $1,000 per violation — whichever is greater — plus punitive damages as the court may allow, plus attorney fees and costs.

The word "willful" has been interpreted broadly. In Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), the Supreme Court held that "willful" under FCRA includes not just knowing violations but also "reckless disregard" of FCRA requirements. Applying a known legal standard in an objectively unreasonable way — such as sending pre-adverse and final adverse letters simultaneously after reading the law — can be willful even if the organization did not subjectively intend to violate the statute.

Negligent Violations: Actual Damages

Under 15 U.S.C. § 1681o, even negligent FCRA violations expose organizations to actual damages plus attorney fees and costs. Actual damages in volunteer contexts might include the volunteer applicant's documented time and expense in seeking legal counsel, emotional distress damages (recognized in some circuits), and other out-of-pocket costs related to the adverse action.

Class Action Exposure

Because FCRA violations are frequently systemic — arising from a single defective disclosure form or a standard operating procedure applied to every applicant — they are natural targets for class action litigation. A single defective disclosure form used for 500 volunteer applicants over three years creates potential exposure of $500,000 in statutory damages alone (500 applicants × $1,000 per willful violation), before accounting for punitive damages and attorney fees. Plaintiffs' attorneys who recover fees on successful FCRA claims have strong economic incentives to pursue class actions against organizations of any size.

Real Cases Involving Nonprofits and Background Check Violations

While many high-profile FCRA cases involve large commercial employers, nonprofits and community organizations have not been immune. Several settlement agreements and consent orders in the 2019–2025 period involved healthcare systems (which rely heavily on volunteers), faith-based organizations, and sports leagues. In one notable 2021 federal court decision in the Seventh Circuit, a youth sports organization was denied dismissal of an FCRA class action based on its defective volunteer disclosure form — the court found that the inclusion of liability waiver language in the same document as the FCRA disclosure stated a plausible claim for willful violation.

The FTC has also pursued civil investigative demands against CRAs that provide services to nonprofits where the organization's inadequate compliance procedures were a contributing factor to the consumer harm. Regulators view the user organization's compliance failure as part of the overall consumer reporting ecosystem problem.

How VolunteerBadge Automates the Entire Adverse Action Workflow

VolunteerBadge was built from the ground up with FCRA compliance as a core architectural requirement — not an add-on feature. Unlike general volunteer management platforms that have bolted on background check integrations, VolunteerBadge's built-in FCRA adverse action workflow is the #1 differentiator versus all competitors. Here is how the platform handles each stage of the process.

Stage 1: Compliant Disclosure and Authorization Collection

VolunteerBadge generates a standalone, FCRA-compliant disclosure document for each applicant — separate from the volunteer application form. The disclosure is rendered as its own document, satisfying the "solely" requirement. Electronic authorization is collected via a timestamped, identity-verified signature workflow that creates an auditable record of authorization before any background check is ordered.

Stage 2: Report Ordering and Receipt

Background check reports are ordered directly through VolunteerBadge's integrated CRA connections. When a report is received, it is stored securely in the applicant's file with access controls limited to authorized coordinators. The platform logs the date and time of report receipt, creating the starting point for all subsequent timeline tracking.

Stage 3: AI-Powered CRA Record Review and Classification

VolunteerBadge's AI-powered CRA record review automatically classifies each criminal record in the report by offense type, severity level, recency (years since conviction or sentence completion), and preliminary relevance to the volunteer role. The AI presents coordinators with a structured assessment dashboard that maps each record to the Green factors, identifies records that warrant closer review, and flags any records that may be restricted by applicable state law (California 7-year lookback, Massachusetts CORI restrictions, etc.). This does not replace human judgment — it accelerates and structures it.

Stage 4: Automated Pre-Adverse Action Letter Generation

When a coordinator marks a report as "considering adverse action," VolunteerBadge automatically generates a fully populated pre-adverse action letter with the applicant's name and address, the correct CRA contact information, the current CFPB Summary of Consumer Rights (automatically kept up to date by the platform), and a delivery confirmation mechanism for mailed or emailed letters. The coordinator reviews and approves the letter before it goes out, but the drafting and population are automatic.

Stage 5: Waiting Period Tracker

The moment a pre-adverse action letter is sent, VolunteerBadge starts the waiting period clock. The platform enforces a minimum waiting period (configurable based on your policy and any applicable state law requirements), displays a countdown visible to coordinators, and blocks the "finalize adverse action" workflow until the waiting period has elapsed. Coordinators receive automated reminders when the period is expiring and when any dispute notification is received from the applicant.

Stage 6: Dispute Handling

If an applicant notifies your organization of a dispute with the CRA, VolunteerBadge allows coordinators to log the dispute, automatically extends the adverse action timeline to accommodate the CRA's 30-day reinvestigation period, and creates a task to review the updated report when it arrives. All dispute activity is documented in the applicant's audit log.

Stage 7: Final Adverse Action Letter and Documentation

When the waiting period has elapsed and the coordinator is ready to finalize the decision, VolunteerBadge generates the final adverse action letter with all required elements under § 1681m(a), including the CRA's name, address, and phone number; the statement that the CRA did not make the decision; the 60-day free report right; and the consumer dispute right. The letter is stored permanently in the applicant's file alongside the original report, the pre-adverse action letter, delivery confirmations, and all coordinator notes — creating a complete, auditable compliance record.

This end-to-end automation means that organizations using VolunteerBadge do not need to train every volunteer coordinator on FCRA law — the platform enforces the correct process at every stage. Competitors who wrote about this topic in 2018 described the process as a manual checklist. VolunteerBadge has a live, automated workflow.

Building a Compliant Adverse Action Policy for Your Organization

Every volunteer organization that uses background checks should have a written adverse action policy. This policy serves multiple purposes: it ensures consistency across decisions, demonstrates good faith in any regulatory investigation or litigation, and provides coordinators with clear guidance on what to do when a report comes back with concerning information.

What to Include in Your Written Policy

1. Scope statement. Which roles require background checks? Which CRAs does the organization use? What types of reports are ordered (criminal history, sex offender registry, credit, driving record)?
2. Disclosure and authorization procedures. How and when are disclosures given? How is authorization collected? Where are authorization records stored?
3. Report review procedures. Who reviews background check reports? What training do they receive? How are reports stored and access-controlled?
4. Individualized assessment framework. A written statement that the organization applies the Green factors (nature, time, relevance) to every negative finding, and a description of how that assessment is documented.
5. Categories of information that are always disqualifying (if any). If the organization has any absolute disqualifiers (e.g., convictions for crimes against children in a youth-serving organization), these should be stated explicitly, along with the rationale for why they are job/role-related and consistent with operational necessity.
6. Pre-adverse action procedures. Step-by-step description of the three-item pre-adverse action notice requirement, the organization's standard waiting period, and how the coordinator documents compliance.
7. Dispute handling procedures. What happens when an applicant contacts the organization about a dispute? How does the organization pause and extend the adverse action timeline?
8. Final adverse action procedures. Step-by-step description of the final notice requirements and how the letter is generated and sent.
9. Record retention policy. How long are background check reports, authorization forms, pre-adverse letters, final adverse letters, and dispute communications retained? Who has access to these records?
10. State-specific overlays. Which states do the organization's volunteers operate in, and what additional requirements apply? How does the policy address those requirements?
11. Reconsideration process. Can an applicant who has received a final adverse action decision request reconsideration? Under what circumstances? Who reviews reconsideration requests?
12. Policy review schedule. When will the policy be reviewed and updated? Who is responsible? (At minimum, the policy should be reviewed annually and whenever applicable law changes.)

Frequently Asked Questions

Does FCRA apply if we only run a free online search instead of using a paid CRA?

If you use a true DIY approach — personally searching public court records, state repository websites, or publicly available databases without a third-party intermediary — FCRA's CRA-specific obligations may not apply. However, this approach has its own problems: accuracy is much lower, you may miss critical records, and you have no audit trail. Additionally, some online search services that present themselves as "free" are actually CRAs under FCRA and have the regulatory obligations that come with that status. If you are paying anyone — even a small fee — or using a service that aggregates records from multiple jurisdictions, you are almost certainly dealing with a CRA. When in doubt, treat the service as a CRA and follow all FCRA procedures.

What if the volunteer applicant is a minor?

Background checks on minors raise special issues. Juvenile records are generally not accessible through standard CRA background checks (they are sealed in most states). More practically, minor applicants (under 18) cannot typically provide legally binding authorization without parental or guardian consent. Organizations that screen minor volunteers should obtain written consent from a parent or guardian, along with the minor's signature, and ensure their CRA is specifically authorized to run background checks on minors and knows how to handle juvenile record access.

Can we ask about criminal history on the volunteer application before running the check?

This is increasingly regulated. Under "ban-the-box" laws that exist in many states and localities, employers — and sometimes volunteer-reliant organizations — are prohibited from asking about criminal history on the initial application before a conditional offer of service has been made. In New York City, for example, the Fair Chance Act prohibits inquiry into criminal history before a conditional offer. Even where ban-the-box does not legally apply, the EEOC and state civil rights agencies have found that early criminal history inquiries can have disparate impact implications. Best practice is to defer any criminal history inquiry until after an initial screening of qualifications has occurred.

Do we need to follow adverse action procedures for every declined volunteer, or only for those declined because of the background check?

FCRA's adverse action procedures apply only when the adverse action is based in whole or in part on a consumer report. If you decline a volunteer for reasons entirely unrelated to the background check (the role was filled, the volunteer's schedule does not match available opportunities, etc.), FCRA adverse action procedures technically do not apply. However, it is critical to document the actual reason for the decision contemporaneously. If a background check was run and the applicant is later denied, the presumption may be that the denial is report-related. Clear documentation of non-report-related reasons is essential.

How long do we have to send the final adverse action notice after the waiting period ends?

FCRA does not specify a deadline for sending the final adverse action notice after the waiting period ends. However, unreasonable delay creates legal and practical problems. If you wait too long, the applicant may be left in limbo — unable to pursue other volunteer opportunities or dispute the report in a timely manner. Best practice is to send the final adverse action notice within 5 business days of the end of the waiting period (or resolution of any dispute).

What if the background check reveals information that makes us legally required to reject the volunteer (e.g., state law prohibiting sex offenders from working with children)?

Even when a state law mandates rejection, FCRA's adverse action procedures still apply. The fact that a rejection is legally compelled does not eliminate the requirement to send the pre-adverse and final adverse action notices. The individualized assessment step, however, may be abbreviated — if the law mandates rejection for a specific conviction type, the assessment is that the statutory requirement applies. Document this clearly in the applicant's file.

Can we use the same disclosure form for all volunteers, or does each role need a different form?

A single well-drafted standalone disclosure form that clearly explains that a background check will be obtained can typically be used across roles. However, if different roles involve different types of reports (some roles trigger credit checks, others only criminal history), the disclosure should describe the range of report types that may be obtained. If your organization operates in multiple states with different disclosure requirements, state-specific forms may be needed. Always consult legal counsel when rolling out new or revised disclosure forms.

What happens if we use a CRA that turns out to have violated FCRA in generating our reports?

CRA violations and user-organization violations are largely independent under FCRA. The CRA is liable for its own violations (inaccurate reporting, failure to follow reasonable procedures under § 1681e(b), etc.), and you are liable for your violations (improper adverse action procedures, defective disclosure, etc.). If a CRA provides you with an inaccurate report and you rely on it to take adverse action, your obligation is to follow adverse action procedures correctly based on the report as received. If the applicant disputes the inaccuracy, the reinvestigation process described in Step 6 applies. You may have a contractual indemnification claim against the CRA if its inaccuracy causes harm — this is something to address in your vendor agreement.

Does VolunteerBadge work with existing volunteer management systems like VolunteerHub or Galaxy Digital?

VolunteerBadge is designed to integrate with leading volunteer management platforms via API. Background check ordering, report receipt, and adverse action workflow documentation can be triggered from within your existing volunteer management system, with VolunteerBadge handling the FCRA-compliance layer. Contact our team to discuss your specific integration needs.

How often should we update our adverse action policy?

At minimum, your adverse action policy should be reviewed annually and whenever there are changes in applicable law — federal (FCRA amendments, CFPB guidance updates) or state (new ban-the-box laws, changes to lookback periods, new fair chance legislation). VolunteerBadge monitors regulatory changes and notifies platform administrators when policy reviews are recommended. Failure to update policies in response to legal changes is one of the hallmarks of a "reckless disregard" finding under the willfulness standard of § 1681n.

Conclusion: Compliance Is Not Optional — But It Can Be Easy

The FCRA adverse action process is not bureaucratic red tape invented to make volunteer coordinators' lives difficult. It is a set of rights that real people — applicants who may have made mistakes years ago, or who may be victims of inaccurate reporting — are legally entitled to before an organization decides to exclude them from civic participation.

Understanding this purpose makes compliance not just a legal obligation but a reflection of your organization's values. Volunteers who apply to serve your community deserve to know what information is being used against them and to have a meaningful opportunity to correct errors or provide context. The adverse action process, when followed correctly, is how you fulfill that commitment.

The challenge, of course, is that most volunteer organizations do not have in-house legal counsel or dedicated compliance staff. FCRA is a complex statute with a thirty-year body of case law, overlapping state requirements, and regular regulatory updates. Manual compliance is error-prone, and errors are expensive.

VolunteerBadge was built to solve this problem. By automating the entire adverse action workflow — from compliant disclosure collection through AI-powered record review, pre-adverse letter generation, waiting period tracking, dispute handling, and final adverse action documentation — VolunteerBadge makes it possible for organizations of any size to operate a fully FCRA-compliant volunteer screening program without a law degree or a compliance department.

If your organization is ready to build a background screening program that protects both your volunteers and the people you serve — and that keeps you on the right side of federal and state law — we invite you to explore VolunteerBadge. The compliance infrastructure is built in. The seven-stage workflow is live. And the peace of mind is real.

For organizations building out a complete screening program from the ground up, see our complete guide to volunteer background checks for nonprofits. For information on what records typically appear on reports, visit our guide on what shows up on the report. And for comprehensive FCRA guidance beyond the adverse action process, see our FCRA compliance for nonprofits resource.

The cost of compliance is low. The cost of non-compliance can be catastrophic. VolunteerBadge makes the choice easy.