FCRA Compliance for Nonprofits: A Volunteer Screening Checklist

Many nonprofit leaders assume the Fair Credit Reporting Act (FCRA) is an HR problem for large employers. It isn’t. The moment your organization hires an outside company to run a criminal check on a volunteer, you become a user of a consumer report, and federal rules apply to you.

FCRA compliance for nonprofits comes down to a short list of repeatable steps. You disclose, get written authorization, use the report fairly, and follow a defined process before turning anyone away. This guide covers each step, the mistakes that cause the most trouble, and how to build a process your board can defend.

What Is the FCRA, and Why Does FCRA Compliance for Nonprofits Matter?

The Fair Credit Reporting Act is a federal law. It governs how consumer reporting agencies (CRAs) collect and share personal information, and how organizations that use their reports must behave. The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) oversee enforcement.

A background check vendor is a CRA. When your nonprofit orders a criminal history or sex offender registry search through that vendor, your organization becomes a “user” of a consumer report. That carries legal duties whatever your size or budget.

Does the FCRA Apply to Volunteers?

In most cases, yes. FTC staff guidance has treated screening for a nonprofit staffed wholly or partly by volunteers as an “employment purpose” under the FCRA. Courts often look to FTC guidance, so the safest approach is to treat volunteer applicants like job applicants for screening purposes.

What Counts as a Consumer Report?

A consumer report is any background information a CRA assembles about a person and provides to you for a decision. Criminal record searches, registry searches, and identity data all qualify.

A quick internet search by a staff member is not a substitute. It is unreliable, can surface the wrong person’s records, and leaves no audit trail.

What Are the Core Requirements for FCRA Compliance for Nonprofits?

Every nonprofit that screens volunteers should follow this sequence:

1. Certify your purpose. Tell the screening provider you have a permissible purpose, have given the required disclosure, and will follow the adverse action rules.
2. Give a standalone disclosure. Tell the applicant, in a clear separate document, that you may obtain a background report.
3. Collect written authorization. Get the person’s signed consent before ordering anything. Electronic signatures work when captured properly.
4. Evaluate results fairly. Apply the same written criteria to every applicant for the same role.
5. Follow the adverse action process. Complete it before rejecting, removing, or restricting anyone based on a report.
6. Keep records. Store disclosures, authorizations, reports, and notices with dates.

How Should Disclosure and Authorization Work?

The disclosure should be simple and easy to understand. It should not be buried inside a volunteer application or mixed with unrelated terms, and liability waivers don’t belong in it. Many nonprofits stumble here because they reuse an old form that bundles everything together.

The signed authorization can sit in the same digital signing flow, as long as the disclosure stands out. If you plan to re-screen volunteers periodically, check that your wording covers future checks.

How Does the Adverse Action Process Work?

Adverse action means any decision to deny, remove, or limit a volunteer role based even partly on a background report. The FCRA requires two notices with a pause between them.

1. Send a pre-adverse action notice. Include a copy of the report and the FTC’s “Summary of Your Rights Under the Fair Credit Reporting Act.”
2. Wait a reasonable period. The law sets no exact number of days, but many organizations wait at least five business days.
3. Send a final adverse action notice. It should name the screening company and its contact details. It should also state that the company did not make the decision and explain the applicant’s right to dispute the report and to request a free copy within 60 days.

If the applicant disputes the report, pause the final decision until the dispute is resolved.

Why Does the Pre-Adverse Step Matter So Much?

It gives the applicant a chance to correct errors. Records can be incomplete, belong to someone with a similar name, or have been sealed or expunged. A missed pre-adverse notice is among the most common FCRA errors. Class actions over it have produced large settlements in the employment world.

What Mistakes Undermine FCRA Compliance for Nonprofits?

These are the problems that come up most often:

• Informal rejection. A coordinator hears about a record and quietly stops scheduling the volunteer. That is adverse action without notice.
• Cluttered forms. The disclosure is merged with the application or includes a waiver.
• Inconsistent standards. One church volunteer is cleared despite a record, while another applicant is turned away for something similar.
• Ignoring state law. Some states add their own disclosure rules, timing requirements, or limits on which records you may consider. Check the rules where your volunteers live and serve.
• Missing records. You can’t prove consent or notice delivery months later.
• Lapsed checks. A volunteer cleared three years ago may no longer be current under your own policy.

How Do You Decide Who Passes a Screening?

Put your decision rules in a written nonprofit background check policy and have the board approve it. A strong policy does the following:

• Identifies which roles require screening, such as anyone with unsupervised access to children, seniors, or cash.
• Defines which records are relevant to each role.
• Considers the nature of the offense, how long ago it occurred, and its relevance to the duties involved.
• Names who reviews results and who sends notices.
• Sets re-screening intervals.

Relevance matters. A decades-old, nonviolent matter may carry little weight for a food-sorting shift, while a recent offense involving minors weighs heavily for a youth mentor role. Written criteria protect applicants from arbitrary treatment and protect your organization from claims of unfairness.

Some federal and state laws require checks for volunteers serving vulnerable populations. Others restrict what you can consider. Confirm both with counsel.

How Can a Small Nonprofit Achieve FCRA Compliance for Nonprofits Affordably?

Compliance doesn’t require a large budget, but it does require a process. The simplest route is a provider that builds the FCRA steps into the workflow, so staff can’t skip them by accident.

What Should You Ask a Screening Provider?

• Does the application include FCRA disclosure language and e-signature authorization?
• Does the platform generate pre-adverse and final adverse action notices?
• Is every check, result, and action stored in an exportable audit trail?
• Can you see which data sources are searched?
• What happens if a record can’t be verified?
• Are there monthly or setup fees on top of per-check pricing?

How Does VolunteerBadge Support This?

VolunteerBadge is an FCRA-regulated consumer reporting agency that serves churches, camps, schools, and other nonprofits. It charges $5 per national criminal check with no monthly fee, and its public pricing and features address most items on the list above:

• Applications embed FCRA disclosure and digital authorization.
• The platform generates pre-adverse and final adverse action notices for you to review and send.
• It keeps an audit trail of checks and actions.
• It publishes its 3,241 data sources.
• It refunds checks where county records exist but can’t be verified under FCRA guidelines.
• A compliance roster and re-screening alerts flag expiring clearances 30 and 7 days ahead.

Review any provider’s terms yourself, and have your attorney confirm the process fits your state.

Conclusion

FCRA compliance for nonprofits is manageable when you treat it as a process rather than a one-time form. Give a clear standalone disclosure, get written authorization, apply written criteria consistently, and never turn someone away without the two-step adverse action process. Keep records of everything.

A tight, documented workflow protects the people you serve, the volunteers who give their time, and your organization’s reputation.

Frequently Asked Questions

Does FCRA compliance for nonprofits apply if volunteers are unpaid?

Yes, in most cases. If you use a third-party screening company, FTC staff guidance treats volunteer screening by nonprofits as an employment purpose. Unpaid status does not remove FCRA duties.

Do we need written consent before running a volunteer background check?

Yes. You must give a clear disclosure and obtain the applicant’s written authorization before ordering a report. An electronic signature is acceptable when it is captured and stored properly.

What is a pre-adverse action notice?

It is the first notice sent when a background report may lead you to deny or remove a volunteer. It must include a copy of the report and the FTC’s summary of consumer rights. It gives the person time to review the report and dispute errors before a final decision.

How long should we wait before sending the final adverse action notice?

The FCRA doesn’t set an exact number of days. It calls for a reasonable period, and many organizations wait at least five business days. If the applicant disputes the report, wait until the dispute is resolved.

Can a Google search replace an FCRA-compliant background check?

No. Informal searches are unreliable, can misidentify people, and produce no documented disclosure, authorization, or audit trail. Use a consumer reporting agency and follow the FCRA process.