FCRA Compliance for Nonprofits: What You're Actually Required to Do Before Screening a Volunteer

The Fair Credit Reporting Act — FCRA — was originally written to protect consumers from errors in credit reporting. But its scope is much broader than most people realize. If you're using a third-party company to run background checks on volunteers, FCRA applies to you. Full stop.

This isn't a technicality that only matters if something goes wrong. It's a legal framework with specific steps you're required to follow before, during, and after the screening process. Getting it wrong exposes your organization to liability. Getting it right takes maybe 10 minutes to set up properly once you know what you're doing.

Step 1: Disclosure and Authorization (Before You Run Anything)

Before you can run a background check on a volunteer, you need two things in writing:

1. A standalone disclosure — a document that tells the applicant you may obtain a consumer report (background check) about them. This has to be a separate document. It cannot be buried inside a longer application form.
2. Written authorization — the applicant's signed consent to run the check.

VolunteerBadge handles both of these automatically. When you build a volunteer application in the platform, the FCRA-required disclosure and authorization language is embedded in the form. The applicant signs digitally. The signed document is stored and timestamped. You're covered.

Step 2: Running the Check With a Certified CRA

You must use a Consumer Reporting Agency (CRA) that is certified under FCRA to provide consumer reports. This is non-negotiable. Running your own searches through Google, county court websites, or informal databases doesn't satisfy FCRA requirements — and more importantly, those results aren't legally defensible if challenged.

VolunteerBadge runs checks through DataDivers Technologies, a certified data provider, and the platform itself operates within FCRA guidelines on every search.

Step 3: What to Do When a Record Is Found

This is where most nonprofits get into trouble. Finding a record doesn't mean you can immediately deny someone a volunteer position. FCRA requires a two-step adverse action process:

Pre-Adverse Action Notice: Before you make a final decision, you must send the applicant a notice that includes: (1) a copy of the background check report, (2) a copy of the FTC's "A Summary of Your Rights Under the FCRA," and (3) information about who provided the report. You then have to give them a reasonable time to dispute the information — typically 5 business days, though more is better practice.

Final Adverse Action Notice: After the dispute period, if you're proceeding with the denial, you send a final notice that confirms the decision. This notice must include contact information for the CRA, a statement that the CRA didn't make the decision, and information about the applicant's right to get a free copy of the report and dispute its accuracy.

VolunteerBadge generates both notices for you. When a check comes back with a record that requires action, the platform prompts you through the process — pre-adverse notice, waiting period, final notice — and produces the documents pre-filled with the right information. You review, you send. The platform keeps a record of everything.

What You Can and Can't Consider

FCRA doesn't tell you what records to screen for — that's your organization's policy decision. But it does require that your screening criteria be applied consistently and that they're relevant to the volunteer position. A minor traffic violation from 2019 isn't a legitimate basis for denying someone a position tutoring students, and applying it selectively creates legal exposure.

Many states also layer additional protections on top of FCRA — look-back periods on how far back a check can go, restrictions on certain conviction types, and ban-the-box rules in some jurisdictions. VolunteerBadge's results flag what's reportable in your jurisdiction vs. what isn't.

The Bottom Line

FCRA compliance isn't optional and it isn't complicated once you understand the structure. The disclosure, the authorization, the pre-adverse notice, the waiting period, the final notice — these are the five things that matter. If you're doing all five correctly, you're covered. If you're missing any of them, you have exposure.

VolunteerBadge was designed to make FCRA compliance the default, not an afterthought. Every step in the process is built into the platform so you can't accidentally skip it.