What Is a Consumer Reporting Agency and Why It Matters
Learn what is a consumer reporting agency, how CRAs work under the FCRA, and what nonprofits need to know to stay compliant when screening volunteers.
On this page
A volunteer coordinator is ready to place mentors with children, but one question stops the onboarding process: what is a consumer reporting agency, and does the organization's screening provider count as one? The vendor may call itself a background-data company, a records platform, or a volunteer-screening service. Those labels don't settle the issue.
The Fair Credit Reporting Act, or FCRA, looks at what an organization does, not what it calls itself. A nonprofit that gathers personal information, creates reports, and supplies those reports to another organization for an eligibility decision may have responsibilities associated with a consumer reporting agency, even if it isn't a major credit bureau. The same functional analysis matters when a small volunteer program coordinates screening internally or shares screening reports with other organizations.
Table of Contents
- What a Consumer Reporting Agency Actually Does
- The Main Categories of Consumer Reporting Agencies
- What Data CRAs Compile and Why It Matters
- FCRA Obligations Every CRA Must Follow
- How CRAs Differ From Other Background Check Providers
- Choosing and Using a CRA as a Nonprofit
- Compliance Checklist and Final Takeaways
What a Consumer Reporting Agency Actually Does
The FCRA defines a consumer reporting agency, or CRA, as an entity that, for fees or on a cooperative nonprofit basis, regularly assembles or evaluates consumer information for the purpose of furnishing consumer reports to third parties. The definition also refers to using interstate commerce in preparing or furnishing those reports. You can review the statutory framework in the Federal Reserve's FCRA compliance manual.
That language becomes easier to apply when you break the workflow into three questions.
Start with the activity, not the company name
First, does the organization assemble or evaluate information about people? That information can include identity details, addresses, court records, driving history, employment information, or other personal data. A service that only provides software for a nonprofit to manage documents may not perform the same function as a company that searches records, resolves identities, and prepares a screening report.
Second, does the organization furnish the resulting report to a third party? A third party might be an employer, landlord, insurer, lender, school, church, youth league, or another nonprofit. The recipient doesn't need to be a large business. A report furnished to a small community organization can still be used for an eligibility decision.
Third, does the recipient use the report, or plan to use it, for a decision about a person's eligibility? Volunteer placement is a useful example. A nonprofit might decide whether someone may mentor children, transport participants, handle donations, enter a client's home, or work with vulnerable adults. Those decisions can make the screening workflow more consequential than an informal reference check.
Why nonprofit status doesn't answer the question
A cooperative nonprofit arrangement can still fall within the FCRA definition. A volunteer network that gathers screening information and distributes reports to member organizations shouldn't assume that its mission or nonprofit status removes CRA-related obligations.
The same issue can arise inside a small organization. Suppose one nonprofit's volunteer coordinator collects records, evaluates them, and sends screening summaries to several affiliated nonprofits. The coordinator may think of the activity as administrative support. Functionally, however, the organization may be assembling consumer information for reports furnished to third parties.
Practical rule: Ask who collects the information, who evaluates it, who receives the report, and what decision the report supports. Those answers matter more than the words on a vendor's website.
A traditional credit bureau is an obvious CRA, but the functional definition reaches more broadly. Modern screening workflows often combine identity data and public records, then present the result to an organization deciding whether to accept, place, or retain a volunteer. That's why “we aren't a credit bureau” isn't a complete compliance analysis.
The Main Categories of Consumer Reporting Agencies
CRAs do not all provide the same kind of report. A nonprofit screening a youth mentor needs information connected to safety, identity, role duties, and its written screening policy, not automatically a traditional lending profile.
Credit reporting companies
Credit bureaus furnish credit reports and related scoring products. These reports support decisions about credit and other financial eligibility questions. A nonprofit may encounter this category when a volunteer will manage funds, oversee fundraising proceeds, or perform another role for which the organization has identified a legitimate financial screening need.
The role alone does not justify requesting credit information. The nonprofit needs an appropriate purpose, a defensible policy, and a clear connection between the report and the volunteer's duties. Credit history also cannot replace a criminal-record or identity search. Each product answers a different question.
Employment and tenant screening CRAs
Employment and tenant screening CRAs compile information used in hiring and housing decisions. Depending on the provider and product, a report may include criminal records, eviction information, driving records, employment history, or identity data.
Volunteer programs often use similar workflows, even when no one is paid. A youth sports league might order a report before assigning a coach to a team. A church might screen someone before placing that person in children's ministry. The organization should examine the actual purpose and workflow under the FCRA rather than treating “volunteer” as a compliance exemption.
That functional approach also matters when a small coordinator or vendor assembles information from several sources and sends a screening result to the nonprofit. The label on the service may describe its marketing category, while the work performed determines whether CRA obligations apply.
Investigative and specialty CRAs
Specialty CRAs focus on narrower or more investigative data sets. Examples include identity-verification services, public-record aggregators, healthcare-related screening providers, and products organized around particular risk categories. A provider may also act as a reseller or aggregator, obtaining information from another CRA and furnishing a combined report to its customer.
For a volunteer program, this activity may sit behind a single dashboard. The nonprofit sees one result, while the provider may use multiple sources, identity-resolution tools, and upstream data partners. That arrangement makes it important to identify who collected the information, who evaluated it, and who furnished the report.
| CRA Category | Typical Reports | Nonprofit Volunteer Use |
|---|---|---|
| Credit reporting companies | Credit reports and scoring products | Financial stewardship roles, where appropriate and legally justified |
| Employment and tenant screening CRAs | Criminal, eviction, driving, employment, and identity information | Mentor, coach, staff, driver, and housing-related eligibility workflows |
| Investigative and specialty CRAs | Identity verification, public records, specialty databases, and investigative products | Youth programs, healthcare-related services, fiduciary roles, and broader risk review |
| Reseller or aggregator CRAs | Reports assembled from other agencies or data providers | One combined screening report delivered through a nonprofit's vendor platform |
These categories help explain what a provider sells. They do not replace the FCRA's functional test. A specialty provider can still be a CRA when it regularly assembles or evaluates consumer information to furnish reports to third parties. For a nonprofit, that classification affects how the screening program is configured, documented, and reviewed.
What Data CRAs Compile and Why It Matters
A volunteer coordinator receives a report showing a criminal record for a prospective youth mentor. Before treating it as disqualifying, the organization needs to know whether the record belongs to the applicant, what the final disposition was, and whether the information relates to the role. A screening report is useful only when its identity matching, sources, context, and review process support a fair decision.
Records tied to the role
County and state criminal records may matter when a volunteer works with children, vulnerable adults, or private client information. A name-only match can identify the wrong person, and an incomplete record may omit the disposition that explains what happened. The coordinator should know which jurisdictions were searched and how possible matches are verified.
Sex offender registry information can be relevant to youth-serving programs. The screening policy should explain why the check is used, who reviews a potential match, and how the organization handles an identity conflict. Registry information supports verification. It does not replace it.
Address history and identity traces help establish where a person may have lived and whether the search reaches the appropriate jurisdictions. They can also reveal gaps or inconsistencies that need clarification before the provider treats the search as complete.
Motor vehicle records matter for volunteer drivers, transportation coordinators, and people operating organizational vehicles. A criminal check does not show whether someone meets the program's driving requirements, so the workflow may need a separate motor vehicle review.
Other information fits narrower placements. Employment, education, and reference information may support screening for a skilled volunteer providing professional services. Civil court records, bankruptcy information, or eviction filings may be considered for specifically defined fiduciary or housing-related roles. Relevance and permissible purpose still control the decision.
Accuracy is part of the data architecture
The FCRA requires a CRA to follow reasonable procedures to assure maximum possible accuracy when preparing a consumer report. Accuracy therefore belongs in the system design, not only in a final review. A provider should use reliable sources, apply identity-resolution safeguards, distinguish people with similar names, preserve relevant dispositions, and offer a practical dispute process.
A dismissed case listed as an unresolved criminal matter can unfairly affect a volunteer and leave the nonprofit defending a decision based on incomplete information. Teams should document which data categories the role requires, how results are reviewed, and what happens when the applicant challenges a record.
Organizations using credit-related reporting also need to understand the specialized structure behind industry data exchange. CEFCore on Metro 2 reporting explains why standardized reporting practices and data-quality controls matter in credit-reporting environments.
For a plain-language guide to what may show on a background check, nonprofit leaders can compare common report categories with their own screening policy. The practical rule is straightforward: collect what the role requires, verify what the report says, and give the person a meaningful way to challenge an error.
FCRA Obligations Every CRA Must Follow
A small nonprofit coordinator orders a volunteer screening report, receives it by email, and forwards it to a program director. At that point, the workflow involves more than finding public information. The organization and its provider must address how data is gathered, matched to the right person, disclosed, challenged, and secured. The FCRA functional test matters more than a company's label. A vendor, contractor, or internal operation that regularly assembles and furnishes consumer information for eligibility decisions may be performing CRA functions in practice.
Accuracy and reinvestigation
A CRA must use reasonable procedures to assure maximum possible accuracy. A broad database search alone is not enough. The process should include reliable source selection, identity matching, record updates, and reinvestigation when the person disputes information.
Consider a volunteer whose dismissed court record appears without the dismissal. The nonprofit should not treat the entry as self-explanatory. The provider needs a defined method for receiving the dispute, investigating the challenged record, correcting or confirming the result, and communicating what happened. The FTC's FCRA materials also address the relationship between report accuracy and notices used after a report contributes to an adverse decision.
Permissible purpose and authorized use
A CRA cannot treat every request for personal information as an acceptable screening purpose. The nonprofit should identify the volunteer role, document why the report relates to that role, obtain the required authorization, and restrict access to staff involved in the decision.
Volunteer programs need particular care because the screened person may provide unpaid service rather than hold a conventional job. A volunteer label does not by itself settle how the FCRA applies. Organizations should obtain role-specific legal guidance and use a disciplined authorization and review process for eligibility decisions.
Consumer access and dispute rights
The person being screened needs a clear way to understand and challenge the report. The workflow should identify the CRA, provide usable contact information, preserve the relevant report, and explain how the person can request a copy or dispute inaccurate information.
The nonprofit should assign responsibility before a dispute arrives. Staff need to know who receives the challenge, which decision pauses during review, what records must be retained, and how a correction reaches the final decision-maker.
Adverse-action support
If a nonprofit takes adverse action based on a consumer report, its notice must identify the CRA, state that the CRA did not make the decision, and provide the required contact information, including a toll-free number for nationwide agencies.
The CRA supports this step by furnishing an understandable report and accurate agency contact details. The nonprofit remains responsible for the decision and should not tell a volunteer that the CRA rejected them. A screening result supplies information for a decision. It is not the decision itself.
Security and access controls complete the operating model. Reports should move through controlled systems, remain available only to authorized users, and follow documented retention and deletion practices. Nonprofits setting up this workflow can also review this guide to nonprofit volunteer background checks for practical program considerations.
How CRAs Differ From Other Background Check Providers
A quick internet search, a private investigator, an artificial intelligence resume tool, and a CRA can all produce information about a person. They don't provide the same protections, sourcing, verification, or dispute pathway.
A nonprofit may be tempted to search a volunteer's name in a search engine or visit a county courthouse website. That approach can produce useful leads, but it doesn't automatically create a compliant consumer-reporting workflow. It may miss records, confuse people with similar names, omit dispositions, and leave the organization without a structured reinvestigation process.
| Criteria | FCRA CRA | PI / Non-CRA Vendor | Resume Screener | Self-Run Court Search |
|---|---|---|---|---|
| FCRA coverage | Designed to furnish consumer reports under the FCRA framework | Depends on the actual activity and purpose | Usually focused on resume or application data, not necessarily consumer reports | Depends on how the organization gathers and furnishes the information |
| Data sourcing | Uses defined reporting sources and identity-resolution processes | May rely on investigator work, interviews, or public records | Primarily uses application and resume content | Usually limited to selected court or public-record systems |
| Dispute pathway | Provides a structured process for consumer disputes and reinvestigation | May offer a general correction process, but terms vary | Often addresses application errors rather than report disputes | Usually requires the organization to revisit the source itself |
| Reporting standard | Produces a report for an identified permissible purpose | May deliver investigative findings or narrative research | Produces screening or ranking outputs | Produces raw findings or internal notes |
| Adverse-action support | Can provide agency information and workflow support | May not provide FCRA notices or decision guidance | Usually isn't built for adverse-action notices | Leaves the nonprofit to create the process |
The vendor's label isn't a safe harbor
A private investigator-style provider may still meet the CRA definition if it regularly assembles or evaluates consumer information to furnish reports to third parties. Conversely, a tool that only helps a nonprofit organize information supplied directly by applicants may perform a different function. The facts of the workflow control.
Resume-screening tools create another boundary problem. An algorithm that ranks applications based on information in those applications isn't automatically a CRA. If the tool also gathers outside personal information and furnishes reports used for eligibility decisions, the analysis changes.
Organizations that need a separate process for obtaining an FBI criminal history record should evaluate the legal route, authorization requirements, and intended use carefully. A practical resource on how to check an employee background with FBI can help frame that research, but it doesn't replace a nonprofit's own FCRA review.
The risk of a non-CRA provider isn't that the report may look different. The organization may lose the structured disclosure, authorization, dispute, and adverse-action support that a CRA workflow is designed to provide. It may also create avoidable problems if staff treat unverified online information as a final eligibility decision.
Choosing and Using a CRA as a Nonprofit
A small nonprofit can become part of the CRA process without realizing it. For example, a volunteer coordinator may collect an applicant's identifying information, send it to a screening vendor, receive a report, and use that report to decide whether the person may work with children. The label on the software does not settle the question. If an organization regularly assembles or evaluates consumer information for reports used by another party's eligibility decision, the workflow may trigger CRA-related responsibilities. Review the actual functions, not just the contract title.
Ask operational questions before signing
Evaluate a screening provider as both a data source and a compliance partner. A polished dashboard does not show whether the provider can identify the right person, explain its sources, address disputes, and support the nonprofit when information affects a volunteer decision.
Request a clear description of the sources used for each product. Ask how the provider handles similar names, incomplete identities, court dispositions, record updates, and unavailable jurisdictions. A flat-rate “nationwide” search with vague sourcing requires closer review, because that label does not explain what was searched or verified.
Follow the process from the applicant's perspective. The provider should make it straightforward to present a standalone disclosure, collect authorization, deliver required notices, and route disputes to the appropriate party. The disclosure should not be hidden inside a volunteer application or combined with unrelated language such as a liability waiver.
Match the search to the role. A volunteer driver may need motor vehicle information. A youth mentor may require checks relevant to child safety. A treasurer may call for a different review. Using one package for every position can collect information that has little connection to the decision and make relevance harder to explain.
Build the process around decisions
Separate screening from general onboarding so staff know which steps apply before a report is ordered.
- Define the role: Document the volunteer's access, responsibilities, supervision, and role-related risks.
- Obtain disclosure and authorization: Provide the required disclosure as a standalone document and collect authorization before ordering the report.
- Review the report carefully: Give an authorized reviewer enough context to distinguish a verified, relevant record from an unresolved match.
- Use pre-adverse-action procedures: If the report may support an unfavorable decision, provide the required materials and give the volunteer an opportunity to respond before deciding.
- Document the outcome: Record the role-related reason, information considered, and any individualized assessment.
- Retain and secure records: Apply the organization's retention schedule, access controls, and destruction procedures.
Use the FTC's FCRA materials already discussed earlier when checking notice and accuracy controls. A nonprofit should obtain legal advice for its particular forms and workflow. The provider should not be the only party that understands the process. Train coordinators on what they may review, what they may disclose, and where disputes must go.
Assess the relationship after launch
Vendor evaluation continues after implementation. Monitor report clarity, source transparency, response quality, and the time staff need to resolve an applicant's question. Check whether volunteers receive consistent communications and whether managers can access more information than their roles require.
Screening should fit the nonprofit's wider trust practices. A guide to marketing for nonprofits can help teams consider consistency across communications and outreach. Privacy language, volunteer messages, and staff training should describe the same expectations.
A nonprofit may choose a provider such as VolunteerBadge, which describes a volunteer-screening workflow that includes disclosure and authorization collection, report delivery, dispute handling, and adverse-action notice support. Compare any provider's actual process with the CRA functional test and the nonprofit's volunteer roles before signing.
For a repeatable procurement process, use a vendor evaluation checklist covering source questions, contract terms, dispute handling, security controls, and staff responsibilities.
Compliance Checklist and Final Takeaways
A nonprofit can reduce confusion by turning the legal framework into five operating checkpoints. Run these checks before ordering a report and after any report contributes to a volunteer decision.
- Written disclosure and authorization: Give the volunteer a clear, standalone disclosure and obtain authorization before requesting the report.
- Permissible purpose documentation: Record the role, the decision being made, and why the selected information is relevant.
- Accuracy and dispute handling: Use a provider with a defined reinvestigation process, and pause or reassess decisions when a volunteer challenges a material error.
- Secure retention and access: Keep reports in controlled systems, restrict access, follow the organization's retention policy, and securely dispose of information when the retention period ends.
- Adverse-action workflow: If the report may support an unfavorable decision, follow the pre-adverse and final adverse-action process, identify the CRA, explain that the CRA didn't make the decision, and provide the required contact information.
Three nonprofit mistakes appear repeatedly in practice. Teams mix screening into a general onboarding packet, which can obscure the standalone disclosure. They buy a report from a provider that doesn't understand the provider's own CRA responsibilities. They also skip the pre-adverse-action step and move directly from an unfavorable result to a final rejection.
The central lesson is the functional CRA test. Don't ask only whether a company calls itself a credit bureau or background-check vendor. Ask whether it regularly assembles or evaluates consumer information, furnishes reports to third parties, and supports eligibility decisions. Then ask whether your nonprofit's own workflow performs those same functions.
Your next action should be a vendor and workflow audit. List every organization that collects, evaluates, or shares volunteer screening information, compare each activity with the FCRA definition, inspect your disclosure and authorization forms, and document who handles disputes and adverse-action notices.
VolunteerBadge helps nonprofits organize FCRA-focused volunteer screening with disclosure and authorization collection, report access, dispute handling, and adverse-action notice support in one workflow. Visit VolunteerBadge to review how its screening process can fit your organization's volunteer roles and compliance procedures.
