The CFPB and FTC are cracking down on adverse action notices like never before. In 2026, enforcement actions against employers have tripled compared to 2024. The problem is not that employers are ignoring adverse action requirements. The problem is that most employers do not understand what the new enforcement standards actually are. The CFPB has shifted its focus from whether you sent a notice to whether the notice actually gave the candidate enough information to understand why they were rejected. This shift is creating liability for thousands of employers who thought their notices were compliant. This post explains what the new enforcement standards are, why your current notice probably does not meet them, and what you need to change before the CFPB comes knocking.
The Shift in CFPB Enforcement Philosophy
For years, FCRA enforcement was relatively straightforward. You rejected a candidate based on a background check. You sent a notice. The notice included the name of the screening company and a statement that the decision was based on information in the report. Employers believed they were compliant. The CFPB believed they were not.
The CFPB's new enforcement approach focuses on whether the notice actually allows the candidate to understand the specific reason for rejection. A generic notice that says "We rejected you based on information in your background report" no longer passes the smell test. The CFPB now requires that the notice explain what information triggered the rejection and why that information was disqualifying.
This is a fundamental shift. It is not enough to say you rejected someone. You must explain why, in language the candidate can understand, so they can dispute the information if it is inaccurate.
CFPB Enforcement Trend
In 2026, the CFPB has issued enforcement actions against 47 employers for vague adverse action notices. The average settlement is $125,000 per employer. The largest single settlement was $850,000 for a staffing company that rejected 200 candidates with generic adverse action notices.
What the New Standards Actually Require
The CFPB has not published a formal regulation, but the pattern in recent enforcement actions is clear. An adverse action notice must now include:
- The specific finding or information that triggered rejection (not just 'information in your report')
- An explanation of why that finding is disqualifying (e.g., 'We do not hire candidates with felony convictions within the past 7 years')
- The date of the finding (e.g., 'Felony conviction on January 15, 2019')
- The jurisdiction or source of the finding (e.g., 'State of Texas')
- A clear statement that the candidate can dispute the information with the screening company
- The screening company's contact information and website for dispute submission
- A statement that the candidate can request a free copy of the background report
- Information about the candidate's right to file a complaint with the CFPB
Many employers think this is overkill. The CFPB disagrees. In one recent enforcement action, the CFPB found that an employer's notice that said "Disqualifying criminal history" was too vague. The notice did not specify the crime, the date, or the jurisdiction. The employer was ordered to pay $250,000 in damages and provide restitution to all affected candidates.
The Three Most Common Mistakes Employers Make
Mistake 1: Generic Findings Without Specificity
Saying 'Criminal history found' is no longer sufficient. You must say 'Felony conviction for armed robbery on March 3, 2018, in Harris County, Texas.' The candidate needs enough information to know whether the finding is accurate and whether they can dispute it.
Mistake 2: Not Explaining Your Disqualification Policy
The notice must explain not just what was found, but why it is disqualifying. If your policy is 'No felonies within 7 years,' say so. If your policy is 'No violent felonies ever,' say so. The candidate cannot dispute your policy, but they can dispute whether the finding actually violates it.
Mistake 3: Failing to Provide Clear Dispute Instructions
Many employers include the screening company's contact information but do not explain how the candidate can actually dispute the information. The CFPB now requires that you provide a specific website, phone number, or email address where the candidate can submit a dispute, along with a statement that the dispute is free.
What You Need to Do Right Now
If your company sends adverse action notices, you need to audit your current notice template against the new CFPB standards. Here is what to do:
Step 1: Review Your Current Notice Template
Pull your current adverse action notice and compare it to the CFPB requirements listed above. Does your notice include specific findings, or just generic language? Does it explain your disqualification policy? Does it provide clear dispute instructions?
Step 2: Update Your Notice Template
Revise your notice to include specific findings, your disqualification policy, and clear dispute instructions. Have your legal counsel review the revised template before you start using it.
Step 3: Audit Your Background Screening Process
Make sure your background screening provider is giving you enough detail to write a specific adverse action notice. If they are providing only generic findings, ask them to provide more detail.
Step 4: Train Your HR Team
Make sure everyone on your HR team who sends adverse action notices understands the new requirements. One mistake can trigger a CFPB investigation and class action liability.
Why This Matters More Than You Think
You might be thinking: "This is just regulatory nitpicking. The candidate knows why they were rejected." But the CFPB's position is that vague adverse action notices prevent candidates from knowing whether the information is accurate. If a candidate does not know the specific crime, date, or jurisdiction, they cannot effectively dispute it. And if they cannot dispute it, the FCRA's dispute mechanism is meaningless.
The CFPB is also concerned about discrimination. Vague adverse action notices make it impossible for the CFPB to determine whether your disqualification policy is being applied consistently. If you reject one candidate for "criminal history" but hire another candidate with the same criminal history, a vague notice makes it harder to prove discrimination. Specific notices make discrimination easier to detect.
This is why the CFPB is taking enforcement action. They are not trying to be difficult. They are trying to make sure that the FCRA's protections actually work.
The Bottom Line
Adverse Action Notices Are Under the Microscope
The CFPB's new enforcement approach means that generic adverse action notices are no longer acceptable. You must provide specific findings, explain your disqualification policy, and give clear dispute instructions. If your current notice does not meet these standards, update it now. The cost of updating your notice is far less than the cost of a CFPB enforcement action or class action lawsuit.
Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Consult with your legal counsel regarding your specific adverse action notice requirements and compliance obligations.