Most employers think FCRA adverse action is a one-step process. You find something disqualifying in the background check. You send a rejection email. Done. This assumption is costing employers thousands of dollars in settlements and fines in 2026. The FCRA actually requires two separate notices, sent at two different times, for two different purposes. Skip either one, and you have violated federal law. Get the sequence wrong, and you have compounded the violation. This post explains exactly what the two-step process is, why employers keep getting it wrong, and what it is costing them.
The Two-Step Adverse Action Process Explained
The FCRA requires employers to provide two distinct notices before making a final hiring decision based on background check information. These are not optional steps or procedural niceties. They are legal requirements that the Federal Trade Commission, state attorneys general, and private plaintiffs' attorneys are now actively enforcing.
The two steps are the pre-adverse action notice and the adverse action notice. They serve different purposes, contain different information, and must be sent at different times in the hiring process. Understanding the distinction is the difference between a compliant hiring process and a lawsuit.
Step 1: Pre-Adverse Action Notice (Before You Decide)
As soon as you receive the background check report and identify information that you plan to use to reject the candidate, you must send a pre-adverse action notice. This notice must include a copy of the background report, a summary of the candidate's rights under the FCRA, and information about how to dispute inaccurate information. You must give the candidate at least 5 business days to review the report and respond before you make your final decision.
Step 2: Adverse Action Notice (After You Decide)
After the dispute period expires and you have made your final decision to reject the candidate, you must send an adverse action notice. This notice must explain the specific findings that led to rejection, clarify that the decision was based on information in the background report, provide the name and contact information of the screening company, and inform the candidate of their right to obtain a free copy of the report and dispute inaccurate information.
Why Employers Get This Wrong
The two-step requirement seems straightforward in theory. In practice, employers violate it constantly. Here are the most common mistakes:
Mistake 1: Sending Only One Notice
Many employers send a single rejection email that attempts to serve as both the pre-adverse action notice and the adverse action notice. This violates the FCRA because it does not give the candidate the required 5 business days to dispute the information before the final decision is made. The FTC considers this a direct violation.
Mistake 2: Sending the Pre-Adverse Action Notice Too Late
Some employers wait until after they have decided to reject the candidate before sending the pre-adverse action notice. This defeats the entire purpose of the pre-adverse action notice, which is to give the candidate a chance to dispute information before the decision is made. The FCRA requires the pre-adverse action notice to be sent before the final decision, not after.
Mistake 3: Not Including Required Information in Either Notice
The pre-adverse action notice must include a copy of the background report and a summary of FCRA rights. The adverse action notice must include specific findings and the screening company's contact information. Omitting any of this information violates the FCRA. Many employers send notices that lack one or more of these required elements.
Mistake 4: Not Waiting the Full 5 Business Days
The FCRA requires at least 5 business days for the candidate to dispute information after receiving the pre-adverse action notice. Some employers wait only 2 or 3 days before sending the adverse action notice. This violates the statute. The 5 business days is a minimum, not a guideline.
Mistake 5: Sending Notices to the Wrong Contact Information
If the pre-adverse action or adverse action notice does not reach the candidate, it is as if it was never sent. Some employers send notices to email addresses that bounce or phone numbers that are no longer valid. The FCRA requires reasonable effort to ensure the candidate actually receives the notices.
What the Pre-Adverse Action Notice Must Include
The pre-adverse action notice is the first critical step. It must contain specific information, formatted in a specific way, and be sent at a specific time. Here is exactly what must be included:
- A clear statement that adverse action may be taken based on information in the background report
- A copy of the background report itself (the actual report from the screening company)
- A copy of the FCRA disclosure statement explaining the candidate's rights (this is typically provided by the screening company)
- Information about how the candidate can dispute inaccurate information in the report
- The name, address, and phone number of the screening company that prepared the report
- A statement that the candidate has the right to contact the screening company to dispute any information
- A reasonable amount of time (at least 5 business days) for the candidate to review and respond before adverse action is taken
The Pre-Adverse Action Notice Is Not Optional
Some employers think they can skip the pre-adverse action notice if the background check finding is obviously disqualifying (e.g., a felony conviction). This is incorrect. The FCRA requires the pre-adverse action notice regardless of how serious the finding is. Skipping this step is a direct violation.
What the Adverse Action Notice Must Include
After the dispute period expires and you have made your final decision, the adverse action notice must be sent. This is the second critical step. It must include:
- A clear statement that adverse action has been taken (the candidate is not being hired)
- The specific reason(s) for the adverse action based on information in the background report
- A statement that the decision was based in whole or in part on information obtained from the background report
- The name, address, and phone number of the screening company that prepared the report
- A statement that the screening company did not make the decision and cannot explain the employer's decision
- Information about the candidate's right to dispute inaccurate information with the screening company
- Information about the candidate's right to obtain a free copy of the background report from the screening company
- Information about the candidate's right to add a statement to their file if they dispute the accuracy of the report
The adverse action notice must be specific. Saying 'We found disqualifying information in your background check' is not sufficient. You must explain exactly what information led to the rejection. For example: 'We did not move forward with your application because the background check revealed a felony conviction for armed robbery in 2018. This conviction is relevant to the position because the role requires handling cash and working with customers.'
The Timeline: When Each Notice Must Be Sent
The timing of these notices is critical. Send them in the wrong order or at the wrong time, and you have violated the FCRA. Here is the exact timeline:
| Event | Timing | Action |
|---|---|---|
| Background report received | Day 0 | Review report for disqualifying information |
| Disqualifying info identified | Day 0 | Send pre-adverse action notice immediately |
| Pre-adverse action notice sent | Day 1 | Candidate receives notice and begins 5-business-day review period |
| Dispute period | Days 1-5 | Candidate has 5 business days to review and respond |
| Dispute period expires | Day 6 | You can now make final decision |
| Final decision made | Day 6-7 | Send adverse action notice |
| Adverse action notice sent | Day 7 | Candidate receives final rejection notice |
The key point: the pre-adverse action notice must be sent before you make your final decision. The adverse action notice must be sent after the dispute period expires and you have made your final decision. These are two separate events, separated by at least 5 business days.
Real-World Consequences of Getting It Wrong
The FTC and state attorneys general are now actively enforcing the two-step requirement. Here are real examples of what employers are facing:
Example 1: Single Notice Violation
An employer sends a single email that says 'We received your background check and found disqualifying information. We are not moving forward with your application.' This email attempts to serve as both the pre-adverse action notice and the adverse action notice. The FTC considers this a violation because it does not give the candidate 5 business days to dispute the information before the decision is made. The employer faces a settlement of $50,000 to $100,000 plus class action liability.
Example 2: Missing Information Violation
An employer sends a pre-adverse action notice but fails to include a copy of the background report or information about dispute rights. The candidate cannot properly review the report or understand their rights. The FTC investigates and finds this is a pattern across 50+ candidates. The employer faces a $250,000 settlement plus required remediation.
Example 3: Insufficient Wait Time
An employer sends the pre-adverse action notice on Monday and the adverse action notice on Wednesday (only 2 business days later). The FCRA requires at least 5 business days. A private plaintiffs' firm files a class action on behalf of all candidates who received notices with insufficient wait time. The employer settles for $500,000 plus attorney fees.
How to Implement the Two-Step Process Correctly
Implementing the two-step process correctly requires a documented system and clear communication. Here is how to do it:
Create a Pre-Adverse Action Notice Template
Work with your screening company or legal counsel to create a template that includes all required elements: a copy of the background report, FCRA disclosure statement, dispute instructions, screening company contact information, and a clear statement of the 5-business-day review period. Do not deviate from this template.
Create an Adverse Action Notice Template
Create a separate template for the adverse action notice that includes all required elements: specific findings, statement that the decision was based on the background report, screening company contact information, and dispute rights. This template must be specific to each candidate and each finding.
Set Up a Calendar System
When you send the pre-adverse action notice, immediately set a calendar reminder for 5 business days later. This reminder should trigger a review of whether the candidate has disputed any information. If no dispute has been received, you can then send the adverse action notice.
Document Everything
Keep a record of when each notice was sent, to whom it was sent, and how it was delivered (email, certified mail, etc.). If the FTC or a plaintiff's attorney questions your process, this documentation is your defense.
Train Your HR Team
Make sure everyone involved in the hiring process understands the two-step requirement. This includes HR staff, hiring managers, and anyone else who touches the background check process. A single mistake by one person can trigger an FTC investigation.
Common Questions About the Two-Step Process
Employers often ask specific questions about how to implement the two-step process. Here are the answers to the most common ones:
Q: Can I send the pre-adverse action notice and adverse action notice on the same day?
No. The FCRA requires at least 5 business days between the pre-adverse action notice and the adverse action notice. This is not a guideline. It is a legal requirement. If you send both on the same day, you have violated the FCRA.
Q: What if the candidate disputes the information? Do I still have to send the adverse action notice?
If the candidate disputes the information and the screening company corrects it, you must reassess your decision. If the corrected information is no longer disqualifying, you must hire the candidate or send a new pre-adverse action notice with the corrected information. If the information is still disqualifying after correction, you can send the adverse action notice.
Q: What if the candidate does not respond to the pre-adverse action notice?
If the candidate does not respond within 5 business days, you can proceed with the adverse action notice. The candidate's failure to respond does not waive their rights. You still must send the adverse action notice with all required information.
Q: Can I send the notices electronically, or do they have to be in writing?
The FCRA requires written notices. Electronic delivery (email) is acceptable as long as the candidate can print and retain a copy. However, you must ensure the email actually reaches the candidate. If the email bounces or goes to spam, you have not complied with the requirement to provide the notice.
Q: Do I have to send the adverse action notice if I decide to hire the candidate after the pre-adverse action notice?
No. If you decide to hire the candidate after reviewing the background check, you do not need to send an adverse action notice. The adverse action notice is only required if you decide not to hire based on information in the background report.
The Connection to Your Broader FCRA Compliance Program
The two-step adverse action process is just one piece of a comprehensive FCRA compliance program. If you want to understand how this fits into your overall compliance obligations, read our post on the FCRA Compliance Checklist for Employers in 2026. That post covers the entire hiring process from initial disclosure through final documentation.
For a deeper dive into how FCRA enforcement is changing in 2026, see our post on The FCRA Is Getting Stricter in 2026. That post explains the FTC's enforcement priorities and real-world consequences of non-compliance.
The Two-Step Process Is Not Optional
The FCRA requires two separate notices, sent at two different times, for two different purposes. This is not a procedural nicety or a best practice. It is a legal requirement that the FTC, state attorneys general, and private plaintiffs are now actively enforcing. Employers who skip either step or get the timing wrong are facing settlements of $50,000 to $500,000 or more. The cost of compliance is minimal. The cost of non-compliance is substantial. Implement the two-step process correctly, document it, and train your team. This is one of the most important steps you can take to protect your company in 2026.
Use this as your checklist for every adverse action. Before you send any pre-adverse action notice or adverse action notice, review this post. Make sure you are including all required information. Make sure you are waiting the full 5 business days. Make sure you are sending the notices in the correct order. A single mistake can cost tens of thousands of dollars.
Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Employers should consult qualified employment counsel before making hiring decisions based on background check results or implementing FCRA compliance procedures.