Does the FCRA Apply to Nonprofit Volunteer Background Checks?
This is one of the most common questions nonprofit and church volunteer managers ask — and the answer surprises many organizations: yes, the Fair Credit Reporting Act (FCRA) typically applies to volunteer background checks, not just employment screening.
The FCRA governs how Consumer Reporting Agencies (CRAs) — which include most commercial background check services — can collect, use, and share consumer information. When your nonprofit uses a CRA to screen volunteers, you become a "user" of consumer reports under the FCRA and must follow specific procedural requirements. The law doesn't distinguish between paid employees and unpaid volunteers in this context.
The stakes are real. Nonprofit organizations have faced FCRA litigation and FTC enforcement actions for improper volunteer screening procedures. The penalties for willful FCRA violations can reach $1,000 per violation plus punitive damages and attorney's fees — potentially catastrophic for a small nonprofit.
Key FCRA Requirements for Volunteer Background Checks
1. Disclosure and Authorization (Before the Check)
Before running a background check on a volunteer, your organization must:
- Provide the volunteer with a clear, written disclosure that a background check will be conducted using a Consumer Reporting Agency
- This disclosure must be a standalone document — it cannot be embedded in a general volunteer application, handbook, or release form
- Obtain the volunteer's written authorization to conduct the check
- Provide a copy of the Summary of Rights Under the FCRA at the time of disclosure
The standalone requirement is where many nonprofits inadvertently fall out of compliance. Placing "I authorize a background check" in a checkbox on a general volunteer application form is not sufficient under the FCRA.
2. The Volunteer Background Check Consent Form
A properly structured volunteer background check consent form includes:
- The name and contact information of the Consumer Reporting Agency that will conduct the check
- A clear statement that a consumer report (background check) will be obtained
- The volunteer's full legal name, date of birth, Social Security Number, and current address
- A signature line with date (electronic signatures are permissible)
- A copy of the FCRA Summary of Rights (can be appended to the consent form itself)
If you're using a digital screening platform, the consent workflow is typically built into the volunteer invitation process — the volunteer receives a link, reads the disclosures, and electronically signs the authorization before the check is initiated. This eliminates the most common consent compliance errors.
3. Adverse Action: What to Do When a Check Returns a Record
If a background check returns information that leads you to consider denying or revoking a volunteer role, the FCRA requires a specific two-step adverse action process:
Step 1 — Pre-adverse action notice: Before making a final decision, send the volunteer:
- A copy of the background check report
- A copy of the FCRA Summary of Rights
- Written notice that you are considering an adverse action based on the report's contents
You must then wait a reasonable time (the FTC has informally indicated 5 business days as a safe harbor) to allow the volunteer to dispute any inaccuracies in the report before making a final decision.
Step 2 — Final adverse action notice: If you proceed with denying the volunteer role, you must send:
- A final adverse action notice stating the decision
- The name, address, and phone number of the CRA that prepared the report
- A statement that the CRA did not make the adverse decision and cannot explain why it was made
- Notice of the volunteer's right to dispute the report's accuracy with the CRA
Skipping the pre-adverse action notice — even in obvious cases — is an FCRA violation. The 5-day waiting period exists because CRA reports can contain errors, and the consumer has a legal right to dispute them before a decision is finalized.
4. Record Retention
The FCRA requires records of consent authorizations and adverse action notices to be retained. Best practice for nonprofits is a minimum 5-year retention period for all background check documentation. If using a digital platform, ensure the platform's records are exportable and not subject to loss if you cancel the service.
What the FCRA Does NOT Require
A few common misconceptions:
- You don't have to hire (or accept) anyone. The FCRA governs process, not outcomes. You can deny a volunteer for a relevant criminal record — the adverse action process just ensures they have the right to dispute inaccuracies first.
- There is no FCRA look-back limitation for most records. The seven-year limit applies to certain civil judgments and non-conviction records; convictions can be reported regardless of age.
- Checking public records yourself is not covered. If you search a volunteer's name on a government court records website yourself (rather than using a CRA), the FCRA doesn't apply to that search. However, this approach lacks the consistency and comprehensiveness of a professional screening service.
FCRA-Compliant Background Check Tools for Nonprofits
Rather than managing FCRA compliance manually — drafting standalone consent forms, tracking 5-day holds, generating adverse action letters — most nonprofits are better served by a screening platform that builds compliance into the workflow automatically.
VolunteerBadge's FCRA compliance tools include automated consent collection with standalone disclosure documents, a built-in 5-business-day adverse action workflow with automated notices, immutable audit trails for consent and adverse action documentation, and free tools including an FCRA adverse action letter generator for organizations managing the process manually.
For nonprofits concerned about FCRA exposure, a platform that automates these steps is significantly safer than a DIY approach — especially for volunteer coordinators who aren't compliance specialists.
The Bottom Line
FCRA compliance for nonprofits isn't optional when you're using a Consumer Reporting Agency to screen volunteers. The good news is that the requirements are procedural — consent, disclosure, adverse action process, record retention — and entirely manageable with the right screening platform. The risk of non-compliance (FTC enforcement, private litigation) far outweighs the cost of using a service that handles compliance automatically.