FCRA Compliance Checklist for Landlords: Everything You Need to Know

What Is the FCRA and Why Does It Apply to Landlords?

The Fair Credit Reporting Act (FCRA) is a federal law passed in 1970 that governs how consumer reporting agencies collect, maintain, and share consumer information — and how businesses that use that information must handle it. When you use a third-party screening service to run a credit check, background check, eviction search, or rental history trace on a prospective tenant, you are a 'user of consumer reports' under the FCRA, and the law's requirements apply directly to you.

Many landlords mistakenly believe the FCRA only applies to credit reports. That is incorrect. The FCRA covers any report furnished by a consumer reporting agency for use in a housing decision — which includes criminal background checks, eviction history searches, rental history traces, and employment verification reports. If you are paying a third party to look up information about an applicant and using that information to make a housing decision, the FCRA applies.

FCRA Compliance Checklist: Before You Screen

1. 1Establish written rental criteria documenting the standards you will apply consistently to every applicant
2. 2Prepare an FCRA authorization form that includes applicant consent, a description of the report types you will obtain, and the Summary of Consumer Rights disclosure
3. 3Document your permissible purpose — for landlords, this is tenant screening for a housing decision
4. 4Have your adverse action notice process ready before you begin screening, not after a denial

Step 1: Obtain Written Consent (Non-Negotiable)

Before obtaining any consumer report — credit, criminal, eviction, or rental history — you must have the applicant's explicit written authorization. This is not optional. The FCRA prohibits consumer reporting agencies from furnishing reports without a permissible purpose, and landlord use of a CRA requires the applicant's written consent as part of that permissible purpose documentation.

The written consent form must include: a clear description of the types of reports you will obtain, the name and contact information of each consumer reporting agency you will use, a statement of the applicant's rights under the FCRA (the FTC provides a standard Summary of Consumer Rights disclosure), and the applicant's signature and date. Many landlords embed the consent into the rental application — this is acceptable as long as the consent is clearly stated and not buried in fine print.

Step 2: Document Your Permissible Purpose

The FCRA requires that every consumer report be obtained for a specific permissible purpose. For landlords, the permissible purpose is tenant screening — specifically, evaluating an applicant for a housing decision. This permissible purpose must be documented at the time you place the screening order. You cannot use a tenant's screening report for any other purpose: sharing it with other landlords, using it for employment decisions, or selling it.

If you own multiple rental properties and use a property management company, ensure that the management company — not you personally — is the user of record on screening orders they place on your behalf. Each entity that obtains and uses consumer reports must have its own documented permissible purpose. Reports cannot be shared across entities without a separate authorization.

Step 3: Follow the Pre-Adverse Action Process

If you review a consumer report and decide to take an adverse action — denying the application, requiring a co-signer, or charging a higher deposit — the FCRA requires a two-step notification process before the adverse action becomes final. Step one is the pre-adverse action notice, sent before you finalize your decision. This notice must include: the name, address, and toll-free phone number of the consumer reporting agency that provided the report; a copy of the report (or notice that the applicant is entitled to request a copy); and the FTC's Summary of Consumer Rights.

The purpose of the pre-adverse action notice is to give the applicant an opportunity to review the report and dispute any inaccurate information before you make a final decision. Standard practice is to wait at least 5 business days after sending the pre-adverse action notice before finalizing and communicating the denial. This gives the applicant a reasonable window to contact the CRA about errors.

Step 4: Send the Final Adverse Action Notice

After the waiting period, if you still decide to deny the application, you must send a final adverse action notice. This is separate from the pre-adverse action notice and must include: the specific reason or reasons for the adverse action (not just 'failed background check' — you must specify which factors), the name, address, and toll-free number of the consumer reporting agency, a statement that the CRA did not make the adverse decision and cannot explain why it was made, notice that the applicant may obtain a free copy of the report from the CRA within 60 days, and notice of the right to dispute inaccurate information with the CRA.

Step 5: Handle Disputes Properly

After receiving an adverse action notice, applicants have the right to dispute inaccurate information in the consumer report with the CRA. The CRA must investigate the dispute within 30 days (or 45 days if the consumer provides additional information) and notify you of the outcome. If the dispute results in a correction or deletion, you must reconsider your adverse decision in light of the corrected information.

As the user of the report, you generally are not required to investigate disputes yourself — that is the CRA's responsibility. However, if an applicant contacts you directly with documentation that a negative item in the report is inaccurate, best practice is to pause any final adverse action until the dispute is resolved. Taking adverse action against an applicant who is actively disputing inaccurate report information creates legal exposure.

FCRA Violations: What Landlords Must Avoid

• Using a consumer report without the applicant's prior written consent — every screening order must have an authorization
• Failing to send pre-adverse action notices before making a final denial based on screening data
• Failing to send final adverse action notices after denying based on screening data
• Using outdated screening reports — a report should be obtained specifically for the current application, not reused from a previous inquiry
• Sharing screening reports with third parties — the report can only be used by the entity that obtained it, for the stated permissible purpose
• Applying blanket criminal record exclusions without individualized assessment — HUD guidance warns this may violate Fair Housing Act
• Keeping reports longer than necessary — establish a data retention and destruction policy

State FCRA Laws: Additional Requirements in Some States

The federal FCRA establishes a baseline, but many states have enacted additional consumer protection laws that impose stricter requirements on landlords. California, for example, has the California Consumer Credit Reporting Agencies Act, which adds requirements around notice and dispute rights. New York City has a Fair Chance for Housing Act that restricts when landlords can run criminal background checks. Seattle has ban-the-box ordinances that limit criminal history inquiries. Washington State has the Tenant Protections Act with specific screening notification requirements.

Before implementing your screening policy, research the specific state and local laws that apply in every jurisdiction where you own rental property. What is compliant in one state may be a violation in another. Consulting with a landlord-tenant attorney in your area is the most reliable way to ensure your policies meet all applicable federal, state, and local requirements.

Frequently Asked Questions

Do I need to send an adverse action notice if I just don't call back?

Yes. If you obtained a consumer report and that report was a factor in your decision not to approve an applicant — even if you simply did not respond to their application — you are required to send an adverse action notice under the FCRA. Silence is not a compliant adverse action process. The consumer must receive the notice, copy of their rights, and CRA contact information regardless of how you communicate your decision.

Can I use a tenant's screening report from another landlord?

No. Consumer reports can only be used by the entity that obtained them for the specific permissible purpose under which they were obtained. Using another landlord's screening report — even if the applicant provides it to you — creates FCRA liability for both parties. You must obtain your own fresh report with your own documented permissible purpose and the applicant's new consent.

How long should I keep screening records?

The FCRA does not specify a mandatory retention period for landlords, but best practice is to retain screening records and adverse action notices for at least 2 years after the application decision. Many landlord-tenant attorneys recommend 3 years, which covers the statute of limitations for FCRA claims in most jurisdictions. Establish a written data retention and destruction policy and follow it consistently.

What are the penalties for FCRA violations?

FCRA violations can be costly. Consumers can sue for actual damages, statutory damages between $100 and $1,000 per willful violation, punitive damages in egregious cases, and attorney fees and costs. State attorneys general and the FTC can also bring enforcement actions. The most common violations that result in lawsuits against landlords are failure to send adverse action notices and using reports without written consent.