FCRA Compliance for Nonprofits: Volunteer Background Check Consent Forms & Legal Guide

Does the FCRA Apply to Volunteer Background Checks?

Yes. If your nonprofit uses a third-party background check company — called a Consumer Reporting Agency (CRA) — to screen volunteers, the Fair Credit Reporting Act (FCRA) applies.

This surprises many nonprofit leaders. The FCRA is most commonly associated with employment background checks, but its scope extends to any "consumer report" obtained from a CRA for any purpose, including volunteer placement. The operative question isn't whether you're hiring someone for pay — it's whether you're using a third-party CRA to obtain information about an individual.

FCRA compliance for nonprofits is not optional, and the consequences of non-compliance are real: statutory damages of $100–$1,000 per violation, potential class-action exposure, and reputational harm.

This guide explains what compliance requires in plain language.

---

The Three Pillars of FCRA Compliance

Pillar 1: Disclosure Before the Check

Before ordering a background check, you must provide the volunteer with a clear written disclosure that a consumer report will be obtained. The FCRA is specific about the form this disclosure must take:

It must be in a standalone document — not buried in a volunteer application, a waiver, or any other form

It must consist solely of the disclosure (plus the authorization described below)

It must clearly state that a background check will be run and that the report may be used to make a volunteer placement decision

Common mistake: Embedding the disclosure in the volunteer application. Courts have found this violates the standalone document requirement even when the disclosure language itself is accurate.

Pillar 2: Written Authorization

The volunteer must sign a volunteer background check consent form authorizing the check before it is ordered. This is a separate requirement from the disclosure — you need both.

What the consent form must include:

The volunteer's full legal name and any aliases

Date of birth

Social Security Number (or verification that SSN will be collected by the CRA)

Signature and date

A statement confirming the volunteer has received and read the disclosure

What the consent form should NOT include:

Any release of liability language or waiver of rights under the FCRA

Blanket consent for future checks without specifying when re-screening will occur

Requests for information unrelated to the background check

VolunteerBadge provides FCRA-compliant disclosure and consent forms as part of their platform. The forms are delivered digitally, collected via e-signature, and stored in your account for audit purposes.

Pillar 3: Adverse Action Procedures

If you decide not to place a volunteer — or to restrict their role — based on information in their background check, you must follow the FCRA's two-step adverse action process.

Step 1: Pre-Adverse Action Notice

Before making a final decision, you must:

Send the volunteer a copy of their background check report

Send them a copy of "A Summary of Your Rights Under the FCRA" (published by the CFPB)

Allow a reasonable time period (typically 5 business days is considered standard) for the volunteer to dispute inaccurate information

Step 2: Final Adverse Action Notice

If you proceed with the adverse action after the waiting period, you must send a final notice that includes:

A statement that the adverse action was taken

The name, address, and phone number of the CRA that provided the report

A statement that the CRA didn't make the decision and can't explain why

Notice of the individual's right to obtain a free copy of their report within 60 days

Notice of their right to dispute the accuracy or completeness of the report

Use VolunteerBadge's FCRA adverse action letter generator to create compliant pre-adverse and final adverse action notices automatically.

---

The Volunteer Background Check Consent Form: What to Include

A compliant volunteer background check consent form contains the following elements:

Section 1: Organization Identification

Legal name of your nonprofit

EIN (recommended)

Contact person and address

Section 2: Volunteer Information

Full legal name

Any other names used in the past seven years (maiden name, former names)

Date of birth

Current address and addresses for the past seven years

Social Security Number (handled securely by your CRA)

Phone number and email

Section 3: Authorization Statement

A clear statement that the volunteer authorizes the named organization to obtain a consumer report from a CRA, used to evaluate their volunteer application. The statement should reference the standalone disclosure document.

Section 4: Signature and Date

A wet or electronic signature and the date signed.

What NOT to include:

A release of claims against your organization

A waiver of FCRA rights

A blanket authorization for indefinite future checks

---

FCRA Compliance for Nonprofits: Common Mistakes

Mistake 1: Combining the Disclosure and Consent Form with Other Documents

The disclosure must stand alone. If it's on the same page as your volunteer application, liability waiver, or code of conduct, it doesn't comply — even if the language is correct.

Mistake 2: Running Checks Without Written Consent

Verbal consent isn't sufficient. You need a signed consent form before the check is ordered. Running a check without written authorization is a per-violation FCRA liability.

Mistake 3: Skipping the Pre-Adverse Action Notice

Many nonprofits go straight to a "we can't place you" communication without providing a copy of the report and a waiting period. This is the most commonly litigated FCRA violation in the nonprofit sector.

Mistake 4: Using the Wrong Adverse Action Letter

The FCRA requires specific content in adverse action notices. A generic "thank you for applying" letter doesn't satisfy the requirement. Use a template from a FCRA-specialist provider or have your counsel review your letter.

Mistake 5: Not Storing Consent Forms

If your consent forms are paper-based and not retained, you lose your documentation in the event of a dispute. Store signed forms — digitally, in an access-controlled location — for at least five years.

Mistake 6: Re-Screening Without Fresh Consent

If you re-screen a volunteer a year or two later, you need a new consent form. An authorization signed in 2023 doesn't cover a 2026 re-screen.

---

State Law Layers on Top of the FCRA

The FCRA is the federal floor. Many states have passed additional requirements:

California: The California Investigative Consumer Reporting Agencies Act (ICRAA) adds requirements on top of the FCRA including additional disclosure language and limitations on the lookback period for certain conviction types. New York: Article 23-A of the New York Correction Law requires a multi-factor assessment before denying a volunteer opportunity based on a criminal conviction. Massachusetts: "Ban the box" provisions restrict when organizations can ask about criminal history during the application process. Illinois: The Illinois Human Rights Act limits the use of criminal records in placement decisions.

Your screening platform should support state-specific compliance workflows. VolunteerBadge's FCRA compliance center includes state-specific guidance and document templates.

---

Building a Compliant Consent and Adverse Action Workflow

The simplest way to maintain FCRA compliance for nonprofits is to use a platform that builds the workflow for you.

When you invite a volunteer through VolunteerBadge:

The volunteer receives an email with a link to the FCRA-compliant disclosure document

They review and e-sign the standalone disclosure

They complete the authorization form with their information

The background check is triggered automatically

Results are returned to your dashboard

If an adverse action is warranted, the platform guides you through the pre-adverse notice, waiting period, and final adverse notice steps

All documents are retained in the volunteer's record

Every step is documented. Every required document is generated correctly. The consent form and adverse action letters are FCRA-compliant by design — not by hope.

---

Summary: FCRA Compliance Checklist for Nonprofits

[ ] Provide a standalone FCRA disclosure document before ordering any check

[ ] Obtain a signed volunteer background check consent form before ordering

[ ] Store signed consent forms for a minimum of five years

[ ] Obtain fresh consent before each re-screening cycle

[ ] If taking adverse action: send pre-adverse notice with report copy and rights summary

[ ] Allow a reasonable waiting period (5 business days recommended)

[ ] Send final adverse action notice with required content

[ ] Apply your organization's individualized assessment process to all criminal records

[ ] Verify state-specific requirements in the states where your volunteers reside

The easiest way to stay compliant: use a platform that automates the entire workflow. VolunteerBadge was built to handle every step — from consent collection through adverse action — so your team focuses on your mission, not your legal exposure.