ORDER A REPORT
SECURE FILE UPLOAD

The Consumer Financial Protection Bureau (CFPB) is an independent U.S. federal agency responsible for implementing and enforcing federal consumer financial protection laws. Its mission is to ensure that markets for consumer financial products and services are fair, transparent, and competitive, while protecting consumers from unfair, deceptive, and abusive acts or practices (UDAAP). [consumerfinance.gov], [congress.gov]

The CFPB has broad authority over banks, credit unions, and non‑bank financial institutions that offer consumer financial products, including mortgages, credit cards, auto loans, student loans, debt collection, and consumer reporting.

The Illusion of Instant Criminal Checks: Why a True National Criminal Database Still Doesn’t Exist

If you’ve ever been pitched a “national criminal database,” you’ve probably imagined a single, authoritative system that instantly returns every criminal record across the United States. That database doesn’t exist for non‑law‑enforcement users and relying on anything marketed that way can lead to missed records, inaccurate matches, and regulatory headaches.

What actually exists at the national level?

The FBI operates several national systems—NCIC, III, NGI, N‑DEx, and NICS—to support criminal justice operations. These are law‑enforcement systems, with access tightly constrained by federal law and regulation (including 28 C.F.R. § 20.33). Employers generally cannot query NCIC/III directly unless a statute authorizes fingerprint‑based checks for specific roles (e.g., child care, elder care, or other regulated positions) and the check is routed through the state repository per the Compact Council rules.

Even within law enforcement, these systems are indexes and exchanges that depend on state and local repositories to submit arrests and dispositions; coverage and timeliness vary. The DOJ/BJS surveys and FBI guidance repeatedly emphasize gaps and the critical need to report final court dispositions to keep records accurate.

So what are “national criminal databases” sold by private vendors?

Commercial “national” or multi‑jurisdictional files aggregate data from many sources (state repositories where available, departments of corrections, sex offender registries, selected county uploads, watchlists, etc.). They can be useful as a pointer or discovery tool, but they are not comprehensive and often not current enough to stand alone. Coverage varies by jurisdiction and update cadence; name‑match noise creates false positives/negatives, especially with common names.

Industry resources and compliance guidance are consistent on this point: use multi‑jurisdictional databases to broaden the net, then verify at the originating court or repository before reporting or taking action.

Why “database‑only” screening creates risk

  1. Incomplete coverage: Not all courts or states report; updates lag. Recent charges or local misdemeanors may be absent.
  2. Identity ambiguity: Limited identifiers can mis‑match results; aliases and data entry errors compound the problem.
  3. Stale or missing dispositions: Arrests without case outcomes mislead; expungements or dismissals may remain in bulk feeds.
  4. Fair Credit Reporting Act (FCRA) compliance exposure: The FCRA requires “reasonable procedures to assure maximum possible accuracy” and complete, up‑to‑date public record reporting. Database “hits” must be confirmed at the source, and consumers must be notified appropriately when adverse public records are reported for employment decisions.

Regulators have sharpened expectations. In 2024, the Consumer Financial Protection Bureau (CFPB) reiterated that consumer reporting agencies (CRAs) must prevent reporting of duplicate or expunged/sealed items and include disposition information where available. CRAs also must disclose the source(s), both original and any intermediaries, when consumers request their files.

Why this still matters

Despite modernization, data gaps persist—especially in disposition reporting and identity matching. The newest BJS/SEARCH survey shows continued dependence on state repositories and varying automation/completeness across states, reinforcing why source verification and robust procedures remain critical.

Meanwhile, regulators (CFPB/FTC) are raising the bar on “maximum possible accuracy.” Organizations that rely on “instant database” products without verification risk adverse action mistakes, consumer disputes, and enforcement exposure.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

December 12th, 2025|Categories: Compliance Corner for Employment Decisions|Tags: , , |

Independent Contractors, Misclassification, and the FCRA: Lessons from Joel Galarza’s Eleventh Circuit Case

The Eleventh Circuit’s recent decision in Galarza v. One Call Claims, LLC sent ripples through compliance and risk management circles. At its core, the case addressed whether three insurance adjusters labeled as independent contractors were actually employees under the Fair Labor Standards Act (FLSA). The court applied the economic realities test and concluded that a jury could reasonably find these workers were employees, reversing the district court’s summary judgment in favor of the companies. Five of six factors favored employee status, including:

  • Control over work: The companies dictated schedules, monitored performance, and approved overtime.
  • Economic dependence: Adjusters worked exclusively for the companies for nearly two years.
  • Integral role: Their work was central to the companies’ operations.
  • Permanency: Long-term, exclusive engagements suggested employment rather than independent contracting.

Why This Matters for Employment Background Screening

While the Galarza case was decided under the FLSA, it raises a critical question for compliance professionals: Should independent contractors be treated as employees for purposes of the Fair Credit Reporting Act (FCRA)?

Under the FCRA, requirements such as stand-alone disclosures, written authorization, and pre-adverse action notices apply when a consumer report is obtained for “employment purposes.” The statute defines this as evaluating a consumer for employment, promotion, reassignment, or retention as an employee. Although Federal Trade Commission (FTC) staff reports have suggested that the FCRA’s “employment purpose” provision may extend to certain independent contractors, courts have generally taken a narrower view. For example, in Smith v. Mutual of Omaha (S.D. Iowa), the court held that background screening for contractor roles did not trigger the FCRA’s employment-related protections.

However, the Galarza decision underscores a practical risk: labels don’t control legal outcomes. If a contractor is later deemed an employee under an “economic realities” or similar test, a company could face exposure—not just under wage laws, but potentially under FCRA if the screening process didn’t meet employment-purpose requirements.

Compliance Takeaways

  1. Don’t Rely on Labels Alone
    Contracts calling someone an “independent contractor” won’t shield you if the working relationship looks like employment. Courts focus on substance over form.
  2. Assess Classification Before Screening
    If the role involves long-term, exclusive work under significant control, treat the individual as an employee for FCRA compliance. This means providing proper disclosures, obtaining written consent, and following adverse action procedures.
  3. Update Policies and Vendor Agreements
    Ensure your background screening policies clearly address contractor roles and include contingency plans if classification changes.
  4. Monitor Legal Trends
    The Eleventh Circuit’s ruling aligns with broader enforcement trends emphasizing misclassification risks. Expect more scrutiny in wage-and-hour and consumer reporting contexts.

Bottom Line

The Galarza case is a wake-up call: misclassification isn’t just a wage-and-hour issue—it’s a compliance risk that touches background screening and FCRA obligations. When in doubt, err on the side of treating high-control, long-term contractors as employees for screening purposes. It’s a small step that can prevent big liability

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

November 11th, 2025|Categories: Compliance Corner for Employment Decisions|Tags: , , , |

A Unified Credit Reporting System: CFPB Clarifies Federal Preemption Under the FCRA

On October 28, 2025, in a significant move toward regulatory clarity, the Consumer Financial Protection Bureau (CFPB) issued a new interpretive rule reaffirming the broad preemptive scope of the Fair Credit Reporting Act (FCRA) over state laws. This rule replaces the narrower interpretation issued in July 2022, which the CFPB formally withdrew in May 2025.

Why This Matters

The FCRA, enacted in 1970 and amended multiple times since, governs the creation and use of consumer reports. It has always included a preemption clause, but the scope of that clause has evolved. In 1996, Congress expanded FCRA’s preemption to cover specific subject matters, aiming to prevent a fragmented regulatory landscape. This expansion was made permanent in 2003 to support a unified national credit reporting system.

The CFPB’s latest interpretive rule confirms that the FCRA broadly preempts state laws that touch on the subject matter regulated by the federal statute. This clarification is intended to promote consistency across the credit reporting industry and ensure that consumers and businesses operate under a single, coherent set of standards.

The Shift from 2022

The 2022 interpretive rule argued for a narrow reading of FCRA’s preemption clause, suggesting that states could regulate areas like medical debt, rental information, and arrest records unless those regulations directly conflicted with specific FCRA provisions. The CFPB now asserts that this interpretation was flawed, both legally and practically.

According to the Bureau, the language of the FCRA—particularly section 1681t(b)(1)—uses broad terms like “no requirement or prohibition” and “with respect to any subject matter regulated under,” which indicate Congress’s intent to occupy the field of consumer reporting. The phrase “relating to” further expands the scope, encompassing any state law connected to the topics covered by the FCRA.

Legal and Legislative Support

The CFPB’s position is supported by legislative history and judicial precedent. Congress explicitly aimed to create national standards to avoid a “patchwork system of conflicting regulations.” Courts have consistently interpreted the FCRA’s preemption clause broadly, finding that state laws addressing the same subject matter as federal provisions are preempted even if they don’t mirror the exact language of the FCRA.

Implications on Compliance

While the CFPB’s interpretive rule provides helpful guidance, it is important to note that interpretive rules are not binding on any court. Courts may choose not to adopt the CFPB’s interpretation, and legal challenges could arise depending on jurisdiction and context.

 

Disclaimer: This communication is for general informational purposes only and does not constitute legal advice. The summary provided in this alert does not, and cannot, cover in detail what employers need to know about the amendments to the Philadelphia Fair Chance Law or how to incorporate its requirements into their hiring process. No recipient should act or refrain from acting based on any information provided here without advice from a qualified attorney licensed in the applicable jurisdiction.

October 31st, 2025|Categories: Compliance Corner for Employment Decisions|Tags: , , |

CFPB’s Advisory Opinion on Name-Only Matching for Consumer Reporting

On July 12, 2022, the Consumer Financial Protection Bureau (CFPB) issued an advisory opinion regarding the “permissible purpose requirement” of the Fair Credit Reporting Act (FCRA) as it applies to both a consumer reporting agency (CRA) and a user of consumer reports (e.g., employer).

The CFPB’s position is that name-only matching records in a consumer report violate the permissible purpose requirement in FCRA section 604(a)(3). The CFPB noted that consumer report users must ensure they do not violate a person’s privacy by obtaining or using a report without a permissible purpose, and that a consumer reporting agency should not provide reports with “possible matches” to users.

The CFPB further warned that including a disclaimer in the report, such as “this record was matched to the subject by First Name, Last Name ONLY and may not belong to your subject; your further review of the [source] is required in order to determine if this is your subject” does not adequately address the problem of using name-only matching procedures because the report may include information about a person other than the subject for whom the CRA has a permissible purpose. In the CFPB’s view, a disclaimer “will not change the fact that the consumer reporting company has failed to satisfy the requirements of 604(a)(3) and has provided a consumer report about a person lacking a permissible purpose with respect to that person.”

The CFPB’s advisory opinion raises the possibility that employers, as users of such consumer reports, could be held liable for FCRA permissible purpose violations resulting from a CRA’s matching procedures or mistakes. The opinion emphasized the CFPB’s position that there is strict liability for obtaining or using a consumer report without a permissible purpose and also included a reminder about criminal liability for knowing or willful violations of the FCRA provisions.

July 19th, 2022|Categories: Compliance Corner for Employment Decisions|Tags: , |

The CFPB issues new policy guidance on credit reporting and dispute resolution

On April 1, 2020, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) issued a non-binding general policy statement (“Policy Statement”) regarding the Fair Credit Reporting Act (FCRA) and Regulation V in light of the recently enacted Coronavirus Aid, Relief, and Economic Security Act (CARES Act).

The CFPB’s Policy Statement highlights furnishers’ responsibilities and informs consumer reporting agencies (“CRAs”) of the Bureau’s flexible supervisory and enforcement approach during this pandemic. The Bureau intends to consider the circumstances that entities face as a result of the COVID-19 pandemic and their good faith efforts to comply with statutory and regulatory obligations as soon as possible.

The Bureau believes that this flexibility will help furnishers and CRAs to manage the challenges of the current crisis. Below are examples of the flexibility the Bureau intends to provide in the consumer reporting system.

Furnishing consumer information impacted by COVID-19: The Bureau reiterates its prior guidance encouraging financial institutions to work constructively with borrowers and other customers affected by COVID-19 to meet their financial needs. While companies generally are not legally obligated to furnish information to CRAs, the Bureau encourages them to continue doing so despite the current crisis. Furnishers’ providing accurate information to CRAs produces substantial benefits for consumers, users of consumer reports, and the economy as a whole. The CARES Act, a section of which amends the FCRA, generally requires furnishers to report as current certain credit obligations for which furnishers make payment accommodations to consumers affected by COVID-19 who have sought such accommodations from their lenders. Many furnishers are or will be offering consumers affected by COVID-19 various forms of payment flexibility, including allowing consumers to defer or skip payments, as required by the CARES Act or voluntarily. Such payment accommodations will avoid the reporting of delinquencies resulting from the effects of COVID-19. The Bureau supports furnishers’ voluntary efforts to provide payment relief, and it does not intend to cite in examinations or take enforcement actions against those who furnish information to CRAs that accurately reflects the payment relief measures they are employing.

Disputes: The FCRA generally requires that CRAs and furnishers investigate disputes within 30 days of receipt of the consumer’s dispute. The 30-day period may be extended to 45 days if the consumer provides additional information that is relevant to the investigation during the 30-day period. The Bureau is aware that some CRAs and furnishers may face significant operational disruptions that pose challenges in the investigations. For example, some CRAs and furnishers may experience reductions in staff, difficulty in taking disputes, or lack of access to necessary information, rendering them unable to investigate the disputes within the timeframes the FCRA requires. Furnishers include a wide variety of businesses that vary in size and sophistication and can range from small retailers to very large financial services firms, each of which will face unique challenges due to the COVID-19 pandemic. In evaluating compliance with the FCRA as a result of the pandemic, the Bureau will consider a CRA’s or furnisher’s individual circumstances and does not intend to cite in an examination or bring an enforcement action against a CRA or furnisher making good faith efforts to investigate disputes as quickly as possible, even if dispute investigations take longer than the statutory timeframe. The Bureau reminds furnishers and CRAs that they may take advantage of statutory and regulatory provisions that eliminate the obligation to investigate disputes submitted by credit repair organizations and disputes they reasonably determine to be frivolous or irrelevant. The Bureau will consider the current constraints on furnishers’ and CRAs’ time, information, and other resources in assessing if such a determination is reasonable.

Regulatory requirements: The Policy Statement is a non-binding general statement of policy articulating considerations relevant to the Bureau’s exercise of its supervisory and enforcement authorities. It is therefore exempt from the notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 USC 553(b).

Resources for consumers and small businesses facing the impacts of the COVID-19 pandemic are available on the Bureau’s website at https://www.consumerfinance.gov/coronavirus/.

April 3rd, 2020|Categories: Compliance Corner for Employment Decisions|Tags: , |

CFPB publishes annual guide about consumer reporting agencies

Every year, the Consumer Financial Protection Bureau (the “CFPB”) updates and publishes a guide to consumer reporting companies, The guide includes information in connection with requesting a consumer report from the three largest nationwide consumer reporting companies and dozens of specialty reporting companies, tips regarding specialty reports, updated information about authentication of identity when requesting a consumer report, information on companies that provide free credit scores, and rights with respect to consumer reports.

The CFPB notes that in prior years, its guide referred to consumer reporting businesses as “agencies” or “bureaus,” and that these terms can be confusing because they may imply these businesses are government entities. They are not—these companies are private-sector, for-profit entities, and in this year’s guide, the CFPB refers to them as “companies” for better clarity.

February 23rd, 2016|Categories: Compliance Corner for Employment Decisions|Tags: , , |

Privacy laws gain momentum in Congress

President Barack Obama has made data security a priority in recent weeks.

Speaking at the Federal Trade Commission (FTC) in January, the President announced three pieces of legislation: the Student Digital Privacy Act (which would prohibit the sale of sensitive student data for non-education purposes), the codification of the Consumer Privacy Bill of Rights issued by the White House in 2012, and the Personal Data Notification & Protection Act.

Implicating businesses across the country, the Data Notification Act would establish nationwide, uniform data breach notification rules that would preempt the existing collection of 47 different state laws. Criminal penalties for hackers would also be strengthened and companies would be required to notify consumers of a breach within 30 days.

Broader than prior proposals of federal data breach notification bills, the Act defines “sensitive personally identifiable information” to include a range of data, like an individual’s first and last name or initial and last name in combination with two other items like a home address or telephone number, birthdate, or mother’s maiden name, a Social Security number by itself, and a user name or e-mail address in combination with a password or security question answer that would permit access to an online account.

The notice provisions allow companies to inform consumers of a breach by mail, telephone, and e-mail, under certain conditions. When more than 5,000 individuals are affected in a single state, media notice is required; if more than 5,000 total individuals (regardless of residence) are impacted, the company must also notify credit reporting agencies and the federal government.

Although the bill designates the FTC as the primary enforcement agency, with the authority to promulgate rules pursuant to the law, the measure also requires the agency to coordinate with the Consumer Financial Protection Bureau (CFPB) where a data breach relates to “financial information or information associated with the provision of financial products or services.”

Some exemptions are included in the proposed bill. A business that does not access, store, or use covered data for more than 10,000 individuals during a 12-month period is exempt from the individual notice requirements. Safe harbor is also provided for companies that conduct a “risk assessment” that determines the data breach did not result in – and will not result in – harm to affected individuals. The business must notify the FTC of its “risk assessment” results and affirmatively indicate its intent to invoke the safe harbor.

A few days after he presented the proposal, President Obama reiterated his intent to pass data security measures in his State of the Union address, sending a message that he is focused on cybersecurity and privacy in the coming legislative session. Recent high-profile cyberattacks and data breaches (think Sony and Target) have also led to support from lawmakers and consumers, giving the bill momentum, but the question of its passage remains uncertain.

Learn more about Personal Data Notification & Protection Act

February 23rd, 2015|Categories: Commercial Transactions Due Diligence|Tags: , , |

CFPB issues long-awaited rule on supervising non-banks that pose risks to consumers

On June 26, 2013, the Consumer Financial Protection Bureau (the “CFPB”) issued a final rule that establishes procedures to bring under its supervisory authority certain nonbanks whose activities pose risks to consumers. Non-banks subject to the rule are companies that offer or provide consumer financial products or services but do not have a bank, thrift, or credit union charter, and include a nonbank’s affiliate service providers. The final rule will be effective 30 days after its publication in the Federal Register.

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), the CFPB is authorized to supervise any nonbank, regardless of its size, that the CFPB has reasonable cause to determine “is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services.”

The CFPB has already finalized “larger participant” rules for the credit reporting and debt collection markets and has proposed such a rule for the federal and private student loan servicing market.

July 2nd, 2013|Categories: Commercial Transactions Due Diligence|Tags: , , |

CFPB’s database is now searchable by state and includes complaints about credit reporting

On May 31, 2013 the Consumer Financial Protection Bureau (“CFPB”) announced that its Consumer Complaint Database, now searchable by state, has been expanded to include credit reporting and money transfer complaints. In addition to these two new categories, the database, which can be accessed at http://www.consumerfinance.gov/complaintdatabase/, includes complaints relating to credit cards, mortgages, student loans, bank accounts and services, and consumer loans.

When submitting a complaint about credit reporting, consumers can select from five common issues, which are all searchable on the updated database: incorrect information on a credit report; problems with a credit reporting agency’s investigation; improper use of a credit report; not being able to get a credit report or credit score; and problems with credit monitoring or identity protection services.

June 20th, 2013|Categories: Compliance Corner for Employment Decisions|Tags: , , |
© 2012- SCHERZER INTERNATIONAL | ALL RIGHTS RESERVED
Go to Top