California AB 506 Compliance for Churches: Training, Live Scan, and Policies

To comply with California’s AB 506, a church that runs any program for minors must do three things: train every covered administrator, employee, and regular volunteer as a mandated reporter; run Live Scan fingerprint background checks on those same people through a California Department of Justice–authorized process; and adopt written child abuse prevention policies that require two adults present with children whenever possible and direct suspected abuse to be reported to outside authorities. The requirements sit in Business and Professions Code Section 18975 and have been in force long enough that any California church with youth ministry should already be meeting them.¹

Which Churches and Which People Are Covered

The statute reaches any “youth service organization,” meaning one that employs or uses people who qualify as mandated reporters under Penal Code Section 11165.7(a)(7). That Penal Code section covers administrators and employees of youth centers, youth recreation programs, and youth organizations.² Sunday school, youth group, vacation Bible school, summer camp, nursery care during services — if your church supervises minors in any of these settings, you are a youth service organization. There is no religious carve-out, and the law applies wherever the supervision happens, including off-site locations and private homes.

Within a covered church, three categories of people must comply: administrators, employees, and regular volunteers. The statute draws no line among employees based on job duties or proximity to kids. A church receptionist faces the same requirements as the youth pastor.¹

Volunteers are treated differently. A “regular volunteer” is someone 18 or older who has direct contact with or supervision of children for more than 16 hours in a month or more than 32 hours in a year.¹ Track hours. A parent who only helps at summer camp and a Christmas pageant can quietly cross 32 hours in a year and trigger every obligation below.

Mandated Reporter Training

Every covered person must complete training in identifying and reporting child abuse and neglect before they begin working with minors.¹ The statute specifically names the free online training offered by the Office of Child Abuse Prevention within the California Department of Social Services as satisfying this requirement. That program includes modules tailored to clergy and volunteers.³

The training walks through the signs of physical, emotional, and sexual abuse and neglect, and it explains that the legal duty is to report suspicions to outside authorities rather than resolve them internally. Keep every completion certificate on file. The statute sets no refresher schedule, but building a periodic retake into the calendar is a reasonable practice.

Live Scan Background Checks

Every covered administrator, employee, and regular volunteer must undergo a fingerprint-based background check through Live Scan, aimed at identifying and excluding anyone with a history of child abuse.¹

Becoming an Authorized Applicant Agency

Before a church can request background checks, the DOJ must authorize it as an applicant agency. BPC 18975 provides the statutory basis for that authorization. Churches apply through the DOJ’s Agency Authorization Portal. A DOJ analyst reviews the application and assigns an Originating Agency Identifier, or ORI, that links every future submission back to the church.⁴

Running the Scans

Once authorized, the church gives each person a Request for Live Scan Service form pre-filled with the church’s ORI. The individual takes it to a certified Live Scan operator, presents identification, and is fingerprinted electronically. The operator transmits the prints to both the California DOJ and the FBI for a combined state and federal criminal history review.⁵

DOJ processing fees are $32 for the state check and $17 for the federal check, totaling $49.⁶ The Live Scan operator adds its own rolling fee, which varies by location. All in, budget roughly $60 to $80 per person. Some churches absorb the cost; others ask volunteers to pay. For a congregation with dozens of volunteers, this is a material line item.

Designating a Custodian of Records

Every applicant agency must designate at least one Custodian of Records (COR). The COR is responsible for the security, storage, sharing, and destruction of any criminal history information the DOJ returns, and serves as the church’s primary point of contact with the DOJ.⁷

This is a vetted role, not a title you can hand out. The prospective COR undergoes a separate state and federal background check, and anyone with a felony conviction or an offense related to the custodian’s duties will be rejected. The DOJ retains the COR’s fingerprints for ongoing arrest notification. Churches submit their COR candidate through the Applicant Agency Justice Connection Portal using Live Scan form BCIA 8016CUS and confirmation form BCIA 8374-9007. Processing and confirmation fees for the COR total $79, plus the Live Scan operator’s rolling fee.⁷

Treat the confidentiality rules seriously. Criminal history data must be stored securely, shared only with authorized personnel, and destroyed when it is no longer needed. Mishandling that data creates liability separate from any underlying child safety issue.

Written Child Abuse Prevention Policies

Training and screening cover individuals. The statute also requires the organization itself to adopt written child abuse prevention policies covering two areas: supervision standards and external reporting.¹

The Two-Adult Rule

The policy must call for at least two mandated reporters to be present “to the greatest extent possible” whenever staff or volunteers are in contact with or supervising children.¹ The qualifier is not a loophole. Two adults must be the default, with exceptions limited to situations where it genuinely cannot be arranged. Routinely leaving a single adult alone with children is a compliance problem and a significant liability exposure.

A narrow exception applies to organizations that provide one-on-one mentoring, provided they have adopted reporting policies and comprehensive screening, training, and regular contact protocols with volunteers and parents.¹ Standard church youth programs do not qualify.

Reporting to Outside Authorities

The written policy must set out procedures for reporting suspected child abuse to authorities outside the organization. This is where churches most often go wrong. Reporting a concern to a senior pastor, elder board, or denominational supervisor does not satisfy the law. The policy must direct people to contact law enforcement or child protective services directly.¹ Make the policy accessible to every parent and guardian of a participating child.

The Individual Reporting Duty

Covered people need to understand that the duty to report runs to them personally. When a mandated reporter knows or reasonably suspects that a child has been abused or neglected, two steps follow. First, an immediate phone call to a designated agency: a police department, sheriff’s department, county probation department (if designated), or county welfare department.⁸ Second, a written follow-up report prepared and sent within 36 hours of receiving the information.⁹

Failure to report known or reasonably suspected abuse is a misdemeanor punishable by up to six months in county jail, a fine of up to $1,000, or both. If the reporter intentionally conceals the failure, the offense is treated as continuing until an agency discovers it.⁹ That criminal exposure sits on the individual, not the church.

Ongoing Monitoring Through Subsequent Arrest Notification

A Live Scan is a snapshot. For continuing visibility, churches can enter into a Subsequent Arrest Notification Service contract with the DOJ under Penal Code Section 11105.2. The DOJ retains the submitted fingerprints and notifies the church if a cleared person is later arrested.¹⁰

The contract specifies which categories are monitored, such as employees, regular volunteers, or both. Fingerprints submitted before the contract’s effective date are not retained for notification, so enrolling after you have already fingerprinted a group leaves gaps for those earlier submissions. The church must also notify the DOJ when it no longer has a legitimate interest in monitoring a particular person, for example when a volunteer leaves.¹⁰

Insurance Consequences

AB 506 compliance is not just a statutory question. The law explicitly permits liability insurers to request proof of compliance before writing coverage for a youth service organization.¹ A church that cannot document training, background checks, and written prevention policies may find it difficult to obtain or renew coverage. Check with your carrier about the specific documentation it expects, and keep records organized enough that producing them on request is routine.

1
California Legislative Information. California Code BPC 18975 – Youth Service Organizations
2
California Legislative Information. California Penal Code 11165.7 – Mandated Reporters
3
California Department of Social Services. Child Abuse Mandated Reporter Training
4
State of California – Department of Justice – Office of the Attorney General. Applicant Agencies
5
State of California – Department of Justice – Office of the Attorney General. Fingerprint Background Checks
6
State of California – Department of Justice – Office of the Attorney General. Applicant Fingerprint Processing Fees
7
State of California – Department of Justice – Office of the Attorney General. Custodian of Records
8
California Legislative Information. California Penal Code 11165.9 – Reporting Agencies
9
California Legislative Information. California Penal Code 11166 – Mandated Reporter Duties
10
California Department of Justice. Contract for Subsequent Arrest Notification Service