California Employment Credit Check: Notices, Adverse Action, and Penalties

California employment credit check requirements start from a prohibition: employers may not pull a consumer credit report on an applicant or employee unless the position falls into one of eight narrow categories set by Labor Code 1024.5. When a position does qualify, the employer still has to layer three sets of rules — California’s Consumer Credit Reporting Agencies Act, the Investigative Consumer Reporting Agencies Act, and the federal Fair Credit Reporting Act — before the report is ordered and again before any decision is made from it. Statutory damages begin at $10,000 per violation under state law.¹

When a California Employer Can Run a Credit Check

The default rule is no. The eight exceptions are the only situations where a credit report is legal for employment purposes, and the employer carries the burden of showing the position fits.¹

Managerial positions, meaning employees who qualify for the executive exemption under Wage Order 4 — not everyone with “manager” in a title.
Positions within the California Department of Justice.
Sworn peace officer and other law enforcement positions.
Positions where a credit disclosure is required by other state or federal law.
Positions with regular access, for the same individual, to all three of: bank or credit card account information, Social Security number, and date of birth.
Financial authority positions: a named signatory on the employer’s bank or credit card account, someone authorized to transfer money for the employer, or someone authorized to enter financial contracts on its behalf.
Positions with access to trade secrets or proprietary information that has independent economic value from being secret and that the employer actively protects.
Positions involving regular access to $10,000 or more in cash — belonging to the employer, a customer, or a client — in a single workday.

The sensitive-data category trips up a lot of employers. Access to one of those three data types is not enough. The statute requires regular access to bank or credit account details, Social Security numbers, and dates of birth for the same person. A retail clerk who processes credit card applications as part of the job does not qualify.¹

Financial Services Employers

Businesses subject to the Gramm-Leach-Bliley Act — banks, insurance companies, securities firms, and other financial institutions under state or federal regulatory oversight — are exempt from Labor Code 1024.5 entirely. They can run credit checks without matching one of the eight categories.¹ They still have to follow the disclosure, consent, and adverse action rules below, because those come from separate statutes.

Income or Employment Verification Only

A report that only verifies income or past employment, with no credit score, credit history, or payment records, is not a consumer credit report under this law.¹ An employer who just needs to confirm where you worked and what you earned can do that without triggering any of these restrictions, as long as the report stays in that lane.

Notices the Employer Must Give Before Pulling the Report

Assuming the position qualifies, the employer has to work through disclosures from both state and federal law. Each is a separate requirement; none substitutes for another.

California CCRAA Notice

Before requesting the report, the employer must give you a written notice identifying three things: that a credit report will be used, the specific Labor Code 1024.5(a) exemption that justifies it, and the source of the report. The notice must include a checkbox you can mark to receive a copy of the report. If you check it, the credit reporting agency has to send you a copy at the same time the employer gets one, at no cost to you.²

Saying the check is being run “for the position” is not enough. The notice has to name which of the eight categories applies — managerial, law enforcement, trade secrets access, or whichever one it is. That forces the employer to analyze the position before pulling the report rather than afterward.

California ICRAA Notice

If the credit check is part of a broader background investigation, the Investigative Consumer Reporting Agencies Act adds its own layer. The employer must give you a standalone written disclosure, separate from any other document, before ordering the report. That disclosure identifies the reporting agency by name, address, and phone number, states the purpose of the report, notes that the report may include information about your character and reputation, and summarizes your right to inspect the agency’s files. You have to authorize the report in writing.³

There is one carve-out. When an employer is investigating suspected wrongdoing or misconduct by a current employee, the advance disclosure and authorization requirements do not apply.³

Federal FCRA Disclosure

The federal Fair Credit Reporting Act sits on top. Before pulling any consumer report for employment purposes, the employer must provide a clear and conspicuous written disclosure, in a standalone document, that a credit report may be obtained. You must authorize it in writing. The employer must also certify to the credit reporting agency that it has complied with these disclosure rules, that it will follow the adverse action process if applicable, and that it will not use the information in violation of federal or state equal opportunity laws.⁴

A compliant California employer typically ends up with at least two or three separate disclosure documents before any report is ordered. Bundling them into one form, or mixing the disclosure with a job application or arbitration agreement, has been the basis of successful lawsuits — both the FCRA and the ICRAA require standalone documents.

The Adverse Action Process

If something in the credit report leads the employer to want to reject you or take action against you, the law does not let the employer act on it directly. Both California and federal law require a two-step process. Skipping or compressing the steps is one of the most common ways employers get sued here.

Pre-Adverse Action Notice

Before making a final decision, the employer must give you a copy of the credit report and a written summary of your rights under the FCRA.⁴ The point is to let you see what the report says and dispute errors before the decision becomes final. The FCRA doesn’t set a specific waiting period, but five business days between the pre-adverse notice and the final decision is the generally recommended minimum.

Final Adverse Action Notice

If the employer goes ahead after the waiting period, a final notice has to follow. Under federal law, that notice includes the name, address, and phone number of the credit reporting agency, a statement that the agency did not make the employment decision, notice of your right to a free copy of your report from the agency within 60 days, and notice of your right to dispute inaccurate information.⁵

California’s CCRAA adds a parallel requirement: whenever employment is denied wholly or partly because of credit report information, the employer must notify you and provide the name and address of the reporting agency.² This covers rejecting an applicant, denying a promotion, and terminating an employee.

How Old the Information in the Report Can Be

Credit reports cannot carry negative information indefinitely. Under the FCRA, most negative items — late payments, collections, civil judgments — fall off after seven years. Bankruptcies can be reported for up to ten years.⁶ If a report used for an employment decision includes items older than those limits, the report itself may be defective, and any action taken on that stale information adds to the employer’s legal exposure.

Penalties for Employer Violations

The damages are what make credit check compliance different from a lot of other employment rules. One slip against one person can be expensive, and class actions multiply it quickly.

Under the Investigative Consumer Reporting Agencies Act, an employer that fails to comply owes the affected person actual damages or $10,000, whichever is greater. The $10,000 floor applies per violation in individual cases, though not in class actions. The employer also pays attorney’s fees and court costs. If the violation was grossly negligent or willful, a court can add punitive damages.⁷

A willful FCRA violation exposes the employer to statutory damages between $100 and $1,000 per violation (or actual damages if higher), plus punitive damages and attorney’s fees.⁸ The federal per-violation numbers look modest next to California’s $10,000 floor, but FCRA class actions are where systemic disclosure defects, like extra language stuffed into a supposedly standalone form, pull in every person who ever received that form.

The CCRAA offers a safe harbor to employers who can show they maintained reasonable compliance procedures, but that defense depends on documentation.²

Records the Employer Should Keep

Federal law requires employers to keep employment records, including background check authorizations and disclosures, for at least one year after the employment relationship ends. The practical retention period runs longer. FCRA claims can be brought up to two years after you discover the violation, or up to five years if it wasn’t reasonably discoverable. Keeping consent forms, disclosure documents, and adverse action notices for at least five to six years gives the employer a buffer for late-discovered claims and the time it takes litigation to start. An employer asserting the CCRAA’s reasonable-procedures defense needs the paperwork to show what procedures were in place and that they were followed.

1
California Legislative Information. California Code LAB 1024.5
2
California Legislative Information. California Code CIV 1785.20.5
3
California Legislative Information. California Code CIV 1786.16
4
Office of the Law Revision Counsel. 15 USC 1681b
5
Office of the Law Revision Counsel. 15 USC 1681m
6
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
7
California Legislative Information. California Code CIV 1786.50
8
Office of the Law Revision Counsel. 15 USC 1681n