California AB 506 for Churches: Training, Live Scans, Reporting

To meet the AB 506 compliance requirements for churches, a California congregation that runs any program serving minors must train its covered people as mandated reporters, run fingerprint background checks through Live Scan, designate a Custodian of Records to handle criminal history data, and adopt written child abuse prevention policies that include a two-adult supervision rule and direct external reporting. The law, codified at Business and Professions Code Section 18975, took effect January 1, 2022, and organizations that were not previously running background checks had until January 1, 2024, to start.¹ Every California church with youth programs should already be in full compliance.

Which Churches and People the Law Reaches

The statute applies to any “youth service organization,” defined as one that employs or uses people who qualify as mandated reporters under Penal Code Section 11165.7(a)(7): administrators and employees of youth centers, youth recreation programs, and youth organizations.² Sunday school, youth group, vacation Bible school, and summer camps all qualify. There is no religious carve-out, and it doesn’t matter whether supervision happens at church, at a park, or in a private home.

Three groups within a covered church must comply: administrators, employees, and regular volunteers. For employees, the statute draws no line based on duties or how often someone is around children. A receptionist and a youth pastor face the same obligations.¹

Volunteers get a narrower test. A “regular volunteer” is anyone 18 or older who has direct contact with or supervision of children for more than 16 hours in a month or more than 32 hours in a year.¹ The 32-hour annual threshold catches seasonal helpers at camps and holiday programs. Track volunteer hours. Someone who “just helps out” a few times can quietly cross the line and trigger the full set of requirements.

Mandated Reporter Training

Every administrator, employee, and regular volunteer must complete training in identifying and reporting child abuse and neglect before starting work with minors.¹ The statute says this obligation can be met through the free online training run by the Office of Child Abuse Prevention within the California Department of Social Services, which includes modules for clergy and volunteers.³

The training covers recognizing physical, emotional, and sexual abuse as well as neglect, and it walks participants through the legal duty to report suspicions to outside authorities rather than handle concerns internally. Keep completion certificates on file. The statute does not require retraining on a set schedule, but periodic refreshers are worth building into the calendar because the content and the law can change.

Live Scan Background Checks

Every covered administrator, employee, and regular volunteer must undergo a fingerprint-based background check through the Live Scan system. The statute requires this screening to “identify and exclude any persons with a history of child abuse.”¹

Getting Authorized as an Applicant Agency

Before the church can request any background checks, it must be authorized by the California Department of Justice as an applicant agency. The DOJ only approves organizations with a statutory basis for requesting criminal history checks, and BPC 18975 provides that basis. Churches apply through the DOJ’s Agency Authorization Portal. A DOJ analyst reviews the application and assigns an Originating Agency Identifier (ORI) that links every future submission back to the church.⁴

Running the Live Scan and What It Costs

Once authorized, the church gives each person a Request for Live Scan Service form pre-filled with the church’s ORI and other agency information. The individual takes the form to a certified Live Scan operator, presents identification, and is fingerprinted electronically. The operator transmits the prints to both the California DOJ and the FBI for combined state and federal review.⁵

The DOJ sets processing fees at $32 for the state check and $17 for the federal check, totaling $49.⁶ The Live Scan operator adds its own rolling fee, which varies by location. Budget roughly $60 to $80 per person all in. For a church with dozens of volunteers, that adds up. Some churches cover the cost; others ask volunteers to pay their own way.

Designating a Custodian of Records

Every applicant agency must designate at least one Custodian of Records (COR), the person responsible for the security, storage, sharing, and destruction of any criminal history information the DOJ sends back. The COR is also the church’s primary point of contact with the DOJ.⁷

This is not a ceremonial appointment. The prospective COR undergoes a separate state and federal background check, and anyone convicted of a felony or an offense related to the duties of a custodian will be rejected. The DOJ retains the COR’s fingerprints for ongoing arrest notification.⁷

Criminal history information is confidential. The COR must ensure results are stored securely, shared only with authorized personnel, and destroyed when no longer needed. Churches often overlook the weight of this obligation. Mishandling criminal history data creates liability separate from any child safety issue.

Written Child Abuse Prevention Policies

Beyond training and screening individuals, each youth service organization must develop and implement written child abuse prevention policies covering two core areas: supervision standards and external reporting.¹

The Two-Adult Rule

The statute requires policies calling for at least two mandated reporters to be present “to the greatest extent possible” whenever staff or volunteers are in contact with or supervising children.¹ The qualifier matters. The law recognizes that two trained adults cannot always be present, but that must be the default, not the exception. A church that routinely leaves one adult alone with children has a compliance problem and a significant liability exposure regardless of the “greatest extent possible” phrasing.

One narrow exception applies. Organizations providing one-on-one mentoring to youth are exempt from the two-adult requirement if they have adopted reporting policies and implemented comprehensive screening, training, and regular contact protocols with volunteers and parents.¹

External Reporting Procedures

The policy must include procedures for reporting suspected child abuse to authorities outside the organization. This is where churches sometimes go wrong: telling a senior pastor or church board does not satisfy the law. The written policy must direct people to contact law enforcement or child protective services directly, and it should be accessible to every parent and guardian of participating children.¹

How Covered Individuals Must Report Suspected Abuse

When a mandated reporter knows or reasonably suspects that a child has been abused or neglected, the law requires two steps. First, an immediate phone call to a designated agency: a police department, sheriff’s department, county probation department (if designated), or county welfare department.⁸ Second, a written follow-up report sent within 36 hours of receiving the information.⁹

Failure to report known or reasonably suspected child abuse or neglect is a misdemeanor punishable by up to six months in county jail, a fine of up to $1,000, or both. If the reporter intentionally conceals the failure to report, the offense is treated as continuing until an agency discovers it.⁹ This is personal criminal liability that lands on the individual, not the organization. Every person covered by AB 506 should understand that.

Subsequent Arrest Notification

A background check is a snapshot. To stay current, a church can contract with the DOJ for Subsequent Arrest Notification Service, authorized under Penal Code Section 11105.2. Under the contract, the DOJ keeps the fingerprints submitted for background checks and automatically notifies the church if a cleared person is later arrested.¹⁰

The church specifies which groups it wants monitored (employees, volunteers, or both). One catch: fingerprints submitted before the contract’s effective date are not retained for notification. Signing up after already running background checks can leave gaps. The church is also required to notify the DOJ when it no longer has a legitimate interest in monitoring someone, for example when a volunteer leaves.¹⁰

What Noncompliance Means for Insurance

The statute explicitly permits liability insurers to request proof of AB 506 compliance before writing coverage for a youth service organization.¹ A church that cannot document its training, background checks, and written prevention policies may struggle to obtain or renew coverage. Losing insurance on a child abuse claim is a financial exposure that dwarfs the cost of compliance. If your church already carries liability coverage, ask your carrier what documentation it expects to see.

1
California Legislative Information. California Code BPC 18975 – Youth Service Organizations
2
California Legislative Information. California Penal Code 11165.7 – Mandated Reporters
3
California Department of Social Services. Child Abuse Mandated Reporter Training
4
State of California – Department of Justice – Office of the Attorney General. Applicant Agencies
5
State of California – Department of Justice – Office of the Attorney General. Fingerprint Background Checks
6
State of California – Department of Justice – Office of the Attorney General. Applicant Fingerprint Processing Fees
7
State of California – Department of Justice – Office of the Attorney General. Custodian of Records
8
California Legislative Information. California Penal Code 11165.9 – Reporting Agencies
9
California Legislative Information. California Penal Code 11166 – Mandated Reporter Duties
10
California Department of Justice. Contract for Subsequent Arrest Notification Service