California Employment Credit Check Requirements and Penalties

Under California employment credit check law, an employer generally cannot pull your credit report for hiring, promotion, or discipline decisions. Labor Code 1024.5 bans the practice outright except for eight specific job categories, and even when a position qualifies, the employer must layer California’s Consumer Credit Reporting Agencies Act, the Investigative Consumer Reporting Agencies Act, and the federal Fair Credit Reporting Act on top of each other before a single report is ordered. Get any step wrong and statutory damages start at $10,000 per violation under state law.¹

The Eight Positions Where a Credit Check Is Legal

The default rule is a flat no. A California employer cannot use a consumer credit report for employment purposes unless the position falls into one of these eight categories, and the burden is on the employer to show it fits.¹

Managerial positions. Having “manager” in a job title is not enough. The role must qualify for the executive exemption under Wage Order 4, which generally means spending more than half the workday managing a business or department and directing at least two other employees.
Positions within the California Department of Justice.
Sworn peace officers and other law enforcement positions.
Positions where credit information is required by some other state or federal law, independent of Labor Code 1024.5.
Positions with regular access to a specific bundle of another person’s sensitive data: bank or credit card account information, Social Security number, and date of birth. All three, for the same individual. Access to one or two of those categories does not qualify.
Positions where the person is a named signatory on the employer’s bank or credit card account, is authorized to transfer money on the employer’s behalf, or can enter into financial contracts for the employer.
Positions with access to trade secrets or other confidential information that has independent economic value from being kept secret and that the employer actively protects.
Positions that regularly involve handling $10,000 or more in cash belonging to the employer, a customer, or a client in a single workday.

The sensitive-data category catches many employers off guard. A retail clerk who occasionally processes credit card applications does not fall inside it, because the exception requires regular access to bank or card details and Social Security numbers and dates of birth for the same person. Miss one leg of that tripod and the exception is gone.

Banks and Other Financial Institutions Are Treated Differently

Businesses subject to the Gramm-Leach-Bliley Act — banks, insurance companies, securities firms, and similar financial institutions under state or federal regulatory oversight — are exempt from Labor Code 1024.5 as a whole.¹ These employers can run credit checks without shoehorning the job into one of the eight categories. They still have to follow the disclosure, consent, and adverse action rules discussed below, because those come from separate statutes.

What Counts as a Credit Report

Labor Code 1024.5 borrows the definition from Civil Code 1785.3: any communication from a consumer reporting agency that bears on creditworthiness, credit standing, or credit capacity. There is one useful carve-out. A report that only verifies income or employment, and contains no credit score, credit history, or payment records, is not a consumer credit report under this law.¹ Employers who just want to confirm that a candidate actually worked where they claimed and earned what they reported can do that without triggering the credit check restrictions, as long as the report stays inside that lane.

Notices and Consent the Employer Must Provide

Assuming the job qualifies for a check, three separate laws stack on top of each other before the report can be ordered.

California’s Consumer Credit Reporting Agencies Act

Before requesting the report, the employer has to give you a written notice that says three things: a credit report will be used, the specific Labor Code 1024.5(a) exemption that justifies it, and the source of the report. The notice must include a checkbox letting you request your own copy of the report. If you check it, the agency has to send you a copy at the same time it sends one to the employer, at no cost to you.²

A generic “we’re going to run a credit check for this position” line does not satisfy this. The notice has to name the category — managerial, law enforcement, trade secrets access, cash handling, and so on. That requirement pushes employers to actually analyze the position first, rather than pulling reports and rationalizing later.

California’s Investigative Consumer Reporting Agencies Act

When the credit inquiry is part of a wider background investigation, the ICRAA piles on further requirements. The employer must give you a standalone written disclosure, separate from any other paperwork, before ordering the report. That disclosure must identify the reporting agency by name, address, and phone number; explain the purpose of the report; note that the report may include information about your character and reputation; and summarize your right to inspect the agency’s files. You have to authorize the report in writing.³

One exception applies to current employees. When an employer is investigating suspected wrongdoing or misconduct, the advance disclosure and authorization requirements do not apply.³

The Federal FCRA Layer

The federal Fair Credit Reporting Act sits on top of the state requirements. Before pulling any consumer report for employment purposes, the employer must provide a clear and conspicuous written disclosure, in a standalone document, that a credit report may be obtained. You have to authorize it in writing. The employer must also certify to the reporting agency that it has complied with these disclosure rules, that it will follow the adverse action rules if the report leads to a negative decision, and that it will not use the information in violation of equal opportunity laws.⁴

Handled correctly, this means a California employer ends up producing two or three separate disclosure documents before a single report is ordered. Combining the federal and state disclosures into a single form is risky, and burying either one inside a job application or arbitration agreement has been the basis of successful lawsuits.

If the Employer Wants to Reject You Because of the Report

An employer cannot simply see something on your credit report and pull the offer. Both California and federal law require a two-step process, and skipping or compressing it is one of the most common compliance failures.

Step One: The Pre-Adverse Action Notice

Before the decision is final, the employer must give you a copy of the credit report and a written summary of your FCRA rights.⁴ The point of this step is to give you a chance to see what the report says and dispute errors before the decision hardens. The FCRA does not name a specific waiting period, though five business days between the pre-adverse notice and the final decision is generally recommended.

Step Two: The Final Adverse Action Notice

If the employer decides to proceed after that waiting period, a final notice has to follow. Under federal law, it must include the name, address, and phone number of the reporting agency; a statement that the agency did not make the employment decision; notice of your right to get a free copy of the report from the agency within 60 days; and notice of your right to dispute inaccurate information.⁵

California adds a parallel requirement. Whenever employment is denied wholly or partly because of credit report information, the employer must notify you and provide the name and address of the reporting agency.² The rule covers rejected applicants, denied promotions, and terminated employees alike.

How Old Negative Information Can Be

Credit reports cannot carry negative items forever. Under the FCRA, most negatives — late payments, collections, civil judgments — drop off after seven years. Bankruptcies can be reported for up to ten.⁶ If the report an employer relied on contains items past those limits, the report itself may be defective, and any decision made on the strength of stale information adds another layer of legal exposure.

What the Employer Owes You for Violations

This is where California credit check compliance stands apart. Statutory damages are large enough that a single violation against one person is costly, and class actions multiply the exposure quickly.

Under the ICRAA, an employer that fails to comply owes actual damages or $10,000, whichever is greater. That $10,000 floor applies per violation in individual cases, though it does not apply in class actions. The employer also pays attorney’s fees and court costs. If the violation was grossly negligent or willful, the court can add punitive damages.⁷

A willful FCRA violation exposes the employer to statutory damages between $100 and $1,000 per violation, or actual damages if higher, plus punitive damages and attorney’s fees.⁸ The federal per-person numbers look modest next to California’s $10,000 floor, but the FCRA is where class actions tend to land. A systemic defect in the employer’s disclosure form — say, bundling extraneous language into what should be a standalone document — makes every recipient a potential class member.

The CCRAA does provide a safe harbor for employers who maintained reasonable compliance procedures, but that defense requires documentation to back it up.²

How Long Records Have to Be Kept

Federal law requires employers to keep employment records, including background check authorizations and disclosure forms, for at least one year after employment ends. The realistic retention period is longer. FCRA claims can be filed up to two years after you discover the violation, or up to five years if the violation was not reasonably discoverable, so consent forms, disclosures, and adverse action notices tend to be kept for five to six years. The CCRAA’s reasonable-procedures defense depends on the same paper trail: the employer has to be able to show what procedures existed and that they were actually followed.

1
California Legislative Information. California Code LAB 1024.5
2
California Legislative Information. California Code CIV 1785.20.5
3
California Legislative Information. California Code CIV 1786.16
4
Office of the Law Revision Counsel. 15 USC 1681b
5
Office of the Law Revision Counsel. 15 USC 1681m
6
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
7
California Legislative Information. California Code CIV 1786.50
8
Office of the Law Revision Counsel. 15 USC 1681n