What a CRA should require from a public-records data vendor
Your name is on the report, so your vendor’s mistakes are yours. The costly FCRA cases in screening have mostly been about accuracy, not about failing to screen. Here is the checklist those cases suggest — ten questions, what a weak and a strong answer sound like, and the red flags that should end a vendor conversation.
By Daniel Mase, Offendersearch. General information, not legal advice.
Accuracy you can show, not just records you can buy
Ask a vendor how it matches, how it confirms current status, what it searched and how, how it applies reporting limits and state restrictions, what evidence it keeps, and how it handles disputes. A vendor that returns an unexplained yes or no leaves the accuracy risk with you; one that shows why each record matched, says exactly what it searched, and refuses to call a partial search clear shares it.
Who is responsible for what
A consumer reporting agency — the background check company whose name is on the report — owes reasonable procedures to assure maximum possible accuracy (15 U.S.C. § 1681e). When it buys records from a data provider, those records arrive inside its procedures. The provider’s controls do not replace the agency’s; they are part of them. That is why vendor due diligence belongs in an agency’s compliance program, not just its procurement file.
| Usually the screening company | Usually the data provider |
|---|---|
| Disclosure and authorization from the applicant | Matching records to the right person |
| Vetting end users and their permissible purpose | Confirming the record’s current status at its source |
| Adjudication and adverse-action notices | Applying reporting limits and state restrictions it is asked to apply |
| The consumer’s copy and summary of rights | Evidence of what was searched and returned |
| Owning the dispute and its 30-day clock | Reinvestigating its own records and announcing corrections |
The ten questions
1. How does it match?
Name-only matching against a sex-offender registry is the fact pattern behind a CFPB action against a background screening company that ended in $10.5 million of redress and a $2.5 million penalty. Require an exact date-of-birth match before a record is reported, and a visible match basis on every record so your reviewers can see why it matched. The other side of the record is instructive too: in Erickson v. First Advantage (11th Cir. 2020), a report that said plainly the match was on name only, and that further review was needed, defeated the accuracy claim. Honest framing of weak matches is a defence; silent weak matches are not.
2. Is the status current at the time of the report?
For employment, adverse public-record information must be complete and up to date when reported, unless the applicant is told at the time (15 U.S.C. § 1681k). Ask whether the vendor checks the record against the official source at the time of your request, and what it does when that check fails. “Updated regularly” describes a database, not a record.
3. Does it tell you exactly what it searched, and how?
Ask for a source-by-source account with every answer: which registries and courts were searched, which were searched live and which from stored data, when, and how old the stored data was. Without it you cannot tell a real clear from a search that never reached the relevant state.
4. Does it say incomplete when a source did not answer?
“Clear” on a partial search is the most dangerous answer a vendor can give you. Require an explicit incomplete result whenever a relevant source was unreachable.
5. Is one person one record?
Presentation counts as accuracy. In 2026 the FTC resolved a case against a tenant screening company for $2.25 million where the same proceeding appeared twice in a report. A person on three registries should be one record, not three.
6. Are reporting limits applied charge by charge?
Non-conviction items past seven years must come out of most reports, and several states cap convictions too (15 U.S.C. § 1681c). Ask whether the vendor applies those limits charge by charge, uses the role’s salary and the job’s state, and what it does with an item it cannot date. Our guide to the seven-year rule has a worked example.
7. Are offences labelled accurately?
A $4 million verdict in Taylor v. Inflection turned on a “violence” label attached to a non-violent, downgraded offence. Ask how the vendor classifies offences, and whether you see the court’s own wording alongside any label.
8. Does it apply state registry restrictions?
California restricts Megan’s Law information to protecting a person at risk and prohibits uses relating to employment, housing and several other purposes unless another law authorizes them (Cal. Penal Code § 290.46(j)); Nevada and New Jersey restrict housing uses. Ask which of these the vendor applies, for which purposes, and whether the rule is recorded with each answer.
9. Does it capture the end user and purpose on every order?
Resellers must identify each end user and the purpose of the report (15 U.S.C. § 1681e). A vendor that records the end user, purpose and consent attestation per order gives you that trail for free; one that only knows your account cannot.
10. What evidence does it keep, and how are disputes handled?
When a consumer disputes, you have 30 days (15 U.S.C. § 1681i). Require a per-request record of what was searched, what each source said, which rules applied and what was furnished or withheld — and a vendor that reinvestigates its own records with the authority that holds them, on a clock you can see, and tells you when a record is corrected or removed.
Scorecard: weak and strong answers
| Question | Weak answer | Strong answer |
|---|---|---|
| Matching | “Fuzzy matching on name and age” | Exact date of birth required; match basis on every record |
| Current status | “Our database is updated often” | Each record checked at its source at the time of the request |
| What was searched | “Nationwide” | A per-source table: live or stored, checked when, data as of when |
| Partial searches | Returns no records | Returns incomplete, with the reason |
| Duplicates | One row per source | One record per person, with every source attached |
| Time limits | “That’s your job” | Applied charge by charge, using salary and job state, counts disclosed |
| State registry laws | Not considered | Applied by purpose, recorded with the answer |
| Evidence | Logs on request | A per-order evidence record and a signed report you can verify |
| Disputes | An email address | A dispute endpoint with due dates, statuses and correction notices |
Red flags
- Records are “instant” but the vendor cannot say when each source was last checked.
- A clear result does not say which states were searched.
- Matching rules are described as proprietary and cannot be shown.
- The vendor offers to adjudicate for you, or to label people “pass” and “fail.”
- Disputes go to a shared inbox with no due date.
- There is no way to prove later what a report said on the day it was made.
How we answer the checklist
FCRA Partner Access was built to this list. Through the FCRA Orders API, one order covers sex-offender and criminal records for a named end user, purpose and consent attestation. Each search runs live in every state of the applicant’s address history and the job’s state, reports a record only on an exact date-of-birth match, keeps one record per person, applies the federal seven-year rule and state limits to criminal records charge by charge, applies the California, Nevada and New Jersey registry restrictions, and returns incomplete rather than clear when a relevant state did not answer live.
Every order carries a source-by-source coverage table, an evidence record and a signed PDF anyone can check at /verify. Disputes are an endpoint on the 30-day clock — see the disputes API — and the applicant can see and dispute what we furnished in the consumer portal. For a summary aimed at choosing a provider, see FCRA-compliant background check data.
Vendor due-diligence questions
Does a vendor’s accuracy failure become our liability?
Your agency owes reasonable procedures to assure maximum possible accuracy for the reports it furnishes. A vendor’s controls are part of your procedures, which is why they belong in your due diligence and your agreement.
What is a consumer reporting agency background check?
It is a background check prepared by a consumer reporting agency — a company that assembles information about people for third parties to use in decisions like hiring or renting. Because it is a consumer report, the FCRA’s accuracy, reporting-limit and dispute rules apply.
Should a vendor make the adjudication decision?
No. The vendor supplies accurate, current, correctly labelled records; adjudication and adverse-action notices stay with you and your client.
What should the vendor agreement cover?
Permissible purposes and end-user certifications, the controls applied before furnishing, evidence retention, dispute handling and correction notices, and which state restrictions the vendor applies. Have counsel review it against your own program.
How do we test a vendor before signing?
Run a set of known people through a sandbox and a pilot: someone with a registry record, a namesake with a different date of birth, someone with a dismissed old arrest, and someone who has moved states. Check the match basis, the coverage and the withheld counts on each.
Is a national criminal database search enough?
On its own, rarely. Stored databases are useful for finding where to look, but current status has to come from the court or registry that holds the record, which is why reports should say what was checked at its source.
How often should a vendor’s controls change?
Whenever the law or the data changes — but every answer should record which version of the rules it ran under, so a past report can be explained exactly.
What are the main FCRA risks when buying public-records data?
False positives from weak matching, stale status, duplicated records, wrong labels, old items past the reporting limits, and disputes that miss the 30-day clock. Each one is a control you can ask a vendor to show you.
FCRA Partner Access
Regulated sex-offender and criminal records for consumer reporting agencies and screening platforms, with the controls in this article applied before anything is furnished.
Request FCRA Partner Access How the program works
Related: FCRA-compliant background check data · FCRA Partner Access · FCRA disputes, explained · For background screening providers