The month a paragraph on the wrong form became the violation: FCRA compliance at 73K MRR (2026)

Our lawyer said that on a Tuesday, in the tone people use when they are being kind about something expensive. We were at 73K MRR, twenty-two people, hiring steadily for eighteen months. We had run background checks on every candidate who reached a final round. We had disclosed the check. We had asked permission. We had never once used a report to reject anyone without telling them why. And the problem, she explained, was none of that. The problem was that our disclosure form had a second paragraph on it.

Quick answer (2026)

This diary is a composite. The company, the numbers and the people are assembled from several real operators I have worked with and interviewed, not a single business, and nothing here is legal advice. The lesson generalises anyway, because the mechanism is textual. Under the Fair Credit Reporting Act, the violation in a case like ours is almost never the background check itself. It is the layout of the piece of paper the check was disclosed on. And the size of the bill turns on a single word in the liability section, which the Supreme Court has read more broadly than most founders assume. FCRA compliance is one of the few regimes I have met where the penalty is set by how clear the rule was, not by how badly you behaved.

The form we used, and the line nobody read

The operative text is short. 15 U.S.C. 1681b(b)(2)(A)(i) says a person may not procure a consumer report for employment purposes unless "a clear and conspicuous disclosure has been made in writing to the consumer at any time before the report is procured or caused to be procured", and then adds the words that cost us the year: the disclosure must be "in a document that consists solely of the disclosure".

Solely. Not primarily, not prominently, not in a clearly marked section. Solely.

Our form was a single page headed "Background check authorisation". Under the disclosure sat one further paragraph: a short at-will acknowledgement that our template had carried since the first year, sitting there because someone had sensibly decided that fewer forms meant fewer forms to lose. That paragraph was true, lawful, and completely unrelated. It was also, on the statute's own word, the violation.

The clause that immediately contradicts it

Here is the part I did not expect, and it is the reason standalone is a worse summary than the word the statute actually uses.

The very next clause, 1681b(b)(2)(A)(ii), says the consumer must have "authorized in writing (which authorization may be made on the document referred to in clause (i)) the procurement of the report by that person".

So the statute says the document must consist solely of the disclosure, and then, in the adjacent clause, names exactly one other thing that may share the page. The real rule is not solely on its own. It is the disclosure, plus the authorisation, and nothing else. Two clauses, read together, define a permission set of exactly two items. Read apart, the first one reads like an absolute and the second one reads like a footnote.

I had read the first clause. I had never read them as a pair.

The fork that decides the number

Everything after that is arithmetic, and the arithmetic has two branches.

If the failure is negligent, 15 U.S.C. 1681o makes you liable for "any actual damages sustained by the consumer as a result of the failure". That is the whole remedy. Our applicants suffered nothing: the ones we hired were hired, the ones we did not were turned down for reasons that had nothing to do with a report. Actual damages, honestly assessed, were zero.

If the failure is willful, 15 U.S.C. 1681n makes you liable for "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000", plus "such amount of punitive damages as the court may allow", plus fees.

Note the grammar, because it is doing work. Subparagraph (A) is a plain disjunction. The very next subparagraph, (B), covering reports obtained under false pretences, says "actual damages sustained by the consumer as a result of the failure or $1,000, whichever is greater". Congress wrote "whichever is greater" once, in the neighbouring subparagraph, and did not write it in (A). A consumer with no injury at all does not need to clear any threshold under (A). They elect the band.

Across eighteen months we had screened roughly 1,900 candidates. At the floor, that is $190,000. At the ceiling, $1.9 million. Against 73K MRR, the floor alone is about two and a half months of revenue and the ceiling is over two years of it. Same forms, same people, same zero harm. One word decides which number applies.

What willfully turned out to mean

I assumed "willfully" meant something close to "on purpose". It does not.

In Safeco Insurance Co. of America v. Burr, the Supreme Court held that "Willful failure covers a violation committed in reckless disregard of the notice obligation". Reckless, not deliberate. The Court set the bar at conduct that "shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless".

What interested me was not the standard but the escape. Safeco won, and the reasons given were these: the provision was silent on the point at issue, the company's reading had a foundation in the statutory text, "Before these cases, no court of appeals had spoken on the issue", and "no authoritative guidance has yet come from the Federal Trade Commission". The Court summarised it as a "dearth of guidance and the less-than-pellucid statutory text". You can read the whole thing at the Court's opinion in Safeco v. Burr.

Every one of those four escape conditions is a fact about the state of the law. Not one of them is a fact about the defendant.

The inversion: the clearer the rule, the more it costs

Now hold the two halves together.

The way out of willfulness is built from ambiguity: silence in the text, no appellate authority, no agency guidance. Which means the defence is strongest exactly where the law is murkiest, and weakest exactly where the law is plainest.

"A document that consists solely of the disclosure" is not murky. It is one of the least ambiguous sentences in the statute. There is appellate authority. There is agency guidance. So the defendant who misreads a genuinely hard provision, and gets it substantively wrong in a way that harms someone, may well escape the statutory band. The defendant who puts one true, harmless, unrelated paragraph on a form, against a rule anyone can read in ten seconds, has nothing to reach for.

That is the inversion, and it still bothers me. My violation was trivial and my exposure was large precisely because the rule I broke was easy to understand. A worse mistake against a harder rule would have been cheaper.

The guidance that protects you is the guidance that trips you

Then I read the FTC's own business guidance, and the thing got sharper.

The FTC's page for employers says the notice "must be in writing and in a stand-alone format." and that "The notice can't be in an employment application." So far, the statute. Then it adds this: "You can include some minor additional information in the notice (like a brief description of the nature of consumer reports), but only if it doesn't confuse or detract from the notice." That is from Background Checks: What Employers Need to Know.

Read that against "solely". The statute names one permitted extra, the authorisation. The agency charged with enforcing it publishes a tolerance for a second category the statute does not mention, bounded by a standard, "confuse or detract", that appears nowhere in the text.

So the guidance is looser than the law it interprets. And it cuts both ways at once. Relying on it is evidence you were not reckless, which is the thing that saves you from the band. Relying on it is also how the extra text ended up on the page, which is the thing that creates the violation. The document that protects you from the penalty is the document that causes the breach.

I had expected an agency to add requirements. I had not expected one to subtract them.

The asymmetry I did not expect

I assumed the regulator held the bigger stick. It holds the smaller one.

15 U.S.C. 1681s gives the FTC a civil penalty only "in the event of a knowing violation, which constitutes a pattern or practice of violations of this subchapter", and then caps it: "such person shall be liable for a civil penalty of not more than $2,500 per violation". It also directs that in setting the amount "the court shall take into account the degree of culpability, any history of such prior conduct, ability to pay, effect on ability to continue to do business".

Line that up against the private route. The government needs knowing conduct; a private plaintiff needs recklessness. The government needs a pattern or practice; a private plaintiff needs one form. The government's figure is a ceiling; the private figure is a floor. And the government is required to weigh whether the penalty will put you out of business, while nothing in 1681n asks anyone to consider that at all.

The body with the public-protection mandate is the one restrained by your ability to pay.

What I looked for and did not find

Before I accepted the exposure I went looking for the door. I searched the whole of 1681b, 1681n and 1681o for the usual small-company escapes: de minimis, small business, small entity, fewer than, number of employees, annual revenue, revenue threshold, business-to-business, good faith.

All nine returned zero. Not one appears anywhere in those three sections. The word "exempt" does not appear either.

There is no headcount floor, no revenue floor, no first-offence grace, and no good-faith defence written into the private liability provisions. A twenty-two person company and a twenty-two thousand person company are reading the identical sentence with the identical consequence attached.

What I got wrong

Three things, and I would rather write them down.

I assumed the $100 to $1,000 band had to have been inflation-adjusted since it was written. It has not been. The amendment note on 1681n records that before 1996, the willful section read exactly as the negligent section reads today, and that Congress added the band then. The words "inflation", "adjust" and "consumer price" appear zero times in all four sections I read. It is not a stale figure. It was never wired to move.

I assumed agency guidance would be stricter than the statute. It is looser.

And I assumed that because we had done the substantive things right, the paperwork defect would be treated as what it was. The statute does not grade on that curve, and the one provision that does weigh culpability and ability to pay is the one the regulator uses, not the one a plaintiff uses.

Limits

I am not a lawyer and this is not legal advice. Whether a particular extra paragraph crosses the line, and whether a court treats a given form as reckless, is fact specific and contested, and this is a composite rather than a decided case. I read the Safeco syllabus rather than the full opinion. I did not establish whether the FTC's $2,500 ceiling is moved by an inflation adjustment table, so I quote it exactly as the statute prints it rather than guessing at a current figure.

What actually happened

We rebuilt the form as one page containing the disclosure and the authorisation and nothing else. It took an afternoon. The at-will acknowledgement became its own sheet, which is what it should always have been.

The one thing I would tell you

Go and look at your background check form today, and count the things on it.

Not whether it is clear. Not whether it is fair. Count the items. If there is anything on that page that is not the disclosure and not the authorisation, you are relying on a tolerance that lives in agency guidance rather than in the statute, and the value of that reliance is the thing you will be arguing about later.

The cheapest afternoon we ever spent was the one where we deleted a true sentence.